Preface

Copyright

Copyright ©2017, Maipu Communication Technology Co., Ltd. All Rights Reserved.

No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Maipu Communication Technology Co., Ltd.

and [image] are trademarks of Maipu Communication Technology Co., Ltd.

All other trademarks that may be mentioned in this manual are the property of their respective owners.

The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied.

Security Statement

Important! Before powering on and starting the product, please read the security and compatibility information of the product.

Environmental protection

This product has been designed to comply with the environmental protection requirements. The storage, use, and disposal of this product must meet the applicable national laws and regulations.

Manual Introduction

This manual introduces all the software functions supported by MP1800X series router, including function configurations and monitoring and maintaining, and provides typical configuration cases.

This manual instructs the readers to use the commands by cooperating with MP1800X Series Router Configuration Manual.

Product Versions

The corresponding product versions of the manual are as follows:

Product Name | Product Model
MP1800X series router | MP1800X-40-X(V1)
 | MP1800X-40E(V1)
 | MP1800X-40W(V1)
 | MP1800X-50(V1)
 | SJW12-4G(V2)
 | MP1800X-40-X(V1)

Audience

This documentation is intended for:

l Commissioning engineers

l Field maintenance engineers

l System maintenance engineers

Conventions

Conventions of screen output format:

Format | Description
Screen print | Represents the output information of the screen
Keywords of Screen print | The red part represents the key information in the screen output

Conventions:

Format | Description
 | An alert that contains additional or supplementary information.
 | An alert that calls attention to important information that if not understood or followed can result in data loss, data corruption, or damage to hardware or software.
 | An alert that calls attention to important information that if not understood or followed can result in personal injury or device damage.

Command conventions:

Convention | Description
Boldface | Bold text represents commands and keywords that you enter literally as shown.
Italic | Italic text represents arguments that you replace with actual values.
[ ] | Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... } | Braces enclose a set of required syntax choices separated by vertical bars, from which you select one.
[ x | y | ... ] | Square brackets enclose a set of optional syntax choices separated by vertical bars, from which you select one or none.
{ x | y | ... } * | Asterisk marked braces enclose a set of required syntax choices separated by vertical bars, from which you select at least one.
&<1-n> | The argument or keyword and argument combination before the ampersand (&) sign can be entered 1 to n times.
# | A line that starts with a pound (#) sign is comments.

The icons used in the manual and the meanings:

Icon | Description
交换机 | Represents a generic switch
路由器 | Represents a generic router

Supporting Manuals of Product

The supporting manuals of the product:

Manual name | Overview
MP1800X Series Router Installation Manual | Describes the device hardware specifications and installation methods, guiding you to install the device
MP1800X Series Router Configuration Manual | Describes the configuration methods and configuration steps of the device software functions, providing typical cases for reference
MP1800X Series Router Command Manual | Describes the device commands, equivalent to command dictionary, convenient for searching for the function of each command

Obtaining Documentation

You can access the most up-to-date Maipu product documentation on the World Wide Web at www.maipu.com .

Technical Support

l Technical supporting hotline: 400-886-8669

l Fax: (+8628)85148948

Documentation Feedback

You can feed back your opinions and suggestions by:

l Email: tech support@maipu.com

l Technical hotline: 400-886-8669

l We appreciate your comments.

Revision Records

The revision records describe all manual update information. The latest manual version contains all the previous manual update content.

Version | Revision Date | Revised Content
V1.0 | 2017-6-21 | First formal release

V1.0 (2017-06-21)

The first formal release


1.1 Overview

System operation basics mainly describe the basic knowledge of device operations, including device configuration modes, command modes, and command line interface.


1.2 System Operation Basic Functions

Table 1-1 Configuration list of the system operation basic functions

Configuration Task
Device configuration mode | Device configuration mode
Command operating mode | Command operating mode
Command line interface | Command line interface


1.2.1 Device Configuration Modes

Users can log in to the device for configuration and management in different modes. (For details of the login modes, refer to the chapter "System login" in the configuration guide.) The device provides four typical configuration modes:

l Logging in to the device locally through the Console port. By default, users can configure the device directly in this mode.

l Logging in to the device by remote dial-up through a Modem. The device cannot be configured directly in this mode, that is, before configuration, some preparations need to be made.

l Logging in to the device remotely through Telnet. The device cannot be configured directly in this mode, that is, before configuration, some preparations need to be made.

l Logging in to the device remotely through SSH. The device cannot be configured directly in this mode, that is, before configuration, some preparations need to be made.


1.2.2 Command Operating Modes

The device provides a command processing subsystem for management and execution of system commands. The subsystem shell provides the following main functions:

l Registration of system commands

l Editing of system configuration commands by users

l Parsing of the commands that have been inputted by users

l Execution of system commands

If a user configures the device through shell commands, the system provides multiple operating modes for the execution of the commands. Each command mode supports specific configuration commands. In this way, hierarchical protection is provided to the system, protecting the system from unauthorized access.

The shell subsystem provides multiple modes for the operating of configuration commands. These modes have different system prompts, prompting the current system mode of the user. The following lists common configuration modes:

l Common user mode (user EXEC)

l Privileged user mode (privilege EXEC)

l Global configuration mode (global configuration)

l Interface configuration mode (interface configuration)

l File system configuration mode (file system configuration)

l Access list configuration mode (access list configuration)

l Other configuration modes (They will be described in the related sections and chapters.)

The following table shows how to enter the common command modes and switch over between the modes.

Table 1‑2 System modes and methods of switching over between the modes

Mode | How to Enter the Mode | System Prompt | How to Exit the Mode | Functions
Common user mode | Log in to the device. | Hostname> | Run the exit command to exit the mode. | Changes the terminal settings. Performs basic tests. Display the system information.
Privileged user mode | In common user mode, run the enable command. | Hostname# | Run the disable or exit command to exit to the common user mode. | Configure the operating parameters of the device. Display the operating information of the device.
Global configuration mode | In privileged user mode, run the configure terminal command. | Hostname(config)# | Run the disable or exit command to exit to the common user mode | Configures the global parameters that are required for the device operation.
Interface configuration mode | In global configuration mode, run the interface command (while specifying the corresponding interface or interface group). | Hostname(config-if-xxx[number])# or Hostname(config-if-group[number])# | Run the exit command to exit to the global configuration mode. Run the end command to exit to the privileged user mode. | In this mode, configures device interfaces, including: Interfaces of different types Interface groups
File system configuration mode | In the privileged user mode, run the filesystem command. | Hostname(config-fs)# | Run the exit command to exit to the privileged user mode. | Manages the file system of the device.
Access list configuration mode | In global configuration mode, run the ip access-list standard or ip access-list extendedcommand. | Hostname(config-std-nacl)# Hostname(config-ext-nacl)# | Run the exit command to exit to the global configuration mode. Run the end command to exit to the privileged user mode. | Configures the Access Control List (ACL). The configuration tasks include: Configuring standard access control lists. Configuring extended access control lists.

l Hostname is the system name. In global configuration mode, a user can run the hostname command to modify the system name, and the modification takes effect immediately.

l If a user is not in privileged user mode while the user wants to run a privileged mode command, the user can use the do command to run the required command without the need to returning back to the privileged mode. (For details, refer to the related sections in "System Operation Basics" of the command manual.) Note that the mode switchover command such as do configure terminal is not included.


1.2.3 Command Line Interface

The command line interface is a man-machine interface that is provided by the shell subsystem to configure and use the device. via the command line interface, users can input and edit commands to perform the required configuration tasks, and they can also query the system information and learn the system operation status.

The command line interface provides the following functions for the users:

l System help information management

l System command inputting and editing

l History command management

l Terminal display system management

Command Line Online Help

The command line provides the following types of online help:

l Help

l Full help

l Partial help

via the above types of online help, users can obtain various help information. The following gives some examples.

l To obtain a brief description of the online help system, run the help command in any command mode.

Hostname#help

Help may be requested at any point in a command by entering

a question mark '?'. If nothing matches, the help list will

be empty and you must backup until entering a '?' shows the

available options.

Two styles of help for command are provided:

1. Full help is available when you are ready to enter a

command argument (e.g. 'show ?') and describes each possible

argument.

2. Partial help is provided when an abbreviated argument is entered

and you want to know what arguments match the input

(e.g. 'show pr?'.)

And "Edit key" usage is the following:

CTRL+A -- go to home of current line

CTRL+E -- go to end of current line

CTRL+U -- erase all character from home to current cursor

CTRL+K -- erase all character from current cursor to end

CTRL+W -- erase a word on the left of current cursor

CTRL+R -- erase a word on the right of current cursor

CTRL+D,DEL -- erase a character on current cursor

BACKSPACE -- erase a character on the left of current cursor

CTRL+B,LEFT -- current cursor backward a character

CTRL+F,RIGHT -- current cursor forward a character

l To list all commands and their brief description in any command mode, type "?" in the command mode.

Hostname#configure terminal

Hostname(config)# ?

aaa Authentication, Authorization and Accounting

access-list Access list

alarm Set the utilization factor alarm of the cpu or memory

apply Command apply

arp Set a static ARP entry

banner Define a login banner

bgp BGP information

bridge Bridge Group

cam Config cam global parameters

cardreset-exception Cardreset exception handling for RM2 3G card

cellular Cellular

..................................................... ......... ......

l Type a command followed by "?", and all sub-commands that can be executed in the current mode are displayed.

Hostname#show ?

about Print the copyright information

access-list Access List

access-list-reflexive List reflexive access lists

access-lists Show acl lists

acl-log-count Display the number of access list log

acl-object Show acl object

arp Command arp

bfd BFD Protocol information

bgp BGP information

bridge Bridge Forwarding/Filtering Database [verbose]

cam Command cam

card_list Show information of hardware modules

..................................................... .....

l Type a character string followed by "?", and all the key words starting with the character string and their description are displayed.

Hostname#show a?

about Print the copyright information

access-list Access List

access-list-reflexive List reflexive access lists

access-lists Show acl lists

acl-log-count Display the number of access list log

acl-object Show acl object

arp Command arp

Command Line Error Messages

For all commands that are typed by users, the command line performs a syntax check. If the commands pass the syntax check, they are executed properly; otherwise, the system reports error messages to the users. The following table shows common error messages.

Table 1-3 Command line error messages

Error Message | Error Cause
% Invalid input detected at '^' marker. | No command or key word is found, the parameter type is incorrect, or the parameter value is not within the valid range.
Type “*** ?” for a list of subcommands or % Incomplete command | The inputted command is incomplete.
Hostname#wh % Ambiguous command: wh % Please select: whoami who | The inputted character string is a fuzzy command.

History Commands

The command line interface provides a function that is similar to the Doskey function. The system automatically saves the user inputted commands into the history command cache. Then, users can invoke the history commands saved by the command line interface at any time and execute the command repeatedly, reducing unnecessary efforts in re-typing the commands. The command line interface saves up to 10 commands for each user that is connected to the device. Then, new commands overwrite old ones.

Table 1-4 Accessing history commands of the command line interface

To... | Press... | Execution Result
Access the previous history command | The up arrow key ↑ or Ctrl+P keys | If an earlier history command is available, it is displayed. If no earlier history command is available, an alarm sound is played.
Access the next history command | The down arrow key ↓ or Ctrl+P keys | If an later history command is available, it is displayed. If no later command is available, the commands are cleared, and an alarm sound is played.

l If you want to access history commands by using the up and down arrow keys, when you telnet to the device in the Windows 98 or Windows NT OS, set Terminals > Preferred Options > Simulation Options to VT-100/ANSI.

l History command display is based on the current command mode. For example, if you are in privileged mode, only history commands in privileged mode are displayed.

Editing Features

The command line interface provides basic command editing functions. It supports multi-line editing. Each line of command can contain up to 256 characters. The following table lists the basic editing functions that are provided by the shell subsystem for the command line interface.

Table 1‑5 Basic editing functions

Key | Function
A common key | If the edit buffer is not full, the character is inserted to the position of the cursor, and the cursor moves to the right. If the edit buffer is full, an alarm sound is played.
The Backspace key | Deletes the character before the cursor and moves the cursor backward. If the cursor reaches the beginning of the command, an alarm sound is played.
The Delete key | Deletes the character behind the cursor. If the cursor reaches the end of the command, an alarm sound is played.
The left arrow key ← or Ctrl+B keys | Moves the cursor one characters to the left. If the cursor reaches the beginning of the command, an alarm sound is played.
The right arrow key → or Ctrl+F keys | Moves the cursor one characters to the right. If the cursor reaches the end of the command, an alarm sound is played.
The up and down arrow keys ↑↓ | Display history commands.
Ctrl+A | Moves the cursor to the beginning of the command line.
Ctrl+E | Moves the cursor to the end of the command line.
Ctrl+U | Deletes all characters on the left of the cursor till the beginning of the command line.

Display Features

To facilitate users, the command line interface provides the following display features:

If the information to be displayed is more than one screen, the pause function is provided, and the prompt "---MORE---" is displayed at the lower left corner of the screen. At this time, the options displayed in the following table are available for users.

Table 1‑6 Display features

Key | Function
Space key, down arrow key ↓, or Ctrl-F | Display the next screen.
The up arrow key ↑ or Ctrl-B keys | Display the previous screen.
The Enter key, right arrow key → or equal key = | Scroll the displayed information one line down.
The left arrow key ← or the minus key - | Scroll the displayed information one line up.
Ctrl-H | Return back to the topmost part of the displayed information.
Any other keys | Exit the display. Then, the information that has not been displayed will not be displayed.


2 System Login


2.1 Overview

The device supports the following system login modes:

l Logging into the device through the Console port for management and maintenance.

l Telnet (remote login). Users can manage and maintain the device remotely in this mode.

l Secure Shell (SSH). via its encryption and authentication technology, SSH provides secure remote login management services for users.


2.2 System Login Function Configuration

Table 2-1 System login function configuration list

Configuration Tasks
Logging in to the device through the Console port | -
Logging in to the device through the AUX port | -
Configuring remote login through Telnet | Enable the Telnet service of the device.
 | The device acts as a Telnet client for remote login.
Configuring remote login through SSH | Enable the SSH service of the device.
 | The device acts as an SSH client for remote login.

l For the related user configuration of Telnet and SSH remote login, refer to the login control and management manual.


2.2.1 Log in to Device via Console Port

To connect a terminal to the device through the Console port to configure the device, perform the following steps:

Step 1:

Select a terminal.

The terminal can be a terminal with a standard RS-232 serial port or an ordinary PC, and the latter one is more frequently used. If the remote dial-up login mode is selected, two Modems are required.

Step 2:

Connect the physical connection of the Console port.

Ensure that the terminal or the device that provides the Console port has been powered off, and then connect the RS-232 serial port of the terminal to the Console port of the device. The following figure shows the connection.

Figure 2‑1Connection for login via the console port

Step 3:

Configure the HyperTerminal.

After powering on the terminal, you need to set the communication parameters of the terminal, that is, baud rate of 9600 bps, 8 data bits, 1 stop bit, no parity check, and no data stream control. For a PC with the Windows XP or Windows NT OS, run the HyperTerminal program, and set the communication parameters of the serial port of the HyperTerminal according to the previously mentioned settings. The following takes the HyperTerminal in the Windows NT OS for example.

l Create a connection:

Input a connection name, and select a Windows icon for the connection.

Figure 2‑2 Creating a connection

l Select a serial communication port:

According to the serial communication port that has been connected, select COM1 or COM2.

Figure 2‑3 Selecting a serial communication port

l Configure parameters for the serial communication port:

Baud rate: 9600 bps

Data bit: 8 bits

Parity check: None

Stop bit: 1 bit

Data stream control: None

Figure 2‑4 Configuring parameters for the serial communication port

l Login success authentication:

After the device with the Console port is powered on, the startup information of the device is displayed on the terminal. After the startup is completed, the "Press any key to start the shell!" message is displayed. If login authentication is configured to be required, input the user name and password; otherwise, press any key to log in directly. After the login succeeds, the "Hostname>" prompt is displayed on the terminal. Then, you can configure the device.


2.2.2 Configure Remote Login via Telnet

Configuration Condition

None

Enable Telnet service of Device

A user can log in to the device remotely through Telnet for management and maintenance. Before using the Telnet service, enable the Telnet service of the device. After the Telnet service of the device is enabled, the Telnet service port 23 is monitored.

Table 2‑2 Enabling the telnet service of the device

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the Telnet service of the device. | telnet server enable | Mandatory. By default, the Telnet service is enabled.

Take Device as Telnet Client for Remote Login

The user takes the device as a Telnet client to log in to the specified Telnet server for configuration and management.

Table 2-3 Taking the device as a telnet client for remote login

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the Telnet client of the device. | telnet client enable | Optional. By default, the Telnet client is enabled.
Take the device as a Telnet client for remote login. | telnet [ vrf vrf-name ] { hostname | remote-host } [ port-number ] [ ipv4 | ipv6 ] [ source-interface interface-name ] | Mandatory.

l The Telnet client can log in to a remote device only when the Telnet server function of the remote device is enabled, and the network between the Telnet client and the remote device is normal.


2.2.3 Configure Remote Login via SSH

Configuration Condition

None

Enable the SSH Service of the Device

After the SSH server of a device is enabled, the device accepts the connection request initiated by the user from the SSH client. After the client passes the authentication, the client can access the device. After the SSH service of the device is enabled, the SSH service port 22 is monitored. If the ip ssh server command is used without parameter sshv1-compatible, it indicates that an SSH client can log in only through SSHv2.

Table 2-4 Enabling the SSH service of the device

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the SSH service of the device. | ip ssh server [ sshv1-compatible ] [ listen-port ] | Mandatory. By default, the SSH service is disabled.

Take the Device as an SSH Client for Remote Login

The device acts as an SSH client to log in to the specified SSH server remotely through the SSHv1 or SSHv2 protocol. During the login, a user name and a password are required for authentication from the SSH server.

Table 2-5 Taking an SSH client for remote login

Step | Command | Description
Take the device as an SSH client for remote login. | ssh [vrf vrf-name] version { 1 | 2 } remote-host port-number [source-interface interface-name] user auth-method 1 password [timeout] | Mandatory.
Configure cutting off all SSH connections when the SSH service is disabled | ssh disconnect client when-disable-server | Optional By default, do not cut off the current SSH connection when the SSH service is disabled.

l The Telnet client can log in to a remote device only when the SSH service of the remote device is enabled, and the network between the SSH client and the remote device is normal.


2.2.4 System Login Monitoring and Maintaining

Table 2-6 System login monitoring and maintaining

Command | Description
show fingerprint | Display the fingerprint information of the SSH public key.


2.3 Typical Configuration Example of System Login


2.3.1 Configure a Local Terminal to Telnet to the Device

Network Requirements

l A PC is used as a local terminal to log in to the device through Telnet.

l A route must be available between the PC and the device.

Network Topology

Figure 2-5 Network topology for configuring a local terminal to telnet to the device

Configuration Steps

Step 1:

Configure the IP address for vlan2.

Device>enable

Device#configure terminal

Device(config)#interface vlan2

Device (config-if-vlan2)#ip address 2.0.0.1 255.255.255.0

Step 2:

Configure the enable password.

Device>enable

Device#configure terminal

Device(config)#enable password admin

Step 3:

Telnet to the device.

#On the PC, run the Telnet program, and input the IP address of vlan2.

Step 4:

Check the result.

#If the login succeeds, a window as shown in the following figure is displayed.

Figure 2‑9Window displayed after telnet success

After logging in to the device successfully, input the correct enable password to obtain the required operation rights of the device. To log out of the device, input the exit command continuously or press the shortcut key Ctrl+c.

l If the "Too many clients or invalid access" message is displayed, it indicates that the number of login users has reached the maximum allowed number of login users of the device. In this case, wait a while and try to log in again.

l If the "%enable operation is locked by login-secure service" message is displayed, it indicates that the number of enable password input errors exceeds the number of continuous login authentication failures. If the number of enable password input errors reaches the number specified by the system, the system rejects the login connection request from the IP address during the specified time.

l If the "Password required, but none set" message is displayed, it indicates that no login password has been configured.


2.3.2 Configure a Local Device to Log in to a Remote Device via Telnet

Network Requirements

l The local device Device1 acts as the Telnet client, while the remote device Device2 acts as the Telnet server.

l A route must be available between the two devices.

l The PC can normally log in to Device1.

Network Topology

Figure 2-10 Network topology for configuring a local device to telnet to a remote device

Configuration Steps

Step 1: | Use a PC to log in to Device1. (Omitted)
Step 2: | Configures the IP addresses and enable password for Decice2. (Omitted)
Step 3: | On Device1, run the following command to Telnet to Device2 on Device1.

Device1>enable

Device1#telnet 2.0.0.1

#Enter the shell screen of Device2.

Connect to 2.0.0.1 ...done

Device2>

After logging in to the Device2 successfully, input the correct enable password to obtain the required operation rights of the device. To log off the device, input the exit command continuously or press the shortcut key Ctrl+c.

l If the "Too many clients or invalid access" message is displayed, it indicates that the number of login users has reached the maximum allowed number of login users of the device. In this case, wait a while and try to log in again.

l If the "%enable operation is locked by login-secure service" message is displayed, it indicates that the number of enable password input errors exceeds the number of continuous login authentication failures. If the number of enable password input errors reaches the number specified by the system, the system rejects the login connection request from the IP address during the specified time.

l If the "Password required, but none set" message is displayed, it indicates that no login password has been configured.


2.3.3 Configure a Local Device to Log in to a Remote Device via SSH

Network Requirements

l The local device Device1 acts as the SSH client, while the peer device Device2 acts as the SSH server.

l A route must be available between the two devices.

l The PC can normally log in to Device1.

Network Topology

Figure 2‑6 Network topology for configuring a local device to log in to a remote device via SSH

Configuration Steps

Step 1:

Configure the local user and related attribute.

#Configure Device2.

Device2>enable

Device2#configure terminal

Device2(config)#user admin password 0 admin

Step 2:

Enable the SSH server function of Device2.

Device2>enable

Device2#configure terminal

Device2(config)#ip ssh server

Step 3:

Set the login authentication mode to local authentication.

Device2>enable

Device2#configure terminal

Device2(config-line)#line vty 0 15

Device2(config-line)#login local

Device2(config-line)#exit

Step 4:

#On Device1, log in to Device2 through SSH.

#Configure Device1.

Device1#ssh version 2 2.0.0.1 22 a auth-method 1 a

The authenticity of host '130.255.168.44' can't be established

DNS SPOOFING is happening or the IP address for the host and its host key have changed

RSA key fingerprint is 7b:ed:cc:81:cf:12:36:6f:f7:ff:29:15:63:75:64:10.

Are you sure you want to continue connecting (yes/no)? yes

Please type 'yes' or 'no': yes

Step 7:

Check the result.

If the login succeeds, the shell screen of Device2 is displayed.

l If the "Connection closed by foreign host" message is displayed, it indicates that the SSH service of the peer end is disabled, or the inputted user name or password is incorrect.

l The SSH server can be configured not to use authentication. If the SSH server does not use authentication, when a client logs in, a user can use any character string as the user name and password.


3 System Control and Management


3.1 Overview

To enhance the operation security of the device, in user login or enable operation, the device provides multiple authentication management types (including AAA. Refer to the related sections and chapters in AAA configuration manual.) Only the user with the required operation rights can log in or perform the enable operation successfully.

To authorize different set of executable commands to different level of users, the device commands are divided into levels 0-15, and user levels are divided into levels 0-15. Among the levels, level 0 has the lowest rights while level 15 has the highest rights.


3.2 Login Control and Management Function Configuration

Table 3-1 Configuration list of login control and management

Configuration Tasks
Switch over between user levels. | Switch over between user levels.
Configure the command level. | Configure the command level.
Configure the enable password. | Configure the enable password.
Configure users and the related properties. | Configure auto commands.
 | Configure no password authentication during login.
 | Configure user passwords.
 | Configure the user privilege level.
Configure line properties. | Enter the line configuration mode of the Console port.
 | Enter the line configuration mode of the Telnet or SSH user.
 | Configure the absolute time for the login user operation.
 | Configure the privilege level of the login user.
 | Configure users to automatically execute commands after login.
 | Configure auto command execution options.
 | Configure login user idle timeout time.
 | Configure the line password.
 | Configure the login authentication mode.
 | Configure the line authorization mode.
 | Configure the line accounting mode.
 | Enable the Modem function of the Console port.
 | Configure the user login timeout time.


3.2.1 Switch Over Between User Levels

If a user name and password of the corresponding level is configured, the user can run the enable level (0-15) command and then enter the correct password to enter the required user level. Meanwhile, the user has the execute permission of the user level and the lower levels.

l If the current user level is higher than the user level that the user wants to enter, then no authentication is required, and the user directly enters the required user level. If the user level that the user wants to enter is higher than the current user level, authentication is required according to the current configuration, and the authentication mode is selected according to the configuration.

l If the enable password of the corresponding level has been configured (by using the enable password level command), while the enable authentication of Authorization, Authentication and Accounting (AAA) is not configured or the AAA enable authentication is set to use the enable method, use the enable password for authentication.

l If the enable password of the required level has not been configured, but the enable authentication method is set to use the local enable password for authentication, there are two cases:

a) In the case of a Telnet user, the login fails. If AAA has not been configured, the "% No password set" is prompted. If AAA has been configured, the "% Error in authentication" message is prompted.

b) For a Console port user, if AAA has been configured, try to use the enable password for authentication during the login. If the enable password has not been configured, use the none authentication method, that is, the login passes the authentication by default. If AAA has not been configured, the "% No password set" message is prompted, and the authentication fails.

l If enable authentication succeeds, the user enters the specified user level and the user has execution permission of the level. To query the user level of the current user, run the show privilege command.

l If the aaa authentication enable default method is configured and a related method list is used to enable authentication, then the related method is required for authentication, including:

a) If aaa authentication enable default none is configured, no password is required.

b) If aaa authentication enable default line is configured, and the line password is configured, use the password for authentication. Otherwise, the "% Error in authentication" message is prompted, and the authentication fails.

c) If aaa authentication enable default radius is configured, Remote Authentication Dial in User Service (RADIUS) authentication is used. Note that the enable authentication user names for RADIUS are fixed, that is, $enab+level$. Here "level" is a number in the range of 1-15, that is, the level that the user wants to enter. The RADIUS user names are fixed, therefore, during authentication, no user name is required. The user needs only to input the password. If passwords have been set for users of different levels on the RADIUS server, after inputting the correct password, the login succeeds; otherwise, the login fails. For example, in running the enable 10 command, the fixed user name is $enab10$. If the user name exists on the RADIUS server, input the password corresponding to the user name, and then the authentication succeeds.

c) If aaa authentication enable default tacacs is configured, Terminal Access Controller Access Control System (TACACS) authentication is used. If the user name is displayed during login, keep the user name for login, and input the enable password of the user name. Otherwise, input a user name and the enable password of the user name. If the inputted user name exists in the TACACS server and the enable password of the TACACS has been set, the authentication succeeds; otherwise, the authentication fails.

l The previously mentioned enable authentication methods can form a combination in use.

Configuration Condition

None

Switch Over Between User Levels

If a user has the corresponding authority, the user can switch from the common user mode to the privileged user mode by switching over between user levels with a command. Then, the user has the authority of the user level. If a user runs the command in the privileged user mode, the user level switchover is performed according to the command parameter.

Table 3-2 Switching over between user levels

Step | Command | Description
Switch over between user levels. | enable [ level-number ] | Mandatory. By default, the user level is level 15.


3.2.2 Configure the Command Level

Configuration Condition

None

Configure the Command Level

In the application program, each shell command has a default level, which can be modified through the privilege command. A user can execute only the commands with the level equal to or smaller than the user level. For example, a user with the user level 12 can execute only the commands with the levels 0-12. In configuring the command level, you need to make use of command modes. You can modify the level of a single command or all commands in a specified command mode.

Table 3-3 Configuring the command level

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the command level. | privilege privilege-mode level level-number [ all | command command-line ] | Mandatory.


3.2.3 Configure the enable Password

Configuration Condition

None

Configure the enable Password

The enable password is the password that is used by a level of users to enter the local level. If no level is specified in the enable command, the password is set as the enable password of level 15 by default.

Table 3-4 Configuring the enable password

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the enable password. | enable password [ level level-number ] [ 0 ] password | Mandatory. By default, no enable password is configured.


3.2.4 Configure Users and the Related Properties

Configuration Condition

None

Configure Auto Commands

After auto commands are configured, during the user login, the system automatically executes the pre-configured commands. In addition, the user can configure delay time for execution of auto commands, and configure whether to disconnect the user connection after the commands are executed automatically. By default, the command execution is not delayed, and the user connection is disconnected after the commands are executed automatically.

Table 3-5 Configuring auto commands

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configuring auto commands. | user username autocommand command-line | Mandatory
Configure the options for execution of auto commands. | user username autocommand-option { nohangup [ delay delay-time-number ] | delay delay-time-number [ nohangup ] } | Optional

Configure No Password Authentication During Login

During the user login, if no password authentication is required, configure the no password authentication function.

Table 3-6 Configuring no password authentication during login

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure that no password authentication is required during user login. | user username nopassword | Mandatory.

Configure User Passwords

To ensure the security of the system, you can configure user passwords to restrict login of users.

Table 3-7 Configuring user passwords

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure user passwords. | user username password 0 password | Mandatory

Configure Max. Online quantity of the User

When it is necessary to limit the online login quantity of one user at one time, you can configure the maximum online quantity of the user.

Table 3-8Configuring the maximum online quantity of the user

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum online quantity of the user | user username max-online-num max-online-number | Optional

Configure Live Time of the User

To ensure the security of the user account, you can configure the live time of the user to regularly remind the user to change the password.

Table 3-9Configuring the live time of the user

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the live time of the user | user username live-time user-live-time | Optional

Configure the User Group of the User

After configuring the users to belong to one user group, you can manage the users of the user group in a unified manner. For example, configure the live time of one group of users.

Table 3-10Configuring the user group of the user

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the user group of the user | user username set-name set-name | Optional

Configure Max. Authentication Failure Times of the User

When it is necessary to limit the authentication failure times of one user, you can configure the maximum failure times of the user.

Table 3-11Configuring the maximum authentication failure times of the user

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum authentication failure times of the user | user username max-try-time max-try-time | Optional

Configure the Service Type of the User

When it is necessary to limit the service type owned by the user, you can configure the service type of the user.

Table 3-12Configuring the service type of the user

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the service type of the user | user username service-type type | Optional

Configure the Live Time of the User Group

You can configure the live time of the user group to regularly remind one group of users to change the password, convenient for the unified management of users.

Table 3-13Configuring the live time of the user group

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the live time of the user group | user-set set-name live-time user-live-time | Optional

Configure the File System Authority of the User

To ensure the security of the file system, you can specify the user to own one file authority, preventing the illegal access.

Table 3-14 Configuring the file system authority of the user

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the user file authority | user username filesys-control type | Optional

Configure the User Privilege Level

To limit users to configuration commands of different privilege levels, you need to grant different privilege levels to different users.

Table 3-15 Configuring the user privilege level

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configuring the privilege level of the user. | user username privilege privilege-level-number | Mandatory


3.2.5 Configure Line Properties

The device supports up to one Console port user and 16 Telnet or SSH users to log in at the same time. Line commands can set different authentication and authorization properties for the login users.

Configuration Condition

None

Enter Line Configuration Mode of Console Port

To configure the Console port properties, you need to enter the line configuration mode of the Console port.

Table 3-16 Entering the line configuration mode of the console port

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enters the line configuration mode of the Console port. | line con 0 | Mandatory

Enter the Line Configuration Mode of the Telnet or SSH User

To configure the Telnet or SSH properties, you need to enter the line configuration mode of Telnet of SSH.

Table 3-17 Entering the line configuration mode of the Telnet or SSH user

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Telnet or SSH user. | line vty { vty-min-number } [ vty-max-number ] | Mandatory

l yty resources are shared by the SSH and Telnet.

Configure Absolute Time for Login User Operation

The absolute time for the login user operation refer to the timeout time from the successful login of a user to the automatic exit of the user, in the unit of minute. If the absolute time is set to 0, it indicates that the time is not limited. By default, the time is 0. In addition, five seconds before the configured time expires, the following prompt message is displayed: Line timeout expired.

Table 3-18 Configuring the absolute time for the login user operation

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port or Virtual Type Terminal (VTY). | line { con 0 | vty vty-min-number [ vty-max-number ] } | Mandatory
Configure the absolute time for the login user operation. | absolute-timeout absolute-timeout-number | Mandatory. By default, the absolute time is 0, that is, no time limit.

Configure Privilege Level of Login User

Configure the privilege level of the login user. The default privilege level is 1. A user can execute only the commands with the level equal to or smaller than the current level.

Table 3-19 Configuring the privilege level of the login user

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port or VTY. | line { con 0 | vty vty-min-number [ vty-max-number ] } | Mandatory.
Configure the privilege level of the login user. | privilege level level-number | Mandatory. The privilege level is 1.

Configure Users to Automatically Execute Commands after Login

Configure the commands to be automatically executed after users successfully log in. By default, no command is to be automatically executed.

Table 3-20 Configuring the commands to be automatically executed after successful login

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port or VTY. | line { con 0 | vty vty-min-number [ vty-max-number ] } | Mandatory
Configure the commands to be automatically executed after successful login. | autocommand command-line | Mandatory By default, no command is executed automatically.

Configure Auto Command Execution Options

You can configure delay time for auto commands, and configure whether to disconnect the user connection after the commands are executed automatically. By default, the command execution is not delayed, and the user connection is disconnected after the commands are executed automatically.

The auto command execution options include delay and whether to disconnect the user connection after command execution.

Table 3-21 Configuring auto command execution options

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port or VTY. | line { con 0 | vty vty-min-number [ vty-max-number ] } | Mandatory.
Configure the auto command execution options. | autocommand-option { nohangup [ delay delay-time-number ] | delay delay-time-number [ nohangup ] } | Mandatory.

l The autocommand-option command is valid only after the autocommand function is configured.

Configure Login User Idle Timeout Time

If the time in which login user does not perform any operation on the device is longer than the idle timeout time, the device make the current login user to log out. The default idle timeout exit time is 5 minutes. If the time is set to 0, then idle timeout does not take effect.

Table 3-22 Configuring the idle timeout exit time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port or VTY. | line { con 0 | vty vty-min-number [ vty-max-number ] } | Mandatory
Configuring the idle timeout exit time. | exec-timeout exec-timeout-minute_number [ exec-timeout-second_number ] | Mandatory The default idle timeout exit time is 5 minutes.

Configure the Line Password

Use 0 and 7 to indicate whether the line password is in plain text or cipher text. 0 indicates that the password is in plain text while 7 indicates that the password is in cipher text. In interaction mode, only plain-text password is allowed. That is, in this mode, parameter value 0 is used.

Table 3-23 Configuring the line password

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port or VTY. | line { con 0 | vty vty-min-number [ vty-max-number ] } | Mandatory
Configure the line password. | password 0 password | Mandatory

Configure the Login Authentication Mode

The device supports the following login authentication modes:

l Login authentication mode: Uses line password authentication.

l Login local authentication mode: Uses the local user database authentication.

l Login authentication mode: Uses the AAA authentication.

l No login indicates that no authentication is required for login. (If AAA is not configured, this mode can be used.)

l By default, the login authentication mode is used for Telnet, and the login local authentication mode is used for SSH.

Table 3-24 Configuring the login authentication mode

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port or VTY. | line { con 0 | vty vty-min-number [ vty-max-number ] } | Mandatory
Configure the login authentication mode. | login [ local | authencation ] | Mandatory

Configure the Line Authorization Mode

If the AAA function has been configured, you can reference exec or commands for each line to give authorization. For details, refer to the AAA Configuration Guide.

Table 3-25 Configuring the line authorization mode

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port or VTY. | line { con 0 | vty vty-min-number [ vty-max-number ] } | Mandatory
Configuring the authorization mode. | authorization { exec | commands level } { default | word } | Mandatory

l The authorization command can be configured only after AAA is enabled.

Configure the Line Statistics Mode

If the AAA function has been configured, you can reference exec or commands for each line for accounting. For details, refer to the AAA Configuration Guide.

Table 3-26 Configuring the accounting mode

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port or VTY. | line { con 0 | vty vty-min-number [ vty-max-number ] } | Mandatory
Configuring the accounting mode. | accounting { exec | { commands level } } { default | word } | Mandatory. For the accounting method of exec and commands, refer to the AAA Configuration Guide.

l The accounting command can be configured only after AAA is enabled.

Enable the Modem Function of the Console Port

The Console port of the device provides the functions of the AUX port. Therefore, you can enable the Modem function of the Console port to support remote dial-up login.

Table 3-27 Enabling the modem function of the console port

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Entering the line configuration mode of the console port. | line con 0 | Mandatory
Enable the Modem function of the Console port. | Modem auto-detection | Mandatory. By default, the Modem function of the Console port is disabled.

Configure the ACL in Line

Configure the ACL of the IP address/IPv6 address in the line.

Table 3-28 Configuring the ACL in the line

Step | Command | Description
Enter the line configuration mode | line vty vty-min-number [ vty-max-number ] | Optional
Enter the line configuration mode of the Console port | line con 0 | Optional
Configure the ingress ACL of the IP address | access-class { access-list-number | access-list-name } in | Optional The number of the IP standard ACL, with the value range 1-1000
Configure the egress ACL of the IP address | access-class { access-list-number | access-list-name } out | Optional
Configure the ingress ACL of the IPv6 address | ipv6 access-class { access-list-number | access-list-name } in | Optional The IPv6 ACL number range is 7001-8000
Configure the egress ACL of the IPv6 address | ipv6 access-class { access-list-number | access-list-name } out | Optional

Configure the User Login Timeout Time

During login, if the wait time for the user to input the user name or password times out, the system prompts that the login fails. By default, the login timeout time is 30 seconds. To modify the wait timeout time, use this function.

Table 3-29 Configuring the user login wait timeout time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the line configuration mode of the Console port. | line con 0 | Mandatory.
Configure the user login wait timeout time. | timeout login respond respond-time-value | Mandatory. By default, the wait time for the user to input the user name or password is 30 seconds.


3.2.6 System Control and Management Monitoring and Maintaining

Table 3-30 System control and management monitoring and maintaining

Command | Description
clear line { con con-number | vty vty-number } | Clear a terminal service.
show privilege | View the privilege level of the current user.
show users | Display the configured user information.


4 FTP, FTPS, TFTP and SFTP


4.1 Overview

File Transfer Protocol (FTP) is used between a server and a client to transmit files. It improves file sharing, and provides an efficient and reliable data transmission mode between the user and remote computer. The FTP protocol usually uses TCP port 20 and 21 for transmission. Port 20 transmits data in active mode, and port 21 transmits control messages.

Similar to most Internet services, FTP uses the client/server communication mechanism. To connect to an FTP server, usually you are required to have the authorized account of the FTP server. On the Internet, a large number of FTP servers are anonymous FTP servers, which aim at provide file copying services to the public. For this type of FTP server, users need not register with the server or obtain authorization from the FTP servers.

FTP supports two types of file transmission modes:

l ASCII transmission mode, in which text files are transmitted.

l Binary transmission mode, in which program files are transmitted.

If the device acts as an FTP client, only the binary transmission mode is supported. If the device acts as an FTP server, both transmission modes are supported.

FTP supports two working modes:

l Active mode: An FTP client first sets up a connection with an FTP server through the TCP21 port and sends commands through this channel. If the FTP client wants to receive data, it sends the PORT command through this channel. The PORT command contains through which port the client receives data. Then the FTP server connects its TCP20 port to the specified port of the FTP client to transmit data. The FTP server must set up a new connection with the FTP client to transmit data.

l Passive mode: The method of setting up the control channel in passive mode is similar to that in active mode. However, after the connection is set up, the PASV command instead of the PORT command is sent. After the FTP server receives the PASV command, it opens a high end port (with the port number larger than 1024) and inform the client to transmit data through this port. The FTP client connects to the port of the FTP server, and then the FTP server transmits data through this port.

Many Intranet clients cannot log in to the FTP server in active mode, because the server fails to set up a new connection with an Intranet client.

When the device acts as an FTP client, it sets up a data connection in active mode.

FTPS is one enhanced FTP protocol of using the standard FTP protocol and commands, adding the SSL security function for the FTP protocol and data channel. FTPS is also called FTP-SSL and FTP-over-SSL. SSL is one protocol of encrypting and decrypting the data in the security connection between the client and the server with the SSL function. On the device, only the FTP client supports the function.

Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol which is based on the User Datagram Protocol (UDP). It transmits data through UDP port 69. The protocol is designed for transmission of small files; therefore, it does not have as many functions as the FTP protocol. It does not support list of directories or authentication. The device only implements the functions of the TFTP client.

SFTP (Secure File Transfer Protocol /Secure FTP) is the new function in SSH 2.0. SFTP is based on the SSH connection so that the remote user can log into the device safely for managing the file, transmitting the file and other operations, providing higher security guarantee for the data transmission. SFTP provides one safe method for transmitting the file. SFTP is the sun function of SSH, realizing the safe transmission of the file. SFTP encrypts the transmitted authentication information and transmitted data, so using SFTP is safe. If the requirement for the network security is higher, you can use SFTP to replace FTP, but the SFTP file transmission adopts the encryption/decryption technology, so the transmission efficiency is lower than the FTP file transmission.


4.2 FTP, FTPS, TFTP, and SFTP Function Configuration

Table 4-1 FTP, FTPS, TFTP, and SFTP function configuration list

Configuration Tasks
Configure an FTP server. | Configure the functions of an FTP server.
Configure an FTP client. | Configure the functions of an FTP client.
Configure a TFTP client. | Configure the functions of a TFTP client.
Configure an SFTP server | Configure the functions of the SFTP server
Configure an SFTP client | Configure the functions of the SFTP client


4.2.1 Configure an FTP Server

Configuration Condition

None

Configure the Functions of an FTP Server

Before configuring the device as the FTP server, first enable the FTP server function. Then, the FTP client can access the FTP server. For security sake, the device provides the FTP service only to authorized users, and it limits the maximum allowed number of concurrent login users.

Table 4–2 Configuring the functions of an FTP server

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the FTP server function. | ftp enable | Mandatory. By default, the FTP server function is disabled.
Configure the authorized user name and password. | user username password 0 password | Mandatory. By default, the authorized user name and password are not configured. For details of the command, refer to the related sections in "System Control and Management".
Configure the monitor port of the FTP service | ftp listen-port [ port-num ] | Optional By default, the monitor port number of the FTP service is 21
Configure the maximum allowed number of concurrent login users. | ftp max-user-num user-num | Optional. By default, the maximum allowed number of concurrent login users is 1.
Configure the connection timeout time. | ftp timeout time | Optional. By default, the connection timeout time is 300 seconds.


4.2.2 Configure an FTP Client

Configuration Condition

None

Configure the Functions of an FTP Client

On the device, when you use the copy command to copy files (Refer to the related sections in "File System Management") or use the sysupdate command to upgrade the software version (Refer to the related sections in "Software Upgrade"), the device can be triggered to act as the FTP client and set up a connection with the remote FTP server.

The connection between an FTP client and an FTP server uses the address of the outgoing interface of the route to the FTP server as the source address by default. Users can also use the ip ftp source-address or ip ftp source-interface commands to specify the FTP client source address or source interface.

Table 4-3 Configuring the functions of an FTP client

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the source address of the FTP client. | ip ftp { source-interface interface-name | source-address ip-address } | Optional. By default, the FTP client uses the address of the outgoing interface of the route to the FTP server as its source address to communicate with the FTP server.

l For the security sake, some networks may restrict the communication between the address of the outgoing interface of the route from the device to the FTP server and the FTP server, but the other service interface addresses are available. In this case, users can use the ip ftp source-address or ip ftp source-interface commands to specify the FTP client source address or source interface. For the FTPS function, the above commands also take effect.


4.2.3 Configure a TFTP Client

Configuration Condition

None

Configure the Functions of a TFTP Client

On the device, when you use the copy command to copy files (Refer to the related sections in "File System Management") or use the sysupdate command to upgrade the software version (Refer to the related sections in "Software Upgrade"), the device can be triggered to act as the TFTP client and set up a connection with the remote TFTP server.

The connection between a TFTP client and a TFTP server uses the address of the outgoing interface of the route to the TFTP server as the source address by default. Users can also use the ip tftp source-address or ip tftp source-interface commands to specify the TFTP client source address or source interface.

Table 4-4 Configuring the functions of a TFTP client

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the source address of the TFTP client. | ip tftp { source-interface interface-name | source-address ip-address } | Optional By default, the output port address of the router to the TFTP server is used as the source address to communicate with the TFTP server.

l For the security sake, some networks may restrict the communication between the address of the outgoing interface of the route from the device to the TFTP server and the TFTP server, but the other service interface addresses are available. In this case, users can use the ip tftp source-address or ip tftp source-interface commands to specify the TFTP client source address or source interface.


4.2.4 Configure an SFTP Server

Configuration Condition

None

Configure the Functions of an SFTP Server

Before configuring the device as the SFTP server, first enable the SFTP server function. Then, the SFTP client can access the SFTP server. SFTP is one subsidiary function of SSH, so the configuration of enabling the SFTP service is the same as that of enabling the SSH remote login service.

Table 4-5 Configuring the SFTP server function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the SFTP server function | ip ssh server [ sshv1-compatible ] [ listen-port ] | Mandatory By default, do not enable the SFTP server function.


4.2.5 Configure a SFTP Client

Configuration Condition

None

Configure the Functions of an SFTP Client

The device serves as the SFTP client and connects the SFTP server, downloading the file from the SFTP server or uploading the file to the SFTP server.

Table 4-6Configuring the function of an SFTP client

Step | Command | Description
Configure the device as the SFTP client to upload or download the file to the SFTP server | sftp { get | put } [vrf vrf-name] host-ip-address port-number [source-interface interface-name] user password src-filename dest-filename [compress] | Optional


4.2.6 FTP, TFTP and SFTP Monitoring and Maintaining

None


4.3 Typical Configuration Example of FTP, TFTP, and SFTP


4.3.1 Configure a Device as an FTP Client

Network Requirements

l A PC acts as an FTP server, and Device acts as an FTP client. The network between the server and the device is normal.

l On the FTP server, the user name for a device to log in to the FTP server is admin, and the password is admin. The files to be downloaded are placed in the FTP server directory.

l The device acts as the FTP client to upload files to and download files from the FTP server.

Network Topology

Figure 4-1 Networking for configuring a device as an FTP client

Configuration Steps

Step 1: | Configure an FTP server, and place the files to be downloaded in the FTP server directory. (Omitted)
Step 2: | Configure the IP addresses of the devices so that the network between the client and the server is normal. (Omitted)
Step 3: | Device acts as the FTP client to upload files to and download files from the FTP server.

#In the global mode of the Device, copy one file from the FTP server to the file system of Device.

Device>enable

Device#copy ftp 2.0.0.1 admin admin rp37-7.3.0.60(R).pck file-system rp37-7.3.0.60(R).pck

#In the file system mode of the Device, copy one file from the FTP server to the file system of Device.

Device#filesystem

Device(config-fs)#copy ftp 2.0.0.1 admin admin rp37-7.3.0.60(R).pck file-system rp34-7.3.0.26(R).pck

#In the file system mode of Device, copy the startup file of Device into the FTP server.

Device#filesystem

Device(config-fs)#copy file-system startup ftp 2.0.0.1 admin admin startup.txt

Step4:

Check the result.

#After the copy process is completed, check whether the downloaded file exists in the file system of Device. In the FTP server, check whether the uploaded file exists. (Omitted)

Device#filesystem

Device (config-fs)#dir

10206 APR-04-2008 08:33:24 history

2048 DEC-12-1999 10:11:08 snmp <DIR>

4728 APR-10-2008 04:18:48 startup

101210 APR-10-2008 21:04:42 logging

4 APR-10-2008 21:07:32 secret

10352116 APR-06-2008 02:47:02 rp37-7.3.0.60(R).pck

l If the " FTP Hookup: connect error 65" message is printed, it indicates that the server cannot be reached, and the cause may be that the route is not available or the server has not been started.

l If the "Total 51054 bytes copying completed!" message is printed, it indicates that the file is copied successfully. The message shows the file size, which is determined by the actual file size.


4.3.2 Configure a Device as an FTP Server

Network Requirements

l Device1 acts as an FTP server, while PC and Device2 act as FTP clients. The network between the client and the server is normal.

l On the FTP server Device1, the user name is admin, and the password is admin. The file system directory of Device1 acts as the root directory of the FTP server.

l PC and Device2 act as the FTP client to upload files to and download files from the FTP server Device1.

Network Topology

Figure 4–2 Networking in which a device acts as an FTP server

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces so that the network between the PC, Device 2, and Device 1 are normal. (Omitted)
Step 2: | On Device1, enable the FTP service, and configure the authorized user name and password.

#On Device1, configure the authorized user name and password.

Device1#configure terminal

Device1(config)#user admin password 0 admin

#On Device1, enable the FTP service.

Device1#configure terminal .

Device1(config)#ftp enable

#on Device1, configure the maximum number of concurrent connected users as 2.

Device1#configure terminal

Device1(config)#ftp max-user-num 2

Step 3:

Check the result.

#Check whether the FTP service function is enabled on Device1.

Device1#show ip sockets

Active Internet connections (including servers)

PCB Proto Recv-Q Send-Q Local Address Foreign Address vrf (state)

-------- ----- ------ ------ ---------------------- ---------------------- ------- -------

701bb4a4 TCP 0 0 0.0.0.0.21 0.0.0.0.0 all LISTEN

767e4e24 TCP 0 0 0.0.0.0.23 0.0.0.0.0 all LISTEN

767e4464 TCP 0 0 127.0.0.1.2600 127.0.0.1.1024 global ESTABLISHED

75f44f04 TCP 0 0 127.0.0.1.1024 127.0.0.1.2600 global ESTABLISHED

75f44e44 TCP 0 0 127.0.0.1.2600 0.0.0.0.0 global LISTEN

767e4524 UDP 0 0 0.0.0.0.514 0.0.0.0.0 all

767e4824 UDP 0 0 0.0.0.0.1025 0.0.0.0.0 all

75f44b44 UDP 0 0 0.0.0.0.1024 0.0.0.0.0 all

If the FTP service function has enabled, you can find that port 21 is in the listen state.

Step 4:

Use Device2 as an FTP client to copy a startup file from FTP server Device1 to Device2.

Device2#filesystem

Device2(config-fs)#copy ftp 2.0.0.1 admin admin startup file-system startup

Step 5:

Use PC as an FTP client to copy a startup file from FTP server Device1 to PC.

#In the following part, the Windows DOS screens are taken as an example to illustrate the process.

#In the Windows DOS screen, input the correct IP address, user name, and password to log in to the FTP server.

D:\>ftp 2.0.0.1

Connected to 2.0.0.1.

220 FTP server ready

User (2.0.0.1:(none)): admin

331 Password required

Password:

230 User logged in

ftp>

Figure 4-3 Logging in to the FTP server via the windows DOS screen

#Configure the PC and FTP server to transmit data in binary mode.

ftp>binary

Figure 4-4 Configuring the PC and FTP server to transmit data in binary mode

#Obtain the startup file in the file system of the FTP server Device1.

ftp>get startup

Figure 4-5 Copying a configuration file from the FTP server

After the file copy process is completed, the file is available in the specified Windows directory.

l If the "421 Session limit reached, closing control connection" message is printed, it indicates that the number of connections has exceeds the maximum number allowed by the server.

l When you use a device to copy a file, if the "FTPHookup: connect error 61 Error: Getting response from FTP server failed" message is printed, the cause may be that the server function is not enabled, or the route between the server and the client is not reachable.

l When you connect the FTP server through the FTP client PC, if the " connect :Unknown error number" is printed, the cause may be that the server function is not enabled, or the route between the server and the client is not reachable.


4.3.3 Configure a Device as an TFTP Client

Network Requirements

l A PC acts as a TFTP server, and Device acts as a TFTP client. The network between the server and the device is normal. The files to be downloaded are placed in the TFTP server directory.

l The device acts as the TFTP client to upload files to and download files from the TFTP server.

Network Topology

Figure 4-6 Networking for configuring a device as a TFTP client

Configuration Steps

Step 1: | Configure the TFTP server function on the PC, and place the files to be downloaded in the TFTP server directory. (Omitted)
Step 2: | Configure the IP addresses of the devices so that the network between the client and the server is normal. (Omitted)
Step 3: | Device acts as the TFTP client to upload files to and download files from the TFTP server.

#On Device, copy a file from the TFTP server to the file system of Device.

Device#filesystem

Device(config-fs)#copy tftp 2.1.2.1 rp37-7.3.0.60(R).pck file-system rp37-7.3.0.60(R).pck

#On Device, copy the startup file from Device to the TFTP server.

Device#filesystem

Device(config-fs)#copy startup-config tftp 2.1.2.1 startup.txt

Step 4:

Check the result.

After the copy process is completed, check whether the downloaded file exists in the file system of Device. In the TFTP server, check whether the uploaded file exists. (Omitted)

Device#filesystem

Device (config-fs)#dir

10206 APR-04-2008 08:33:24 history

2048 DEC-12-1999 10:11:08 snmp <DIR>

4728 APR-10-2008 04:18:48 startup

101210 APR-10-2008 21:04:42 logging

4 APR-10-2008 21:07:32 secret

10352116 APR-06-2008 02:47:02 rp37-7.3.0.60(R).pck

l If the "Total 51054 bytes copying completed!" message is printed, it indicates that the file copy is successful. The message shows the file size, which is determined by the actual file size.

l When you use a device to copy a file, if the "tftpSend: Transfer Timed Out.Error: Tftp transmit error" message is printed, the cause may be that the TFTP server function is not enabled, or the route between the server and the client is not reachable.


4.3.4 Configure a Device as an SFTP Client

Network Requirements

l A PC acts as an SFTP server, and Device acts as an SFTP client. The network between the server and the device is normal.

l On the SFTP server, the user name for a device to log in to the SFTP server is admin, and the password is admin. The files to be downloaded are placed in the SFTP server directory.

l The device acts as the SFTP client to upload files to and download files from the SFTP server.

Network Topology

Figure 4-7 Networking for configuring a device as an SFTP client

Configuration Steps

Step 1: | Configure an SFTP server, and place the files to be downloaded in the SFTP server directory. (Omitted)
Step 2: | Configure the IP addresses of the devices so that the network between the client and the server is normal. (Omitted)
Step 3: | Device acts as the SFTP client to upload files to and download files from the SFTP server.

#Download one file from the SFTP server to the file system of the device.

Device#sftp get 2.0.0.1 22 admin admin rp37-7.3.0.60(R).pck rp37-7.3.0.60(R).pck

The authenticity of host '2.0.0.1 (2.0.0.1)' can't be established.

RSA key fingerprint is e4:dd:11:2e:82:34:ab:62:59:1c:c8:62:1d:4b:48:99.

Are you sure you want to continue connecting (yes/no)? yes

Downloading########################################################################################################################################OK!

#Upload the startup file of the Device file system to the SFTP server.

Device#sftp put 2.0.0.1 22 admin admin startup startup.txt

The authenticity of host '2.0.0.1 (2.0.0.1)' can't be established.

RSA key fingerprint is e4:dd:11:2e:82:34:ab:62:59:1c:c8:62:1d:4b:48:99.

Are you sure you want to continue connecting (yes/no)? yes

Uploading###############################################################################################################################################################OK!

Step 4:

Check the result.

#After copying, you can view whether the downloaded file exists in Device file system; view whether the uploaded file exists on the SFTP server (omitted).

Device(config-fs)#dir

  size          date       time       name

--------       ------     ------    --------

101526     MAR-01-2015  01:17:18   logging

10147      MAR-26-2015  07:58:50   startup

10207      MAR-01-2015  01:17:54   history

11676148    MAR-26-2013  07:51:32  rp37-7.3.0.60(R).pck

2048       JAN-10-2015  17:30:20   snmp               <DIR>


4.3.5 Configure a Device as an SFTP Server

Network Requirements

l A PC acts as an SFTP server, and Device acts as an SFTP client. The network between the server and the device is normal.

l On the SFTP server, the user name for a device to log in to the SFTP server is admin, and the password is admin. The file system directory of Device serves as the root directory of the SFTP server.

l The PC acts as the SFTP client to upload files to and download files from the SFTP server.

Network Topology

Figure 4-8 Networking for configuring a device as an SFTP server

Configuration Steps

Step 1: | Configure the IP address of the interface so that the network between the PC and the Device is normal. (Omitted)
Step 2: | On the Device, enable the SFTP server, and configure the authorized user name and password.

# On the SFTP server Device, configure the authorized user name and password.

Device#configure terminal

Device(config)#user admin password 0 admin

#On the Device, enable the SSH service (SFTP is one sub module of the SSH protocol).

Device(config)#ip ssh server

Step 3:

Use the PC as the SFTP client to upload and download one file to the SFTP server Device.

#The following takes the Linux system as an example to describe the related process.

#Input the correct IP address and user name, password to log into the SFTP server.

[root@aas ~]# sftp admin@2.1.1.1

Connecting to 2.1.1.1...

admin@2.1.1.1's password:

sftp>

#Get the startup file in the file system of the SFTP server Device.

sftp> get startup startup

Fetching /flash/startup to startup

/flash/startup 100% 13KB 12.9KB/s 00:00

#After copying the file, you can find the related file in the operation directory.

sftp> ls

rp37-7.3.0.60(R).pck rp37-7.3.0.60(R).pck startup tech test_pc

sftp>

#Upload the file in the PC to the file system of the SFTP server Device.

sftp> put rp37-7.3.0.60(R).pck rp37-7.3.0.60(R).pck

Uploading rp37-7.3.0.60(R).pck to /flash/ rp37-7.3.0.60(R).pck

rp37-7.3.0.60(R).pck 100% 11424KB 16.0KB/s 00:00

#After uploading the file, you can find the corresponding file in the file system of Device.

Device(config-fs)#dir

size date time name

------------ ------ ------ --------

2048 JUN-30-2015 16:35:50 tech <DIR>

10229 JUN-12-2015 14:31:22 history

101890 JUN-30-2015 17:46:40 logging

39755 JUN-30-2015 16:33:56 startup

740574 MAY-27-2014 18:55:14 web-Spl-1.1.243.rom

2048 JUN-27-2015 16:26:10 snmp <DIR>

11698172 JUN-30-2015 10:36:18 rp37-7.3.0.60(R).pck


4.3.6 Configure a Device as an FTPS Client

Network Requirements

l A PC acts as an FTP server, and Device acts as an FTP client. The network between the Device and the Client is normal.

l Set up the security data channel between FTP Server and FTP Client, providing the security guarantee for the data transmission.

l The file can be uploaded and downloaded between FTP Client and FTP Server.

Network Topology

Figure 4-9 Networking for configuring a device as an FTPS client

Configuration Steps

Step 1: | Configure the IPv4 address of the interface (omitted).
Step 2: | Install the certificate at the FTP Server, and set the FTP user certificate path, private key path, and CA certificate path:

Step 3:

FTP Client imports the FTP CA certificate, user certificate, and private key.

#Create one domain test on the device :

Device#configure terminal

Device(config)#crypto ca identity test

Device(ca-identity)#exit

#Bind FTP with the domain test:

Device(config)#ip ftp secure-identity test

#Open the CA certificate (rsaRoot.cer) by the notepad, copy the content, input crypto ca import certificate to test on the shell, and import the certificate to the device domain test according to the prompt:

Device(config)#crypto ca import certificate to test

% Input the certificate data, press <Enter> twice to finish:

-----BEGIN CERTIFICATE-----

MIIDBzCCAnCgAwIBAgIITpXH17Hj/AswDQYJKoZIhvcNAQEFBQAwYjELMAkGA1UE

BhMCQ04xEDAOBgNVBAgMB0JFSUpJTkcxDjAMBgNVBAoMBUNJRUNDMQ8wDQYDVQQL

DAZHRkEgQ0ExIDAeBgNVBAMMF01pbmlDQSBGcmVCU0QgUm9vdCBDZXJ0MB4XDTA5

MDgwMzA2MDY1MloXDTE5MDgwMzA2MDY1MlowYjELMAkGA1UEBhMCQ04xEDAOBgNV

BAgMB0JFSUpJTkcxDjAMBgNVBAoMBUNJRUNDMQ8wDQYDVQQLDAZHRkEgQ0ExIDAe

BgNVBAMMF01pbmlDQSBGcmVCU0QgUm9vdCBDZXJ0MIGeMA0GCSqGSIb3DQEBAQUA

A4GMADCBiAKBgHXZMtpxzH8p0uUt6QomUhuJNcy9iyYhoJVx4I3T6kpmx9cdzapM

RoKUa9eB/jCzhgctQc7ZDuKP+gafHWgZtbzwwSVksVsNmFqBivixveGx9dCrtequ

+vDiXVyDVPSNDDTmamMGYyCb0N7aSOzdgv6BYyQKyy/Y0FK6/v/v4NUxAgMBAAGj

gcYwgcMwPQYDVR0fBDYwNDAyoDCgLoYsaHR0cDovLzE2OC4xNjguMTcuNDY6OTAw

MC9nZmEvY3JsL2dmYWFwcC5jcmwwSAYDVR0gBEEwPzA9BggrBgEEAYcrMjAxMC8G

CCsGAQUFBwIBFiNodHRwOi8vd3d3LmdmYXBraS5jb20uY24vcG9saWN5LmRvYzAL

BgNVHQ8EBAMCAuQwDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQUhnY8uZXbE2iX1mXO

ipvfuDUgAeswDQYJKoZIhvcNAQEFBQADgYEAcNPdTE+YpfOQn8lW1oF7TkGJ/Vzd

c0O5UUB+jPhYkj+fXUX8WyxabOxgl3u+7DJ/3gHw1rO8ZcDO94Wz+nBsile5tFv7

/bHz0yqJVoUJMIaWOdmLXJj5fI5GeBCprzLM88RJCv6LBHfg4ThOC4Ds80Ssive1

eAod+7kbmVPOZg8=

-----END CERTIFICATE-----

% Input the private key data, press <Enter> twice after data to finish or press <Enter> without data to ignore:

% The Root CA Certificate has the following attributes:

Serial Number: 4e95c7d7b1e3fc0b

Subject: C=CN, ST=BEIJING, O=CIECC, OU=GFA CA, CN=MiniCA FreBSD Root Cert

Issuer : C=CN, ST=BEIJING, O=CIECC, OU=GFA CA, CN=MiniCA FreBSD Root Cert

Validity

Start date: 2009-08-03 06:06:52

End date: 2019-08-03 06:06:52

Usage: General

Fingerprint(sm3) :18d39e4c50c9ad8b11446ac7ac1736f853ac92e769994b98233b48787562429c

Fingerprint(sha1):ab3559e26384539ffcac3c76b5a5e7a1f7073dfb

% Do you accept this root ca-certificate[yes]/[no]:

% Please answer 'yes' or 'no'.

% Do you accept this root ca-certificate[yes]/[no]:

Nov 11 2015 19:06:04: %PKI-CERTIFICATE_STATECHG-5: Certificate(issuer:C=CN, ST=BEIJING, O=CIECC, OU=GFA CA, CN=MiniCA FreBSD Root Cert, sn:4E95C7D7B1E3FC0B, subject:C=CN, ST=BEIJING, O=CIECC, OU=GFA CA, CN=MiniCA FreBSD Root Cert) state valid

% PKI: Import Certificate success.

#Open the user certificate (topsec_rsa2_myself.pem) and the private key certificate (topsec_rsa2_myself.key) by the notepad, copy the content, input the command crypto ca import certificate to test on the shell, and import the certificates to the device domain test according to the prompt in turn:

Device(config)#crypto ca import certificate to test

% Input the certificate data, press <Enter> twice to finish:

-----BEGIN CERTIFICATE-----

MIIDVTCCAr6gAwIBAgIQEJ7twbl3pDlzJz99DFOKOzANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJDTjEQMA4GA1UECAwHQkVJSklORzEOMAwGA1UECgwFQ0lFQ0MxDzANBgNVBAsMBkdGQSBDQTEgMB4GA1UEAwwXTWluaUNBIEZyZUJTRCBSb290IENlcnQwHhcNMTIwNjI2MDUwMTIzWhcNMzIwNjI2MDUwMTIzWjB/MQswCQYDVQQGEwJDTjEQMA4GA1UECAwHYmVpamluZzESMBAGA1UEBwwJZG9uZ2NoZW5nMQ4wDAYDVQQKDAVjaWVjYzEMMAoGA1UECwwDZ2ZhMR0wGwYJKoZIhvcNAQkBFg50ZXN0QGVjLmNvbS5jbjENMAsGA1UEAwwEcnNhMjCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA6AlNqTnNsV9Yyij2tTMppB9C5VCLtkPh9KlIq/ZTlVhrJED+N5HVfQQyZYS/z4JWAip50dyP1+NP+bvP+pb9CfEaJ8+ObYQnfUH6qiPccLkWO3XYanu6Dw5EMJYntwglSKmk1Pcc+j+yzWnwYMDFcbSsQ+8J5UzlesFhU7GnXacCAwEAAaOB7jCB6zA+BgNVHR8ENzA1MDOgMaAvhi1odHRwczovLzIxMS44OC4yNS4xODo4NDQ0L2dmYS9jcmwvUlNBMTAyNC5jcmwwUQYDVR0gBEowSDBGBggrBgEEAYcrMjA6MDgGCCsGAQUFBwIBFixodHRwczovLzIxMS44OC4yNS4xODo4NDQ0L2dmYS9jcmwvUlNBMTAyNC5wbDALBgNVHQ8EBAMCA/gwCQYDVR0TBAIwADAdBgNVHQ4EFgQUp/9/ODGLR84syxPaBkLG3mCpU5YwHwYDVR0jBBgwFoAUhnY8uZXbE2iX1mXOipvfuDUgAeswDQYJKoZIhvcNAQEFBQADgYEAYrFZQrINHoLN9odcGctzTRGVmMcv9sJ0ncgUEfbrLu6QUodQy3jjxWFIxheJK1btfF66/ShuKtZpqJ1WE9l92tfIHwLpXT0gujtxNi02TOPBNEU7P9nUgxgfDG+uhyPTeufSkfn3LCTHmGfVORF2soGSlaUPV1Zy5E9hmFZoMhs=-----END CERTIFICATE-----

% Input the private key data, press <Enter> twice after data to finish or press <Enter> without data to ignore:

-----BEGIN RSA PRIVATE KEY-----

MIICXQIBAAKBgQDoCU2pOc2xX1jKKPa1MymkH0LlUIu2Q+H0qUir9lOVWGskQP43kdV9BDJlhL/PglYCKnnR3I/X40/5u8/6lv0J8Ronz45thCd9QfqqI9xwuRY7ddhqe7oPDkQwlie3CCVIqaTU9xz6P7LNafBgwMVxtKxD7wnlTOV6wWFTsaddpwIDAQABAoGBAMnJNWliJFgI4+1CvHGN4buhmApWBnnmBL1A7jrlh4CMGPi5MJrgzvjeSnlwfWIXJXbSu4feuJT1UFqMkuyIm9l+k8Rm3hjClXIlfNV/ykG6a6GIVFYGxQWhaL50Pm6S7xXL9Ryd6hnOHUUtwuLvkpBTx/4qvrIABDtXRjVglvApAkEA9BN1ZxM31BOyeB6KXvvmXD6/+dGaDfE4Dbcijy1LgKliaEBJ00e/0R9ekg6myGTU2asJvPtkaXPqcwvU6+e2mwJBAPNfRTk9LzUlNmTV2DrsE9k3rbPnqqS9wb/mLUNdv2FQeoY/Zf4qh0WXsug2q/6GPsvLUA7mbdArGFUwwQbw3+UCQQC8r25LSOgX40JM6g8+bq4fEcOHdSoLLTeQIststC9yP3/75/cqhoUbPYz2jK0SriB+RWM53X46p4nPdo4b8P2RAkBGjoBLL+nXxooWgcjGjFrUxsedOLTIPhtFvz2wIiWx2NsswISZQ0skae58VB1ZFSJvguoa58M+bsAHMrNDh+HhAkBcNAjKBDdVw0ll6bNoRGugEvuo3Z3O0kbVcjzZld+4aVG4DzvEp1ZbsYRv9YPMtpnzmB7WZUshAL99nHnHxtbh-----END RSA PRIVATE KEY-----

Nov 11 2015 19:06:56: %PKI-CERTIFICATE_STATECHG-5: Certificate(issuer:C=CN, ST=BEIJING, O=CIECC, OU=GFA CA, CN=MiniCA FreBSD Root Cert, sn:109EEDC1B977A43973273F7D0C538A3B, subject:C=CN, ST=beijing, L=dongcheng, O=ciecc, OU=gfa, E=test@ec.com.cn, CN=rsa2) state valid

% PKI: Import Certificate success.

#After importing the certificate successfully, you can use the command show crypto ca certificates to view that the status is Valid.

Device#show crypto ca certificates

Root CA Certificate:

Status: Valid

Serial Number: 4e95c7d7b1e3fc0b

Subject: C=CN, ST=BEIJING, O=CIECC, OU=GFA CA, CN=MiniCA FreBSD Root Cert

Issuer : C=CN, ST=BEIJING, O=CIECC, OU=GFA CA, CN=MiniCA FreBSD Root Cert

Validity

Start date: 2009-08-03 06:06:52

End date: 2019-08-03 06:06:52

Key Type: RSA(1023 bit)

Usage: General

Fingerprint(sm3):18d39e4c50c9ad8b11446ac7ac1736f853ac92e769994b98233b48787562429c

Fingerprint(sha1):ab3559e26384539ffcac3c76b5a5e7a1f7073dfb

Associated Identity: test

index: 3

My Certificate:

Status: Valid

Serial Number: 109eedc1b977a43973273f7d0c538a3b

Subject: C=CN, ST=beijing, L=dongcheng, O=ciecc, OU=gfa, E=test@ec.com.cn, CN=rsa2

Issuer : C=CN, ST=BEIJING, O=CIECC, OU=GFA CA, CN=MiniCA FreBSD Root Cert

Validity

Start date: 2012-06-26 05:01:23

End date: 2032-06-26 05:01:23

Key Type: RSA(1024 bit)

Usage: General

Fingerprint(sm3):504599a2f170c51b62b2f8b0850f33a5595bc9e592d14eae9c90b1e59de35a89

Fingerprint(sha1):080614a82cc4f3786458c585f9a58edf19da19bd

Associated Identity: test

index: 4

Step 4:

Upload and download the file between FTP Client and FTP Server.

#FTP Client uploads the file to the FTP Server.

Device#filesystem

Device1(config-fs)#copy file-system startup ftps 1.0.0.1 a a startup VerifyType peer

Copying!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Total 103440 bytes copying completed.

#FTP Client downloads the file from FTP Server.

Device(config-fs)#ftpscopy 1.0.0.1 a a test.doc test.doc VerifyType peer

Downloading########################################################################################################################################################################################################################################################################################### OK!

Step 5:

Check the result.

#After downloading, view the downloaded file in the file system of Device.

Device(config-fs)#dir

size date time name

------------ ------ ------ --------

10189 NOV-04-2015 20:27:03 history

436578 NOV-04-2015 20:33:08 test.doc


5 File System Management


5.1 Overview

The following lists the storage medium of the device and their functions:

l SDRAM: Synchronous Dynamic Random Access Memory (SDRAM) provides the space for executing application programs of the device.

l FLASH: Stores application programs, configuration files, and the BootROM programs, and so on.

l EEPROM: Electrically Erasable and Programmable Read-Only Memory (EEPROM) stores system configuration files and user information which is frequently changed.

l USB: Stores the user data.

The device manages the following types of files:

l BootROM files: Store basic data for system initialization.

l Device application programs: Implement tasks such as route forwarding, file management, and system management.

l Configuration files: Store the system parameters that are configured by the users.

l Log files: Store system log information.

The system has constructed one or more DOS-based file systems to store information which is rarely modified, including device application programs (protocol software and drivers) and BootROM. The file systems are called True Flash File Systems (TFFSs).


5.2 File System Management Function Configuration

Table 5-1 File system management function list

Configuration Tasks
Manage storage devices | Display the information about a storage device.
 | Format a storage device.
 | Remove a storage device.
Manage file directories | Display the information about a file directory.
 | Display the current working path.
 | Change the current working path.
 | Create a directory.
 | Delete a directory.
Manage file operations | Copy a file.
 | Rename a file.
 | Display the content of a file.
 | Delete a file.
Download files form FTP | Download files from the FTP server.
Execute a configuration file manually | Execute a configuration file manually.
Configure startup parameters | Configure startup parameters.


5.2.1 Manage Storage Devices

Configuration Condition

Before performing operations on storage devices, ensure that:

l The system has started normally.

Display the Information About a Storage Devices

By displaying the information about a storage device, you can view the features of the storage device and the size of the remaining space.

Table 5-2 Displaying the Information about a storage device

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Display the information about a storage device. | volume | Mandatory

Format the Storage Devices

If the space of a storage device is unavailable, you can use the format command to format the storage device.

Table 5-3 Formatting a storage device

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Format a storage device. | format { /flash | /syslog | /usb } | Optional

l Exercise caution in formatting a storage device, because the operation may cause permanent loss of all files on the storage device, and the files cannot be recovered.

Remove the Storage Devices

When remove a storage device, first use a command to uninstall the file system and then remove the device in a safe mode.

Table 5‑4 Remove a storage device

Step | Command | Description
Remove a storage device | fschange / usb remove | Mandatory

l Before removing the storage device, first uninstall device in the same way as uninstalling a device on a PC. If the storage device is not uninstalled, file directory on the device may be damage and cannot be recovered.

l Only the USB flash drive can be removed using the preceding command.


5.2.2 Manage File Directories

Configuration Condition

Before performing operations on file directories, ensure that:

l The system has started normally.

Display the Information about a File Directory

By displaying the information about a file directory, you can view the details of the files in the specified directory.

Table 5-5 Displaying the information about a file directory

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Display the information about a directory. | dir [ path ] | Mandatory

Display the Current Working Path

By displaying the current working path, you can view the details of the current path.

Table 5-6 Displaying the current working path

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Display the current working path. | pwd | Mandatory

Change the Current Working Path

By changing the current working path, you can switch over a user to the specified directory.

Table 5-7 Changing the current working path

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Change the current working path. | cd path | Mandatory

Create a Directory

If you want to create a directory in the file system, perform this operation.

Table 5-8 Creating a directory

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Create a directory. | mkdir directory | Mandatory

Delete a Directory

If you delete a directory through this operation, all sub-directories and files in the directory are deleted.

Table 5-9 Deleting a directory

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Delete a directory. | rmdir directory | Mandatory

l Exercise caution when deleting a directory, because the operation of deleting the directory may permanently delete all sub-directories and files in the directory, and the files cannot be recovered.


5.2.3 Manage File Operations

Configuration Condition

Before performing operations on files, ensure that:

l The system has started normally.

Copy a File

In the file system, you can copy a file to the specified directory.

Table 5-10 Copying a file

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Copy a file. | copy src-parameter dest-parameter | Mandatory

l The copy command can be used to copy file between the file system, the FTP server, and the TFTP server. For details, refers to the description of the copy command in the command manual.

Rename a File

In the file system, you can change the name of a file into a specified name.

Table 5-5 Renaming a file

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Rename a file. | rename src-filename dest-filename | Mandatory

Display the Content of a File

In the file system, you can view the content of a file.

Table 5-6 Displaying the content of a file

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Display the content of a file. | type path/filename | Mandatory

Delete a File

In the file system, you can delete a file that is no longer in need.

Table 5-7 Deleting a file

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Delete a file. | delete path/filename | Mandatory

l Exercise caution when you use the delete command because it permanently deletes a file, and the file cannot be recovered.

l Exercise caution when you delete the startup system file. Otherwise, the backup startup file will also be deleted. As a result, the device is not configured and the backup startup file is invisible to users.


5.2.4 Download Files from the FTP

Configuration Condition

Before download files from the FTP manually, first perform the following tasks:

l Start the system normally.

l Ensure that the route between the FTP server and device port is reachable and can be pinged.

Download a File from the FTP

Download related files on the FTP server to the file system via the FTP download command. The ftpscopy command uses the SSL authenticated encryption mode to download files from the FTP security server.

The ftpscopy command is used in the scenario required for high security. Through this command, FTP interaction and file downloading are encrypted. The FTP client can authenticate or does not authenticate the FTP server and vice versa. For details about authentication and encryption, refer to the related sections in "Authentication and Encyption".

Table 5‑8 Download a file from the FTP server

Step | Command | Description
Enter the file system configuration mode | filesystem | -
Download a file from the FTP server | ftpcopy [ vrf vrf-name ] host-ip-address usrname password src-filename { /flash | /sdcard | dest-filename } | Optional
Download a file from the FTP security server | ftpscopy [ vrf vrf-name ] host-ip-address usrname password src-filename { /flash | /sdcard | dest-filename } VerifyType { none | peer } | Optional

l Run the ftpcopy or ftpscopy command to download files from the FTP server to the file system. For details, refer to the related sections in "Methods for Using ftpcopy and ftpscopy".


5.2.5 Execute a Configuration File Manually

Configuration Condition

Before executing a configuration file manually, ensure that:

l The system has started normally.

Execute a Configuration File Manually

By executing a configuration file manually, you can load the configuration file in the specified path.

Table 5-9 Executing a configuration file manually

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Execute a configuration file manually | config-file path/filename [ debug ] | Optional

l Exercise caution in manually executing a configuration file, because it modifies the current configuration of the system forcedly, and this may affect the system services. By default, the startup configuration has been loaded during system startup.


5.2.6 Configure Startup Parameters

Configuration Condition

Before configuring startup parameters, ensure that:

l The system has started normally.

Configure Startup Parameters

In configuring startup parameters, you can configure the application program file that is to be used in next startup.

Table 5-10 Configuring startup parameters

Step | Command | Description
Enter the file system configuration mode. | filesystem | -
Configure startup parameters. | boot-loader path/filename [ bootline-number ] | Mandatory


5.2.7 File System Managing, Monitoring, and Maintaining

Table 5-11 File system managing, monitoring, and maintaining

Command | Description
clear boot-loader [ bootline-number ] | Clears the startup parameters with the specified index.
show filesystem | Display the information about the file system.
show file { location | descriptor } | Display the location of the system file in the file system and the descriptor.
show boot-loader | Display the system startup parameters.


5.3 Typical Configuration Example of File System Management


5.3.1 Configure Startup Parameters

Network Requirements

l A PC is used as the local terminal to log in to the device in the Telnet mod

l The route between the PC and the device must be reachable.

Network Topology

Figure 5‑1 Networking of configuring startup parameters

Configuration Steps

Step 1: | Enter the file system configuration mode.
Step 2: | Configure system startup options.

#View the system startup parameters.

Device#filesystem

Device(config-fs)#show boot-loader

The app to boot at the next time is: g0: rp37-7.3.0.60(R).pck

The app to boot at the this time is: g0: rp37-7.3.0.60(R).pck

Boot-loader0: g0: rp37-7.3.0.60(R).pck

Boot-loader1: g1: rp37-7.3.0.59(v2.3.0.309)-debug.pck

Boot-loader4: backup0: rp37-7.3.0.60(v2.3.0.309)-debug.pck

#Modify the next startup file of the system to the rp37-7.3.0.60(v2.3.0.309)-debug.pck file stored in the flash, and set the priority to 0.

Device#filesystem

Device(config-fs)#boot-loader /flash/ rp37-7.3.0.60(v2.3.0.309)-debug.pck

#View the configuration result.

Device#filesystem

Device(config-fs)#show boot-loader

The app to boot at the next time is: flash0: /flash/ rp37-7.3.0.60(v2.3.0.309)-debug.pck

The app to boot at the this time is: g0: rp34-7.3.0.26(R).pck

Boot-loader0: flash0: /flash/ rp37-7.3.0.60(v2.3.0.309)-debug.pck

Boot-loader4: backup0: rp37-7.3.0.60(v2.3.0.309)-debug.pck


6 Configuration File Management


6.1 Overview

Configuration file management is a function that is used to manage device configuration files. via the command line interface provided by the device, users can easily manage configuration files. If the device needs to automatically load the current configuration of users after restart, the current configuration commands must be saved into the configuration file before the device restarts. Users can upload configuration files to or download configuration files from another device through FTP or TFTP, realizing batch device configuration. The device configuration is categorized into the following two types:

Startup configuration:

When the device starts, it loads the startup configuration file with the name "startup" by default, and it completes the initialization configuration of the device. This configuration is called startup configuration. Here the device has two startup configuration files, one is the default startup configuration file, and the other is the backup startup configuration file. When the device starts, if the default startup configuration file does not exists, the system copies the backup startup configuration file to the location of the default startup configuration file and loads this startup configuration file.

Current configuration:

Current configuration is a set of commands that take effect currently. It consists of startup configuration and the configuration that is added or modified by the user after startup. The current configuration is saved in the memory database. If the current configuration is not saved into the startup configuration file, the configuration information gets lost after the device restarts.

The following describes the contents and formats of the configuration files:

l Configuration files are saved in the file system in the form of text files.

l The contents of the configuration files are saved in the form of configuration commands, and only non-default configuration is saved.

l Configuration files are organized based on command modes. All commands in one command mode are organized together to form a paragraph.

l Paragraphs are organized according to a certain rule: system configuration mode, interface configuration mode, and configuration modes of different protocols.

l Commands are organized according to their relations. The related commands form a group, and different groups are separated by blank lines.


6.2 Configuration File Management Function Configuration

Table 6-1 Configuration file management list

Configuration Tasks
Save the current configuration. | Save the current configuration.
Back up device configuration. | Back up the current configuration.
 | Back up the startup configuration.
Restore the startup configuration. | Restore the startup configuration.


6.2.1 Save the Current Configuration

Configuration Condition

None

Save the Current Configuration

If the current configuration of the user can take effect only after the device starts, you need to save the current configuration into the startup configuration file. When saving the current configuration, the active and the backup startup configuration file save the current configuration to a specified configuration file to ensure that the content in the active and the backup startup configuration files is consistent.

Table 6-2 Saving the current configuration

Step | Command | Description
Save the current configuration to the startup configuration file. | write | Mandatory

l If the device is restarted or powered off while the configuration file is being saved, configuration information may be lost.

l Saving the current configuration not only saves the configuration to the startup configuration file, but also saves the configuration to the backup startup configuration file.


6.2.2 Configure the Backup System

Configuration Condition

Before configuring the backup system parameters, ensure that:

l The route between the device and the server is reachable.

l The configuration file to be backed up exists; otherwise, backup fails.

Back Up the Current Configuration

In backing up the current configuration, you can use a command to back up the current configuration to the FTP server.

Table 6-3 Backing up the current configuration

Step | Command | Description
Enter the privileged user mode. | enable | -
Back up the current configuration to a remote host through the FTP protocol. | copy running-config { ftp [ vrf vrf-name ] { hostname | ip-address } username password dest-filename | ftps [ vrf vrf-name ] { hostname | ip-address } username password dest-filename VerifyType { none | peer } | Mandatory

Back Up Startup Configuration

In backing up the startup configuration, you can use a command to back up the startup configuration to the FTP server.

Table 6-4 Backing up the startup configuration

Step | Command | Description
Enter the privileged user mode. | enable | -
Save the startup configuration to a remote host through the FTP protocol. | copy startup-config { ftp [ vrf vrf-name ] { hostname | ip-address } username password dest-filename | ftps [ vrf vrf-name ] { hostname | ip-address } username password dest-filename VerifyType { none | peer }} | Mandatory


6.2.3 Restore the Startup Configuration

Configuration Condition

Before restoring the startup configuration, ensure that:

l The route between the device and the server is reachable.

l The configuration file that is to be restored exists.

Restore the Startup Configuration

In restoring the startup configuration, you can use a command to download the startup configuration file from the FTP server and set it as the startup configuration file that is used after the active and the backup configuration files restart. In this way, after the device is restarted, the device can load the startup configuration file.

Table 6-5 Restoring the startup configuration

Step | Command | Description
Enter the privileged user mode. | enable | -
Restore the startup configuration. | copy ftp ip-address username password src-filename startup-config | Mandatory

l Before overwriting the local startup configuration, ensure that the configuration file matches the device type and matches the current system version.

l After performing the operation of restoring the startup configuration, the current configuration is not changed. After the device is restarted, the startup configuration is restored. If the restored configuration file is transmitted by the PC client to the server via the ASCII mode, the file is modified. When restoring the file to the device again, it does not pass the check, and as a result, the configuration file fails to be restored.


6.2.4 Configuration File Managing, Monitoring, and Maintaining

Table 6-6 Configuration file managing, monitoring, and maintaining

Command | Description
clear startup | Delete the default startup configuration file and backup startup configuration file.
show running-config [ after-interface | before-interface | interface [ interface-name ] | [ configuration ] ] [ | { { begin | exclude | include } expression | redirect { file file-name | ftp [ vrf vrf-name ] { hostname | ip-address } user-name password file-name } } ] | Display the current configuration information.
show startup-config [ | { { begin | exclude | include | redirect } expression } | redirect { file filename | ftp { [ vrf vrf-name ] { hostname | ip-address } user-name password file-name } } ] | Display the configuration file information that needs to be loaded after the configuration file is restarted at this time or next time.


7 System Management


7.1 Overview

l via system management, users can query the current working status of the system, configure basic function parameters of the device, and perform basic maintenance and management operations on the device. The system management functions include: Configuring the device name

l Configuring the system time and time zone

l Configuring the login welcome message

l Configuring the system exception processing mode

l Restarting the device

l Configuring the password encryption service

l Configuring the history command saving function

l Configuring the login security service

l Configuring CPU monitoring

l Configuring display of properties in pages


7.2 System Management Function Configuration

Table 7-1 System management function list

Configuration Tasks
Configure the device name. | Configure the device name.
Configure the system time and time zone. | Configure the system time and time zone.
Configure the login welcome message. | Configure the login welcome message.
Configure the system exception processing mode. | Configure the system exception processing mode.
Configure to restart the device. | Configure to restart the device.
Configure the encryption service. | Configure the encryption service.
Configure the history command saving function. | Configure the history command saving function.
Configure the login security service. | Configure the login security service.
Configure CPU monitoring. | Configure CPU monitoring.
Configure display of properties in pages. | Configure display of properties in pages.


7.2.1 Configure the Device Name

Configuration Condition

None

Configure the Device Name

A device name is used to identify a device. A user can change the device name according to the actual requirement. The modification takes effect immediately, that is, the new device name is displayed in the next system prompt.

Table 7-2 Configuring the device name

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the device name. | hostname host-name | Mandatory


7.2.2 Configure the System Time and Time Zone

Configuration Condition

None

Configure the System Time and Time Zone

The system time and time zone is the time displayed in the timestamp of system information. The time is determined by the configured time and time zone. You can run the show clock command to view the time information of the system. To make the device work normally with other devices, the system time and time zone must be accurate.

Table 7-3 Configuring the system time and time zone

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the system time. | clock timezone { BEIJING | { timezone-name-string hour-offset-number [ minute -offset-number ]}} | Mandatory. The default is Universal Time Coordinated (UTC).
Enter the privileged user mode. | exit | -
Configure the system time. | clock year-number [ month-number [ day-number [ hour-number [ minute-number [ second-number ] ] ] ] ] | Mandatory


7.2.3 Configure the Login Welcome Message

Configuration Condition

None

Configure the Login Welcome Message

When a user logs in to the device for login authentication, the login welcome message is displayed. The welcome message can be configured according to the requirement.

Table 7-4 Configuring the login welcome message

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the login welcome message. | banner motd banner-line | Mandatory


7.2.4 Configure the System Exception Processing Mode

Configuration Condition

None

Configure the System Exception Processing Mode

When a system exception occurs, the system directly restarts to restore the system. The system exception processing mode is configured in two aspects: The first is enabling periodical exception detection. The system periodically detects the task status, code segment, and semaphore dead lock with a cycle of 10s, 10s, and 30s respectively. Secondly, an exception level is configured. If exceptions of the level and higher levels occur, the device restarts. Exception levels include: alert, critical, emergency, error, and warn.

Table 7-5 Configuring the system exception processing mode

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the system exception processing mode | exception { period-detect enable | reboot { enable | disable | level { alert | critical | emergency | error | warn } } } | Mandatory. By default, periodical exception detection is enabled, and the exception level set for device restart is critical.

l After an exception level is configured for device restart, if an exception at the level or a higher level occurs, the device restarts.

l From high to low, exception levels include emergency, alert, critical, error, and warn.


7.2.5 Configure to Restart a Device

Configuration Condition

None

Restart a Device

When a device fault occurs, you can choose to restart the device according to the actual situation so as to eliminate the fault. The device restart modes include cold restart and hot restart. In a cold restart, the user can directly power off the device and power on the device again. In a hot restart, the user restarts the device by using a restart command. During the hot restart process, the device is not powered off.

Table 7-6 Restarting a device

Step | Command | Description
Use a command to restart the device. | reload | Mandatory

l If you forcedly power off and restart a device that is in the operating status, hardware damage or data loss may be caused. Therefore, this restart mode is usually not recommended.

l If you use the reload command to restart the device, all the services of the device are interrupted. Exercise caution when performing this operation.


7.2.6 Configure the Encryption Service

Configuration Condition

None

Configure the Encryption Service

The encryption service encrypts all passwords of the system so that the passwords are not displayed in plain text, and the security of the passwords is guaranteed. When configuring the encryption service, you need to select an encryption mode. Then, all passwords are encrypted in this mode.

Table 7-7 Configuring the encryption service

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable password encryption. | service password-encryption | Mandatory. It is enabled by default.


7.2.7 Configure the History Command Saving Function

Configuration Condition

None

Configure the History Command Saving Function

With the history command saving function, you can query and collect the history commands that have been executed. Before the history command saving function is configured, history commands are saved in the memory file system. After the function is configured, the system automatically saves history commands in the flash file system.

Table 7-8 Configuring the history command saving function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure to save history commands. | service shell-history | Mandatory. By default, the history command saving function is enabled.


7.2.8 Configure the Login Security Service

Configuration Condition

None

Enable the System Login Security Service

To enhance the system security, the device provides the system login security service function. The functions include:

l Prevents brute force cracking of user login passwords.

l Prevents the fast connection function.

The function of brute force cracking prevention prevents malicious illegal users from forcedly cracking the user name and password for logging in to the device. If the system finds that the number of continuous login authentication failures of a user reaches the number specified by the system, the system rejects the login request from the IP address within the specified period of time.

The function of preventing fast connections prevents illegal users from initiating a large number of login requests within a short period time because this may occupy a lot of system and network resources. If the number of repeated login connections from a user reached a specified number, the system rejects the login connection from the IP address or the login request from the user within the specified period of time.

Table 7-9 Enabling the system login security service

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the system login security service. | service login-secure {telnet | ssh | ftp | snmp} | Mandatory. By default, the system login security service is enabled.

l forbid-time indicates the forbidden time of the user or IP address.

l max-try-time indicates the maximum authentication failure times of the user or IP address. After the authentication failure times reaches the threshold, the user or IP address will be forbidden.

l record-aging-time indicates the aged time of the record after the user or IP address authentication fails, that is, how soon the failure record will be removed.

l restrict-interval is used to set the interval of fast login, that is, when the interval of two login is no more than restrict-interval, it is regarded as the fast login.

Configure the Parameters of the System Login Security Service

Table 7-10 Configuring the parameters of the system login security service

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the time of forbidding the IP address from login | login-secure telnet ip-addr forbid-time forbid-time-number | Mandatory By default, it is 10 minutes.
Configure the maximum authentication failure times of the forbidden IP address | login-secure telnet ip-addr max-try-time max-try-time-number | Mandatory By default, it is 5 times.
Configure the aging time of the forbidden IP address record information | login-secure telnet ip-addr record-aging-time record-aging-time-number | Mandatory By default, it is 15 minutes.


7.2.9 Configure CPU Monitoring

Configuration Condition

None

Configure CPU Monitoring

With CPU monitoring, the system monitors the CPU occupancy to learn the current operation status of the CPU. The following shows the contents of CPU monitoring:

l Monitors the CPU occupancy of each process. After the function is configured, you can view the related information by using the show cpu command.

l Enables the history statistics function of the CPU occupancy. After the function is configured, you can view the related information by using the show cpu monitor command.

Table 7-11 Configuring CPU monitoring

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable CPU occupancy monitoring of the processes. | spy cpu | Mandatory. By default, CPU occupancy monitoring is disabled.
Enable history statistics of CPU occupancy. | monitor cpu | Mandatory. By default, history statistics of CPU occupancy is enabled.


7.2.10 Configure Display of Properties in Pages

Configuration Condition

None

Configure Display of Properties in Pages

System information can be displayed in pages, making it easy for users to view the information. Users can set to display device information in pages according to the actual requirement.

Table 7-12 Configuring display of properties in pages

Step | Command | Description
Enter the privileged user mode |  | -
Configure display of properties in pages. | more { on | off | displine [ num ] } | Mandatory. By default, the function of display in pages is enabled. By default, 24 lines are displayed in displine.


7.2.11 Configure a Serial Number for a Module Part

Configuration Condition

Before configuring a serial number for a module part, ensure that:

l The device runs stably.

l The module part runs normally.

Configure a Serial Number for a Module Part

The serial number is a unique serial number that identifies a module part (including MPU and LPU) of the device. This facilitates user inventory management. Users can modify the serial number of a module part of the device.

Table 7-13 Configuring a serial number for a module part

Step | Command | Description
Enter the privileged user mode. | enable | -
Configure a serial number for a module part. | serialnumber write { mpu | lpu [ lpu-num ] } serialnumber | Mandatory.

l Before modifying the serial number of a module part, ensure that the modification is really in need. Once the serial number is modified, the previous serial number cannot be restored.


7.2.12 Delete the Serial Number of a Module Part

Configuration Condition

Before deleting the serial number of a module part, ensure that:

l The device runs stably.

l The module part runs normally.

Delete the Serial Number of a Module Part

The serial number is a unique serial number that identifies a module part (including MPU and LPU) of the device. This facilitates user inventory management. Users can delete the serial number of a module part of the device according to the requirement.

Table 7-14 Deleting the serial number of a module part

Step | Command | Description
Enter the privileged user mode. | enable | -
Configure a serial number for a module part. | serialnumber delete { mpu | lpu [ lpu-num ] } serialnumber | Mandatory.

l Before deleting the serial number of a module part, ensure that the deletion is really in need. Once the serial number is deleted, it cannot be restored.


7.2.13 System Management Monitoring and Maintaining

Table 7-15 System management monitoring and maintaining

Command | Description
show about | Display the system version information.
show clock | Display the information about the system clock.
show cpu | Display the information about the CPU usage.
show device | Display the device information of the system.
show environment | Display the information about the board temperature.
show history | Display the information about history commands.
show language | Display the information about system language version.
show login-secure [telnet | ssh | ftp | snmp] {ip-addr | user | quick-connect} | View the system login security information
show mbuf allocated [ pool-name ] | Display the mbuf information.
show memory [ detail | free | heap | mbuf | slab | utilization ] | Display the memory information.
show netbuffer [ content pBufHigh pBufLow len | doubleFree | normal caller | jumbo caller ] | Display the netbuffer memory information.
show pool [ detail | information ] | Display the information about the memory pool.
show process [ task-name ] | Display the main tasks in the system and their operating statuses.
show semaphore { sem-name | all | binary | counting | list | mutex } [ any | pended | unpended ] | Display the information about the system semaphore.
show spy | Display the status of the monitoring switch.
show stack | Display the usage of each task stack in the system.
show system fan | Display the fan information.
show system lpu | Display the LPU information.
show system module brief | Display brief information about all module part of the device.
show system mpu | Display the MPU information.
show system power | Display the power supply information.
show tech-support [ detail | page [ detail ] | to-flash ] | Display the technical support information.
show version [ detail ] | Display the system version information.


8 System Alarm


8.1 Overview

With the system alarm function, if an exception occurs, the system sends an alarm prompt message so that the user can pay attention to the exception of the device and take the corresponding measures to ensure stable operation of the device. System alarms include temperature alarms, power supply abnormality alarms, fan abnormality alarms, and system shielding function. For the system temperature alarms, if the CPU or environment temperature reaches the threshold, abnormal system alarm log information is generated. By default, the CPU temperature alarm threshold is 85° and the environment temperature alarm threshold is 75°. Power supply and fan exceptions also generate abnormal system alarm log information.


8.2 System Alarm Function Configuration

Table 8-1 System alarm function list

Configuration Tasks
Configure system temperature alarms. | Configure system temperature alarms.
Configure system power supply alarms. | Configure system power supply alarms.
Configure system fan alarms. | Configure system fan alarms.
Configure system alarm parameters. | Configure the type of system alarms to be shielded.


8.2.1 Configure System Temperature Alarms

Configuration Condition

Before configuring system alarms, ensure that:

l After the system is started and operates stably, all boards are loaded successfully.

l After the system is started and operates stably, the power supply and fans operate normally.

Configure System Temperature Alarms

In configuring system temperature alarms, you need to configure the temperature threshold for CPU or environment alarms. If the CPU temperature or environment temperature reaches the threshold, system alarm log information is generated. By default, the CPU temperature alarm threshold is 95° and the environment temperature alarm threshold is 95°.

Table 8-2 Configuring system temperature alarms

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the threshold for CPU or environment temperature alarms. | alarm temperature { cpu | environment } temperature | Mandatory.


8.2.2 Configure System Power Supply Alarms

Configuration Condition

None

Configure System Power Supply Alarms

If a power supply fault or exception occurs, the system immediately generates log information about system power supply alarms. This helps the user to pay attention to the exception of the device power supply and take the corresponding measures to get rid of the fault and ensure stable operation of the device. By default, the system power supply alarm function is enabled.


8.2.3 Configure System Fan Alarms

Configuration Condition

None

Configure System Fan Alarms

If a system fan fault or exception occurs, the system immediately generates log information about the system fan alarm. This helps the user to pay attention to the exception of the device fans and take the corresponding measures to get rid of the fault and ensure stable operation of the device. By default, the system fan alarm function is enabled.


8.2.4 Configure System Alarm Parameters

Configuration Condition

Before configuring the system alarms, first complete the following tasks:

l After the system is started stably, all boards are successfully loaded.

l When the system is started stably, the power and the fan work normally.

Configure System Alarm Types to Be Shielded

Configuring system alarm types to be shielded means shielding alarm types of different levels. The following four alarm types will be shielded, minor, major, critical, and all

Table 8‑3 Configuring system alarm types to be shielded

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure system alarm types to be shielded. | sysalarm shield type { minor | major | critical | all } | Mandatory


8.2.5 System Alarm Monitoring and Maintaining

Table 8‑4 System alarm monitoring and maintaining

Command | Description
show sysalarm shield [type ] | Display the system alarm types to be shielded.


9 System Log Management


9.1 Overview

System log information is categorized into eight levels, including: emergencies, alerts, critical, errors, warnings, notifications, informational, and debugging. Here levels 0-6 are log information and level 2 is debugging information. For details, refer to the following table.

Table 9-1 Description of the system log level fields

Field | Level | Description
emergencies | 0 | Fatal fault. The system is unavailable, the device stops and it needs to be restarted.
alerts | 1 | Serious error. Functions of a certain type become unavailable, and the services are stopped.
critical | 2 | Critical error. Irreversible problems occur on the functions of a certain type, and some functions are affected.
errors | 3 | Error message.
warnings | 4 | Warning message.
notifications | 5 | Event notification message.
informational | 6 | Message prompt and notification.
debugging | 7 | Debugging message.

System log information is outputted to four directions: control console (Console terminal), monitor console (Telnet or SSH terminal), log server, and log files (memory log files and flash log files). The output to the four directly is controlled by respective configuration commands. The debugging information is outputted to two directions, control console and monitor console. In some special cases, the debugging information can also be configured to output to the log server or log files.

Table 9-2 Log output directions

Log Output Direction | Description
Control console | System log information is outputted to the Console terminal.
Monitor console | System log information is outputted to the Telnet or SSH terminal.
Log server | System log information is outputted to the log server. By default, logs of levels 0-5 are outputted to the log server.
Log files | System log information is outputted to the system memory or flash memory. By default, log information of levels 0-5 is outputted to the system memory, and log information of levels 0-5 is outputted to the flash memory.

The outputted system logs are first saved in the buffer of the log module. The buffer is shared by all information, therefore, if a large amount of information is outputted, logs may get lost. At this time, the log module collects statistics of the lost information and output the information. The log module then obtains the logs one by one from the buffer at the background, and outputs the logs at different output directions according to the log types. If a congestion (such as Console die-hard or Telnet terminal exception) occurs at an output direction during the output process, after the daemon task of the log module detects the congestion, it restarts a new background output task to take over the existing task. In the new task, the direction with the congestion is closed, and the previous task automatically exits after the congestion is automatically removed. The following figure shows the schematic diagram.

Figure 9-1 System log schematic diagram


9.2 System Log Function Configuration

Table 9-3 System log function list

Configuration Tasks
Configure log output functions | Configure log output to the control console.
 | Configure log output to the monitor console.
 | Configure log output to the server.
 | Configure log output to files.
Configure the timestamp for logs. | Configure the timestamp for logs.
Configure a log task name. | Configure a log task name.
Configure the log filtration function. | Configure the log filtration function.
Configure the log file capacity. | Configure the log file capacity.
Configure log display colors. | Configure log display colors.


9.2.1 Configure Log Output Functions

Configuration Condition

None

Configure Log Output to the Control Console

The control console refers to a Console terminal. It is a channel through which the system output log information to the control console. To view output of log information on the control console, you need to enable the log display function of the console.

Table 9-4 Configuring log output to the control console

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the log output function. | logging enable | Optional. By default, the log output function is enabled.
Enable log display on the control console. | logging console [ logging-level ] | Optional. By default, log display on the control console is enabled.

Configure Log Output to the Monitor Console

The monitor console refers to the Telnet or SSH terminal. It is used for remote device management. To configure displaying of log output to the monitor console, you need to enable the log display function of the global monitor console and enable log display on the current terminal. To speed up log display, you can disable the log display function of the console.

Table 9-5 Configuring log output to the monitor console

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the log output function. | logging enable | Optional. By default, the log output function is enabled.
Enable log display on the monitor console. | logging monitor [ logging-level ] | Optional. By default, the log display function of the global monitor console is enabled.
Enable log display of the current monitor console. | terminal monitor | Mandatory. By default, log display on the current monitor console is disabled.

Configure Log Output to the Server

To keep system log information in a more comprehensive manner, you can set up a log server for the devices in the same workgroup. Then the server receives the log information sent by the device. This facilitates system maintenance and management. In some special cases, the local device can also acts as the log server to receive log information from other device. For details, refer to the sections in log server configuration.

Table 9-6 Configuring log output to the log server

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the log output function. | logging enable | Optional. By default, the log output function is enabled.
Enable log output to the log server. | logging trap | Optional. By default, the log output to the log server function is enabled.
Configure log output to the log server. | logging logging-server [ vrf vrf-name ] [ logging-level | port port-num [ logging-level ] ] | Mandatory. By default, lot output to the log server is disabled.
Configuring the source IP address for sending log information. | logging source-ip ip-address | Optional. By default, the outgoing interface for sending log information is determined according to the route. The main IP address of the outgoing interface acts as the source IP address for sending log information.
Configure the IPv6 source address sent by log information | logging source-ipv6 ipv6-address | By default, the outgoing interface for log information transmission can be determined according to routing which can use IPv6 address of the outgoing interface as the IPv6 source address of the transmitted log information.
Configure the source interface sent by log information | logging source-interface interface-name | Optional By default, the outgoing interface for log information transmission can be determined according to routing which can use the main IP address of the outgoing interface as the IPv6 source address of the transmitted log information.
Configure speed limit for log transmission | logging logging-server [ vrf vrf-name ] rate [ limit-sec ] limit-num | Optional By default, the speed limit for log transmission is disabled.
Configure the log transmission type. | logging facility logging-type | Optional. By default, the log transmission type is local7(23).

Configure Log Output to Files

Log files can be stored in two manners, in the memory, and in the flash memory. The memory stores only log information from device startup to restart. By default, log information of level 5 (notifications) and higher levels are stored. By default, the flash memory stores log information of level 5 (notifications) and higher levels. For the levels of logs, refer to the detailed description in Table 9-1. Both the two types of log files have capacity limit. When the size of log files reaches the maximum allowed capacity, the oldest log record is overwritten by the latest one.

Table 9-7 Configuring log output to files

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the log output function. | logging enable | Optional. By default, the log output function is enabled.
Configure logs to be saved into the flash memory. | logging file [ logging-level ] | Optional. By default, the function of saving logs into the flash memory is enabled.
Configure logs to be saved into the memory. | logging buffer [ logging-level ] | Optional. By default, the function of saving logs into the memory is enabled.
Configure the alarm of the insufficient log file capacity | logging { file | buffer } warning [ warning-value ] | Optional By default, the log information alarm function is not enabled.
Configure the log file compression | logging compress [ gunzip ] logging compress { file-size | max-num } value | Optional By default, do not enable the log compression function.


9.2.2 Configure the Timestamp for Logs

Configuration Condition

None

Configure the Timestamp for Logs

The timestamp of a log records in details the time at which the log is generated. By default, log timestamps adopt the Datetime (absolute time) format, but they also support Uptime (relative time) format. The absolute time format records the year and the time with millisecond precision. It outputs the time of logs in details, therefore, the absolute time format is recommended.

Table 9–8 Configuring the timestamp for logs

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the timestamp for logs. | service timestamps { log | debug } [ uptime | datetime [ localtime / msec / show-timezone / year ] ] | Optional. By default, the log information adopts the absolute time format, containing year, but no time zone and millisecond precision display.

l The uptime refers to the run time starting with device startup.

l The datetime refers to the time of the real-time clock.

l The localtime refers to local time.


9.2.3 Configure a Log Task Name

Configuration Condition

None

Configure a Log Task Name

After a name is configured for a log task, users can easily learn that from which system the task is outputted.

Table 9-9 Configuring a log task name

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a log task name. | service taskname [ debug | log ] | Mandatory. By default, a task name is not added into log information.


9.2.4 Configure the Log Filtration Function

Configuration Condition

None

Configure the Log Filtration Function

When configuring log filtration, you can not only specify the filtration string to be displayed, but also specify the string to be filtered out and specify the log level range. In using the command, the filtration string must be used together with the log level range.

Table 9-10 Configuring the log filtration function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the log filtration function. | logging filter { exclude exclude-string | include include-string | level high-level low-level } | Optional. By default, the log filtration function is disabled.


9.2.5 Configure the Log File Capacity

Configuration Condition

None

Configure the Log File Capacity

Limited by the capacity of the flash memory, the log file capacity can be configured from 4096 to 1048576 bytes. When the size of stored log information exceeds the maximum capacity limit, the latest log overwrites the oldest one.

Table 9-11 Configuring the log file capacity

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the log file capacity. | logging file max-size file-size | Optional. By default, the log file capacity is 256000 bytes.


9.2.6 Configure Log Display Colors

Configuration Condition

None

Configure Log Display Colors

When log information is displayed, you can modify log information of different levels so that they are displayed in different colors. In this way, the importance degrees of logs are distinguished. By default, the log display color function is enabled. The following table shows the default colors corresponding to the log levels.

Table 9-12 Description of system log colors

Field | Description
emergencies | Red
alerts | Purple
critical | Blue
errors | Brown
warnings | Cyan
notifications | White
informational | Green
debugging | Green

Table 9-11 Configuring log display colors

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a color for logs of a level. | logging color [ logging-level [ logging-color ] ] | Optional. By default, each log level has a corresponding log display color.

l If the control console or monitor console needs to output log information in different colors, you need to configure the color option of the terminals; otherwise, no color is displayed for the log information.


9.2.7 System Log Monitoring and Maintaining

Table 9-12 System log monitoring and maintaining

Command | Description
clear logging [ buffer | file ] | Clear log information of the device.
show logging [ buffer | file ] | Display the log information that is stored in the memory or flash memory.
show logging filter | Display the filtration configuration of logs.
show logging [ syslog ] message-counter | Display the size of log files and number of log records.
show logging time / level | Display logs according to the log level or log time range.


10 Software Upgrade


10.1 Overview

Software upgrade provides a more stable software version and more abundant software features for the user.

Upgraded programs are stored in the storage mediums of the device in the form of files or data blocks. The software modules with different functions cooperate to keep the device in the stable working state and support the hardware features of the device and application services of users.

Users can upgrade software through the TFTP/FTP network transmission mode or the Xmodem transmission mode of the Console port. In upgrading software of different types, users must carefully read the operation steps and notes and cautions described in the manuals related to the software upgrade.

In upgrading software, you usually need to upgrade software of each type. If the software of a type is not updated during the upgrade process, you need not upgrade the software again. Usually, you can restart the device only after the all software versions are upgraded.

The following types of software are available:

l The image program package: Program package with the suffix pck. It contains a group of programs that are required for normal operation of the system, including operating system and application programs.

l The bootloader program: The program with the suffix bin, similar to the BIOS program, fixed in the ROM of the main board and first executed when the system is powered on. The program initializes the basic system, and realizes the functions, such as upgrade, download, guide, debug and test.


10.2 Software Upgrade Function Configuration

Table 10-1 Software upgrade function list

Configuration Tasks
Upgrade the image program package. | Upgrade the image program in TFTP/FTP mode.
Upgrade the bootloader program | Upgrade the bootloader program via the TFTP/FTP mode
 | Upgrade the bootloader program via the Console port
Upgrade the devinfo file | Upgrade the devinfo file via TFTP/FTP


10.2.1 Upgrade the image Program Package

The image program applies to the host d upgrading.

Configuration Condition

Before upgrading the image program package, ensure that:

l The route between the TFTP/FTP server and the device interface is reachable, and the TFTP/FTP server and the device can ping each other successfully.

l The TFTP/FTP server configuration is correct, and the image program is stored in the specified directory of the TFTP/FTP server.

l The remaining space of the flash memory is sufficient. If the space is insufficient, manually delete files that are not in use.

l The configuration files have been backed up.

Upgrade the image Program Package in TFTP/FTP Mode

Enter the privileged user mode, ensure that the device can obtain the upgrade program through the external TFTP/FTP server, and then use the sysupdate image command to upgrade the program package.

Table 10-2 Upgrading the image program package in TFTP/FTP mode

Step | Command | Description
Enter the privileged user mode. | None | Mandatory.
Upgrade the image program package. | sysupdate image [vrf vrf-name] dest-ip-address filename [ ftp ftp-username ftp-password ] [reload] | Mandatory. If the FTP option is not specified, TFTP is used for upgrade by default.

Example: The following example shows how to make use of the FTP server 128.255.18.18 to upgrade the image program package of the device.

Hostname#sysupdate image 128.255.18.182 rp37-7.3.1.1(R).pck ftp a a

If the reload subcommand is added, a choice whether to reboot the device after the upgrading is completed and whether to save the configuration. If the reload subcommand is not added, run the reload subcommand or power off the device to reboot it after the upgrading is completed. The following command lines will be displayed:

downloading " rp37-7.3.1.1(R).pck " : #####################################################

##################################################################################

#########OK

Download "rp37-7.3.1.1(R).pck" (9967484 Bytes) successfully

Verify the image...valid!

Writing file /flash/rp37-7.3.1.1(R).pck .................................................................................................

............................................................................... OK!

backup ios to raw flash.... .................................................OK!

Sysupdate image rp37-7.3.1.1(R).pck successfully.

router#

The preceding message indicates that the IOS file is upgraded successfully. And then reboot the device.

l If the command option reload is added, the system prompts whether to save the configuration and whether to restart the device. However, usually the device is started after all programs are upgraded. Therefore, the reload option is not recommended.

l Before the upgrade, ensure that there is sufficient space in the flash memory. If the space is insufficient, the upgrade fails. In this case, you can manually delete files that are not in need from the flash memory to obtain more space for upgrading application programs.

l It takes a long time to upgrade the image program package. A smaller remaining space in the flash memory results in longer upgrade time.

l After the upgrade is completed, to run the new image program, restart the device.

l If the device fails to start normally, enter the bootloader interface, modify the startup mode to network startup. After the device is started successfully, start the upgrade. For the method, refer to the related section in the bootloader configuration manual and command manual.

l During the upgrade process, the device must not be powered off or restarted. Otherwise, the system may fail to start, or the flash file system of the device may be damaged.


10.2.2 Upgrade the bootloader Program

Configuration Condition

Before upgrading the bootloader program, ensure that:

l The route between the TFTP/FTP server and the device interface is reachable, and the TFTP/FTP server and the device can ping each other successfully.

l The TFTP/FTP server configuration is correct, and the bootloader program is stored in the specified directory of the TFTP/FTP.

l The configuration files have been backed up.

Upgrade the bootloader Program in TFTP/FTP Mode

Enter the privileged user mode, ensure that the device can obtain the upgrade program through the external TFTP/FTP server, and then use the sysupdate bootloader command to upgrade the program package.

Table 10‑3 Upgrading the bootloader program in TFTP/FTP mode

Step | Command | Description
Enter the privileged user mode. | none | Mandatory.
Upgrade the bootloader program. | sysupdate bootloader [vrf vrf-name] dest-ipaddress filename [ ftp ftp-username ftp-password ] [reload] | Mandatory. If the FTP option is not specified, TFTP is used for upgrade by default.

Example:

The following example shows how to make use of FTP server 128.255.32.10 to upgrade the bootloader program of the device.

Hostname#sysupdate bootloader 128.255.32.10 Bootloader-PR020_29_v1.13.bin ftp a a

If the reload subcommand is added, a choice whether to reboot the device after the upgrading is completed and whether to save the configuration. If the reload subcommand is not added, run the reload subcommand or power off the device to reboot it after the upgrading is completed.

The device will prompt the following information:

downloading " bootloader-PR020_18_40-50_v1.40.bin " : OK

Download "Bootloader-PR020_18_40-50_v1.40.bin " (692260 Bytes) successfully

update bootloader start.

...............................OK

Sysupdate Bootloader-PR020_18_40-50_v1.40.bin successfully.

The preceding message indicates that the bootloader program is upgraded successfully. And then reboot the device. Check whether the bootloader program is upgraded normally through the printed information of Bootloader 1.40 for PR020_18_40-50.

l If the command option reload is added, the system prompts whether to save the configuration and whether to restart the device. However, usually the device is started after all programs are upgraded. Therefore, the reload option is not recommended.

l After the upgrade is completed, to run the new bootloader program, restart the device.

l Select the correct bootloader version for upgrade to prevent the abnormality.

l During the upgrade process, the device must not be powered off or restarted. Otherwise, the system may fail to start, or the bootloader file of the boards may be damaged.

Upgrade the bootloader Program via the Console Port

Ensure that the HyperTerminal can access the device through the Console port. Enter the bootloader mode, adjust the baud rate, and perform the upgrade through the ymodem of the HyperTerminal.

For details of the commands, refer to the sections related to "bootloader " in the command manual.

Table10‑4 Upgrading the bootloader program via the console port

Step | Command | Description
Set the HyperTerminal. | None | Mandatory. Run the HyperTerminal program, select the corresponding serial port (such as com1) and set its properties. Set baud rate to 9600 bps, soft flow control, 8 data bits, no parity check, and 1 stop bit.
Enter the bootloader mode. | None | Mandatory. When the device restarts, press Ctrl + C to enter the bootloader mode.
Modify the baud rate of the Console port and HyperTerminal to improve the upgrade speed. | srate { speed } | Optional. Modify the baud rate of the device Console port to 115200 bps. Then, disconnect the HyperTerminal, and modify the baud rate of the HyperTerminal to 115200 bps, and then connect the HyperTerminal again.
Upgrade the bootloader program. | mupdate | Mandatory. In the bootloader mode, input the mupdate command, select the ymodem protocol of the HyperTerminal, and select the bootloader program to start transmission.

Example:

The following example shows how to upgrade the bootloader program of the host through the Console port.

During upgrading, the prompt information on the terminal is as follows:

bootloader# mupdate bootloader

## Ready for binary (ymodem) download to 0x20000000 at 9600 bps...

CCCC

Starting ymodem transfer. Press Ctrl+C to cancel.

Transferring bootloader-PR020_18_40_50_v1.40.bin...

100% 676 KB 6 KB/s 00:01:40 0 Errors

## Total Size = 0x000a9018 = 692248 Bytes

## Start Addr = 0x4000000

Download bootloader OK.

bootloader image check:

Image header version 1.0

Bootloader validate ok!

Run command=sf update 0x4000000 0x0 0x100000

……………………1048576 bytes written，0 bytes skipped

Update bootloader OK.

bootloader#

After the upgrade is completed, set the attribute of the hyper terminal to its initial settings. Then, power off and reboot the router. Check whether the bootloader program is successfully upgraded through the printed information of Bootloader 1.40 for PR020_18_40-50.

l In upgrading the bootloader program, ensure that the rate of the HyperTerminal is the same as the rate of the device Console port.

l In upgrading the bootloader program, the transmission speed is recommended to be set to 115200 bps. In this way, the upgrade transmission time is shorter.

l If the default rate of the Console port has been modified in upgrading the bootloader program, in loading the image program package, the rate of the device Console port automatically resumes to 9600 bps. At this time, the rate of the HyperTerminal needs to be modified synchronously.

l It is recommended that you upgrade the bootloader program in TFTP/FTP mode. The Console port is used to upgrade the bootloader program only when the upgrade conditions of the first upgrade mode fail to be satisfied.

l During the upgrade process, the device must not be powered off or restarted. Otherwise, the system may fail to start, or the bootloader file of the device may be damaged.


10.2.3 Upgrade devinfo File

Configuration Condition

Before upgrading the devinfo file, ensure that:

l The route between the TFTP/FTP server and the device interface is reachable, and the TFTP/FTP server and the device can ping each other successfully.

l The TFTP/FTP server configuration is correct, and the devinfo file is stored in the specified directory of the TFTP/FTP server.

l The configuration files have been backed up.

Upgrade devinfo File via TFTP/FTP

Enter the privileged user mode, ensure that the device can get the upgrade program from the external TFTP/FTP server, and then upgrade via the sysupdate devinfo command.

Table 10-6 Upgrading the devinfo file via TFTP/FTP

Step | Command | Description
Enter the privileged user mode. | no | Mandatory
Upgrade the devinfo file | sysupdate devinfo [ vrf vrf-name]dest-ip-address filename[ ftp ftp-username ftp-password ][ reload ] | Mandatory If the FTP option is not specified, use the TFTP upgrade by default.

Example:

Upgrade the devinfo file via the FTP server 130.255.168.45.

Hostname#sysupdate devinfo 130.255.168.45 devInfo-mpu(V1.7) ftp a a

#The device prompts the following information:

downloading " devInfo-mpu(V1.7)" : ######################OK

Download " devInfo-mpu(V1.7)" (524288 Bytes) successfully

Update Devinfo…Writing file to filesystem................ ..............................

Writing file to filesystem OK!

Sysupdate devinfo devInfo-mpu(V1.7) successfully!

#The above information indicates that the devinfo is upgraded successfully.

l If the command option reload is added, the system prompts whether to save the configuration and whether to restart the device. However, usually the device is started after all programs are upgraded. Therefore, the reload option is not recommended.

l After the upgrade is completed, to run the devinfo file, restart the device.

l Select the correct devinfo file version to upgrade, so as to avoid the abnormality.

l During the upgrade process, the device must not be powered off or restarted. Otherwise, the system may fail to start, or the devinfo file may be damaged.


10.3 Typical Configuration Example of Software Upgrade


10.3.1 Upgrade All Software Versions

Network Requirements

l A PC acts as an FTP server, and Device acts as an FTP client. The network between the server and the device is normal.

l On the FTP server, the user name for a device to log in to the FTP server is admin, and the password is admin. The image program and bootloader program to be upgraded are placed in the FTP server directory. All device software versions are comprehensively upgraded.

Network Topology

Figure 10-1 Networking for upgrading all software versions

Configuration Steps

Step 1: | Configure an FTP server, and place the image program and bootloader program in the FTP server directory. (Omitted)
Step 2: | Back up device configuration files.(Omitted)
Step 3: | Configure the IP addresses of the interfaces so that the network between Device and the FTP server is normal. (Omitted)
Step 4: | Upgrade the image program.

#Before upgrading the image program, check whether there is sufficient space in the file system.

Device#filesystem

Device(config-fs)#volume

#Use the sysupdate command to upgrade the image program of the host.

Device#sysupdate image 2.0.0.1 rp37-7.3.1.1(R).pck ftp admin admin

The information about the upgrade procedure of the image program and whether the upgrade is successful will be printed.

Step 5:

Upgrade the bootloader program.

#Use the sysupdate command to upgrade the bootloader program of the host.

Device#sysupdate bootloader 2.0.0.1 Bootloader-PR020_29_v1.40.bin ftp admin admin

The information about the upgrade procedure of the bootloader program and whether the upgrade is successful will be printed

Step 6:

Use a command to restart the device.

#Use the reload command to restart the device.

Device #reload

Save current configuration to startup-config(Yes|No)?yes

Please confirm system to reload(Yes|No)?yes

Before the restart, determine whether to save the configuration according to the actual requirement.

Step 7:

Check the result.

#After the upgrade is completed and the device is restarted, view the version numbers of the programs to check whether the versions have been upgraded.

#Check whether the image program and bootloader program have been upgraded successfully.

Device#show system mpu

System Card Information(Mpu 0 - ONLINE)

----------------------------------------------------------------

Type: MP1800X-50(V1)[0x1043138c]

Status: Start Ok

Card-Port-Num: 0

Card-SubSlot-Num: 2

Serial No.:

Card-Name: MP1800X-50(V1)

Description:

Hardware-Information:

PCB-Version: 2

Software-Information:

Bootloader-Version: 1.40

Software-Version: 7.3.1.1(R)(integrity)

CPU-On-Card-Information: <1 CPUs>

CPU-Idx: 00

Status: 0000

Core-Num: 0002

Core-State:

Core-Idx-00

Core-Status: 0000

Core-Utilization: 2%

Core-Idx-01

Core-Status: 0000

Core-Utilization: 100%

Temperature-State:

Temperature = 64°C

MEM-On-Card-Information: <1 MEMs>

MEM-Idx: 00

MEM-State:

BytesFree = 805895328 bytes

BytesAlloc = 237761376 bytes

BlocksFree = 18 blocks

BlocksAlloc = 6755 blocks

MaxBlockSizeFree = 541065216 bytes

DISK-On-Card-Information: <1 DISKs>

DISK-Idx: 00

Type: Flash

Status: Online

Last-Alarm: 0000

DISK-State:

SizeTotal = 99876864 bytes

SizeFree = 51003392 bytes

----------------------------------------------------------------

STATISTICS: 1 IN, 0 OUT, 0 IERR, 0 OERR

System Card Information(Mpu 0/1 - ONLINE)

----------------------------------------------------------------

Type: 5GE[0x10131605]

Status: Start Ok

Card-Port-Num: 5

----------------------------------------------------------------

STATISTICS: 1 IN, 0 OUT, 0 IERR, 0 OERR

l It does not matter whether the image program, or bootloader program is upgraded first, but the device can be restarted only after all programs have been upgraded.

l The image program and bootloader program must be used together.

l Before the upgrade, ensure that there is sufficient space in the flash file system for saving the image file that is used for upgrade. If there is not sufficient space on the device, delete the files that are not in need from the file system of the device. The remaining space of the flash file space is recommended to be larger than 7M before the upgrade. Otherwise, the upgrade may cost a longer time.

l If some programs are not updated in the newly released version, the unchanged programs need not be upgraded.


10.3.2 Upgrade the bootloader Program via the Console Port

Network Requirements

l PC and the Console port of the device is directly connected.

l The bootloader program is to be upgraded through the Console port.

Network Topology

Figure 10-2 Upgrading the bootloader program via the Console port

Configuration Steps

Step 1: | Connect PC and the Console port of the device properly.(Omitted)
Step 2: | Enter the bootloader interface.

When the device is just started and the " press ctrl+c to enter bootloader mode: 0)" message is printed, press and hold Ctrl + C to enter the bootloader interface.

Step 3:

Set the transmission rate to 115200 bps to improve the upgrade speed.

bootloader# srate 115200

#After setting the transmission speed of the Console port of bootloader, you should set the transmission speed of the HyperTerminal also to 115200 bps.

Step 4:

On the bootloader screen, upgrade the bootloader version.

bootloader# mupdate bootloader

#Input the mupdate bootloader command, and use ymodem to transmit the bootloader file that has been saved on the PC.

#Check the result.

#After the upgrade is completed, the following message is printed under the bootloader interface.

Copy to Flash... done

....................................... done

Protected 39 sectors

Update bootloader OK.

Step 5:

Check the result.

#After the upgrade is completed and the device is restarted, the system is booted by the new bootloader.

l Upgrade through the Console port is complex and slow, so the TFTP/FTP upgrade mode is recommended. The Console port upgrade mode is used only when the upgrade conditions of the TFTP/FTP upgrade mode fail to be satisfied.

l After the upgrade is completed, use the reset command to exit bootloader program. Then, the new monitor program boots the loading of the image program.

l If the default rate of the Console port has been modified in upgrading the bootloader program, the rate of the device Console port automatically resumes to 9600 bps when loading the image program package. At this time, the rate of the HyperTerminal needs to be modified synchronously.


11 Bootloader


11.1 Overview

In an embedded system, Bootloader runs before the Operating System (OS) kernel runs. Bootloader is used to initialize hardware devices (including the Console port, Ethernet port, and flash), and set up memory space mapping to bring the hardware and software of the system to a proper state. Finally, it prepares a proper environment for booting the OS kernel. In the embedded system, there is no such firmware program as BIOS, so the booting of the entire system is implemented by the Bootloader.

The Bootloader system mainly provides the following functions:

l Sets startup parameter to load the image program, and select the loading mode of the Image program.

l Upgrades the Bootloader program.


11.2 Bootloader Function Configuration

Table 11‑1 Bootloader function configuration list

Configuration Tasks
Set the Bootloader boot parameters | Set the Bootloader boot parameters
Upgrade the Bootloader program | Upgrade the Bootloader program


11.2.1 Preparation before Configuring the Bootloader Functions

Before configuring the Bootloader functions, you need to set up a local configuration environment. Connect the serial port of the host (or terminal) to the Console port of the device through a configuration cable. The configuration of the communication parameters of the host (or terminal) must be the same as the default configuration of the Console port of the device. The default configuration of the Console port of the device is as follows:

l Transmission speed: 9600 bps

l Flow control mode: None

l Check mode: None

l Stop bit: 1 bit

l Data bit: 8 bits


11.2.2 Set the Bootloader Boot Parameters

Configuration Condition

None

Set bootloader Boot Parameters

Table 11‑2 Set the Bootloader boot parameters

Step | Command | Description
Enter the Bootloader configuration mode | None | Mandatory. After the device is powered on, press the Ctrl + C keys to enter the Bootloader configuration mode. After you enter the mode, the "bootloader:>" is prompted.
Set the Bootloader boot parameters | change { index } { boot-dev } { filename } [ local-ip-addr ] [ host-ip-addr ] [ gatewayip ] [ netmask ] | Mandatory

l If setting the boot device type to the file system boot, you can select the existing Image program name in the flash file system to load and run according to the prompt information.

l If setting the boot device type to the network boot, it is necessary to ensure that the route between the Ethernet interface of the host or terminal and the network management interface (such as ge0) of the device is reachable.


11.2.3 Upgrade the Bootloader Program

Configuration Condition

None

Upgrade the Bootloader Program

Table 11‑3 Upgrade the Bootloader program

Step | Command | Description
Enter the Bootloader configuration mode | None | Mandatory. After the device is powered on, press the Ctrl + C keys to enter the Bootloader configuration mode. After you enter the mode, the "bootloader:>" is prompted.
Upgrade the Bootloader program | update { file-type } { filename } { eth-name } { local-ip-addr } { host-ip-addr } [ gatewayip ] [ netmask ] | Mandatory

l After upgrading the Bootloader system program, use the command reset or power off and restart the device, and then, you can use the latest Bootloader system program.

l When using the update command to upgrade the Bootloader program, ensure that the route between the Ethernet interface of the host (or terminal) and the network management interface (such as ge0) of the device is reachable.


11.2.4 Bootloader Monitoring and Maintaining

None


11.3 Typical Configuration Example of Bootloader


11.3.1 Configure bootloader to Guide the Image Program from the File System

Network Requirements

l The PC is directly connected with the Console port of the device.

l Use the Console port to upgrade the bootloader program of the device.

Network Topology

Figure 11‑1 Configure bootloader to guide the Image program from the file system

Configuration Steps

#输入命令 change 设置bootloader第0条启动参数。

bootloader# change 0 flash0 rp37-7.3.1.1(R).pck

print index:0 boot parream info:

boot dev: flash0

boot file: rp37-7.3.1.1(R).pck

#输入命令 boot 开始引导Image程序。

bootloader# boot

Use boot parameter 0:

device=ge0, file=rp37-7.3.1.0(v2.3.0.309)-debug.pck, local_ip=10.0.0.1, host_ip=10.0.0.200

Using bcmiproc_eth-0 device

TFTP from server 10.0.0.200; our IP address is 10.0.0.1

Filename 'rp37-7.3.1.0(v2.3.0.309)-debug.pck'.

Load address: 0x91007ed0

Loading: ##################################################

done

Bytes transferred = 22488200 (1572488 hex)

Verifying Checksum ... OK

Uncompressing Linux... done, booting the kernel.

Starting init...Starting do before load ...

mount flash file system

done

Starting modules......done


11.3.2 配置bootloader从网络引导Image程序

Network Requirements

l PC与设备 Console口直接连接。

l 设备同FTP服务器路由可达。

l

Network Topology

图 11‑2配置bootloader从网络引导Image程序组网图

Configuration Steps

#设置第0条Bootloader启动参数，选择从设备的网络管理接口ge0加载并运行Image程序rp37-7.3.1.1(R).pck；设置设备网络管理接口ge0的IP地址为192.168.0.2；设置TFTP服务器主机IP地址为192.168.0.1。

#输入命令 change 设置bootloader第0条启动参数。

bootloader# change 0 ge0 rp37-7.3.1.1(R).pck 192.168.0.2 192.168.0.1

bootloader#print 0

print index:0 boot param info:

boot dev: ge0

boot file: rp37-7.3.1.1(R).pck

boot local ip: 192.168.0.2

boot host ip: 192.168.0.1

bootloader#

#输入命令 boot 开始引导Image程序。

bootloader# boot

Use boot parameter 0:

device=ge0, file=rp37-7.3.1.0(v2.3.0.309)-debug.pck, local_ip=192.168.0.2, host_ip=192.168.0.1

Using bcmiproc_eth-0 device

TFTP from server 192.168.0.1; our IP address is 192.168.0.2

Filename 'rp37-7.3.1.1（R）.pck'.

Load address: 0x91007ed0

Loading: ##################################################

done

Bytes transferred = 22488200 (1572488 hex)

Verifying Checksum ... OK

Uncompressing Linux... done, booting the kernel.

Starting init...Starting do before load ...

mount flash file system

done

St


1.1 Overview

The interfaces can be classified into physical interface and logical interface. The physical interface includes Ethernet interface, E1 interface, CE1 interface, and 4G interface. The logical interface includes Ethernet subinterface, aggregation group interface, VLAN interface, loopback interface, null interface, and tunnel interface.

l Physical interface

The physical interfaces can be classified into fast Ethernet interface and slow WAN interface. Ethernet, characterized with highly flexible, relatively simple, and easy to realize, currently has become a most important LAN networking technology. The WAN interfaces are classified into E1 interface, CE1 interface, and synchronous/asynchronous serial interface. These interfaces can capsulate WAN link protocols such as HDLC and PPP. The device supports the following physical interfaces:

L2 Ethernet interface: also called port, is a physical interface. It works in layer 2, the data link layer. It only switches and forwards the received packets in layer 2.

4G interface: is the fourth generation mobile communications interface and provides the high-speed wireless communication access mode. It provides the faster and better data communication service for the user. The networking mode is more flexible.

l Logical interface

The logical interface does not exist physically but it can achieve data switching, interacting, and forwarding. The device supports the following logical interfaces:

Aggregation group interface: is a logical interface. It can be formed by binding multiple physical links between two devices. It works in the data link layer, expanding the link bandwidth and improving the link reliability.

VLAN interface: is a logical interface. It is bound with VLAN and forwards the packet between different VLANs.

loopback interface: is a logical interface. For the packets sent to the loopback interface, the device regards that the packets are sent to itself, so it does not forward the packets.

Null interface: is a logical interface. Any packet sent to null interface is dropped.

Tunnel interface: is a logical interface, providing the transmission link for the point-to-point mode.

For different interfaces, there are corresponding configuration modes. The related configuration modes of the interfaces include:

l Interface configuration mode, corresponds to 4G interface, VLAN interface, and all logical interfaces except the aggregation group interface.

l L2 Ethernet configuration mode: corresponds to L2 Ethernet interface, also called port.

l Aggregation group configuration mode: corresponds to the aggregation group interface.

This chapter mainly describes the common function configuration of various interfaces. For the featured function configuration of various interfaces, refer to the corresponding interface chapter.


1.2 Basic Function Configuration of Interfaces

Table 1‑1 Basic function configuration list of interfaces

Configuration Task
Configure the basic functions of the interfaces | Enter the interface configuration mode
 | Enable/Disable the interface
 | Configure the interface MTU
 | Configure the interface description information
 | Configure the interface logical bandwidth
 | Configure the interface delay
 | Configure the statistics interval of interface traffic.
Configure the interface group function | Configure the interface group
Configure the interface status SNMP proxy concern layer | Configure the interface status SNMP proxy concern layer


1.2.1 Configure Basic Functions of Interfaces

Configuration Condition

None

Enter Interface Configuration Mode

Table 1‑2 Enter the interface configuration mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory

l If a logical interface is not created, the preceding command will be used to create the logical interface and then enter its configuration mode.

Enable/Disable Interface

Users can enable/disable an interface manually.

Table 1‑3 Enable/Disable the interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Either After entering the interface configuration mode, the follow-up configuration can take effect only on the current interface. After entering the L2 Ethernet interface configuration mode, the follow-up configuration can take effect only on the current port. After entering the aggregation group configuration mode, the follow-up configuration can take effect only on the aggregation group interface.
Enter the L2 Ethernet interface configuration mode | interface interface-name
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Disable the interface | shutdown | Mandatory By default, the interface is enabled.
Enable the interface | no shutdown | Mandatory By default, the interface is enabled.

l The null interface does not support the function of disabling the interface.

Configure Interface MTU

The MTU configured on the interface takes effect at the same time for the ingress and egress packets, and the set values are the same. When the length of the received and sent packets exceeds the set value, the packets are dropped directly.

In contrast, the MTU configured on L3 Ethernet interface only takes effect for the egress packets. When the length of the sent packet exceeds the set value, the packet first performs the IP fragmenting, making the length of the fragmented packet not exceed the set value, and then send it out.

Table 1‑4 Configure interface MTU

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Either After entering the interface configuration mode, the follow-up configuration can take effect only on the current interface. After entering the interface configuration mode, the follow-up configuration can take effect only on the current port.
Enter the L2 Ethernet interface configuration mode | interface interface-name
Configure the interface MTU | mtu mtu-size | Mandatory The default MTU value varies for different interface types. For details, refer to the command manual.

l The null interface, loopback interface, tunnel interface, and aggregation group interface do not support the MTU configuration.

l The MTU value of the tunnel interface varies with MTU value of the egress interface.

l The actual valid port MTU is the multiples of 4 bytes. If the setting value is not the multiples of 4 bytes, the actual valid MTU = (setting value / 4) x 4. For example, if the set MTU is 1501 bytes, the actual valid MTU is 1500 bytes. If the length of the frame received and transmitted by the port exceeds the set MTU, the frame is dropped directly.

Configure Interface Description Information

Users can describe the interface through configuring the interface description information.

Table 1‑5 Configure the interface configuration information

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Either After entering the interface configuration mode, the follow-up configuration can take effect only on the current interface. After entering the interface configuration mode, the follow-up configuration can take effect only on the current port. After entering the aggregation group configuration mode, the follow-up configuration can take effect only on the aggregation group interface.
Enter the L2 Ethernet interface configuration mode | interface interface-name
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the interface description information | description description-name | Mandatory By default, the interface description information is not configured

l The null interface does not support the function of configuring the interface description.

Configure Interface Logical Bandwidth

The interface logical bandwidth affects the routing costs and QoS calculation, which does not affect the interface physical bandwidth. Generally, when the interface is connected to the WAN, it is recommended that the interface logical bandwidth and the actual bandwidth of the leased line be consistent.

Table 1‑6 Configure the interface logical bandwidth

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the interface logical bandwidth | bandwidth width-value | Mandatory The default logical bandwidth varies for different interface types. For details, refer to the command manual.

l The interface logical bandwidth does not vary with the rate negotiated at the physical layer. For example, the gigabit-Ethernet port negotiates a rate as 100 M. The logical bandwidth still remains at the default value 1,000,000 kbps.

l The default logical bandwidth varies for different interface types. You can run the show interface interface-name command to check.

l The null interface, aggregation group interface, and L2 Ethernet interface do not support the function of configuring the logical bandwidth.

Configure Interface Delay

The interface delay configuration affects the calculation of the IRMP routing protocol cost, but does not affect the actual transmission delay of the interface. Users can change the cost of the routing protocol by configuring the interface delay.

Table 1‑7 Configure the interface delay

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the interface delay | delay delay-time | Mandatory The interface delay is in the unit of 10 microseconds. The default delay varies for different interface types. The default delay value of the gigabit Ethernet interface is 1, that is, 10 microseconds (1x10 microseconds). If the configured delay is 2, that is 20 microseconds (2x10 microseconds).

l The default delay value varies for different interface types. You can run the show interface interface-name command to check.

l The null interface, aggregation group interface, and L2 Ethernet interface do not support the function of configuring the delay.

Configure Statistics Interval of Interface Traffic

The device measures the interface traffic regularly. Users can change the statistics interval of the interface traffic by manual configuration.

Table 1‑8 Configure statistics interval of interface traffic

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Either After entering the interface configuration mode, the follow-up configuration can take effect only on the current interface. After entering the interface configuration mode, the follow-up configuration can take effect only on the current port. After entering the aggregation group configuration mode, the follow-up configuration can take effect only on the aggregation group interface.
Enter the L2 Ethernet interface configuration mode | interface interface-name
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the statistics interval for the average interface traffic rate | load-interval interval | Mandatory The default statistic interval is 300s.

l The null interface does not support the function of configuring the statistics interval of the interface traffic.

Configure Adding or Reducing Interface Packet Statistics Length

In the compatibility test or actual application, the bandwidth calculation mode of the instrument or device connected to the local device may be different from the local device. We can configure the interface packet statistics length to modify, so as to keep consistent.

Table 1‑9 Configure adding or reducing the interface packet statistics length

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure adding or reducing the interface packet statistics length | packet account length { add | subtract } length | Mandatory By default, do not configure adding or recuding the packet statistics length on the interface.


1.2.2 Configure Interface Group Functions

Bind multiple interfaces as one interface group. Configuring various interface commands on the interface group is equivalent to configuring on all interfaces of the interface group, while it is not necessary to configure on each interface repeatedly. Display the information of one interface group is to display the information of all interfaces in the interface group.

Configuration Condition

Before configuring the interface group function, first complete the following task:

l The interfaces covered by the interface group should already exist.

Configure Interface Group

Table 1‑10 Configure the interface group

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the interface group in the enumeration mode | interface group group-id enum interface-name1 interface-name2 … interface-nameN [ point-to-point | multipoint ] | Mandatory By default, the interface group is not created.
Enter the global configuration mode | exit | -
Create the interface group in the specified scope | interface group group-id range | start-interface-name end-interface-name [ point-to-point | multipoint ] | Mandatory By default, the interface group is not created.

l The interface types in the interface group should be the same. The user can configure multiple interface groups as desired.

l The user can configure the commands supported by all types of interfaces in the interface group, but if the interfaces covered by the interface group do not support, the commands do not take effect and there may be no error prompt. Please check whether the commands take effect by viewing the configuration.

l If the interface group covers the logical interface and when the logical interface is deleted, the logical interface in the interface group is also deleted automatically.


1.2.3 Configure Interface Status SNMP Proxy Concerned Layer

In fact, the interface UP/DOWN status has two layers of status in the system. One is the L2 link layer status and the other is L3 protocol layer status. You can adopt the show ip interface brief command to view. Usually, the two states vary with the physical interface UO/DOWN, but when configuring keepalive gateway on the Ethernet interface, the L3 prototcol layer status is controlled by the keepalive detection status.

If the SNMP proxy function is enabled on the device, the network management server can get the interface status information via the public mib. If SNMP Trap is enabled, the interface status change information can be sent to the network management server.

With the function command, you can set the SNMP proxy concerned interface status layer. By default, the SNMP procy concerned interface status layer is L2 link layer, but to make the interface status displayed by the network management server be consistent with the keepalive detection status when keepalive gateway is configured on the Ethernet interface, it is necessary to set the SNMP proxy concerned interface status is the L3 protocol layer. Therefore, in the environment enabled with keepalive detection (such as MSTP WAN line environment), it is suggested to configure link-status-care l3.

Configuration Condition

None

Table 1‑11 Configure the interface status SNMP proxy concerned layer

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the network management layer of the interface status | link-status-care { l2 | l3 } | Mandatory By default, the interface status SNMP proxy concerned layer is L2 link layer.
Exit the global configuration mode | exit | -


1.2.4 Basic Monitoring and Maintaining of Interfaces

Table 1‑12 Basic monitoring and maintaining of interfaces

Command | Description
clear interface interface-name | Clear the statistics information of the master interfaces and subinterfaces
clear interface interface-name original statistics | Clear the statistics information of the master interfaces
clear interface group group-id | Clear the statistics information of all interfaces in the interface group
show interface [ interface-name ] | Display the statistics information of the master interfaces and subinterfaces
show interface group group-id | Display the interface group information
show interface interface-name original statistics | Display the statistics information of the mater interfaces
show interface statistics [ input | output ] | Display the bit rate, bytes, packets and bandwidth utilization statistics information of all interfaces
show running-config current-mode | Display the current interface configuration information


2 Ethernet Interface


2.1 Overview

Ethernet adopts the CSMA/CD media access mechanism, enabling any workstation to access the network at any time. Before transmitting data, the workstation first monitors whether the network is available. If no data is transmitted on the network, the workstation sends the information to be transmitted to the network. Ethernet, characterized with highly flexible, relatively simple, and easy to realize, currently has become a most important network technology.

Gigabit Ethernet, as a high-speed Ethernet technology, provides an efficient solution for improving the core network. The biggest advantage of this solution lies in that it inherits cost effective character of the traditional Ethernet technology. The gigabit Ethernet adopts the same frame format, frame structure, network protocol, full-/half-duplex work mode, flow control mode, and wiring system as the 10 M Ethernet. The gigabit Ethernet does not change the desktop application, operating system, application programs, and network management components of the traditional Ethernet, therefore it can be perfectly compatible with the 10 M/100 M Ethernet and protect the investment to a large extent. In addition, the IEEE standard supports the multimode fiber with a maximum distance of 550 m, single mode fiber with a maximum distance of 70 km, and coaxial cable with a maximum distance of 100 m. The gigabit Ethernet fills the gap of the 802.3 Ethernet/fast Ethernet standards.

The ten gigabit Ethernet standard is contained in the complementary standard IEEE 802.3ae of the IEEE802.3. It extends the IEEE 802.3 protocol and MAC standard, enabling them to support the 10 Gb/s transmission rate. In addition, through the WIS (WAN interface sublayer), the 10 gigabit Ethernet can be adjusted to a low transmission rate, which requires that the transmission format of the 10 gigabit Ethernet device and of the SONET (synchronous optic network) STS -192c are compatible.

The Ethernet interfaces are classified into L2 Ethernet interface and L3 Ethernet interface.

Ethernet interface, also called L2 Ethernet interface or port, is a physical interface. It works at layer 2 in the OSI reference model-data link layer. It is mainly used to execute two basic operations:

Data frame forwarding: According to the MAC address (that is physical address) of the data frame, forward the data frame. Ethernet interface can only perform the L2 switching forwarding for the received packets, that is, can only receive and send the packets whose source IP and destination IP are at the same segment.

MAC address learning: Construct and maintain the MAC address table, used to support forwarding the data frames.

L3 Ethernet interface works at layer 3 in the OSI reference model-network layer. It configures the IP address, handles the L3 protocol, and provides the routing function.

According to the maximum rate supported by the port, the ports can be divided to the following three types:

Fastethernet: 100M port, can be abbreviated as Fa, such as gigabitethernet0/0 or Fa0/1;

Gigabitethernet: 1000M port, can be abbreviated as Gi, such as gigabitethernet0/25 or Gi0/25;

Tengigabitethernet: 10 Gigabit port, can be abbreviated as Te, such as tengigabitethernet1/1 or Te1/1.

According to the media type of the port, the port type can be divided to copper (electrical port) and fiber (optical port).

L2 Ethernet interface and L3 Ethernet interface differ in functions, resulting in different configuration modes. L2 Ethernet interface and L3 Ethernet interface correspond to L2 Ethernet configuration mode and L3 Ethernet configuration mode, respectively.


2.2 Ethernet Interface Function Configuration

Table 2‑1 Function configuration list of Ethernet interface

Configuration Task
Configure basic functions of Ethernet interface | Configure the rate and duplex mode
 | Configure the switching of Ethernet interface fiber and electrical modes
Configure features of L3 Ethernet interface | Configure the MAC address of the Ethernet interface
 | Configure the automatic negotiation of the Ethernet interface fiber mode
Configure features of L2 Ethernet interface | Enter the L2 Ethernet interface configuration mode
 | Enter the batch configuration mode of L2 Ethernet interface
 | Configure the port MDIX (Media Dependent Interface Crossover) mode
 | Configure the port media type
 | Configure the head-of-line blocking
 | Configure the port flow control
 | Configure the delay time
 | Configure automatic energy-saving of the port
 | Configure the status flap detection of the port
 | Enable port loopback test
 | Configure the storm suppression parameter
 | Configure the action executed after the storm suppression
 | Configure the UNI/NNI attribute of the port
 | Configure the uni port connectivity


2.2.1 Configure Basic Functions of Ethernet interface

Configuration Condition

None

Configure Rate and Duplex Mode

The interface rate can be set in the following two methods:

One is to set the fixed rate according to the port rate capability set. The optional parameters include 10 (10M), 100 (100M), 1000 (1000M), 10000 (10000M), 40000 (40000M).

The other is to set the rate as auto (auto-negotiation), specifying that the rate is negotiated by the local end and the peer port.

Similarly, the port duplex mode can be set in the following two methods:

One is to set the duplex mode according to the capability set of the port duplex mode. The optional parameters include full (full-duplex mode), indicating that the port can send packets when receiving the packets; half (half-duplex mode), indicating that the port can only receive or send packets at one moment, but cannot perform at the same time;

The other is to set the duplex mode as auto (auto-negotiation), indicating that the duplex mode is negotiated automatically by the local end and the peer port.

Table 2‑2 Configure the rate and duplex mode of the port

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Either After entering the interface configuration mode, the follow-up configuration can take effect only on the current interface. After entering the interface configuration mode, the follow-up configuration can take effect only on the current port.
Enter the L2 Ethernet interface configuration mode | interface interface-name
Configure the port rate | speed { 10 | 100 | 1000 | 10000 | 40000 | auto } | Mandatory By default, the port rate is set to auto.
Configure the duplex mode of the port | duplex { auto | full | duplex } | Mandatory By default, the duplex mode of the port is set to auto.

Configure Switching of Ethernet Fiber and Electrical Modes

Table 2‑3 Configure the switching of Ethernet fiber and electrical modes

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Either After entering the interface configuration mode, the follow-up configuration can take effect only on the current interface. After entering the interface configuration mode, the follow-up configuration can take effect only on the current port.
Enter the L2 Ethernet interface configuration mode | interface interface-name
Configure the interface media type | media-type { auto | copper | fiber } | Mandatory By default, the media type of the electrical port is copper, the media type of the optical port is fiber, and the media type of the Combo port is copper.


2.2.2 Configure Features of L2 Ethernet Interface

Enter the L2 Ethernet Interface Configuration Mode

To configure on the specified port, first enter the L2 Ethernet interface configuration mode of the port and then execute the corresponding configuration command.

Table 2‑4 Enter the L2 Ethernet interface configuration mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Mandatory

l The naming rule of the port number is S/P (Slot/Port). Slot indicates the slot on the device, numbered from 0. If there is fixed port, slot 0 is reserved for the fixed port. The service slot is numbered from 1. Port indicates the physical port on the device or service card. The port on each device and service card is numbered from 0.

l The naming rule of the port name interface-name is port type + port number. For example, gigabitethernet0/0 indicates the fixed port numbered 1 and the type is 1000 M port.

Enter Batch Configuration Mode of L2 Ethernet Interface

When performing the same configuration on multiple ports, to improve the configuration efficiency and reduce the repeated steps, select entering the batch configuration mode of the L2 Ethernet interface, including the following three cases: single port, such as gigabitethernet 0/1; successive ports, using “-” to indicate one section of successive ports, such as gigabitethernet 0/3-0/4, indicating port 0/3, 0/4; that is, include single port and successive ports, using comma to separate, such as “gigabitethernet0/1, 0/3-0/4”, indicating port 0/1, 0/3, 0/4.

Table 2‑5 Enter the batch configuration mode of the L2 Ethernet interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the batch configuration mode of the L2 Ethernet interface | interface interface-list | Mandatory

Configure Port MDIX Mode

We can send and receive signals only after connecting the local end and the peer port. Therefore, the MDIX mode is used with connection cables.

The cables connecting ports are divided to two types: straight-through cable and crossover cable. To support the two types of cables, provide three kinds of MDIX modes: normal, cross, and auto.

The optical port can only support straight-through cable. Therefore, MDIX mode can only be set as normal.

The electrical port is formed by eight pins. You can change the roles of the pins by setting the MDIX mode. When setting as normal, use pin 1 and 2 to send signals, and pin 3, 6 to receive signals; when setting as cross, use pin 1, 2 to receive signals, pin 3, 6 to send signals; when setting as auto, the local and peer electrical ports automatically negotiate the functions of the pins by connecting the cables.

When using the straight-through cable, the MDIX modes of the local and peer ports cannot be the same.

When using crossover cable, the MDIX modes of the local and peer ports should be the same or at least one is auto.

Table 2‑6 Configure port MDIX mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | -
Configure the mode of receiving and transmitting signal via the network cable | mdix { auto | cross | normal } | Mandatory By default, the MDIX mode of the electrical port is set to auto and the MDIX mode of the optical port is set to normal.

Configure Port Flow Control

When the sending or receiving buffer is full and if the duplex mode of the port is half-duplex, send the blocking signals back to the source end by the back pressure mode; if the duplex mode of the port is full-duplex mode, the port informs the source end to stop sending by the flow control mode.

Table 2‑7 Configure the port flow control

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | -
Configure the port flow control | flowcontrol { on | off } | Mandatory By default, the flow control function of the port is disabled.

l The local flow control can be realized only when the local and peer ends both enable the flow control function.

Configure Delay Time

When the port changes from Up to Down, first enter the set suppression time period and the switching of the port status is not felt by the system; and then after the set suppression time, report the port status change to the system. In this way, we can avoid the unnecessary running cost caused by the frequent switching of the ports status in short time.

Table 2‑8 Configure delay time

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | -
Configure the delay time | link-delay link-delay-value | Mandatory By default, the delay report time of the port changing from Up to Down is 0, that is, disable the delay report function; when the port changes from Up to Down, report and process immediately.

Configure Port Status Flap Detection

When the port changes from Down to Up and if the port status flap detection is configured and it meets the detection condition, it is regarded that the status flap happens to the specified port or called Link-Flap and the port is automatically disabled and set as Error-Disabled.

Table 2‑9 Configure the port status flap detection

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the port status flap detection | errdisable flap-setting cause link-flap max-flaps max-flaps-number time time-value | Mandatory By default, the trigger condition of executing Link-Flap is within 10s. the detected port becomes Up for at least 5 times.

l When the port is disabled by the Link-Flap function and set as Error-Disabled and if it is necessary to recover automatically, you can configure the command errdisable recovery causeto set the above function.

Configure Storm Suppression Parameters

Limit the broadcast, multicast or unknown unicast traffic on the port by configuring the storm suppression parameters. When the broadcast, multicast and unknown unicast traffic on the port exceeds the set threshold, the system drops the excessive packets, so as to make the proportion of the broadcast and unknown unicast traffic on the port reduce to the limited range and ensure the normal running of the network services.

Table 2‑10 Configure the storm suppression parameters

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | -
Configure the storm suppression parameters | storm-control bps bps-value | Mandatory By default, the port storm suppression parameters are not configured.
l storm-control bps bps-valu supports suppressing the total traffc of the unknown unicast and broadcast packets.

Configure Port UNI/NNI Type

Uni port is the connection port between the user device and network; nni port is the connection interface between networks. On one device, the nni port and uni port or nni ports are interconnected; uni ports are separated from each other.

Table 2‑11 Configure the UNI/NNI attribute of the port

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | -
Configure the UNI/NNI attribute of the port | port-type { nni | uni } | Mandatory By default, the UNI/NNI type of the port is nni.

Configure Connectivity of uni Port

By default, all uni ports of one device are separated from each other. However, to realize the intercommunication between the specified multiple uni ports, but not change the separation relation between these uni ports and other uni ports, you can configure the connectivity of the uni port.

When configuring the connectivity on the specified uni port, you can only set whether the uni port can forward packets to other uni ports, not affecting whether other uni ports can forward packets to the specified uni port. Therefore, to realize the intercommunication among multiple uni ports, you should configure as community on these uni ports respectively.

Table 2‑12 Configure the connectivity of uni port

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | -
Configure the connectivity of uni port | uni-isolate { community | isolated } | Mandatory By default, the uni port cannot forward packets to other uni ports.

l The command can only take effect on the uni port.


2.2.3 Ethernet Interface Monitoring and Maintaining

Table 2‑13 Ethernet interface monitoring and maintaining

Command | Description
clear interface { interface-list | switchport } statistics | Clear the packet and traffic statistics information of the port
clear interface interface-name | Clear the statistics information of the specified L3 Ethernet interface
show errdisable flap-values | Display the current setting of triggering executing Link-Flap function
show interface { interface-list | switchport [ brief [ down | up ]] } | Display all information or abstract information of the Ethernet interface or virtual switch link member port
show interface interface-list statistics | Display the packet and traffic statistics information of the port
show interface switchport statistics [ packet | rate ] | Display the packet and traffic statistics information of all ports on the device
show port-type [ interface-list | { uni | nni } [ interface interface-list ] ] | Display the UNI/NNI attribute information of the port


2.3 Typical Configuration Example of Ethernet Interface


2.3.1 Configure Storm Suppression Function

Network Requirements

l Configure the storm suppression function on the port of Device to suppress the total packets, realizing that PC2 can access Internet normally when PC1 sends lots of broadcast and unknown unicast packets.

Network Topology

Figure 2‑1 Networking of configuring storm suppression

Configuration Steps

Step 1:

Configure VLAN and port link type on Device.

#Create VLAN2 on Device.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

#Configure the link type of port gigabitethernet0/0 and gigabitethernet0/1 on Device as Access, permitting the services of VLAN2 to pass.

Device(config)#interface gigabitethernet0/0,0/1gigabitethernet 0/0,0/2

Device(config-if-range)#switchport mode access

Device(config-if-range)#switchport access vlan 2

Device(config-if-range)#exit

#Configure the link type of port gigabitethernet0/2 on Device as Trunk, permitting the services of VLAN2 to pass.

Device(config)#interface gigabitethernet0/2

Device(config-if-gigabitethernet0/2)#switchport mode trunk

Device(config-if-gigabitethernet0/2)#switchport trunk allowed vlan add 2

Device(config-if-gigabitethernet0/2)#exit

Step 2:

Configure the storm suppression function

#Adopt bps limitation mode to suppress the packets on port gigabitethernet0/0and the suppression rate is 1024 kbps.

Device(config)#interface gigabitethernet 0/0

Device(config-if-gigabitethernet0/0)#storm-controlgigabitethernet0/0 bps 1024

Device(config-if-gigabitethernet0/0)#exitgigabitethernet0/0gigabitethernet0/0gigabitethernet0/0

Step 3:

Check the result

#View the storm suppression information of port gigabitethernet 0/1 on Device.

Device#show interface gigabitethernet 0/0gigabitethernet 0/0

gigabitethernet0/0 configuration information

Description :

Status : Enabled

Link : Up

Set Speed : Auto

Act Speed : 1000

Def Speed : Auto

Set Duplex : Auto

Act Duplex : Full

Def Duplex : Auto

Set Flow Control : Off

Act Flow Control : Off

Mdix : Auto

Mtu : 2000

Port mode : LAN

Port ability : 10M HD,10M FD,100M HD,100M FD,1000M FD

Link Delay : No Delay

Storm Control : Unicast Disabled

Storm Control : Broadcast Disabled

Storm Control : Multicast Disabled

Storm Control : All Bps 1024

Storm Action : None

Port Type : Nni

Pvid : 1

Set Medium : Copper

Act Medium : Copper

Mac Address : 0001.7ac9.6924

#When PC1 sends lots of broadcast and unknown unicast packets, PC2 also can access Internet normally.


3 Aggregation Group Interface


3.1 Overview

Aggregation group interface is one logical interface. When enabling the link aggregation function on multiple ports, the multiple ports with the same link aggregation feature form the aggregation group and are abstracted to aggregation group interface; meanwhile, the multiple ports with the same attribute are called the member ports of the aggregation group. It is mainly used to expand the link bandwidth and improve the connection reliability.


3.2 Aggregation Group Interface Function Configuration

Table 3‑1 Function configuration list of aggregation group interface

Configuration Task

Configure the basic functions of the aggregation group interface

Enter the aggregation group configuration mode


3.2.1 Configure Basic Functions of Aggregation Group Interface

Configuration Condition

None

Enter the aggregation group configuration mode

Table 3‑2 Enter the aggregation group configuration mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id | Mandatory

l Before entering the specified aggregation group configuration mode, first create the corresponding aggregation group.


3.2.2 Aggregation Group Interface Monitoring and Maintaining

Table 3‑3 Monitoring and maintaining of aggregation group interface

Command | Description
clear link-aggregation link-aggregation-id statistics | Clear the packet and traffic statistics information of the specified aggregation group
show link-aggregation [ link-aggregation-id | brief ] | Display all information of the aggregation group
show link-aggregation link-aggregation-id statistics | Display the packet and traffic statistics information of the specified aggregation group
show port-type link-aggregation link-aggregation-id | { uni | nni } link-aggregation link-aggregation-id | Display the UNI/NNI attribute information of the specified aggregation group


4 VLAN Interface


4.1 Overview

VLAN interface is one logical interface, used to be bound with VLAN and complete the packet forwarding between different VLANs. One VLAN can only be bound to one VLAN interface. One VLAN interface also can only be bound with one VLAN.


4.2 VLAN Interface Function Configuration

Table 4‑1 VLAN interface function configuration list

Configuration Task

Configure the basic functions of the VLAN interface

Configure VLAN interface


4.2.1 Configure VLAN Interface

Configuration Condition

None

Configure VLAN Interface

Table 4‑2 Configure the VLAN interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the VLAN interface | interface vlan vlan-id | Mandatory By default, the VLAN interface is not configured.

l There is no order requirement for creating VLAN interface, creating VLAN and adding physical port to VLAN.

l For how to create a VLAN and add the physical port to the VLAN, refer the VLAN chapter in the configuration manual.


4.2.2 VLAN Interface Monitoring and Maintaining

Table 4‑3 VLAN interface monitoring and maintaining

Command | Description
clear interface vlan vlan-id | Clear the statistics information of the specified VLAN interface
show interface vlan vlan-id | Display the information of the specified VLAN interface
show interface vlan vlan-id original statistics | Display the statistics information of the specified VLAN interface


4.3 Typical Configuration Example of VLAN Interface


4.3.1 Configure VLAN Interface

Network Requirements

l Configure the VLAN interface on Device to realize the intercommunication between PC1 and PC2 of different VLANs.

Network Topology

Figure 4‑1 Networking of configuring VLAN interface

Configuration Steps

Step 1:

Configure VLAN and port link type on Device.

# Create VLAN2 and VLAN3 on Device.

Device#configure terminal

Device(config)#vlan 2-3

# Configure the link type of port gigabitethernet0/0 and gigabitethernet0/1 on Device as Access. Port gigabitethernet0/0 permits the services of VLAN2 to pass and gigabitethernet0/1 permits the services of VLAN3 to pass.

Device(config)#interface gigabitethernet 0/0

Device(config-if-gigabitethernet0/0)#switchport mode access

Device(config-if-gigabitethernet0/0)#switchport access vlan 2

Device(config-if-gigabitethernet0/0)#exit

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#switchport mode access

Device(config-if-gigabitethernet0/1)#switchport access vlan 3

Device(config-if-gigabitethernet0/1)#exit

Step 2:

Configure the VLAN interface and IP address on Device.

# Create VLAN2 interface on Device whose IP address is 1.1.1.1 and subnet mask is 255.255.255.0; create VLAN3 interface whose IP address is 2.1.1.1 and subnet mask is 255.255.255.0.

Device(config)#interface vlan 2

Device(config-if-vlan2)#ip address 1.1.1.1 255.255.255.0

Device(config-if-vlan2)#exit

Device(config)#interface vlan 3

Device(config-if-vlan3)#ip address 2.1.1.1 255.255.255.0

Device(config-if-vlan3)#exit

Step 3:

Check the result.

#View the information of VLAN interface on Device.

Device#show interface vlan 2

vlan2:

line protocol is up

Flags: (0xc008063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 1.1.1.1/24

Broadcast address: 1.1.1.255

Queue strategy: FIFO , Output queue: 0/1 (current/max packets)(0)

Metric: 0, MTU: 1500, BW: 100000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0045.1023.0032

5 minutes input rate 0 bits/sec, 0 packets/sec

5 minutes output rate 0 bits/sec, 0 packets/sec

0 packets received; 1 packets sent

0 multicast packets received

1 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

Device#show interface vlan 3

vlan3:

line protocol is up

Flags: (0xc008063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 2.1.1.1/24

Broadcast address: 2.1.1.255

Queue strategy: FIFO , Output queue: 0/1 (current/max packets)(0)

Metric: 0, MTU: 1500, BW: 100000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0045.1023.0032

5 minutes input rate 0 bits/sec, 0 packets/sec

5 minutes output rate 0 bits/sec, 0 packets/sec

0 packets received; 1 packets sent

0 multicast packets received

1 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

#PC1 can ping PC2.


5 4G Interface


5.1 4G Overview

4G is short for 4th Generation. It is evolved from the the third generation communication technology, that is, LTE (Long Term Evolution). The importing of various core technologies, such as OFDM (Orthogonal Frequency Division Multiplexing) and MIMO (Multiple Input Multiple Output), improves the communication efficiency and transmission rate in the LTE network. With the advantages of high bandwidth, high rate and low delay, LTE brings better data transmission service for the wireless communication. It will also bring more revolutionary change, such as VoLTE (Voice over LTE) and MBMS (Multimedia Broadcast Multicast Service).

LTE mainly has two mainstream network modes, that is, LTE-TDD and LTE-FDD. LTE-TDD mainly adopts the Time Division Multiplexing technology and the main advantage is that the uplink and downlink rate can be adjusted by configuring the uplink and downlink timeslot ratio. It has high utilization for the fragmental bands, applicable to the asymmetrical transmission services. The disadvantage is the poor immunity. LTE-FDD mainly adopts the Frequency Division Multiplexing technology. The uplink and downlink transmission adopts different bands to ensure the stability of the communication rate and strong immunity. The disadvantage is the low band utilization. In the 20M spectrum bandwidth, the LTE uplink and downlink theoretical rates are 50Mb/s, 100Mb/s respectively. With the updating of the LTE technology, the rate is also improved continunously.

With the evolution of the mobile communication technology, the network difference is gradually reduced, bringing more colorful services for the user.


5.1.1 4G Application Scenario

The data communications in the 4G wireless network is available when the 4G communication modules, such as a USB adapter and 3G board card, are inserted into the device. If there is no 4G network or the 4G network coverage is not stable, the module can switch to 2G/3G network. The specific application scenario is shown in the following figure.

Figure 5‑1 4G application scenario

Viewing from the preceding figure, the device achieves the wireless communication with the operator base station via the 4G communication modules and achieves data interaction with the WAN finally via the operator. Different 4G communication modules and different SIM cards determine different operators and different network modes. However, viewing from the overall application scenario, the data communications methods differ slightly.


5.2 4G Function Configuration

Table 5‑1 4G configuration list

Configuration Task
Configure the 4G dialing access point | Configure the APN dialing access point
Configure the 4G dialing parameters | Configure the user name and password
 | Configure the authentication type
Configure the SIM card safety function | Enable the PIN code function
 | Authenticate the PIN code manually
 | Authenticate the PIN code automatically
 | Modify the PIN code
 | Unblock the PIN code
 | Configure IMSI binding function
Select the network mode | Seelect the forced mode
 | Select the auto mode
Configure the multi-account dialing function | Configure the multi-account dialing function
配置拨号连接等待超时时间 | 配置拨号连接等待超时时间
配置system id与username绑定 | 配置system id与username绑定


5.2.1 Configure 4G Dialing Access Point

The APN access point name is provided by the carrier. During dialing, the carrier determines the accessed server and sets up the data connection by resolving the access point name.

Configuration Condition

The carrier needs to support the APN avvess function.

Configure Dialing Access Point

Configure the dialing access point according to the dialing requirement of the carrier, mainly setting the accesse server name.

Table 5‑2 Configure the dialing access point

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure the 4G dialing access point | dialer config apn apn-name | Optional By default, apn-name is CMNET.


5.2.2 Configure 4G Dialing Parameters

The carrier determines the access server, authenticates and sets up the connection by resolving the user name and password.

The authentication type configuration of the 4G interface needs to be consistent with that of the server.

Configuration Condition

The carrier needs to support the access function via the user name and password.

Configure Dialing User Name and Password

Configure the user name and password according to the dialing requirement of the carrier.

Table 5‑3 Configure the dialing user name and password

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure the 4G dialing user namd and password | dialer config username user-name password pwd | Optional By default, user-name is card and pwd is card.

Configure Dialing Authentication Type

It needs to be consistent with the authentication type of the server. If the server does not need the authentication type, do not affect the dialing process after 4G interface configuration.

Table 5‑4 Configure dialing authentication type

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure the 4G dialing authentication type | dialer config authtype {chap | pap | pap_chap} | Optional By default, the authentication type is CHAP.


5.2.3 Configure SIM Card Safety Function

SIM card safety function mainly provides PIN code protection and IMSI binding, protecting the right of using the 4G module.

The SIM (subscriber identity module), also called the subscriber identity card, records the user identity data and information.

PIN (Personal Identification Number) code is the personal identity password of the SIM card. The PIN code is set to 1234 or 0000 by default. If the PIN code is enabled, a four-digit PIN code must be entered when powering on. The PIN code can be changed, which is used to protect your own SIM card from being used by others.

PUK (PIN Unlocking Key) is the unblocking code of the PIN code. When the SIM card is locked caused by entering wrong PIN code, you can unblock it using the PUK code.

A unique IMSI (International Mobile Subscriber ldentification Number) is allocated to every SIM card. This code is valid at any places including the roaming area on the network. The IMSI binding function binds the unique identifier of the SIM card with the slot number.

l When the PIN code is wrongly entered for three consecutive times, the SIM card will be locked. At this time, you can use the PUK code to unblock it. However, if the PUK code is wrongly entered for ten consecutive times, the SIM card will be locked permanently.

Configuration Condition

None

Enable PIN Code

The right of using the SIM card is protected by enabling the PIN code. You must enter the correct PIN code to use the SIM card.

Table 5‑5 Enable the PIN code

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure the 4G PIN code protect | pin-code pin-enable pin code | Mandatory By default, do not enable the PIN code protect function.

Authenticate PIN Code Manually

PIN code manual authentication means PIN code authentication by entering the command manually every time.

Table 5‑6 Authenticate the PIN code manually

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure the 4G PIN code authentication | pin-code pin-check pin code | Mandatory By default, do not configure the manual authentication PIN code.

Authenticate PIN Code Automatically

In the PIN code automatic authentication mode, the PIN code is verified by presetting the PIN code. The user only needs to configure the PIN code for one time and the device will use the configured PIN code for authentication.

Table 5‑7 Authenticate the PIN code automatically

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure the 4G auto authentication PIN code function | pin-code pin-check auto pin code | Mandatory By default, do not configure the auto authentication PIN code.

Change PIN Code

Changing the PIN code allows the new PIN code set by the user. After the PIN code is changed, the new PIN code is used for authentication.

Table 5‑8 Change the PIN code

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Change the 4G PIN code | pin-code pin-change pin code new pin code | Mandatory By default, do not change the PIN code.

Unblock PIN Code

If the SIM card is locked by entering the wrong PIN code for three consecutive times, the user can enter the PUK code to unblock it and set new PIN code.

Table 5‑9 Unblock the PIN code

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Unlock and set the new PIN code via the PUK code | pin-code puk-check puk code pin code | Mandatory By default, do not configure the unblock PIN code

Configure IMSI Binding Function

The user can specify the SIM card to the 3G communication module in the fixed slot by the IMSI binding function, and the 3G communication modules in other slots cannot use the SIM card. This function is only available for this device.

Table 5‑10 Configure the IMSI binding function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Perform the IMSI binding for the specified 4G interface SIM card | dialer condition imsi-band { current-imsi | imsi } | Mandatory By default, do not enable the IMSI binding function


5.2.4 Select Network Mode

The optional network configuration modes provided by the deivce include auto mode, LTE mode, WCDMA mode, TD-SCDMA, and CDMA mode. The auto mode indicates that the module automatically adapts to the current network and performs the network switching according to the preferred mode automatically. The other modes are the forced modes, which are used when the 4G signal coverage is stable in the customer scenario and the user has the specified requirement for the rate. Usually, the auto mode is recommended.

Configuration Condition

None

Select Network Mode

The user can configure as desired.

Table 5‑11Select network mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure the network selecting mode | dialer condition mode { auto | lte | wcdma | tdscdma | cdma} | Optional By default, enable the auto mode.


5.2.5 Configure Multi-account Dialing Function

The multi-account dialing function is mainly used: In the auto dialing mode, when the default dialing configuration in the 4G interface fails to dial in the set time, automatically switch to multi-account list. The carrier needs to support the function.

Configuration Condition

None

Configure Multi-account List

To create the multi-account list, configure the desired dialing parameter.

Table 5‑12 Configure the multi-account list

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the sub list configuration mode | multi-dialer multi-list-name | multi-list-name: Up to 10 lists can be configured. The length of the list name cannot exceed 20.
Enter the sub item configuration mode | config-list list-id | list-id: optional value 1-2
Configure the dialing parameter sub item | apn apn-name username user-name password pwd authtype {chap | pap | ap_chap} | Optional By default, do not configure.

Configure 4G Interface to Associate with Multi-account List

The default dialing configuration in the interface is still the preferred dialing configuration. After configuring the 4G interface to associate with the multi-account list, the created multi-account list can take effect.

Table 5‑13 Configure the 4G interface to associate with the multi-account list

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure the 4G interface to associate with the multi-account list | multi-dialer multi-list-name | Optional By default, do not configure the 4G interface to associate with the multi-account list


5.2.6 Configure Wait Timeout of Dialing Connection

The configuration depends on the wireless communication link quality, the time of the carrier distributing the bandwidth resource, and so on. For example, when the link communication quality is poor, the carrier is distributing the IP adderss for the 4G device, and the device actively disconnects the dialing request because waiting for getting the IP address times out, you can adjust the wait timeout parameter reasonably to improve the probability of dialing success.

Configuration Condition

No

Configure Wait Timeout of Dialing Connection

The user configures the wait timeout of dialing connection according to the actuality.

Table 5‑14 Configure the wait timeout of dialing connection

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure the wait timeout of dialing connection | dialer condition connect-time time | Optional The unit of time is second, the value range is 10-90, and the default value is 30.


5.2.7 Configure Dynamically Switching 4G to 3G

4G is online for a long time, and as a result, lots of lns resources are occupied. The configuration can auto switch to 3G mode when being idle or the interface is shutdown, so as to release the resource.

Configuration Condition

No

Configure Dynamically Switching 4G to 3G

The user configures dynamically switching 4G to 3G according to the actuality.

Table 5‑15 Configure dynamically switching 4G to 3G

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure dynamically switching 4G to 3G | dialer condition disconnect standby | Optional standby is the mode after switching to 3G, standby-cdma, standby-tdscdma, and standby-wcdma.


5.2.8 Configure Binding system id with username

The configuration can bind the system id of the device with the dialing parameter username.

Configuration Condition

No

Configure Binding system id with username

The user can configure binding the system id with user name according to the actuality.

Table 5‑16 Configure binding the system id with user name

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the 4G interface mode | interface fastcellular interface-name | -
Configure binding the system id with user name | dialer condition sysid-band | Mandatory By default, do not bind the system id with username.


5.2.9 Configure 4G Dialing Mode

4G only supports the NDIS dialing mode, so the configuration can make 4G support PPP and NDIS modes at the same time.

Configuration Condition

Only support the backpanel 4G card. It can be configured when the card is loaded successfully.

Configure 4G Dialing Mode

Table 5‑17 Configure the 4G dialing mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the 4G NDIS dialing mode | cellular 1 dial-mode NDIS | The interface name is fastcellular1 in NDIS.
Configure the 4G PPP dialing mode | cellular 1 dial-mode PPP | The interface name is cellular1 in PPP.


5.2.10 4G Monitoring and Maintaining

Table 5‑18 The 4G monitoring and maintaining

Command | Description
show fastcellular interface-name { phyinfo {all | hardware | network | profile | radio | security} | dialer condition } | Display the 4G module hardware information, net5work information, SIM card information of all interfaces, and the error statistics information related with dialing
show multi-list[multi-list-name] | Display the association, dialing status and current configuration content of the current backup dialing configuration list and interface


5.3 Typical Configuration Example of 4G Network


5.3.1 Typical Configuration Example of 4G Dialing on Demand

Network Requirements

l Device1 is connected to the specified private network environment via the dialing-on-demand mode.

l Device1 serves as the site device, the carrier device serves as LAC, and Device2 serves as LNS. Set up the L2TP tunnel between LAC and Device2.

Network Topology

Figure 6‑2 4G dialing-on-demand configuration view

Device | Interface | IP address | Device | Interface | IP address
Device1 | Vlan100 | 172.16.2.1/24 | Device2 | Loopback0 | 64.19.245.250 /24
AAA |  | 130.255.12.28/24 |  | Gi0 | 125.71.215.223/24
 |  |  |  | Gi1 | 26.1.1.1/24
 |  |  |  | Gi2 | 130.255.100.29/24

Configuration Steps

Step 1: | Configure the IP address and route of the interface (omitted).
Step 2: | Configure the 4G interface.

#Configure the dialing user name and password of Device1 4G interface fastcellular1. Configure the interface as the dial-on-demand mode, and get the IP address via DHCP.

Device1#configure terminal

Device1(config)#interface fastcellular1

Device1(config-if-fastcellular1)#dialer config username test@jsyh.vpdn.sc password 0 admin

Device1(config-if-fastcellular1)#dialer-group ip any

Device1(config-if-fastcellular1)#ip address dhcp

Device1(config-if-fastcellular1)#exit

Step 3:

Configure the default route on Device1, and the egress interface is fastcellular1.

#Configure the default route of Device1.

Device1(config)#ip route 0.0.0.0 0.0.0.0 fastcellular1

l The 4G private network can be connected via the APN and domain name. The specific mode depends on the carrier. In the exmplae, use the domain name mode to access.

l If configuring the dialer mode auto command to enable the auto dialing on the 4G interface, do not need to trigger dialing via the data flow; if configuring the dialer-group ip any command to enable the dialing-on-demand on the 4G interface, it is necessary to trigger dialing via the data flow. You can select either of the two dialing modes according to the actual using.

l If configuring the dialer-group ip access-list [name]/[ number] command on the 4G interface, you can specify the interested traffic to trigger 4G interface dialing.

l Configure the dialer interval-time [time] command on the 4G interface, and you can modify the interval of the two dialings. The default value is 10s. It is recommended to use the default value.

l If configuring the command dialer idle-timeout 0 on the 4G interface, you can set the 4G line not to time out forever. The default timeout is 120s.

l If configuring the command ip dhcp router-option disable on the 4G interface to disable the function of DHCP adding the default route automatically, do not add the default route of the egress interface automatically after the 4G interface automatically dials successfully.

l If configuring the command ip address dhcp [A.B.C.D] on the 4G interface, you can specify the subnet mask length of the IP address got by the 4G interface.

Step 4:

Configure AAA.

#Configure Device2.

Use Radius to authenticate, name the authentication list, authorization list as ppp, and configure the Radius server address, authentication port, statistics port, Radius server password.

Device2#configure terminal

Device2(config)#aaa new-model

Device2(config)#aaa authentication ppp ppp radius none

Device2(config)#aaa authorization network ppp radius

Device2(config)#radius-server host 130.255.12.28 auth-port 1812 acct-port 1813 priority 0 key 0 a

Step 5:

Configure the L2TP tunnel.

#Configure Device2.

Configure the virtual template virtual-template 1.

Device2(config)#interface virtual-template 1

Device2(config-if-virtual-template1)#encapsulation ppp

Device2(config-if-virtual-template1)#ppp mtu adaptive proxy

Device2(config-if-virtual-template1)#ppp authentication chap ppp

Device2(config-if-virtual-template1)#ppp authorization ppp

Device2(config-if-virtual-template1)#ip unnumber loopback0

Device2(config-if-virtual-template1)#exit

Enable the VPDN function and configure the VPDN group.

Device2(config)#vpdn enable

Device2(config)#vpdn-group 1

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol l2tp

Device2(config-vpdn-acc-in)#virtual-template 1

Device2(config-vpdn-acc-in)#exit

Configure only accepting the L2TP connection request with hostname GGSNCD01 (optional).

Device2(config-vpdn)#terminate-from hostname GGSNCD01

Configure the L2TP tunnel authentication password. The password should be the same as the L2TP password provided by the carrier.

Device2(config-vpdn)#l2tp tunnel password admin

Step 6:

Check the result.

#On Device2, view the setup status of the L2TP tunnel with LAC.

Device2#show vpdn detail

L2TP MaxTun 6000, MaxSes 6000:

tunnel free num: 5999

TUNNELS:

LocID LocName RemID RemName RemAddr Vpdn Port Sess State

78 Router 78 GGSNCD01 115.169.201.159 1 1701 1 ESTAB

session free num: 1999

SESSIONS:

LocID TunID RemID IfName User SysId Imsi/calling-noState

30 78 386 virtual-access2 test1@jsyh.vpdn.sc - 460110500000920 ESTAB

L2TP total Tunnel and Session Information. Tunnel 1 Session 1

#After dialing successfully, the 4G interface of Device1 can get the IP address and the protocol is UP.

Device1#show interface fastcellular 1

Fastcellular1:

line protocol is up

Flags: (0xc208063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 64.19.245.249/30

Broadcast address: 64.19.245.251

Metric: 0, MTU: 1500, BW: 100000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.7ab8.d858

Last clearing of "show interface" counters never

input peak rate 596 bits/sec, 1 hour 58 minutes 8 seconds ago

output peak rate 715 bits/sec, 1 hour 58 minutes 8 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

618 packets received; 1807 packets sent

4 multicast packets received

29 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

Rate: auto Duplex: auto

rxframes 618, rx bytes 52160, rx arps 21

txframes 1807, tx bytes 308654, tx arps 25

rx errors 0, tx errors 0

#On Device1, ping the address of the virtual interface virtual-access2 on Device2, and view whether the ping can be connected.

Device1#ping 64.19.245.250

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 64.19.245.250 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 316/502/1066 ms.

Device1 can ping the address of the virtual interface virtual- access2 on Device2.


5.3.2 4G VPDN Typical Configuration Example

Network Requirements

l Device1 is connected to the specified private network environment via the domain name.

l Device1 serves as the site device, the carrier device serves as LAC, and Device2 serves as LNS. Set up the L2TP tunnel between LAC and Device2.

l Associate Track on the 4G interface of Device1, used to detect the link status between the site router and LNS.

Network Topology

Figure 5‑2 4G VPDN typical configuration view

Device | Interface | IP address | Device | Interface | IP address
Device1 | Vlan100 | 172.16.2.1/24 | Device2 | Loopback0 | 64.19.245.250 /24
AAA |  | 130.255.12.28/24 |  | Gi0 | 125.71.215.223/24
 |  |  |  | Gi1 | 26.1.1.1/24
 |  |  |  | Gi2 | 130.255.100.29/24

Configuration Steps

Step 1: | Configure the IP address and route of the interface (omitted).
Step 2: | Configure the 4G interface.

#Configure the dialing user name and password of Device1 4G interface fastcellular1. Configure the interface as the auto dialing mode and get IP adderss via DHCP.

Device1#configure terminal

Device1(config)#interface fastcellular1

Device1(config-if-fastcellular1)#dialer config username test@jsyh.vpdn.sc password 0 admin

Device1(config-if-fastcellular1)#dialer mode auto

Device1(config-if-fastcellular1)#ip address dhcp

Device1(config-if-fastcellular1)#exit

l The 4G private network can be connected via the APN and domain name. The specific mode depends on the carrier. In the exmplae, use the domain name mode to access.

Step 3:

Configure AAA.

#Configure Device2.

Use Radius to authenticate. The authentication list and authorization list are named as ppp. Configure the address, authentication port, statistics port, and Radius server password of the Radius server.

Device2(config)#aaa new-model

Device2(config)#aaa authentication ppp ppp radius none

Device2(config)#aaa authorization network ppp radius

Device2(config)#radius-server host 130.255.12.28 auth-port 1812 acct-port 1813 priority 0 key 0 a

Step 4:

Configure the L2TP tunnel.

#Configure Device2.

Configure the virtual template virtual-template 1.

Device2(config)#interface virtual-template 1

Device2(config-if-virtual-template1)#encapsulation ppp

Device2(config-if-virtual-template1)#ppp mtu adaptive proxy

Device2(config-if-virtual-template1)#ppp authentication chap ppp

Device2(config-if-virtual-template1)#ppp authorization ppp

Device2(config-if-virtual-template1)#ip unnumber loopback0

Device2(config-if-virtual-template1)#exit

Enable the VPDN function and configure the VPDN group.

Device2(config)#vpdn enable

Device2(config)#vpdn-group 1

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol l2tp

Device2(config-vpdn-acc-in)#virtual-template 1

Device2(config-vpdn-acc-in)#exit

Configure only accepting the L2TP connection request of the LAC with hostname GGSNCD01 (optional).

Device2(config-vpdn)#terminate-from hostname GGSNCD01

Configure the L2TP tunnel authentication password. The password should be the same as the L2TP password provided by the carrier.

Device2(config-vpdn)#l2tp tunnel password admin

View the L2TP tunnel setup status on Device2.

Device2#show vpdn detail

L2TP MaxTun 6000, MaxSes 6000:

tunnel free num: 5999

TUNNELS:

LocID LocName RemID RemName RemAddr Vpdn Port Sess State

78 Router 78 GGSNCD01 115.169.201.159 1 1701 1 ESTAB

session free num: 1999

SESSIONS:

LocID TunID RemID IfName User SysId Imsi/calling-noState

30 78 386 virtual-access2 test1@jsyh.vpdn.sc - 460110500000920 ESTAB

L2TP total Tunnel and Session Information. Tunnel 1 Session 1

After dialing successfully, the 4G interface of Device1 can get the IP address and the protocol is up.

Device1#show interface fastcellular 1/0

Fastcellular1/0:

line protocol is up

Flags: (0xc208063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 64.19.245.249/30

Broadcast address: 64.19.245.251

Metric: 0, MTU: 1500, BW: 100000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.7ab8.d858

Last clearing of "show interface" counters never

input peak rate 596 bits/sec, 1 hour 58 minutes 8 seconds ago

output peak rate 715 bits/sec, 1 hour 58 minutes 8 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

618 packets received; 1807 packets sent

4 multicast packets received

29 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

Rate: auto Duplex: auto

rxframes 618, rx bytes 52160, rx arps 21

txframes 1807, tx bytes 308654, tx arps 25

rx errors 0, tx errors 0

On Device1, ping the address of the virtual interface virtual-access2 on Device2 and view whether the ping can succeed.

Device1#ping 64.19.245.250

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 64.19.245.250 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 316/502/1066 ms.

Device1 can ping the address of the virtual interface virtual- access2 of Device 2.

Step 5:

Configure the 4G interface to associate with Track.

#On Device1, configure the ICMP-echo entity to detect the network connectivity from Device1 to Device2 and add the entity to the entity group. Schedule the RTP group 1.

Device1(config)#rtr enable

Device1(config)#rtr 1 icmpecho

Device1(config-rtr-icmpecho)#set 64.19.245.250 5 70 2 12

Device1(config-rtr-icmpecho)#exit

Device1(config)#rtr group 1

Device1(config-rtr-group)#member 1

Device1(config-rtr-group)#exit

Device1(config)#rtr schedule 1 group 1 start now ageout 100 life forever

Create Track to associate with SLA.

Device1(config)#track 1

Device1(config-track)#rtr 1

Device1(config-track)#exit

Associate Track1 on the 4G interface.

Device1(config)# interface fastcellular1/0

Device1(config-if-fastcellular1/0)#dialer track id 1

l For the SLA configuration, refer to the SLA chapter of the configuration manual.

Step 6:

Check the result.

When the link status between Device1 and Device2 is normal, view that the track status is up on Device1.

Device1#show track object

track 1

status = up

entnum = 1

logic operator AND

Object Type Status Refcnt instruction

------------------------- -------- ------ ----------------------------------------

rtr up 1 rtr 1

-------------------------------------------------------------------------------------

module priority caller

------------------------- -------- ------

NDISDDR 20 0xd56b88

-------------------------------------------------------------------------------------

#On Device1, view that the 4G interface status is UP and can get the IP address.

Device1#show interface fastcellular 1/0

Fastcellular1/0:

line protocol is up

Flags: (0xc208063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 64.19.245.249/30

Broadcast address: 64.19.245.251

Metric: 0, MTU: 1500, BW: 100000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.7ab8.d858

Last clearing of "show interface" counters never

input peak rate 596 bits/sec, 1 hour 58 minutes 8 seconds ago

output peak rate 715 bits/sec, 1 hour 58 minutes 8 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

618 packets received; 1807 packets sent

4 multicast packets received

29 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

Rate: auto Duplex: auto

rxframes 618, rx bytes 52160, rx arps 21

txframes 1807, tx bytes 308654, tx arps 25

rx errors 0, tx errors 0

When the link status between Device1 and Device2 is not normal, view that the track status is down on Device1. Here, make the 4G interface down and re-dial.


5.3.3 4G IP APN Typical Configuration Example

Network Requirements

l Device1 is connected to the specified private network environment via the APN.

l 4G router Device1 and Device2 use the IPSEC extended authentication to set up the IPsec tunnel, protecting the data between the PC1 network and Network-Center.

l IPsec proposed securitu protocol adopts ESP, IKE proposal and IPsec proposal encryption algorithm adopts 3DES; authentication algorithm adopts SHA1.

l Set up BFD echo multi-hop session between device1 and device2; detect the 4G link status between device1 and device2.

Network Topology

Figure 5‑3 4G IP APN typical networking

Device | Interface | IP address | Device | Interface | IP address
Device1 | Vlan100 | 172.16.2.1/24 | AAA Server |  | 130.255.12.28/24
Device2 | Gi0 | 125.71.215.223/24 |  |  |
 | Gi1 | 26.1.1.1/24 |  |  |
 | Gi2 | 130.255.100.29/24 |  |  |

Configuration Steps

Step 1: | Configure the IP address and route of the interface (omitted).
Step 2: | Configure the 4G interface.

#Configure Device1; configure 4G interface fastcellular1 as auto dialing mode and get IP adderss via DHCP automatically.

Device1#configure terminal

Device1(config)#interface fastcellular1/0

Device1(config-if-fastcellular1/0)#dialer mode auto

Device1(config-if-fastcellular1/0)#ip address dhcp

Device1(config-if-fastcellular1/0)#dialer config apn cdmptx.sc

Device1(config-if-fastcellular1/0)#exit

l The 4G private network can be connected via the APN and domain name. The specific mode depends on the carrier. In the exmplae, use the APN mode to access.

Step 3:

Configure AAA.

#Confgure Device2; use Radius to authenticate; the authentication list and accounting list are named as 4g; configure the Radius server address, authentication port, statistics port, and Radius server password.

Device2#configure terminal

Device2(config)#aaa new-model

Device2(config)#aaa authentication xauth 4g radius

Device2(config)#aaa accounting network 4g wait-start radius

Device2(config)#radius-server host 130.255.12.28 auth-port 1812 acct-port 1813 priority 0 key 0 a

Step 4:

Configure the IKE and IPsec proposal.

#Configure the IKE proposal ikepro on Device1, use the encryption algorithm 3DES and authentication algorithm SHA1; configure the IPsec proposal ippro, use ESP security protocol, use the encryption algorithm 3DES and authentication algorithm SHA1.

Device1(config)#crypto ike proposal ikepro

Device1(config-ike-prop)#encryption 3des

Device1(config-ike-prop)#exit

Device1(config)#crypto ipsec proposal ippro

Device1(config-ipsec-prop)#esp 3des sha1

Device1(config-ipsec-prop)#exit

#Configure the pre-share key on Device1 as admin and permit all peers to use the key.

Device1(config)#crypto ike key admin any

#Configure the IKE proposal ikepro on Device2, use the encryption algorithm 3DES and authentication algorithm SHA1; configure the IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES and authentication algorithm SHA1.

Device2(config)#crypto ike proposal ikepro

Device2(config-ike-prop)#encryption 3des

Device2(config-ike-prop)#exit

Device2(config)#crypto ipsec proposal ippro

Device2(config-ipsec-prop)#esp 3des sha1

Device2(config-ipsec-prop)#exit

#Configure the pre-share key on Device2 as admin and permit all peers to use the key.

Device2(config)#crypto ike key admin any

Step 5: | Configure the IKE ID alias.
 | #Configure the IKE ID aliad as 4g on Device2, apply the extended authentication list 4g, specify the extended authentication IMSI attribute and optional attribute, and apply the accounting list 4g. Device2(config)#crypto ike id alias 4g Device2(config)#authentication 4g authen_imsi optional Device2(config)#accounting 4g
Step 6: | Configure the IPsec tunnel.

#Configure the tunnel tun on Device1 to initiate the negotiation with the identity of the extended authentication client, use the 4G interface fastcellular1/0 as the local address of the tunnel, configure the peer address of the tunnel as 125.71.215.223, configure the authentication mode as the pre-share key authentication, IKE proposal uses ikepro, the IPsec proposal uses ippro, configure the extended authentication client user name as a and password as a, and enable auto initiating negotiation. On the AAA server, it is necessary to configure the IKE extended authentication user name, password, and IMSI information.

l The IMSI value of the AAA server is consistent with the IMSI value of the 4G interface.

Device1(config)#crypto tunnel tun

Device1(config-tunnel)#local interface fastcellular1/0

Device1(config-tunnel)#peer address 125.71.215.223

Device1(config-tunnel)#set authentication preshared

Device1(config-tunnel)#set ike proposal ikepro

Device1(config-tunnel)#set ipsec proposal ippro

Device1(config-tunnel)#set xauth-client user-name a password a

Device1(config-tunnel)#set auto-up

Device1(config-tunnel)#exit

#On Device2, configure the tunnel, use the address of the interface Gi0 125.71.215.223 as the local address of the tunnel, configure the peer address of the tunnel as any, the IKE proposal uses ikepro, the IPsec proposal uses ippro, and set the peer ID alias as 4g.

Device2(config)#crypto tunnel tun

Device2(config-tunnel)#local address 125.71.215.223

Device2(config-tunnel)#peer any

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#set peer-id alias 4g

Device2(config-tunnel)#exit

Step 7:

Configure the IPsec security policy.

#Configure Device1, configure the security policy policy1, protect the IP communication from network 172.16.2.0/24 to network 26.1.1.0/24, and associate the tunnel tun.

Device1(config)#crypto policy policy1

Device1(config-policy)#flow 172.16.2.0 255.255.255.0 26.1.1.0 255.255.255.0 ip tunnel tun

Device1(config-policy)#exit

#Configure Device2, configure the security policy policy1, protect the IP communication of any network, and associate the tunnel tun.

Device2(config)#crypto policy policy1

Device2(config-policy)#flow any any ip tunnel tunnel bypass

Device2(config-policy)#exit

Step 8:

Configure BFD.

#Configure Device1, configure BFD on the 4G interface fastcellular1, the remote IP address is 125.71.215.223, and the local IP address of the BFD is got from the 4G interface dynamically.

Device1(config)#interface fastcellular1

Device1 (config-if-fastcellular1)#dialer bfd remote-ip 125.71.215.223

Device1 (config-if-fastcellular1)#exit

#Configure Device2, and enable BFD on gigabitethernet 0.

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#bfd echo multihop local-ip 125.71.215.223

Device2(config-if-gigabitethernet0)#exit

Step 9:

Check the result.

#View the interface information of the 4G interface fastcellular1 on Device1.

Device1#show interface fastcellular1

fastcellular1:

line protocol is up

Flags: (0xc208063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 10.230.33.13/30

Broadcast address: 10.230.33.15

Metric: 0, MTU: 1500, BW: 1000000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.7adf.e997

Last clearing of "show interface" counters never

input peak rate 545 bits/sec, 0 hour 8 minutes 10 seconds ago

output peak rate 4028 bits/sec, 0 hour 1 minute 20 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 2000 bits/sec, 3 packets/sec

43 packets received; 1749 packets sent

6 multicast packets received

16 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

Rate: auto Duplex: auto

rxframes 43, rx bytes 4842, rx arps 3

txframes 1736, tx bytes 158030, tx arps 9

rx errors 0, tx errors 0

#View the BFD session information on Device1.

Device1#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

10.230.33.13 125.71.215.223 4/4 UP 90000 fastcellular3/0

#View the BFD session information on Device2.

Device2#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

125.71.215.223 0.0.0.0 4/4 DOWN 0 gigabitethernet0

l Currently, BFD only detects the lower-end device, so the upper Device2 session status is always DOWN.

#View the IPsec tunnel information on Device1.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

2128 STATE_XAUTH_C2 10.230.33.13 125.71.215.223 125.71.215.223

2129 STATE_QUICK_I2 10.230.33.13 125.71.215.223 125.71.215.223

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 172.16.2.0/24 26.1.1.0/24 ip any any

local tunnel endpoint : 10.230.33.13 remote tunnel endpoint : 125.71.215.223

the pairs of ESP ipsec sa : id : 2129, algorithm : 3DES HMAC-SHA1-96

inbound esp ipsec sa : spi : 0x262f3048(640626760) crypto m_context(s_context) : 0x9e44e60 / 0x137cd368

current input 10 packets, 0 kbytes

encapsulation mode : UDP-Encapsulation-Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28696/4294967295

uptime is 0 hour 1 minute 44 second

outbound esp ipsec sa : spi : 0xd1e04f22(3521138466) crypto m_context(s_context) : 0x137cd230 / 0x137cd1c8

current output 10 packets, 0 kbytes

encapsulation mode : UDP-Encapsulation-Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28696/4294967295

uptime is 0 hour 1 minute 44 second

total sa and sa group is 1

#View the IPsec tunnel information on Device2.

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

67155 STATE_XAUTH_S3 125.71.215.223 223.104.9.12 a(a)

67156 STATE_QUICK_R2 125.71.215.223 223.104.9.12 a

Device2#show crypto ipsec sa tunnel tun

policy name : subflow-1610618814, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 26.1.1.0/24 172.16.2.0/24 ip any any

local tunnel endpoint : 125.71.215.223 remote tunnel endpoint : 223.104.9.12

the pairs of ESP ipsec sa : id : 67156, algorithm : 3DES HMAC-SHA1-96

inbound esp ipsec sa : spi : 0xd1e04f22(3521138466) crypto m_context(s_context) : 0xa6f4ab8 / 0x18b80d90

current input 10 packets, 0 kbytes

encapsulation mode : UDP-Encapsulation-Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28643/4294967295

uptime is 0 hour 2 minute 37 second

outbound esp ipsec sa : spi : 0x262f3048(640626760) crypto m_context(s_context) : 0x19c0fc58 / 0x2031a298

current output 10 packets, 0 kbytes

encapsulation mode : UDP-Encapsulation-Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28643/4294967295

uptime is 0 hour 2 minute 37 second

total sa and sa group is 1

#You can see that Device1 and Device2 set up the IPsec extended authentication tunnel successfully.

#PC1 and data center can ping each other via the Ipsec tunnel.

#After the line between Device1 and Device2 fails, BFD can detect the fault fast and trigger re-initiating dialing after the 4G interface is down.


5.3.4 Dual-4G Signal Switching

Network Requirements

l The device has two 4G card interfaces, fastcellular 1 and fastcellular 2.

l Both of the two 4G cards have the SIM cards, which can be connected to the network.

l Configure the signal switching parameters on the device. Switch the interface according to the signal strength. The route is switched synchronously.

Network Topology

Configuration Steps

Step 1: | Configure the routes of the two 4G interfaces on the device.
 | Device1(config)#ip route 0.0.0.0 0.0.0.0 fastcellular 1 Device1(config)#ip route 0.0.0.0 0.0.0.0 fastcellular 2/0 100
Step 2: | Configure the signal switching group 1.
 | Device1#configure terminal Device1(config)# signal-switch group 1
Step 3: | Configure adding fastcellular1 and fastcellular2 of the device to the dual-4G switching group 1.
 | Device1 (config-sigswitch-group-1)#member interface fastcellular 1 Device1 (config-sigswitch-group-1)#member interface fastcellular 2

l Signal switching depends on the signal quality, but the signal quality cannot really reflect the link status. When the signal is good, the link is not necessarily unblocked, and when the signal is poor, the link is not necessarily blocked, so, to some extent, it's not always reliable to decide whether or not to switch depending on the quality of the signal.

l In order to prevent the service interruption and dial fluctuation caused by signal instability as much as possible, do not switch if the interface with poor signal has dialed, and the signal strength value of the interface is >=9.


5.3.5 4G Supports PPP Dialing Mode

Network Requirements

l Device1 is connected to the specified private network environment via the PPP dialing mode.

l Device1 serves as the site device, the carrier device serves as LAC, and Device2 serves as LNS. Set up the L2TP tunnel between LAC and Device2.

Network Topology

Figure 6‑5 4G PPP dialing configuration view

Device | Interface | IP address | Device | Interface | IP address
Device1 | Vlan100 | 192.168.100.1/24 | Device2 | Gi0 | 30.1.1.1/24
 |  |  |  | Gi1 | 192.168.201.1/24
 |  |  |  | Gi2 | 192.168.200.1/24
 |  |  |  | Loopback0 | 172.16.20.1/32

Configuration Steps

Step 1: | Configure the IP address and route of the interface (omitted).
Step 2: | Configure the dialing mode of the 4G interface.

#Configure the dialing mode of Device1 4G interface fastcellular1 as PPP, and the interface name automatically changes to cellular1.

Device1#configure terminal

Device1(config)# cellular 1 dial-mode ppp

Are you sure to set dail-mode? (Yes|No):yes

Step 3:

Configure the APN name as hy118.scapn.

#Configure Device1.

Device#cellular 1 configure apn-config apn-set hy118.scapn

Step 4:

Configure the modem dialing script: the script name is g3dia, and the command is ATDT.

#Configure Device1.

Device1#configure terminal

Device1(config)#chat-script g3dia ATDT

Step 5:

Define the data flow of triggering dialing.

#Configure Device1.

Device1(config)#dialer-list 1 protocol ip permit

Step 6:

Configure the 4G interface of Device1.

#Configure Device1.

Device1(config)#interface cellular 1

Device1(config-if-cellular1/0)#dialer in-band

Device1(config-if-cellular1/0)#dialer-group 1

Device1(config-if-cellular1/0)#dialer string *99#

Device1(config-if-cellular1/0)#script dialer g3dia

Device1(config-if-cellular1/0)#ppp chap hostname 3g_authen

Device1(config-if-cellular1/0)#ppp chap password 0 admin

Device1(config-if-cellular1/0)#ip address negotiated

Device1(config-if-cellular1/0)#exit

Step 7:

Configure the default route on Device1, and the egress interface is cellular1/0.

#Configure Device1.

Device1(config)#ip route 0.0.0.0 0.0.0.0 cellular 1

Step 8:

Configure the AAA server to authenticate and distribute the address.

#Configure Device2.

Configure AAA to use the radius authentication and authorization.

Device2(config)#aaa new-model

Device2(config)#aaa authentication ppp default radius

Device2(config)#aaa authorization network default radius

Configure the address, use name and password of the AAA server.

Device2(config)#radius-server host 192.168.200.2 auth-port 1645 priority 0 key admin

Step 9:

Configure the L2TP tunnel between LAC and Device2.

#Configure Device2.

Configure the loopback interface.

Device2(config)#interface loopback0

Device2(config-if-loopback0)#ip address 172.16.20.1 255.255.255.255

Device2(config-if-loopback0)#exit

Configure the template virtual-template 1, and borrow the address of Loopback0.

Device2(config)#interface virtual-template 1

Device2(config-if-virtual-template1)#encapsulation ppp

Device2(config-if-virtual-template1)#ppp mtu adaptive proxy

Device2(config-if-virtual-template1)#ppp authentication chap default

Device2(config-if-virtual-template1)#ppp authorization default

Device2(config-if-virtual-template1)#ip unnumber loopback0

Device2(config-if-virtual-template1)#exit

Enable the VPDN function and configure the VPDN group.

Device2(config)#vpdn enable

Device2(config)#vpdn-group 1

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol l2tp

Device2(config-vpdn-acc-in)#virtual-template 1

Device2(config-vpdn-acc-in)#exit

Configure only accepting the L2TP connection request of LAC with the hostname GGSNCD01 (optional).

Device2(config-vpdn)#terminate-from hostname GGSNCD01

Configure the authentication password of the L2TP tunnel, and the password should be the same as the L2TP password provided by the carrier.

Device2(config-vpdn)#l2tp tunnel password admin

Disable the authentication of the L2TP tunnel.

Device2(config-vpdn)#no l2tp tunnel authentication

Device2(config-vpdn)#exit

Step 10:

Check the result.

#After triggering dialing, view the cellular1 interface information of Device1.

Device1#show interface cellular 1

Cellular1:

line protocol is up

Flags: (0xc0080f1) POINT-TO-POINT MULTICAST RUNNING

Type: PPP

Internet address: 172.16.10.11/32

Destination Internet address: 0.0.0.0

Metric: 0, MTU: 1500, BW: 384 Kbps, DLY: 100000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters never

input peak rate 144 bits/sec, 0 hour 45 minutes 19 seconds ago

output peak rate 112 bits/sec, 0 hour 27 minutes 18 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

577 packets received; 301 packets sent

269 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

LCP:OPENED

IPCP:OPENED

encap-type: simply PPP

Rx chars: 23595, Tx chars 3908

Rx overrun 0, Tx underrun 0

#On Device2, view whether the L2TP tunnel is set up.

Device2#show vpdn detail

L2TP MaxTun 1024, MaxSes 1024:

tunnel free num: 1023

TUNNELS:

LocID LocName RemID RemName RemAddr Vpdn Port Sess State

21 Device2 63 GGSNCD01 119.6.10.116 1 1701 1 ESTAB

session free num: 1023

SESSIONS:

LocID TunID RemID IfName User SysId msi/calling-no State

79 21 4236 virtual-access1 test1 - 8614528080921 ESTAB

L2TP total Tunnel and Session Information. Tunnel 1 Session 1

#On Device1, ping the address of the virtual interface virtual-template 1 on Device2, and view whether the ping can be connected.

Device1#ping 172.16.20.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 172.16.20.1 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 316/502/1066 ms.

Device1 can ping the address of the virtual interface virtual-template 1 on Device2.


6 Loopback Interface


6.1 Overview

Loopback interface, also called local loopback interface, is one logical virtual interface realized by software. The interface is not affected by the physical status. As long as not disabling manually, its status is always enabled. In the dynamical routing protocol, such as OSPF, you can select the IP address of loopback interface as Router ID. For the packets sent to the loopback interface, the device regards that the packets are sent to itself, so it does not forward the packets.


6.2 Loopback Interface Function Configuration

Table 6‑1 Function configuration list of loopback interface

Configuration Task

Configure the loopback interface

Configure loopback interface


6.2.1 Configure Loopback Interface

Configuration Condition

None

Configure Basic Functions of Loopback Interface

Table 6‑2 Configure basic functions of the loopback interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the loopback interface | interface loopback unit –number | Mandatory By default, the loopback interface is not created


7 Null Interface


7.1 Overview

Null interface is one logical interface realized by software. Any packet sent to null interface is dropped. The dynamic routing protocol, such as OSPF, generates the auto-summarized route. The egress interface points to null interface and can avoid route loop effectively. Null0 interface is created by the device by default and the user cannot disable or delete it.


7.2 Null Interface Function Configuration

Table 7‑1 Function configuration list of Null interface

Configuration Task

Configure the basic functions of Null interface

Configure the basic functions of Null interface


7.2.1 Configure Null Interface

Configuration Condition

None

Configure Basic Functions of Null Interface

Table 7‑2 Configure basic functions of Null interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the null interface configuration mode | interface null 0 | Mandatory
Configure prohibiting sending the error packet of ICMP unreachable | no ip unreachables | Optional By default, prohibit sending the error packet of ICMP unreachable.

l Null interface just supports configuring permitting or prohibiting sending the error packet of ICMP unreachable.

l The packet reaching Null interface is dropped. Do not send the error of ICMP unreachable by default.


8 Tunnel Interface


8.1 Overview

Tunnel is the technology of using one network protocol to transmit another network protocol. It includes the process of encapsulating, transmitting, and de-encapsulating data. The path passed by the encapsulated packet when being transmitted in the network is called tunnel. Tunnel is one virtual point-to-point connection. The devices at the two sides of the tunnel are called tunnel endpoints and they are responsible for encapsulating and de-encapsulating packets.

Tunnel interface is one logical interface realized by software, providing the transmission link for the point-to-point mode.


8.2 Tunnel Interface Function Configuration

Table 8‑1 Function configuration list of tunnel interface

Configuration Task

Configure the basic functions of the tunnel interface

Configure the basic functions of the tunnel interface


8.2.1 Configure Tunnel Interface

Configuration Condition

None

Configure Basic Functions of Tunnel Interface

Table 8‑2 Configure basic functions of tunnel interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create tunnel interface and enter its configuration mode | interface tunnel tunnel-unit | Mandatory By default, the tunnel interface is not created on the device.
Configure work mode of tunnel interface | tunnel mode { gre ip | ipip | ipv6ip [ 6to4 | auto-tunnel ] mpls traffic-eng } | Optional By default, the work mode of the tunnel interface is GRE over IPv4.
Configure TOS of tunnel interface | tunnel tos tos-value | Optional By default, the tunnel interface is not configured with TOS.
Configure TTL of tunnel interface | tunnel ttl ttl-value | Optional By default, the TTL value of the tunnel interface is 255.

l The TOS configured on tunnel interface is used to fill the TOS field in the outer IPv4 packet header during encapsulation. If the TOS value is not configured on tunnel interface, use the TOS value in the inner IPv4 packet header.

l The TTL value configured on tunnel interface is used to fill the TTL field in the outer IPv4 packet header during encapsulation.


1 PPP


1.1 Overview

PPP (Point to Point Protocol) is one link layer protocol of transmitting the network layer data on the point-to-point line. PPP includes LCP, NCP and authentication protocol (PAP and CHAP).

l Link Control Protocol (LCP): used to set up, configure and test the data link connection;

l Network Control Protocol (NCP: used to set up and configure different network layer protocols;

l Authentication protocol stack (PAP, CHAP, MS-CHAP): used to ensure the network security.

PAP (Password Authentication Protocol) authentication is twice handshake authentication and the password is plain text.

CHAP (Challenge-Handshake Authentication Protocol) authentication is the three-handshake authentication, the password is cipher text (key) and it adopts the MD5 encryption algorithm.

MS-CHAP (Microsoft CHAP) authentication is the three-handshake authentication and the password is cipher text (key). To increase the bandwidth, we can bind multiple PPP links to use, called PPP multi-link. PPP multi-link fragments the packet (if the packet is smaller than the minimum fragment packet length, do not fragment) and sends to the PPP peer from the multiple PPP channels in the PPP multi-link. The peer assemblies the fragments and transmits to the network layer. It has the features of increasing the bandwidth and load balance and can work in any interface supporting the PPP encapsulation.


1.2 PPP Function Configuration

Table 1‑1 PPP function configuration list

Configuration Task
Configure the PPP basic functions | Encapsulate the PPP protocol
Configure the PPP link keepalive | Configure the detection period of the PPP link keepalive
Configure the PPP authentication | Configure the PAP authentication
 | Configure the CHAP authentication
 | Configure the MS-CHAP authentication
 | Configure the re-authentication times
 | Configure refusing authentication
Configure the PPP negotiation parameters | Configure the LCP re-negotiation interval
 | Configure the forecasting of the LCP connection status
 | Configure the ID binding function of the LCP system
 | Configure the IP address negotiation
 | Configure the IP address pool
 | Configure the WINS DNS address negotiation
 | Configure the IPCP private keepalive
Configure the AAA function of PPP | Configure the AAA authentication
 | Configure the AAA authorization
 | Configure the AAA statistics
Configure the PPP multi-link | Configure the PPP multi-link basic functions
 | Configure the PPP multi-link fragment inserting
 | Configure the PPP multi-link end-point ID
 | Configure the PPP multi-link fragment delay
Configure the PPP link quality inspection and monitoring | Configure the link quality inspection and monitoring
Configure the PPP multi-account switching | Configure the PPP multi-account switching


1.2.1 Configure PPP Basic Functions

PPP is the point-to-point link protocol. After connecting the cables correctly, encapsulate the PPP protocol and configure the IP address on the interfaces of the two sides so that the interfaces can communicate normally.

Configuration Condition

None

Table 1‑2 Encapsulate the PPP protocol

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Encapsulate the PPP protocol | encapsulation ppp | Mandatory By default, the 4G interface encapsulated by PPP uses the link-layer protocol.


1.2.2 Configure PPP Link Keepalive

Link keepalive periodically sends the keepalive packets to detect the link status.

Configuration Condition

Before configuring the PPP link keepalive, first complete the following task:

l Encapsulate the PPP protocol on the interface

Configure Detection Period of PPP Link Keepalive

Table 1‑3Configure the detection period of the PPP link keepalive

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the detection period of the PPP link keepalive | keepalive [ keepalive-seconds ] | Optional By default, the detection period of the PPP link keepalive is 10s.


1.2.3 Configure PPP Authentication

The configuration of the PPP authentication is optional. For the security of the PPP link communication, we need to configure the PPP authentication, which includes three authentication modes, that is, PAP, CHAP, and MS-CHAP.

To configure the PPP authentication, we need to configure one side of PPP as the PPP authenticating end and the other side as the authenticated end.

Configuration Condition

Before configuring the PPP authentication, first complete the following task:

l Encapsulate the PPP protocol on the interface

Configure PAP Authentication

PAP authentication is the twice-handshake authentication, and the password is the plain text. The process of the PAP authentication is as follows:

1. The authenticated end sends the user name and password to the authenticating end.

2. The authenticating end views whether there is the user and whether the password is correct according to the local user table, and then returns different responses. PAP is not one secure authentication protocol. During the authentication, the password is transmitted on the link in the plain text mode. When the PPP link control protocol negotiates successfully, start the PAP authentication. If authenticating successfully, enter the next-phase negotiation. Otherwise, the interface is down.

When configuring the PAP authentication, we need to configure one end as the authenticating end and the other is configured as the authenticated end. The configuration of the authenticating end is as follows:

Table 1‑4 Configure the PAP authenticating end

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the PPP authentication mode as the PAP authentication | ppp authentication pap | Mandatory By default, do not configure the authentication mode.
Exit the interface configuration mode | exit | -
Configure the user name and password of the PPP PAP authentication | user username password 0 password | Mandatory By default, do not configure the user name or password.

The configuration of the authenticated end is as follows:

Table 1‑5Configure the authenticated end of PAP

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the authenticated user name and password of the PPP PAP | ppp pap sent-username username password [ encryption-type ] password | Mandatory By default, do not configure the user name or password.

Configure CHAP Authentication

CHAP authentication is the three-handshake authentication and the password is the cipher text (key). The CHAP authentication process is as follows:

1. The authenticating end actively initiates the authentication request; the authenticating end sends one challenge random number to the authenticated end and carries the local user name to send to the authenticated end.

2. After the authenticated end receives the authentication request of the authenticating end, search for the password of the user in the local user table according to the user name of the authenticating end in the packet. If finding the same user as the user name of the authenticating end in the user table, use the packet ID, the user key, and MD5 algorithm to encrypt the random packet and return the generated cipher text and user name of the authenticated end to the authenticating end.

3. The authenticating end uses its own saved authenticated password and MD5 algorithm to encrypt the original random packet. Compare the two cipher texts and return different responses according to the comparison result. To configure the PPP CHAP authentication, we need to configure one end as the authenticating end and the other end as the authenticated end.

The configuration of the authenticating end is as follows:

Table 1‑6 Configure the authenticating end of CHAP

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the PPP authentication mode as CHAP authentication | ppp authentication chap | Mandatory By default, do not configure the authentication mode
Exit the interface configuration mode | exit | -
Configure the user name and password of the PPP CHAP authentication | user username password 0 password | Mandatory By default, do not configure the authentication user name or password.

The configuration of the authenticated end is as follows:

Table 1‑7 Configure the authenticated end of CHAP

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the authenticated user name of PPP CHAP | ppp chap hostname host-name | Mandatory By default, do not configure the user name.
Configure the authenticated password of PPP CHAP | ppp chap password [ encryption-type ] password | Mandatory By default, do not configure the password.

Configure MS-CHAP Authentication

It is the same as the CHAP authentication process, but the encryption algorithm is different.

When configuring PPPMS-CHAP authentication, we need to configure one end as the authenticating end and the other as the authenticated end.

The configuration of the authenticating end is as follows:

Table 1‑8 Configure MS-CHAP authenticating end

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the PPP authentication mode as MS-CHAP | ppp authentication ms-chap | Mandatory By default, do not configure the authentication mode.
Exit the interface configuration mode | exit | -
Configure the user name and password of the PPPMS-CHAP authentication | user username password 0 password | Mandatory By default, do not configure the user name or password.

The configuration of the authenticated end is as follows:

Table 1‑9Configure the MS-CHAP authenticated end

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the authenticated user name of PPP CHAP | ppp chap hostname host-name | Mandatory By default, do not configure the user name.
Configure the authenticated password of PPP CHAP | ppp chap password [ encryption-type ] password | Mandatory By default, do not configure the password.

Configure Re-authentication Times

When the authentication fails, the user can configure the re-authentication times.

Table 1‑10 Configure the re-authentication times

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the re-authentication times | ppp retry authentication { retry-times | forever } | Optional By default, the re-authentication times is 10.

l The command is used only in the multi-account mode of the 4G interface encapsulated as PPP.

Configure Refusing authentication

For the network security, adopt multiple authentication modes during the PPP communication, but sometimes, to control the authentication mode better, we can refuse some authentication mode.

Table 1‑11Configure refusing authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure refusing authentication | ppp { chap | ms-chap | pap } refuse | Mandatory By default, do not configure refusing authentication.


1.2.4 Configure PPP Negotiation Parameters

The PPP negotiation parameters are mainly used to set the negotiation parameters, such as LCP, IPCP and authentication.

Configuration Condition

Before configuring the PPP negotiation, first complete the following task:

l Encapsulate the PPP protocol on the interface

Configure PPP LCP Re-negotiation Interval

When the PPP LCP negotiation fails, re-negotiate and the interval of the two negotiations can be configured as follows:

Table 1‑12 Configure the PPP LCP re-negotiation interval

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the PPP LCP re-negotiation interval | ppp timeout retry timeout | Mandatory By default, the PPP LCP re-negotiation interval is 5s.

Configure LCP Connection Status Forecasting

PPP can detect the link status via the link keepalive packet and data packet. Usually, adopt the link keepalive packet to detect, but sometimes, to save the bandwidth, we can detect the link status via the data packet. The configuration is as follows:

Table 1‑13 Configure the LCP connection status forecasting

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the packet type of detecting the link status | ppp lcp predictive | Mandatory By default, do not configure the LCP connection status forecasting.

Configure Binding Function of LCP System ID

The function is to send the system ID of the dialing end to the server. When configuring the binding function of the LCP system ID, we need to configure the dialing end as the system ID accept mode and the server as the system ID request mode.

The configuration of the dialing end is as follows:

Table 1‑14 Configure the dialing end

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the system ID | ppp sn serial-number | Mandatory By default, the dialing end does not configure the system ID.
Configure the accept mode | ppp lcp sn accept | Mandatory By default, the dialing end is not configured as the accept mode.

The configuration of the server is as follows:

Table 1‑15 Configure the server

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the request mode | ppp lcp sn request | Mandatory By default, the server is not configured as the request mode.

Configure PPP IP Address Negotiation

The IP address of the PPP interface can be configured manually and also can be got by negotiating with the peer. When configuring the IP address negotiation, one end is configured to request the IP address from the peer and the other end is configured to distribute the IP address for the peer. The distributing mode can be specifying the specific IP address and also can be distributed via the IP address pool.

To get the IP address from the peer, we need to perform the following configuration:

Table 1‑16Configure PPP to request IP address from the peer

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure PPP to request IP address from the peer | ip address negotiated | Mandatory By default, do not request IP address from the peer.

To distribute the IP address for the peer, we need to perform the following configuration:

Table 1‑17Configure PPP to distribute the IP address for the peer

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure PPP to distribute the IP address for the peer | peer default ip address { ip-address | pool pool-name } | Mandatory Specify the IP address or distribute the IP address for the peer via the IP address pool. By default, do not distribute the IP address for the peer.

Configure PPP IP Address Pool

PPP performs the IP address negotiation. When one end is configured to distribute the IP address for the peer via the IP address pool, we need to configure the corresponding address pool as follows:

Table 1‑18 Configure the PPP IP address pool

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the PPP IP address pool | ip local pool { pool-name low-ip-address high-ip-address | default low-ip-address [high-ip-address ] } | Mandatory By default, do not configure the IP address pool.

l If the interface needs to use the address pool, it needs to be associated with the address pool.

Configure PPP WINS DNS Address Negotiation

When configuring the PPP WINS DNS negotiation, one end needs to be configured as requesting WINS DNS address and the other end is configured as distributing the WINS DNS address.

To configure the WINS DNS negotiation, we need to perform the following configuration:

Table 1‑19Configure PPP to request the WINS DNS address

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure requesting the DNS address | ppp ipcp dns request | Mandatory By default, do not configure requesting the DNS address.
Configure requesting the WINS address | ppp ipcp wins request | Mandatory By default, do not configure requesting the WINS address.

Table 1‑20Configure PPP to distribute the WINS DNS address

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the DNS address distributed for the peer | ppp ipcp dns primary-address [ second-address ] | Mandatory By default, do not configure the DNS address.
Configure the WINS address distributed for the peer | ppp ipcp wins primary-address [ second-address ] | Mandatory By default, do not configure the WINS address.

Configure IPCP Private Keepalive

Table 1‑21 Configure the IPCP private keepalive

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the detection period of the IPCP private keepalive | ppp ipcp keepalive [ timeout-value | protocol protocol-number ] | Mandatory By default, do not enable the private keepalive detection function.


1.2.5 Configure PPP AAA Function

AAA includes authenticating, authorizing and accounting. PPP AAA authentication is used to send the user name and password information of the PPP dialing end to the AAA server for authentication. PPP AAA authorizing is mainly used by the AAA server to perform the authorizing and distributing the IP address function for the PPP dialing end. AAA accounting is mainly used for the accounting usage of the PPP line.

Configuration Condition

Before configuring the PPP AAA function, first complete the following task:

l Encapsulate the PPP protocol on the interface

l The authenticating end, authorizing end and accounting end need to enable the AAA function

Configure PPP AAA Authentication

To configure the PPP AAA authentication, we need to configure one end as the authenticating end and the authenticating mode as the AAA authentication, and the other end as the authenticated end.

The configuration of the authenticating end is as follows:

Table 1‑22 Configure the PPP AAA authenticating end

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the AAA function | aaa new-model | Mandatory By default, do not enable the AAA function
Configure the PPP AAA authentication method list (take the RADIUS server as an example) | aaa authentication ppp { default | list-name } radius | Mandatory By default, do not configure the PPP AAA authentication method list.
Configure the related parameters of the AAA authentication server (take the RADIUS server as an example) | radius-server host ip-address [ acc-port acc-port-num ] [ auth-port auth-port-num ] [ priority priority ] [ key [ 0 | 7 ] key ] | Mandatory By default, do not configure the PPP AAA authentication server.
Enter the interface configuration mode | interface interface-name | -
Configure the PPP authentication mode and the AAA list name | ppp authentication { chap / pap / ms-chap } [ aaa-list-name ] | Mandatory The AAA list name should be configured. By default, do not configure the PPP authentication mode and AAA list name.

For the configuration of the authenticated end, refer to the section 2.2.2. The authentication modes of the authenticating end and the authenticated end need to be consistent.

Configure PPP AAA Authorizing

To configure the PPP AAA authorizing, we need to configure one end as the authorizing end and the other end as the authorized end.

Table 1‑23 Configure the PPP AAA authorized end

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the AAA function | aaa new-model | Mandatory By default, do not enable the AAA function.
Configure the PPP AAA authorizing method list (take the RADIUS server as an example) | aaa authorization network { default | list-name } radius | Mandatory By default, do not configure the PPP AAA authorizing method list.
Configure the related parameters of the AAA authorizing server (take the RADIUS server as an example) | radius-server host ip-address [ acc-port acc-port-num ] [ auth-port auth-port-num ] [ priority priority ] [ key [ 0 | 7 ] key ] | Mandatory By default, do not configure the PPP AAA authorizing server.
Enter the interface configuration mode | interface interface-name | -
Configure the name used by the PPP AAA authorizing | ppp authorization aaa-name | Mandatory By default, do not configure the PPP AAA authorizing name.

For the configuration of the authorized end, refer to the section 2.2.3.

Configure PPP AAA Accounting

Table 1‑24 Configure the AAA accounting

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the AAA function | aaa new-model | Mandatory
Configure the PPP AAA accounting method list (take the RADIUS server as an example) | aaa accounting network { default | list-name } radius | Mandatory By default, do not configure the PPP AAA accounting method list.
Configure the related parameters of the AAA accounting server (take the RADIUS server as an example) | radius-server host ip-address [ acc-port acc-port-num ] [ auth-port auth-port-num ] [ priority priority ] [ key [ 0 | 7 ] key ] | Mandatory By default, do not configure the PPP AAA accounting server.
Enter the interface configuration mode | interface interface-name | -
Configure the name used by the PPP AAA accounting | ppp accounting aaa-name | Mandatory


1.2.6 Configure PPP Multi-link

PPP multi-link binds multiple physical links, so as to improve the throughput capability and reduce the transmission delay between the systems. If necessary, it fragments the packet and transmits on multiple physical links. When receiving, re-assembly the fragments and it can ensure receiving and sending in order.

Configuration Condition

None

Configure PPP Multi-link Basic Functions

Table 1‑25 Configure the PPP multi-link basic functions

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the multi-link interface | interface multilink multilink-unit | Mandatory
Exit the interface mode | exit | -
Enter the interface configuration mode | interface interface-name | -
Bind the physical interface and the multi-link interface | mutlink-group multilink-unit | Mandatory

Configure PPP Multi-link Fragment Inserting

Table 1‑26 Configure the PPP multi-link fragment inserting

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface multilink multilink-unit | -
Configure the PPP multi-link fragment inserting | ppp multilink interleave | Mandatory By default, the multi-link interface does not configure the fragment inserting.

Configure PPP Multi-link Endpoint ID

Table 1‑27 Configure the PPP multi-link endpoint ID

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface multilink multilink-unit | -
Configure the PPP multi-link endpoint ID | ppp multilink endpoint string endpoint-name | Mandatory By default, the multi-link interface does not configure the endpoint ID. By default, use the host name as the endpoint ID.

Configure PPP Multi-link Fragment Delay

Table 1‑28 Configure the PPP multi-link fragment delay

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface multilink multilink-unit | -
Configure the maximum delay of the multi-link fragment | ppp multilink fragment-delay timeout | Mandatory By default, the maximum fragment delay of the multi-link interface is 30ms.


1.2.7 Configure PPP Bridge

Configure the PPP bridge to transmit data transparently between the PPP interface and Ethernet interface.

Configuration Condition

Before configuring the PPP bridge, first complete the following task:

l Encapsulate the PPP protocol on the interface

Configure PPP Bridge

Table 1‑29 Configure the PPP bridge

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the PPP bridge | ppp bridge ip | Mandatory By default, do not configure the PPP bridge.


1.2.8 Configure PPP Data Encrypting

Data encrypting is the protection measure taken for the data to ensure that the data can be transmitted to the peer correctly.

Configuration Condition

Before configuring the PPP data encrypting, first complete the following task:

l Encapsulate the PPP protocol on the interface

Configure PPP Data Encrypting

Table 1‑30 Configure the PPP data encrypting

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the PPP data encrypting | ppp encrypt des encryp-key | Mandatory By default, do not configure the PPP data encrypting.


1.2.9 Configure PPP Link Quality Inspection and Monitoring

PPP link quality monitoring can monitor the communication quality of the PPP link in real time. When the link quality is lower than the disabled link quality percentage, the link is disabled; when the link quality is restored to the link quality percentage, the link is automatically re-enabled. To ensure that the link does not oscillate between the disabled and recovery repeatedly, PPP link quality monitoring has some delay when re-enabling the link.

Configuration Condition

Before configuring the PPP link quality inspection and monitoring, first complete the following task:

l Encapsulate the PPP protocol on the interface

Configure Link Quality Inspection and Monitoring

Table 1‑31 Configure the PPP link quality inspection and monitoring

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the PPP link quality inspection and monitoring | ppp quality { percent-number | reject } | Mandatory By default, do not configure the PPP link quality inspection and monitoring.


1.2.10 Configure PPP Multi-account Switching

There can be one account or multiple accounts at the dialing end. CHAP and PAP authentication modes can configure one account and also can configure multiple accounts. Here, mainly describe the configuration steps of multiple accounts.

Configuration Condition

Before configuring the PPP multi-account switching, first complete the following task:

l Encapsulate the PPP protocol on the interface

Configure Account List

Configuring the account list can be divided to two steps. In Step 1, set the account list name in the global mode and create one or multiple accounts in the list; in Step 2, associate the interface with the account list.

Table 1‑32 Configure the PPP user list

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the account list | user-list user-list-name | Mandatory By default, do not configure the account list.
Configure the user name and password | user user-name password encryption-type password [ apn apn-name [ main ] | main ] | Mandatory By default, do not configure the user name or password.

Table 1‑33 Associate the account list with the interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the associated account list | ppp [ chap | pap ] user-list user-list-name | Mandatory By default, the interface is not associated with the account list.

l Only the 4G interface encapsulated by PPP supports the function.


1.2.11 PPP Monitoring and Maintaining

Table 1‑34 monitoring and maintaining

Command | Description
show ppp information [ interface-name ] | Display the configuration information of the PPP interface and the status machine information
show ppp multilink interface-name | Display the information of the PPP multi-link interface


1.3 PPP Typical Configuration Example

MP1800X does not support the WAN line. The PPP protocol is mainly applied to the L2TP scenario or 4G PPP interface, such as perform the PPP authentication configuration in the virtual-ppp interface. For the related example, refer to the L2TP or 4G PPP function configuration.


2 DDR


2.1 Overview


2.1.1 Overview of DDR

DDR (Dial-On-Demand Routing) is the network technology adopted when the devices are interconnected via the public switching network. DDR means that the devices connected across the public switching network do not set up the connection in advance, but when there is data needed to be transmitted between them, set up the connection via the dialing mode. Enable the DDR dialing process to set up the connection and transmit the information. When the link is idle again, DDR automatically cuts off the connection. This does not affect the user communication and can reduce the communication cost of the user.


2.1.2 DDR Terms

Dial prototype: The dialing prototype separates the logical parts of DDR, including the parameters related with the network layer, encapsulation and dialing, from the physical interface responsible for receiving and sending the call. In the dialing prototype, bind and combine the physical interface and logical interface by each call so that the physical interface can dynamically select different parameters according to the incoming or outgoing call.

Physical interface: The actual existing physical interface, such as serial port and 4G interface. We can use the dialer pool-membercommand to associate the physical interface with the dialer pool. One physical interface can be associated with multiple dialer pools.

Dialer interface: It is the physical interface set for configuring the DDR parameters. The physical interface can be bound to the Dialer interface to inherit the configuration information.

Dialing interface: It is the general term for the dialing connection interface. It can be Dialer interface or the physical interface bound to the Dialer interface, or the physical interface directly configuring the DDR parameters.

Dialer pool: The dialer interface usually references one dialer pool. The dialer pool is a group of one or multiple interfaces associated with the dialing prototype.


2.2 DDR Function Configuration

Table 2‑1 DDR function configuration list

Configuration Task
Configure the DDR dialing control list | Create the dialing control list
Configure the DDR basic functions | Enable the DDR function
 | Associate the dialing control list with the dialing interface
 | Associate the dialing set with the dialing interface
 | Configure the dialing number
 | Configure the auto dialing
Configure the DDR interface parameters | Configure the idle time of the link
 | Configure the waiting time for re-dialing
 | Configure the longest time of waiting for the carrier


2.2.1 Configure DDR Dialing Control List

Configuration Condition

None

Create Dialing Control List

We can filter the packets passing the dialing interface by configuring the dialing control list. According to whether the packet complies with the permit or deny condition of the dialing ACL control list, the packets are divided to two kinds:

1. For the packet complying with the permit condition of the dialing ACL control list or not complying with the deny condition of the dialing ACL control list, if the corresponding link is set up, DDR sends out the packet via the link and clears up the Idle timeout timer; if the link is not set up, send out new call.

2. For the packet not complying with the permit condition of the dialing ACL control list or complying with the deny condition of the dialing ACL control list, if the corresponding link is set up, DDR sends out the packet via the link, but does not clear up the idle timeout timer; if the corresponding link is not set up, do not send out call, but drop the packet.

Table 2‑2 Create the dialing control list

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the dialing control list | dialer-list dialer-list-number protocol { ip | ipv6 } { deny | list access-list | permit } | Mandatory By default, do not configure the dialing control list. The dialing control list can directly configure the filter condition of the packet and also can bring in the rules of the ACL.


2.2.2 Configure DDR Basic Functions

Configuration Condition

None

Enable DDR Function

DDR supports the data flow trigger dialing and auto dialing. The common used is the data flow trigger dialing.

Table 2‑3 Enable the DDR function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface dialer dialer-id | -
The interface enables the DDR function | dialer in-band | Mandatory By default, the interface does not enable DDR.

Configure Dialing Control List to Associate with Dialing Interface

Associate one dialing interface with the dialing ACL to control the access. Use the following command to configure on the interface:

Table 2‑4 Configure the dialing ACL to associate with the dialing interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface dialer dialer-id | -
Configure the dialing ACL to associate with the dialing interface | dialer-group group-number | Mandatory By default, do not configure the dialing ACL to associate with the dialing interface. Before configuring the command, the interface should enable the DDR function. Auto dialing does not need to configure the command.

Configure Dialing Pool to Associate with Dialing Interface

For the dialing interface, to specify which dialing pool to connect the specified destination subnet, use the following command to configure.

Table 2‑5 Configure the dialing pool to associate with the dialing interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface dialer dialer-id | -
Configure the dialing pool to associate with the dialing interface | dialer pool pool-number | Mandatory By default, do not configure the dialing pool to associate with the dialing interface. The command can only be used in the dialer interface; auto dialing does not need to configure the command.

Configure Dialing Number

To use the data flow trigger dialing or auto dialing, we need to configure the dialing number.

Table 2‑6 Configure the dialing number

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface dialer dialer-id | -
Configure the dialing number | dialer string string | Mandatory By default, do not configure the dialing number.

Configure Auto Dialing

With data flow triggering, DDR also can auto dial, which is often used by the 4G interface encapsulated by PPP.

Table 2‑7 Configure the auto dialing

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface cellular interface-name | -
Configure the auto dialing | dialer mode auto | Mandatory By default, do not configure the auto dialing.


2.2.3 Configure DDR Interface Parameters

Configuration Condition

None

Configure Link Idle Time

After one link is set up, the link idle time configured by the user takes effect. After the idle time of the link exceeds the specified time, DDR disconnects the link. The command is used on the line without generating the competition. Once the line has the competition, we need to use the dialer fast-idlecommand.

Table 2‑8 Configure the idle time of the link

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface dialer dialer-id | -
Configure the idle time of the link | dialer idle-timeout seconds [ { either | inbound } ] | Optional By default, the idle time of the link is 120s.

Configure Wait Time for Re-dialing

To set the wait time of the DDR interface before re-dialing after the dialing ends or fails, use the command to configure on the interface. If the dialing link is unstable, we need to configure the wait time for re-dialing, so as to prevent the unnecessary overload.

Table 2‑9 Configure the wait time for re-dialing

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface dialer dialer-id | -
Configure the wait time for re-dialing | dialer enable-timeout seconds | Optional By default, the DDR re-dialing wait time is 15s.

Configure Maximum Time of Waiting for Carrier

To control the wait time permitted between dialing initiating and the connection setup, configure the maximum time of waiting for the carrier. If exceeding the time, the dialing is still not set up, DDR ends the dialing.

Table 2‑10 Configure the maximum time of waiting for carrier

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface dialer dialer-id | -
Configure the maximum time of waiting for carrier | dialer wait-for-carrier-time seconds | Optional By default, the maximum time of waiting for carrier is 60s.


2.2.4 DDR Monitoring and Maintaining

Table 2‑11 DDR monitoring and maintaining

Command | Description
clear dialer [ interface dialer dialer-id ] | Clear up the DDR statistics information
show dialer [ { interface dialer dialer-id | maps | statement } ] | Display the DDR information


2.3 DDR Typical Configuration Example


2.3.1 Configure DDR Auto Dialing

Network Requirements

l On Device, configure the related command of auto dialing. After configuration, the dialing interface performs the auto dialing.

l Take the telecom mode in the 4G PPP dialing mode as an example to perform auto dialing.

Network Topology

Figure 2‑1 Networking of configuring the DDR auto dialing

Configuration Steps

Step 1:

Configure the dialing script.

#Configure the dialing script of Device modem; the script name is g3dia; the dialing command is ATDT.

Device#configure terminal

Device(config)#chat-script g3dia ATDT

Step 2:

Configure the dialing command in the dialing interface.

#Configure the dialing number of Device cellular1 as #777 and dialing script as g3dia. Enable DDR.

Device(config)#interface cellular 1

Device(config-if-Cellular1)#dialercellular1 string #777

Device(config-if-Cellular1)#scriptcellular1 dialer g3dia

Device(config-if-Cellular1)#pppcellular1 chap password card

Device(config-if-Cellular1)#pppcellular1 chap hostname card

Device(config-if-Cellular1)#ipcellular1 add negotiated

Device(config-if-Cellular1)#dialercellular1 in-band

#View the dialing status of the interface after Device cellular1 enables the DDR.

Device#show dialer

Cellular1 - dialer type = IN-BAND ASYNC

Idle timer (120 secs), Fast idle timer (20 secs)

Wait for carrier (60 secs), Re-enable (15 secs)

Dialer state is idle

Dial string Successes Failures Last called Last status

#777 0 0 never - Default

The dialing status of the interface cellular1 after enabling DDR is idle.

Step 3:

Configure the auto dialing command.

#Configure Device cellular1 as auto dialing.

Device(config-if-cellular1)#dialer mode auto

Device(config-if-cellular1)#exit

Step 4:

Check the result.

#View the dialing status of the interface after Device cellular1 automatically dials successfully.

Device#show dialer

Cellular1 - dialer type = IN-BAND ASYNC

Idle timer (120 secs), Fast idle timer (20 secs)

Wait for carrier (60 secs), Re-enable (15 secs)

Dialer state is data link layer up

Time until disconnect 37 secs

Current call connected 00:01:25

Connected to #777

Dial string Successes Failures Last called Last status

#777 1 0 00:01:25 successful Default

Dialing succeeded and the link layer negotiation also succeeded. The dialing status of the interface Cellular1 is data link layer up. Here, the data can be sent and received normally.

#View the dialing status of the interface after Device cellular1 automatically dials successfully.

Device#show interface cellular 1

cellular1:

line protocol is up

Flags: (0xc0080f1) POINT-TO-POINT MULTICAST RUNNING

Type: PPP

Internet address: 10.185.48.66/32

Destination Internet address: 172.22.212.127

Metric: 0, MTU: 1500, BW: 2 Kbps, DLY: 100000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters at: 15 hours 18 minutes 29 seconds

input peak rate 119 bits/sec, 0 hour 1 minute 20 seconds ago

output peak rate 97 bits/sec, 0 hour 1 minute 20 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

16 packets received; 14 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

LCP:OPENED

IPCP:OPENED

encap-type: simply PPP

Rx chars: 261, Tx chars 215

Rx overrun 0, Tx underrun 0

After auto dialing succeeded, the got IP address of cellular1 is 10.185.48.66 and the peer IP address is 172.22.212.127.

#View the route table after Device cellular1 automatically dials successfully.

Device#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 127.0.0.0/8 is directly connected, 02:36:16, lo0

C 10.185.48.66/32 is directly connected, 00:02:51, cellular1

C 172.22.212.127/32 is directly connected, 00:02:51, cellular1

There are two direct-connected routes with egress interface cellular1 on Device.


2.3.2 Configure DDR Dial-on-Demand

Network Requirements

l Configure the related command of dial-on-demand on the device. After configuration, the dialing interface performs the trigger dialing when there is matched IP packet to pass.

l Take the telecom mode in 4G PPP as an example to perform auto dialing.

Network Topology

Figure 2‑2 Networking of configuring DDR dial-on-demand

Configuration Steps

Step 1:

Configure the dialing script and dialing control list.

#Configure the dialing script of Device modem; the script name is g3dia and the dialing command is ATDT.

Device#configure terminal

Device(config)#chat-script g3dia ATDT

#Configure the dialing control list of Device dial-on-demand; the list number is 1; permit any IP packet.

Device(config)#dialer-list 1 protocol ip permit

Step 2:

Configure the dialing command in the dialing interface.

#Configure the dialing number of Device cellular1 as #777 and dialing script as g3dia; enable DDR.

Device(config)#interface cellular 1

Device(config-if-cellular1)#dialer string #777

Device(config-if-cellular1)#script dialer g3dia

Device(config-if-cellular1)#ppp chap password card

Device(config-if-cellular1)#ppp chap hostname card

Device(config-if-cellular1)#ip add negotiated

Device(config-if-cellular1)#dialer in-band

#Configure the associated dialing control list 1 of Device cellular1 dial-on-demand.

Device(config-if-cellular1)#dialer-group 1

Device(config-if-cellular1)#exit

Step 3:

Configure the route.

#Configure the default route of Device and the egress interface is cellular1.

Device(config)#ip route 0.0.0.0 0.0.0.0 cellular 1

Step 4:

View the dialing status of the interface when Device cellular1 does not dial on demand.

Device#show dialer

Cellular1 - dialer type = IN-BAND ASYNC

Idle timer (120 secs), Fast idle timer (20 secs)

Wait for carrier (60 secs), Re-enable (15 secs)

Dialer state is idle

Dial string Successes Failures Last called Last status

#777 0 0 never - Default

After enabling DDR, the dialing status of the interface cellular1 is idle.

Step 5:

Check the result.

#View the dialing status of the interface after Device cellular1 dials on demand successfully.

Device#show dialer

Cellular1 - dialer type = IN-BAND ASYNC

Idle timer (120 secs), Fast idle timer (20 secs)

Wait for carrier (60 secs), Re-enable (15 secs)

Dialer state is data link layer up

Dial reason: ip (s=130.255.149.19, d=2.2.2.2)

Time until disconnect 118 secs

Current call connected 00:00:14

Connected to #777

Dial string Successes Failures Last called Last status

#777 5 0 00:00:14 successful Default

The source address of the IP packet of triggering the dialing is 130.255.149.19 and the destination address is 2.2.2.2. If dialing succeeds, the link layer negotiation also succeeds and the dialing status of the interface cellular1 is data link layer up. Here, we can receive and send data normally.

#View the interface status after Device cellular1 dials on demand successfully.

Device#show interface cellular 1

cellular1:

line protocol is up

Flags: (0xc0080f1) POINT-TO-POINT MULTICAST RUNNING

Type: PPP

Internet address: 10.184.118.60/32

Destination Internet address: 172.22.212.124

Metric: 0, MTU: 1500, BW: 2 Kbps, DLY: 100000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters at: 18 hours 31 minutes 17 seconds

input peak rate 88 bits/sec, 0 hour 3 minutes 39 seconds ago

output peak rate 286 bits/sec, 0 hour 3 minutes 39 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

27 packets received; 36 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

LCP:OPENED

IPCP:OPENED

encap-type: simply PPP

Rx chars: 437, Tx chars 939

Rx overrun 0, Tx underrun 0

After dialing on demand succeeded, the got IP address of cellular1 is 10.184.118.60 and the peer IP address is 172.22.212.124.

#View the route table after Device dials on demand successfully.

Device#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

S 0.0.0.0/0 [1/5000000] is directly connected, 00:03:53, cellular1

C 127.0.0.0/8 is directly connected, 02:36:16, lo0

C 10.184.118.60/32 is directly connected, 00:03:53, cellular1

C 172.22.212.124/32 is directly connected, 00:03:53, cellular1

There are two direct-connected routes with egress interface cellular1 on Device.


3 PPPoE


3.1 Overview

With the development of the broadband network technology, the mainstream broadband access technologies, such as xDSL, CableModem and Ethernet are widely applied. Meanwhile, it brings some puzzles for the network carriers. No matter which access technology to be used, how to manage the users efficiently and how to get larger returns from the network investment are very important for them. Therefore, the problems about the charges for the various broadband access technologies become more sensitive. In the traditional Ethernet model, there is no the concept of user charges. Either the user sets/gets the IP address to access the network, or the user cannot access the network. IETF engineers adhere to the operation idea of narrowband dial-up for accessing Internet (use the NAS devices to terminate the PPP packets of the user) to work out the protocol of transmitting the PPP packets on the Ethernet

PPPoE (Point To Point Protocol Over Ethernet) is one protocol of realizing the PPP connection on Ethernet. It provides one standard of connecting multiple hosts in the broadcast network (such as Ethernet) to the remote access concentrator (broadband access server). It adopts the client/server mode. On typical PPPoE application is that PC uses the PPPoE dialing software to set up the point-to-point connection via Ethernet and access concentrator.

PPPoE has two stages, that is, PPPoE Discovery Stage and PPPoE Session Stage. No matter which stage of data packets will eventually be encapsulated into Ethernet frames for transmission.


3.1.1 PPPoE Discovery Stage

At the different stages of PPPoE, the data contents in the payload domain of the PPPoE frame are different. During the discovery stage of PPPoE, fill in some tag in the domain; while during the PPPoE session stage, fill in the PPP packets in the domain. The discovery stage is divided to four steps:

Step 1: The user host first sends one PADI (PPPoE Active Discovery Initiation) packet. The user host sends the packet via the broadcast mode, so the destination address of the Ethernet frame of the packet is filled with all 1, while the source address is filled with the MAC address of the user host. The broadcast packet may be received by multiple access concentrators. The PADI packet should contain one correct service name tag requested by the user host.

Step 2: The access concentrator sends the PADO (PPPoE Active Discovery Offer) packet to answer the PADI packet sent by the user host. The source address of the Ethernet frame of the packet is filled with the MAC address of the access concentrator, while the destination address is filled with the MAC address of the user host got from PADI. The PADO packet should contain one access concentrator name tag, the confirm tag for the service name tag in the PADI and some confirm tags for other tags. If the service access concentrator applied by the user host does not support, the access concentrator does not answer the PADO packet.

Step 3: The user host sends the unicast PADR (PPPoE Active Discovery Request) packet to the access concentrator. The user host selects one access concentrator according to the service name tag of the received PADO packet, and then sends the PADR packet to it. After the user host receives the PADO packet, it gets to know the MAC address of the access concentrator, so the source address of the Ethernet frame of the PADR packet is filled with the MAC address of the user host and the destination address is filled with the MAC address of the access concentrator. The PADR packet should contain one service name tag, indicating the the service requested by the user host and other tag types.

Step 4: When receiving the PADR packet, the access concentrator prepares to start one PPP session, while the access concentrator distributes one unique session ID for the session and carries the session ID in the PADS (PPPoE Active Discovery Session-confirmation) packet sent to the host. If the access concentrator does not meet the service applied by the user, the PADS packet carries the error tag of one service name.

With the above four steps, the user host and access concentrator get the peer MAC address and the unique session ID, so as to enter the PPPoE session stage. Here, the unique point-to-point session is set up between the host and the access concentrator.


3.1.2 PPPoE Session Stage

Once PPPoE enters the session stage, PPP packet is filled in the payload of the PPPoE frame and transmitted to the peer. Here, all Ethernet packets sent by the both are all the peer MAC address. During the session stage, any party of the host or access concentrator can send the PADT (PPPoE Active Discovery Terminate) packet to inform the peer party to end the session.


3.2 PPPoE Function Configuration

Table 3‑1 PPPoE function configuration list

Configuration Task
Configure the PPPoE dialing interface | Configure the dialing interface
Configure the PPPoE dialing mode | Configure the dialing mode


3.2.1 Configure PPPoE Dialing Interface

Configuration Conditions

Before configuring the PPPoE dialing interface, first complete the following tasks:

l Configure the dialer interface

l Configure the dialing pool of the dialer interface (refer to the related chapters of the DDR configuration manual)

Configure Dialing Interface

Before configuring the PPPoE session, we need to configure one dialer interface at first and configure the dialing pool on the dialer interface. Each PPPoE session corresponds to one dialing pool uniquely, and each dialing pool corresponds to one dialer interface uniquely. This is equivalent to set up one PPPoE session via one dialer interface.

To configure the dialing interface, we need to configure in the interface.

Table 3‑2 Configure the dialing interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the dialing interface | pppoe-client dial-pool-number dial-pool-number [ ac-name ac-name ] | Mandatory By default, do not configure the dialing interface.


3.2.2 Configure PPPoE Dialing Mode

Configuration Condition

Before configuring the PPPoE dialing mode, first complete the following task:

l Configure the PPPoE dialing interface

Configure Dialing Mode

PPPoE dialing mode includes two kinds: packet trigger dialing and auto dialing. The work mechanism is described as follows:

l Packet triggering dialing: After the physical line is enabled, the device does not initiate the PPPoE call at once. Only when there is data to be transmitted, the device initiates the PPPoE call to set up the PPPoE session. If the idle time of the PPPoE link exceeds the value configured by the user (by default, the idle time of the dialing interface is 120s. Refer to the DDR chapter of the configuration manual), the device automatically ends the PPPoE session.

l Auto dialing: After the device configuration is complete, initiate the PPPoE call at once to set up the PPPoE session. Auto dialing is also divided to the permanent dialing and dialing in time period. The permanent dialing indicates that when the idle time of the link exceeds the value configured by the user (by default, the idle time of the dialing interface is 120s), the device automatically ends the PPPoE session and re-initiates the PPPoE call to set up the session. The dialing in time period means that the device can initiate the PPPoE call to set up the PPPoE session only in the time period configured by the user. After exceeding the time period configured by the user, the device disconnects the session automatically.

To configure the dialing mode, we need to configure in the interface.

Table 3‑3 Configure the dialing mode

Operation | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the dialing mode | pppoe-client auto-dial { always | time-range time-range-string } | Mandatory By default, do not configure the dialing mode.


3.2.3 Configure PPPoE Server

Configuration Condition

l It can be configured on the Ethernet primary interface, Ethernet sub interface, virtual Ethernet interface, bvi interface and so on.

Configure PPPOE Server

Enable the PPPoE server function to monitor the PPPoE negotiation packets from the client on the line, so as to set up the session connection with the client. Before enabling the server, it is necessary to configure VPDN first, encapsulate the PPPOE protocol, and configure the virtual template. To prevent the client attack, the server can limit the number of the connections with one MAC.

Table 3‑4Configure enabling the server mode

Operation | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure enabling the PPPOE server mode | pppoe enable | Mandatory By default, do not configure enabling the server mode.

Table 3‑5 Configure using the PPPOE protocol on VPDN

Operation | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the VPDN mode | vpdn-group vpdn-name | -
Enter the VPDN access mode | accept-dialin | -
Encapsulate the PPPOE protocol | protocol pppoe | Mandatory By default, do not encapsulate the PPPOE protocol.

Table 3‑6Configure the max. connections of one MAC

Operation | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the VPDN mode | vpdn-group vpdn-name | -
Configure the maximum connections of one MAC | pppoe limit per-mac num | By default, one MAC permits 10 connections.


3.2.4 PPPoE Monitoring and Maintaining

Table 3‑7 PPPoE monitoring and maintaining

Command | Description
debug pppoe { events |receive | send} gigabitethernet interface-unit | View the packet content and event during the PPPoE negotiation
show pppoe list | View the interface configured with PPPoE
show pppoe session { count | information } | View the PPPoE session information, including session quantity and session details


3.3 PPPoE Typical Configuration Example


3.3.1 Configure PPPoE Conventional Dialing

Network Requirement

l Device1 serves as the PPPoE client and Device2 serves as the PPPoE server. Use the PPPoE conventional dialing mode to set up the PPPoE session between Device1 and Device2.

Network Topology

Figure 3‑1 Networking of configuring the PPPoE conventional dialing

Configuration Steps

Step 1:

Configure the PPPoE client.

#Configure Device1.

Configure the trigger dialing type.

Device1#configure terminal

Device1(config)#dialer-list 1 protocol ip permit

Create the dialer0 interface and configure the dialing information.

Device1(config)#interface dialer0

Device1(config-if-dialer0)#ip address negotiated

Device1(config-if-dialer0)#dialer in-band

Device1(config-if-dialer0)#dialer pool 1

Device1(config-if-dialer0)#dialer-group 1

Device1(config-if-dialer0)#exit

Add gigabitethernet0/0 to vlan100, and add the interface vlan100 to the dialing pool 1..

Device1(config)#interface gigabitethernet0/0

Device1 (config-if-gigabitethernet0/0)#switchport mode access

Device1 (config-if-gigabitethernet0/0)#switchport access vlan 100

Device1(config)#interface vlan100

Device1(config-if-vlan100)#pppoe-client dial-pool-number 1

Device1(config-if-vlan100)#exit

Configure one default route with one egress interface dialer0.

Device1(config)#ip route 0.0.0.0 0.0.0.0 dialer0

Step 2:

Configure the PPPoE server.

#Configure Device2.

Create the loopback port Loopback0 and configure the address.

Device2#configure terminal

Device2(config)#interface loopback0

Device2(config-if-loopback0)#ip address 172.16.20.1 255.255.255.255

Device2(config-if-loopback0)#exit

Create the virtual template virtual-template0.

Device2(config)#ip local pool pppoe-pool 172.16.20.10 172.16.20.100

Device2(config)#interface virtual-template 0

Device2(config-if-virtual-template0)#ip unnumbered loopback0

Device2(config-if-virtual-template0)#encapsulation ppp

Device2(config-if-virtual-template0)#peer default ip address pool pppoe-pool

Device2(config-if-virtual-template0)#exit

Create the VPDN group pppoe, and user the virtual template virtual-template0.

Device2(config)#vpdn enable

Device2(config)#vpdn-group pppoe

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol pppoe

Device2(config-vpdn-acc-in)#virtual-template 0

Device2(config-vpdn)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#pppoe enable

Device2(config-if-gigabitethernet0)#exit

Step 3:

Check the result.

#View the dialer0 interface information of Device1.

Device1#show interface dialer0

dialer0:

line protocol is up

Flags: (0x1c008071) POINT-TO-POINT MULTICAST ARP RUNNING

Type: PPP

Internet address: 172.16.20.10/32

Destination Internet address: 0.0.0.0

Metric: 0, MTU: 1492, BW: 56 Kbps, DLY: 20000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters never

input peak rate 44 bits/sec, 0 hour 0 minute 29 seconds ago

output peak rate 288 bits/sec, 0 hour 0 minute 29 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

1 packets received; 4 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

We can see that the dialer interface protocol of Device1 is up and can get the IP address.

#View the PPPoE session information of Device1.

Device1#show pppoe session information

PPPoE Session Information:(Max Sessions=1024)

UID SID RemMAC LocMAC O-Intf state C/S ActiveTime Local-IP Peer-IP

----- ----- -------------- -------------- ---------------- ----- --- ---------- ---------------- ----------------

85 85 0001.7adf.8d1c 0001.7adf.e580 gigabitethernet0 UP C 00:21:26 172.16.20.10 172.16.20.1

There are 1 PPPoE sessions up

We can see that the PPPoE session is set up between Device1 and Device2.

#We can ping the Loopback0 interface address of Device2 on Device1.

Device1#ping 172.16.20.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 172.16.20.1 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.


3.3.2 Configure PPPoE Auto Dialing

Network Requirement

l Device1 serves as the PPPoE client and Device2 serves as the PPPoE server. Use the PPPoE auto dialing mode to set up the PPPoE session between Device1 and Device2.

Network Topology

Figure 3‑2 Networking of configuring the PPPoE auto dialing

Configuration Steps

Step 1:

Configure the PPPoE client.

#Configure Device1.

Configure the trigger dialing type.

Device1#configure terminal

Device1(config)#dialer-list 1 protocol ip permit

Create the dialer0 interface and configure the dialing information.

Device1(config)#interface dialer0

Device1(config-if-dialer0)#ip address negotiated

Device1(config-if-dialer0)#dialer in-band

Device1(config-if-dialer0)#dialer pool 1

Device1(config-if-dialer0)#dialer-group 1

Device1(config-if-dialer0)#exit

Add gigabitethernet0/0 to vlan100, and add vlan100 interface to dialing pool 1 and configure the auto dialing.

Device1(config)#interface gigabitethernet0/0

Device1 (config-if-gigabitethernet0/0)#switchport mode access

Device1 (config-if-gigabitethernet0/0)#switchport access vlan 100

Device1(config)#interface vlan100

Device1(config-if-vlan100)#pppoe-client dial-pool-number 1

Device1(config-if-vlan100)#pppoe-client auto-dial always

Device1(config-if-vlan100)#exit

Step 2:

Configure the PPPoE server.

#Configure Device2.

Create the loopback port Loopback0 and configure the address.

Device2#configure terminal

Device2(config)#interface loopback0

Device2(config-if-loopback0)#ip address 172.16.20.1 255.255.255.255

Device2(config-if-loopback0)#exit

Create the virtual template virtual-template0.

Device2(config)#ip local pool pppoe-pool 172.16.20.10 172.16.20.100Device2(config)#interface virtual-template 0

Device2(config-if-virtual-template0)#ip unnumbered loopback0

Device2(config-if-virtual-template0)#encapsulation ppp

Device2(config-if-virtual-template0)#peer default ip address pool pppoe-pool

Device2(config-if-virtual-template0)#exit

Create the virtual VPDN group pppoe and use the virtual template virtual-template0.

Device2(config)#vpdn enable

Device2(config)#vpdn-group pppoe

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol pppoe

Device2(config-vpdn-acc-in)#virtual-template 0

Device2(config-vpdn)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#pppoe enable

Device2(config-if-gigabitethernet0)#exit

Step 3:

Check the result.

#View the dialer0 interface information of Device1.

Device1#show interface dialer0

dialer0:

line protocol is up

Flags: (0x1c008071) POINT-TO-POINT MULTICAST ARP RUNNING

Type: PPP

Internet address: 172.16.20.10/32

Destination Internet address: 0.0.0.0

Metric: 0, MTU: 1492, BW: 56 Kbps, DLY: 20000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters never

input peak rate 44 bits/sec, 0 hour 0 minute 29 seconds ago

output peak rate 288 bits/sec, 0 hour 0 minute 29 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

1 packets received; 4 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

We can see that the dialer0 interface protocol of Device1 is up and can get the IP address.

#View the PPPoE session information of Device1.

Device1#show pppoe session information

PPPoE Session Information:(Max Sessions=1024)

UID SID RemMAC LocMAC O-Intf state C/S ActiveTime Local-IP Peer-IP

----- ----- -------------- -------------- ---------------- ----- --- ---------- ---------------- ----------------

85 85 0001.7adf.8d1c 0001.7adf.e580 gigabitethernet0 UP C 00:21:26 172.16.20.10 172.16.20.1

There are 1 PPPoE sessions up

We can see that the PPPoE session is set up between Device1 and Device2 successfully.

#We can ping the Loopback0 interface address of Device2 on Device1.

Device1#ping 172.16.20.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 172.16.20.1 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.


3.3.3 Configure PPPoE Time Period-based Auto Dialing

Network Requirement

l Device1 serves as the PPPoE client and Device2 serves as the PPPoE server. Use the PPPoE time period-based auto dialing mode to realize that the client auto dials at 8 o’clock of every day to set up the PPPoE session with Device2 and auto disconnects after 18 o’clock.

Network Topology

Figure 3‑3 Networking of configuring the PPPoE time period-based auto dialing

Configuration Steps

Step 1:

Configure the PPPoE client.

#Configure Device1.

Configure the trigger dialing type.

Device1#configure terminal

Device1(config)#dialer-list 1 protocol ip permit

Create the dialer0 interface.

Device1(config)#interface dialer0

Device1(config-if-dialer0)#ip address negotiated

Device1(config-if-dialer0)#dialer in-band

Device1(config-if-dialer0)#dialer pool 1

Device1(config-if-dialer0)#dialer-group 1

Device1(config-if-dialer0)#exit

Configure the time period of auto dialing to 8 :00 to 18 :00.

Device1(config)# time-range maipu

Device1(config-if-dialer0)# periodic daily 08:00 to 18:00

Device1(config-if-dialer0)#exit

Add gigabitethernet0/0 to vlan100, add vlan100 interface to dialing pool 1, and configure auto dialing.

Device1 (config)#interface gigabitethernet 0/0

Device1 (config-if-gigabitethernet0/0)#switchport mode access

Device1 (config-if-gigabitethernet0/0)#switchport access vlan 100

Device1(config)#interface vlan100

Device1(config-if-vlan100)#pppoe-client dial-pool-number 1

Device1(config-if-vlan100)#pppoe-client auto-dial always

Device1(config-if-vlan100)#exit

Step 2:

Configure the PPPOE server.

# Configure Device2.

Create the loopback port Loopback0, and configure the address pool pppoe-pool.

Device2#configure terminal

Device2(config)#interface loopback0

Device2(config-if-loopback0)#ip address 172.16.20.1 255.255.255.255

Device2(config-if-loopback0)#exit

Device2(config)#ip local pool pppoe-pool 172.16.20.10 172.16.20.100

Create the virtual template virtual-template0.

Device2(config)#interface virtual-template 0

Device2(config-if-virtual-template0)#ip unnumbered loopback0

Device2(config-if-virtual-template0)#encapsulation ppp

Device2(config-if-virtual-template0)#peer default ip address pool pppoe-pool

Device2(config-if-virtual-template0)#exit

Create the VPDN group pppoe, and user the virtual template virtual-template0.

Device2(config)#vpdn enable

Device2(config)#vpdn-group pppoe

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol pppoe

Device2(config-vpdn-acc-in)#virtual-template 0

Device2(config-vpdn)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#pppoe enable

Device2(config-if-gigabitethernet0)#exit

Step 3:

Check the result.

#View the dialer0 interface infiormation of Device1.

Device1#show interface dialer0

dialer0:

line protocol is up

Flags: (0x1c008071) POINT-TO-POINT MULTICAST ARP RUNNING

Type: PPP

Internet address: 172.16.20.10/32

Destination Internet address: 0.0.0.0

Metric: 0, MTU: 1492, BW: 56 Kbps, DLY: 20000 usec, VRF: global Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters never

input peak rate 44 bits/sec, 0 hour 0 minute 29 seconds ago

output peak rate 288 bits/sec, 0 hour 0 minute 29 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

1 packets received; 4 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors 0 collisions; 0 dropped

You can see that the dialer0 interface protocol of Device1 is up and the IP address can be got.

#View the PPPoE session information of Device1.

Device1#show pppoe session information

PPPoE Session Information:(Max Sessions=1024)

UID SID RemMAC LocMAC O-Intf state C/S ActiveTime Local-IP Peer-IP

----- ----- -------------- -------------- ---------------- ----- --- ---------- ---------------- ----------------

85 85 0001.7aca.72ef 0001.7a5e.6a0a gigabitethernet0 UP C 00:21:26 172.16.20.10 172.16.20.1

There are 1 PPPoE sessions up

You can see that the PPPoE session is set up between Device1 and Device2 successfully.

#Device1 can ping the Loopback0 interface address of Device2.

Device1#ping 172.16.20.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 172.16.20.1 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms

l The method of Device2 viewing whether PPPoE is set up successfully is the same as that of Device1, so the process is omitted here.


4 NDIS-DIAL


4.1 Overview

NDIS-DIAL (Network Driver Interface Standard-Dial) indicates the dialing function especially applied on the 4G interface, mainly completing the dialing actions, such as trigger dialing, hang up link, and disconnect and re-dial, and providing the perfect link status detection mechanism (Track detection and BFD detection). When the link fails, automatically disconnect and re-dial, trying to restore the data communication automatically. Compared with the 4G DDR dialing (PPP mode), the NDIS-DIAL function is simpler and more reliable.


4.2 NDIS-DIAL Function Configuration

Table 4‑1NDIS-DIAL function configuration list

Configuration Task
Configure NDIS-DIAL basic function | Configure NDIS-DIAL to auto dial
 | Configure NDIS-DIAL to dial on demand
 | Configure the idle time of the NDIS-DIAL link
 | Configure the NDIS-DIAL re-dial wait time
Configure 4G to associate with Track | Configure the 4G interface to associate with Track
 | Configure the Track detection parameters
Configure 4G to associate with BFD | Configure the 4G interface to associate with BFD
 | Configure the BFD detection parameters


4.2.1 Configure NDIS-DIAL Basic Function

Configuration Condition

No

Configure NDIS-DIAL to Auto Dialing

After enabling the auto dialing function, the interface will always try to dial, so try to ensure that the 4G interface is available.

Table 4‑2 Configure NDIS-DIAL to auto dialing

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure NDIS-DIAL to auto dialing | dialer mode auto | Mandatory By default, the interface does not configure the NDIS-DIAL dialing mode.

Configure NDIS-DIAL to Dial on Demand

After the 4G interface enables the dial-on-demand function, trigger dialing when there is data sent. You can select any IP data flow or data flow meeting the ACL rule to configure the dial-on-demand function.

Table 4‑3 Configure NDIS-DIAL to dial on demand

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure NDIS-DIAL to dial on demand | dialer-group ip [any | access-list [access-list-name | access-list-number]] | Mandatory By default, the interface is not configured with the NDIS-DIAL dial-on-demand mode.

Configure Idle Time of NDIS-DIAL Link

The 4G interface does not have the data flow to pass within a period of time. After the idle time exceeds the configured link idle time, actively disconnect the line. The link idle time takes effect only in the dial-on-demand mode, including three cases: the link idle time when the sending direction of the 4G interface does not have data flow, the link idle item when the receiving direction of the 4G interface does not have data flow, the link idle time when both the sending and receiving directions of the 4G interface do not have data flow.

Table 4‑4 Configure NDIS-DIAL to dial on demand

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the idle time of the NDIS-DIAL link | dialer idle-timeout time [either | inbound ] | Optional By default, the idle time of the link at the sending direction is 120s in the dial-on-demand mode.

l It is not suggested to configure the idle time of the link in the auto dial mode.

Configure NDIS-DIAL Re-dial Wait Interval

Configure the interval before starting the next dialing after the 4G interface is disconnected.

Table 4‑5 Configure NDIS-DIAL re-dial wait interval

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure NDIS-DIAL to dial on demand | dialer interval-time time | Optional By default, the re-dial interval is 10s.

l It is not suggested that the re-dial interval is smaller than 10s.


4.2.2 Configure 4G to Associate with Track

Configuration Condition

Before configuring 4G to associate with Track, first complete the following tasks:

l Create Track group

l Configure Track monitor object

l Configure the dialing mode of 4G interface

Configure 4G Interface to Associate with Track

Associate the 4G interface with the Track object. According to the reported status of the Track object, determine whether to disconnect the 4G interface and re-dial, and try to restore the data communication automatically.

Table 4‑6 Configure 4G interface to associate with Track

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure 4G interface to associate with Track | dialer track id id | Mandatory By default, do not configure the 4G interface to associate with Track.

l For Track configuration, refer to Track configuration manual.

Configure Track Detection Parameters

After the 4G interface dials successfully and if the communication is normal, the Track status changes to UP. Otherwise, the Track status will keep DOWN. To get the correct Track status after the 4G interface dials successfully, it needs to wait for some time before getting the Track status for the first time. If the got Track status after waiting some time is still DOWN, it indicates that the line may fail, disconnect the 4G interface and re-dial.

Table 8‑4 Configure Track detection parameters

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the Track detection parameter | dialer track interval interval | Optional By default, the waiting time of the 4G interface getting the Track status after dialing successfully is 15s.


4.2.3 Configure 4G to Associate with BFD

Configuration Condition

Before configuring 4G to associate with BFD, first complete the following task:

l Configure the interface dialing mode

Configure 4G Interface to Associate with BFD

The BFD (Bidirectional Forwarding Detection) protocol is one standard unified detection mechanism, used to fast detect and monitor the path in the network or the connection status of the IP route forwarding. Associating the 4G interface with BFD can fast detect the link fault between the 4G interface and upper end.

Table 4‑7 Configure 4G interface to associate with BFD

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the 4G interface to associate with BFD | dialer bfd remote-ip ipaddress [ local-ip ipaddress ] | Mandatory By default, do not configure the 4G interface to associate with BFD.

l Usually, it is not suggested to configure local-ip, and NDIS-DIAL will use the interface address as the source address.

Configure BFD Detection Parameter

The BFD detection parameter is used to control the frequency of the 4G interface sending and receiving the BFD detection packets.

Table 8‑6 Configure the BFD detection parameter

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the BFD detection parameter | dialer bfd { min-receive-interval value | min-transmit-interval value | multiplier value } | Optional By default, the value of min-transmit-interval is 10000, the value of min-transmit-interval is 10000, and the value of multiplier is 3.

l For the meaning of min-receive-interval, min-transmit-interval, and multiplier, refer to the BFD command manual.


4.2.4 NDIS-DIAL Monitoring and Maintaining

Table 4‑8 NDIS-DIAL monitoring and maintaining

Command | Description
clear dialer mode [interface-name] | Clear the NDIS-DIAL information
show dialer mode [interface-name] | Display the NDIS-DIAL information
[no] debug ndis [global| interface-name[mode | packet]] | Display the NDIS-DIAL DEBUG information


4.3 NDIS-DIAL Typical Configuration Example


4.3.1 Typical Configuration Example of 4G Dialing

Network Requirement

l Device1 is connected to the specified private network environment via the domain name.

l Device1 serves as the node device, the carrier device servers LAC, and Device2 serves as LNS. Set up the L2TP tunnel between LAC and Device2.

l Associate Track on the 4G interface of Device1, used to detect the link status between the node router to LNS.

Network Topology

Device | Interface | IP Address | Device | Interface | IP Address
Device1 | Vlan100 | 172.16.2.1/24 | Device2 | Loopback0 | 64.19.245.250 /24
AAA |  | 130.255.12.28/24 |  | Gi0 | 125.71.215.223/24
 |  |  |  | Gi1 | 26.1.1.1/24
 |  |  |  | Gi2 | 130.255.100.29/24

Configuration Steps

Step 1: | Configure the IP address and route of the interface (omitted).
Step 2 : | Configure the 4G interface.

#Configure the dial user name and password of Device1 4G interface fastcellular1. Configure the interface to the auto dial mode, and get the IP address via DHCP.

Device1#configure terminal

Device1(config)#interface fastcellular1

Device1(config-if-fastcellular1)#dialer config username test@jsyh.vpdn.sc password 0 admin

Device1(config-if-fastcellular1)#dialer mode auto

Device1(config-if-fastcellular1)#ip address dhcp

Device1(config-if-fastcellular1)#exit

l 4G private network can be accessed via APN and domain name. The specific mode depends on the carrier. In the example, user the domain name to access.

Step 3 :

Configure AAA.

#Configure Device2.

Use Radius to authenticate, name the authentication list and authorization list as ppp, and configure the address, authentication port, statistics port, and the password of the Radius server.

Device2(config)#aaa new-model

Device2(config)#aaa authentication ppp ppp radius none

Device2(config)#aaa authorization network ppp radius

Device2(config)#radius-server host 130.255.12.28 auth-port 1812 acct-port 1813 priority 0 key 0 a

Step 4:

Configure the L2TP tunnel.

#Configure Device2.

Configure the virtual template virtual-template 1.

Device2(config)#interface virtual-template 1

Device2(config-if-virtual-template1)#encapsulation ppp

Device2(config-if-virtual-template1)#ppp mtu adaptive proxy

Device2(config-if-virtual-template1)#ppp authentication chap ppp

Device2(config-if-virtual-template1)#ppp authorization ppp

Device2(config-if-virtual-template1)#ip unnumber loopback0

Device2(config-if-virtual-template1)#exit

Enable the VPDN function and configure the VPDN group.

Device2(config)#vpdn enable

Device2(config)#vpdn-group 1

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol l2tp

Device2(config-vpdn-acc-in)#virtual-template 1

Device2(config-vpdn-acc-in)#exit

Configure only accepting the L2TP connection request of LAC with hostname as GGSNCD01 (optional).

Device2(config-vpdn)#terminate-from hostname GGSNCD01

Configure the L2TP tunnel authentication password, which should be the same as the L2TP password provided by the carrier.

Device2(config-vpdn)#l2tp tunnel password admin

On Device2, view the L2TP tunnel connection status.

Device2#show vpdn detail

L2TP MaxTun 6000, MaxSes 6000:

tunnel free num: 5999

TUNNELS:

LocID LocName RemID RemName RemAddr Vpdn Port Sess State

78 Router 78 GGSNCD01 115.169.201.159 1 1701 1 ESTAB

session free num: 1999

SESSIONS:

LocID TunID RemID IfName User SysId Imsi/calling-noState

30 78 386 virtual-access2 test1@jsyh.vpdn.sc - 460110500000920 ESTAB

L2TP total Tunnel and Session Information. Tunnel 1 Session 1

After dialing successfully, the 4G interface of Device1 can get the IP address and the protocol is UP.

Device1#show interface fastcellular 1

Fastcellular1:

line protocol is up

Flags: (0xc208063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 64.19.245.249/30

Broadcast address: 64.19.245.251

Metric: 0, MTU: 1500, BW: 100000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.7ab8.d858

Last clearing of "show interface" counters never

input peak rate 596 bits/sec, 1 hour 58 minutes 8 seconds ago

output peak rate 715 bits/sec, 1 hour 58 minutes 8 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

618 packets received; 1807 packets sent

4 multicast packets received

29 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

Rate: auto Duplex: auto

rxframes 618, rx bytes 52160, rx arps 21

txframes 1807, tx bytes 308654, tx arps 25

rx errors 0, tx errors 0

On Device1, ping the address of the virtual interface virtual-access2 on Device2, and view whether the ping can be connected.

Device1#ping 64.19.245.250

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 64.19.245.250 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 316/502/1066 ms.

Device1 can ping the address of the virtual interface virtual- access2 on Device2.

Step 5:

Configure associating the 4G interface with Track.

#On Device1, configure the ICMP-echo entity to detect the network connectivity between Device1 and Device2, and add the entity to the entity group. Schedule RTR group 1.

Device1(config)#rtr enable

Device1(config)#rtr 1 icmpecho

Device1(config-rtr-icmpecho)#set 64.19.245.250 5 70 2 12

Device1(config-rtr-icmpecho)#exit

Device1(config)#rtr group 1

Device1(config-rtr-group)#member 1

Device1(config-rtr-group)#exit

Device1(config)#rtr schedule 1 group 1 start now ageout 100 life forever

Create the association between Track and SLA.

Device1(config)#track 1

Device1(config-track)#rtr 1

Device1(config-track)#exit

On the 4G interface, associate Track1.

Device1(config)# interface fastcellular1

Device1(config-if-fastcellular1)#dialer track id 1

l For the SLA configuration, refer to the chapter SLA of the configuration manual.

Step 6:

Check the result.

When the link status between Device1 and Device2 is normal, view that the track status on Device1 is UP.

Device1#show track object

track 1

status = up

entnum = 1

logic operator AND

Object Type Status Refcnt instruction

------------------------- -------- ------ ----------------------------------------

rtr up 1 rtr 1

-------------------------------------------------------------------------------------

module priority caller

------------------------- -------- ------

NDISDDR 20 0xd56b88

-------------------------------------------------------------------------------------

#On Device1, you can see that the 4G interface status is UP and can get the IP address.

Device1#show interface fastcellular 1

Fastcellular1:

line protocol is up

Flags: (0xc208063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 64.19.245.249/30

Broadcast address: 64.19.245.251

Metric: 0, MTU: 1500, BW: 100000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.7ab8.d858

Last clearing of "show interface" counters never

input peak rate 596 bits/sec, 1 hour 58 minutes 8 seconds ago

output peak rate 715 bits/sec, 1 hour 58 minutes 8 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

618 packets received; 1807 packets sent

4 multicast packets received

29 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

Rate: auto Duplex: auto

rxframes 618, rx bytes 52160, rx arps 21

txframes 1807, tx bytes 308654, tx arps 25

rx errors 0, tx errors 0

When the link status between Device1 and Device2 is not normal, view that the track status on Device1is down, make the 4G interface down, and re-dial.


1 Link Aggregation


1.1 Overview

Through link aggregation, multiple physical links between two devices are bound to form a logic link so as to expand link capacity. Within the logic link, the physical links act as redundancy and dynamic backup of each other, providing higher network connection reliability.


1.1.1 Basic Concepts

Aggregation Group and Member Ports

Multiple physical ports are bound to form an aggregation group, and the physical ports are member ports of the aggregation group.

Member Port Status

The member ports of an aggregation group have the following two statuses:

l Selected: The member ports which are in this status can participate in user service traffic forwarding. The member ports in this status are called "the selected ports".

l Unselected: The member ports which are in this status cannot participate in user service traffic forwarding. The member ports in this status are called "the unselected ports".

The rate and duplex mode of an aggregation group is determined by the selected ports in the aggregation group. The rate of an aggregation group is the sum of all selected ports, and the duplex mode of the aggregation group is the same as the duplex mode of the selected ports.

Operation Key

An operation key is the property configuration of member ports. It consists of the rate, duplex mode, and administrative key (that is, the aggregation group number). In property configuration, change of the duplex mode or rate may cause re-calculation of the operation key.

In one aggregation group, if the duplex mode or rate of member ports are different, then the generated operation keys are different. However, the member ports that are in the selected status must have the same operation key.

LACP

Link Aggregation Control Protocol (LACP) is a protocol that is based on IEEE802.3ad. The LACP protocol exchanges messages with the peer end via the Link Aggregation Control Protocol Data Unit (LACPDU).

LACP Priorities

LACP priorities are categorized into two types: system LACP priorities and port LACP priorities.

l System LACP priorities: They are used to determine the LACP priority order of the devices at two ends.

l Port LACP priorities: They are used to determine the priority order at which the member ports of the local device are selected.

System ID and Port ID

System ID: Aggregation property of a device. It consists of the system LACP priority of the device and the system MAC address. The higher the system LACP priority is, the better the system ID of the device is. If the system LACP priorities are the same, then the smaller the system MAC address is, the better the system ID of the device is.

Port ID: Aggregation property of a port. It consists of the port LACP priority and the port number. The higher the port LACP priority is, the better the port ID is. If the port LACP priorities are the same, then the smaller the port number is, the better the port ID is.

Root Port of an Aggregation Group

The protocols that are applied in an aggregation group receive and send protocol packets through the root port of the aggregation group. The root port of an aggregation group is selected from the member ports of the aggregation group. The physical link of the root port must be in the up status.


1.1.2 Link Aggregation Modes

Link aggregation modes include the static aggregation mode and the dynamic aggregation mode. Aggregation groups are categorized into static aggregation groups and dynamic aggregation groups.

Static Aggregation Mode

In static aggregation mode, the LACP protocol of the member ports of the devices at the two ends are in the disabled status. In the static aggregation group of the local device, set the selected and unselected status for the member ports by following the guidelines as described below:

Figure 1‑1 Setting the status of member ports in static aggregation mode

Dynamic Aggregation Mode

In dynamic aggregation ports, a port can join in a dynamic aggregation group in two modes, active or passive.

l If the duplex mode of the port is full duplex:

If the port joins in a dynamic aggregation group in active mode, the LACP protocol is enabled for the port.

If the port joins in a dynamic aggregation group in passive mode, the LACP protocol is disabled for the port. After it receives the LACPDU packets from the peer port, the LACP protocol is enabled.

l If the duplex mode of the port is half duplex, no matter the port joins in a dynamic aggregation group in either mode, the LACP protocol is disabled for the port.

In the dynamic aggregation group, set the selected and unselected status for the member ports by following the guidelines as described below:

First determine the device with a better system ID. Then the device determines the statuses of the member ports of the devices at the two ends. The device with the better system ID sets the selected and unselected status for the member ports by following the guidelines as described below:

Figure 1‑2 Setting the Status of member ports in dynamic aggregation mode


1.1.3 Load Balancing Modes of Aggregation Groups

Three load balancing modes are available, and users can select a mode according to the actual requirement.

l Load balancing based on the destination MAC addresses: The aggregation group implements aggregated load balancing based on the destination MAC addresses of packets.

l Load balancing based on the source and destination MAC addresses: The aggregation group implements aggregated load balancing based on the source and destination MAC addresses of packets.

l Load balancing based on the source MAC addresses: The aggregation group implements aggregated load balancing based on the source MAC addresses of packets.


1.2 Link Aggregation Function Configuration

Table 1‑1 Link aggregation function list

Configuration Tasks
Configure an aggregation group. | Create an aggregation group.
 | Add ports into the aggregation group.
Configure the load balancing mode of the aggregation group. | Configure the load balancing mode of the aggregation group.
Configure LACP priorities. | Configure the system LACP priority.
 | Configure the port LACP priority.


1.2.1 Configure an Aggregation Group

After configuring an aggregation group, you can manage multiple physical ports in a centralized manner. Any configuration on the aggregation group will be applied to each member port.

l A device supports up to 2 aggregation groups, up to 4 ports can join in the aggregation group at the same time, and up to 4 ports can be in the selected status at the same time.

Configuration Condition

None

Create an Aggregation Group

The aggregation groups at the two ends of an aggregated link must be configured to the same type. Description can be added to each aggregation group to make it easier for network administrators to distinguish the aggregation groups.

Table 1‑2 Creating an aggregation group

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Create an aggregation group. | link-aggregation link-aggregation-id mode { manual | lacp } | Mandatory. By default, no aggregation group is created.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id | -
Configure the description for the aggregation group. | description description-name | Optional. By default, no description is added to the aggregation group.

l The protocols that are applied in an aggregation group receive and send protocol packets through the root port of the aggregation group. In static aggregation mode, because the member ports between the devices at two ends do not exchange LACPDU packets, the root ports of the two devices may be on different physical links. As a result, other protocol packets on the aggregation group may fail to be received or sent. To prevent this problem, ensure that the root ports of the devices at the two ends are on the same physical link. In dynamic aggregation mode, the member ports of the devices at two ends exchange LACPDU packets. The negotiation between the two member ports ensures that the root ports of the two devices are on the same physical link.

l After an aggregation group is deleted, all the member ports of the aggregation group are removed from the aggregation group, and then the all the member ports adopt the default settings. This may result in loops in the network. Therefore, before deleting an aggregation group, ensure that the spanning tree function has been enabled or ensure that no loop may occur in the network.

Add Ports into the Aggregation Group

When an aggregation group is created, it is only a logic interface which contains no physical port. In this case, the aggregation function does not take effect. The aggregation function takes effect after ports are added to a static aggregation group. The aggregation function takes effect after local or peer ports are added into a dynamic aggregation group.

Table 1‑3 Adding a port into the aggregation group

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | -
Add the port into the aggregation group. | link-aggregation link-aggregation-id { manual | active | passive } | By default, a port is not added into any aggregation group.

l Before adding a port into an aggregation group, the aggregation group must have been created; otherwise, an error message is displayed.

l A port can be added one aggregation group at a time.

l After a port is added into an aggregation group, the some existing configurations (such as loopback detection and VLAN) will be removed from the port.

l Some functions (such as loopback detection) cannot be configured on a member port in an aggregation group; otherwise, an error message is displayed.

l If a port is added into a dynamic aggregation group in passive mode, its peer port must be added into the dynamic aggregation group in active mode. Otherwise, the two ports are both in the unselected status and they cannot participate in user service traffic forwarding.


1.2.2 Configure the Load Balancing Mode of an Aggregation Group

By configuring the load balancing mode of an aggregation group, you can achieve load balancing of service traffic in the aggregation group in a flexible manner.

Configuration Condition

None

Configure the Load Balancing Mode of the Aggregation Group

Table 1‑4 Configuring the load balancing mode of the aggregation group

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the load balancing mode of the aggregation group. | link-aggregation load-balance { dst-mac | src-dst-mac | src-mac } | Mandatory. By default, the aggregation group implements aggregated load balancing based on the source MAC addresses of packets.


1.2.3 Configure LACP Priorities

Configuration Condition

None

Configure the System LACP Priority

Configuration of the system LACP priority may affect the system ID, and finally affect the selected/unselected status of member ports of dynamic aggregation groups.

Table 1‑5 Configuring the system lacp priority

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the system LACP priority. | lacp system-priority system-priority-value | Mandatory. By default, the system LACP priority is 32768.

Configure the Port LACP Priority

Configuration of the port LACP priority may affect the port ID, and finally affect the selected/unselected status of member ports of aggregation groups.

Table 1‑6 Configuring the port LACP priority

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | -
Configure the port LACP priority. | lacp port-priority port-priority-value | Mandatory. By default, the port LACP priority is 32768.


1.2.4 Link Aggregation Monitoring and Maintaining

Table 1‑7 Link Aggregation monitoring and maintaining

Command | Description
show link-aggregation group [ link-aggregation-id ] | Displays brief information about a specified aggregation group or all existing aggregation groups.
show link-aggregation interface [ interface-name ] | Displays the details of a specified member port of an aggregation group or details of all member ports of the aggregation group.


1.3 Typical Configuration Example of Link Aggregation


1.3.1 Configure a Static Aggregation Group

Network Requirements

l Device1 is connected to PC1, Device2 is connected to PC2 and PC3, and the three PCs are in the same network segment. Device1 and Device2 are interconnected through Trunk ports.

l A static aggregation group is configured between Device1 and Device2 for bandwidth increase, load sharing, and service backup.

Network Topology

Figure 1‑3 Networking for configuring a static aggregation group

Configuration Steps

Step 1:

Create a static aggregation group.

#On Device1, create static aggregation group 1.

Device1#configure terminal

Device1(config)#link-aggregation 1 mode manual

Device1(config)#exit

#On Device2, create static aggregation group 2.

Device2#configure terminal

Device2(config)#link-aggregation 1 mode manual

Device2(config)#exit

Step 2:

Add ports into the aggregation group.

#On Device1, add ports gigabitethernet0/0 and gigabitethernet0/1 into aggregation group 1 in Manual mode.

Device1(config)#interface gigabitethernet 0/0,0/1

Device1(config-if-range)#link-aggregation 1 manual

Device1(config-if-range)#exit

#On Device2, add ports gigabitethernet0/0 and gigabitethernet0/1 into aggregation group 1 in Manual mode.

Device2(config)#interface gigabitethernet 0/0,0/1

Device2(config-if-range)#link-aggregation 1 manual

Device2(config-if-range)#exit

#After the configuration is completed, check the status of aggregation group 1 on the devices.

Here takes Device1 for example:

Device1#show link-aggregation group 1

Link Aggregation 1

Mode: Manual Description:

Load balance method: src-mac

Number of ports in total: 2

Number of ports attached: 2

Root port: gigabitethernet0/0

gigabitethernet0/0: ATTACHED

gigabitethernet0/1: ATTACHED

According to the system display, ports gigabitethernet0/0 and gigabitethernet0/1 are both in the ATTACHED state in aggregation group 1, and aggregation group 1 aggregates successfully.

l For the method of checking Device2, refer to the method of checking Device1.

Step 3:

Configure the load balancing mode of the aggregation group.

#On Device1, configure the load balancing mode of the aggregation group to the dst-mac mode.

Device1(config)#link-aggregation load-balance dst-mac

Step 4:

Configure a VLAN, and configure the link type of the aggregation group and ports.

#On Device1, create VLAN2, configure the VLAN of aggregation group 1 to Trunk and allow services of VLAN2 to pass, and set Port VLAN ID (PVID) to 2.

Device1(config)#vlan 2

Device1(config-vlan2)#exit

Device1(config)#link-aggregation 1

Device1(config-link-aggregation1)#switchport mode trunk

Device1(config-link-aggregation1)#switchport trunk allowed vlan add 2

Device1(config-link-aggregation1)#switchport trunk pvid vlan 2

Device1(config-link-aggregation1)#exit

#On Device1, configure the VLAN of port gigabitethernet0/2 to Access and allow services of VLAN2 to pass.

Device1(config)#interface gigabitethernet 0/2

Device1(config-if-gigabitethernet0/2)#switchport mode access

Device1(config-if-gigabitethernet0/2)#switchport access vlan 2

Device1(config-if-gigabitethernet0/2)#exit

#On Device2, create VLAN2, configure the VLAN of aggregation group 1 to Trunk and allow services of VLAN2 to pass, and set PVID to 2. (Omitted)

#On Device2, configure the VLAN of ports gigabitethernet0/2 and gigabitethernet0/3 to Access and allow services of VLAN2 to pass. (Omitted)

Step 5:

Check the result.

#On the devices, check the aggregated bandwidth of aggregation group 1.

Here takes Device1 for example:

Device1#show link-aggregation 1

link-aggregation 1 configuration information

Description :

Status : Enabled

Link : Up

Act Speed : 2000

Act Duplex : Full

Port Type : Nni

Pvid : 1

According to the system display, the interface bandwidth of aggregation group on Device1 is 2000M.

l For the method of checking Device2, refer to the method of checking Device1.

#On Device1, check the current load balancing mode.

Device1#show link-aggregation group 1

Link Aggregation 1

Mode: Manual Description:

Load balance method: dst-mac

Number of ports in total: 2

Number of ports attached: 2

Root port: gigabitethernet0/0

gigabitethernet0/0: ATTACHED

gigabitethernet0/1: ATTACHED

According to the system display, the current load balancing mode of aggregation group 1 is dst-mac.

#During the process of service interaction between PC1 and PC2 and PC3, load balancing of data is achieved on the aggregated links. If a link in the aggregation group becomes faulty, the remaining links can perform the service backup.


1.3.2 Configure a Dynamic Aggregation Group

Network Requirements

l Device1 is connected to PC1, Device2 is connected to PC2 and PC3, and the three PCs are in the same network segment. Device1 and Device2 are interconnected through Trunk ports.

l A dynamic aggregation group is configured between Device1 and Device2, so as to realize the functions of adding bandwidth, load balance and service backup.

Network Topology

Figure 1‑4 Networking for configuring a dynamic aggregation group

Configuration Steps

Step 1:

Create a dynamic aggregation group.

#On Device1, create dynamic aggregation group 1.

Device1#configure terminal

Device1(config)#link-aggregation 1 lacp

Device1(config)#exit

#On Device2, create dynamic aggregation group 1.

Device2#configure terminal

Device2(config)#link-aggregation 1 lacp

Device2(config)#exit

Step 2:

Add ports into the aggregation group.

#On Device1, add ports gigabitethernet0/0 and gigabitethernet0/1 into aggregation group 1 in Active mode.

Device1(config)#interface gigabitethernet 0/0,0/1

Device1(config-if-range)#link-aggregation 1 mode active

Device1(config-if-range)#exit

#On Device2, add ports gigabitethernet0/0 and gigabitethernet0/1 into aggregation group 1 in Active mode.

Device2(config)#interface gigabitethernet 0/0,0/1

Device2(config-if-range)#link-aggregation 1 mode active

Device2(config-if-range)#exit

#After the configuration is completed, check the status of aggregation group 1 on the devices.

Here takes Device1 for example:

Device1#show link-aggregation group 1

Link Aggregation 1

Mode: LACP Description:

Load balance method: src-mac

Number of ports in total: 2

Number of ports attached: 2

Root port: gigabitethernet0/0

gigabitethernet0/0: ATTACHED

gigabitethernet0/1: ATTACHED

According to the system display, ports gigabitethernet0/0 and gigabitethernet0/1 are both in the ATTACHED state in aggregation group 1, and aggregation group 1 aggregates successfully.

#View the aggregation bandwidth of the aggregation group 1 on the device.

Here takes Device1 for example:

Device1#show link-aggregation 1

link-aggregation 1 configuration information

Description :

Status : Enabled

Link : Up

Act Speed : 2000

Act Duplex : Full

Port Type : Nni

Pvid : 1

It can be viewed that the interface bandwidth of aggregation group on Device1 is 2000M.

l For the method of checking Device2, refer to the method of checking Device1.

Step 3:

Configure the load balancing mode of the aggregation group.

#On Device1, configure the load balancing mode of aggregation group 1 to the dst-mac mode.

Device1(config)#link-aggregation 1 load-balance dst-mac

Step 4:

Configure a VLAN, and configure the link type of the aggregation group and ports.

#On Device1, create VLAN2, configure the VLAN of aggregation group 1 to Trunk and allow services of VLAN2 to pass, and set PVID to 2.

Device1(config)#vlan 2

Device1(config-vlan2)#exit

Device1(config)#link-aggregation 1

Device1(config-link-aggregation1)#switchport mode trunk

Device1(config-link-aggregation1)#switchport trunk allowed vlan add 2

Device1(config-link-aggregation1)#switchport trunk pvid vlan 2

Device1(config-link-aggregation1)#exit

#On Device1, configure the VLAN of port gigabitethernet0/2 to Access and allow services of VLAN2 to pass.

Device1(config)#interface gigabitethernet 0/2

Device1(config-if-gigabitethernet0/2)#switchport mode access

Device1(config-if-gigabitethernet0/2)#switchport access vlan 2

Device1(config-if-gigabitethernet0/2)#exit

#On Device2, create VLAN2, configure the VLAN of aggregation group 1 to Trunk and allow services of VLAN2 to pass, and set PVID to 2. (Omitted)

#On Device2, configure the VLAN of ports gigabitethernet0/2 and gigabitethernet0/3 to Access and allow the services of VLAN2 to pass. (Omitted)

Step 5:

Check the result.

#On the devices, check the aggregated bandwidth of aggregation group 1.

Here takes Device1 for example:

Device1#show link-aggregation 1

link-aggregation 1 configuration information

Description :

Status : Enabled

Link : Up

Act Speed : 2000

Act Duplex : Full

Port Type : Nni

Pvid : 1

According to the system display, the interface bandwidth of the aggregation group on Device1 is 2000M.

l For the method of checking Device2, refer to the method of checking Device1.

#After the configuration is completed, check the current load balancing mode on Device1.

Device1#show link-aggregation group 1

Link Aggregation 1

Mode: LACP Description:

Load balance method: dst-mac

Number of ports in total: 2

Number of ports attached: 2

Root port: gigabitethernet0/0

gigabitethernet0/0: ATTACHED

gigabitethernet0/1: ATTACHED

According to the system display, the current load balancing mode of aggregation group 1 is dst-mac.

#During the process of service interaction between PC1 and PC2 and PC3, load balancing of data is achieved on the aggregated links. If a link in the aggregation group becomes faulty, the remaining links can perform the service backup.


2 Port Isolation


2.1 Overview

Port isolation is a security feature that is based on ports. According to the actual requirement, you can configure certain ports to be isolated from a specified port, that is, configure some isolated ports for a specified port. In this way, the packets that are received by the specified port cannot be forwarded to the isolated ports. This enhances the network security, and also provides a flexible networking scheme.


2.2 Port Isolation Function Configuration

Table 2‑1 Port Isolation function list

Configuration Tasks

Configure the basic function of port isolation.

Configure port isolation.


2.2.1 Configure Basic Functions of Port Isolation

The port isolation function realizes a unidirectional packet isolation. Assuming that port B is configured as the isolated port of port A, then if a packet whose target port is port B enters port A, the port is directly discarded. However, if a packet whose target port is port B enters port B, the port is normally forwarded. The isolated port can be a port or an aggregation group.

The port isolation is configured based on the isolation group.

l The ports in one isolation group are isolated from each other.

The ports in the isolation group can be configured as the ingress, egress, and both modes.

Table 2‑2 Configure the mode forwarding table

Ingress Port Mode | Egress Port Mode | Whether to forward normally
Ingress mode | Ingress mode | Forward normally
Ingress mode | Egress mode | Prohibit forwarding
Ingress mode | Both mode | Prohibit forwarding
Egress mode | Ingress mode | Forward normally
Egress mode | Egress mode | Forward normally
Egress mode | Both mode | Forward normally
Both mode | Ingress mode | Forward normally
Both mode | Egress mode | Prohibit forwarding
Both mode | Both mode | Prohibit forwarding

l The ports in the isolation group communicate with the ports not added to the isolation group normally.

l The ports in different isolation groups can communicate normally.

Configuration Condition

The isolation group is already created.

Configure Port Isolation

Table 2‑2 Configuring port isolation

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter isolation group configuration mode | isolate group group-id | Mandatory
Add the port to the isolation group | interface interface-list[ ingress | egress | both ] | Mandatory By default, the port is not added to the isolation group.
Add the aggregation group to the isolation group | link-aggregation link-aggregation-id[ ingress | egress | both ] | Mandatory By default, the aggregation group is not added to the isolation group.

l When the port is added to the isolation group, the isolation group needs to be created.


2.2.2 Port Isolation Monitoring and Maintaining

Table 2‑4 Port isolation monitoring and maintenance

Command | Description
show isolate { group [ group-id ] | interface interface-list | link-aggregation link-aggregation-id } | Display the port isolation configuration information


2.3 Typical Configuration Example of Port Isolation


2.3.1 Configure Port Isolation

Network Requirements

l PC1 and PC2 are connected to Device, and they communicate with each other in VLAN2.

l On Device, port isolation has been configured; therefore, PC1 and PC2 cannot communicate with each other.

Network Topology

Figure 2‑1 Networking for configuring port isolation

Configuration Steps

Step 1:

Configure a VLAN, and configure the link type of the ports.

#On Device, create VLAN2.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

#On Device, configure the link type of ports gigabitethernet0/0 and gigabitethernet0/1to Access and allow the services of VLAN2 to pass.

Device(config)#interface gigabitethernet 0/0-0/1

Device(config-if-range)#switchport mode access

Device(config-if-range)#switchport access vlan 2

Device(config-if-range)#exit

Step 2:

Configure port isolation.

#On Device, configure port isolation between port gigabitethernet0/0 and gigabitethernet0/1.

Device(config)#isolate group 1

Device(config-isolate-group1)#interface gigabitethernet 0/0 both

Device(config-isolate-group1)#interface gigabitethernet 0/1 both

Device(config-isolate-group1)#exit

#On Device, query the port isolation information.

Device#show isolate group 1

--------------------------------------------------------

isolate group 1

both members: gi0/0-0/1

Step 3:

Check the result.


3 VLAN


3.1 Overview

In a switched Ethernet, each port in the device is an independent collision domain, but all the ports belong to a broadcast domain. When a terminal device sends broadcast packets, all devices in the Local Area Network (LAN) can receive the packets. This not only wastes network bandwidth, but also brings hidden troubles.

Virtual Local Area Network (VLAN) is a technology through which devices in the same LAN can be divided in a logic manner. The devices in the same VLAN can communicate with each other at layer 2, while the devices from different VLANs are isolated at layer 2. In this way, broadcast packets are limited within a VLAN.

VLANs comply with IEEE 802.1Q. This standard defines a new frame encapsulation format, in which a 4-byte VLAN tag containing VLAN information is added after the source MAC address of a traditional data frame.

Figure 3‑1 IEEE 802.1Q frame encapsulation format

A VLAN tag contains the following four fields:

l Tag Protocol Identifier (TPID): It is used to determine whether a VLAN tag is carried by the data frame. The length is 2 bytes, and the value is fixed to be 0x8100, indicating a standard 802.1Q tag.

l Priority: It is the 802.1p priority. The length is 3 bits and the value range is 0-7. Packets with different priorities can obtain services of different levels.

l Canonical Format Indicator (CFI): It indicates whether the MAC address is encapsulated in a standard format for transmission in different media. The length is 1 bit. The value 0 indicates that the MAC address is encapsulated in a standard format while the value 1 indicates that the MAC address is encapsulated in a non-standard format.

l VLAN ID: It indicates the VLAN to which the packet belongs. The length is 12 bits, and the value range is 0-4095, where 0 and 4095 are protocol reserved values, and the available VLAN IDs are in the range of 1-4094.

VLANs has the following advantages:

l Establishes virtual workgroups flexibly. Users with the same requirements can be divided into one VLAN, without being limited by their physical locations.

l Limits broadcast domains. A VLAN is a broadcast domain. Layer-2 unicast, multicast, and broadcast frames can be forwarded only within the domain, and they cannot enter other VLANs directly. This prevents broadcast storms.

l Improves the network security. Different VLANs are isolated at layer two, and the VLANs cannot communicate with each other directly.

According to applications, VLANs are categorized into the following four types:

l Port-based VLANs

l MAC address-based VLANs

l IP subnet-based VLANs

l Protocol-based VLANs

By default, in the order of priorities from high to low, the four types of VLANs are: MAC address-based VLANs, IP subnet-based VLANs, protocol-based VLANs, and port-based VLANs. On one port, the VLANs takes effect according to the priority levels, and only one type of VLAN takes effect. The device only supports port-based VLAN.


3.2 VLAN Function Configuration

Table 3‑1 VLAN function list

Configuration Tasks
Configuring basic attributes of VLANs | Configure a VLAN.
 | Configure the VLAN name.
Configure a port-based VLAN. | Configure the port link type.
 | Add an Access port into the VLAN.
 | Configure a Trunk port to allow services of a VLAN to pass.
 | Add a Hybrid port into the VLAN.
 | Configure PVIDs for ports.


3.2.1 Configure Basic Attributes of VLANs

Configuration Condition

None

Configure a VLAN

Each VLAN corresponds to a broadcast domain. The users in the same VLAN can communicate with each other at layer 2, while users from different VLANs are isolated from each other at layer 2.

Table 3‑2 Configuring a VLAN

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Create a VLAN. | vlan vlan-list | Mandatory. By default, the system automatically creates VLAN1. In creating a single VLAN, after a VLAN is created, you will enter the VLAN configuration mode. In creating multiple VLANs, after a VLAN is created, you are still in the current configuration mode.

Configure the VLAN Name

To facilitate memory and management, you can configure the name of a VLAN according to the service type, function, and connection of the VLAN.

Table 3‑3 Configure the VLAN name.

Step | Command | Description
Enter the global configuration mode. | config ure terminal | -
Enters the VLAN configuration mode. | vlan vlan-id | -
Configure the VLAN name. | name vlan-name | Mandatory. By default, the name of VLAN1 is DEFAULT, and the names of other VLANs follow the format "VLAN vlan-id", such as VLAN100.


3.2.2 Configure a Port-Based VLAN

A port-based VLAN, also called port VLAN, is a VLAN of the simplest division type. After a port is added into the VLAN, the port can forward packets that belong to the VLAN.

Configuration Condition

None

Configure the Port Link Type

A port handles VLAN tags in different modes before it forwards packets. According to the VLAN tag handling modes, the following three link types are available:

l Access type: The packets that have been forwarded do not carry VLAN tags. Ports of this type are usually connected to user devices.

l Trunk type: The packets from the VLANs in which the PVID is located do not carry VLAN tags, while the packets from other VLANs still carry VLAN tags.

l Hybrid type: The packets from the specified VLAN can be configured not to carry or carry VLAN tags. Ports of the type can be connected to user devices or interconnected with network devices.

The ports of the Trunk type and the ports of the Hybrid type cannot be converted to each other directly. They need to be converted to the Access type before being converted to another type.

Table 3‑4 Configuring the port link type

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the port link type. | switchport mode { access | hybrid | trunk } | Mandatory. By default, the port link type is the Access type.

l Some commands can be configured only on the ports with the specified link type, therefore, if the port link type is converted to another type, the functions that are configured on the port with the original link type may become invalid.

Add an Access Port into the VLAN

One Access port can belong to only one VLAN. When an Access port is added into a specified VLAN, it exits from the current VLAN and then enters the specified VLAN. If the VLAN to which the Access port is to be added does not exists, the VLAN is automatically created.

Table 3‑5 Adding an access port into the VLAN

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the port link type to the Access type. | switchport mode access | Mandatory. By default, the port link type is the Access type.
Add an Access port into the specified VLAN. | switchport access vlan vlan-id | Mandatory. By default, the Access port is added into VLAN1.

Configure a Trunk Port to Allow Services of a VLAN to Pass

If a Trunk port allows services of an existing VLAN to pass, the port allows forwarding packets of the VLAN. If the VLAN that the Trunk port allows to pass does not exist, the VLAN will not be created automatically, you must create the VLAN before the port allows forwarding packets of the VLAN.

Table 3‑6 Configuring a trunk port to allow services of a VLAN to pass

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the port link type to the Trunk type. | switchport mode trunk | Mandatory. By default, the port link type is the Access type.
Configure a Trunk port to allow a VLAN to pass. | switchport trunk allowed vlan { all | add vlan-list } | Mandatory. By default, the Trunk port allows VLAN1 to pass.
Configure the packets from the VLAN in which the PVID is located to be forwarded with VLAN tags reserved. | vlan dot1q tag pvid | Optional. By default, the packets from the VLAN in which the PVID is located are forwarded without VLAN tags.

Add a Hybrid Port into the VLAN

If the VLAN to which the Access port is to be added does not exist, the VLAN is automatically created.

Table 3‑7 Adding a hybrid port into the VLAN

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the port link type to the Hybrid type. | switchport mode hybrid | Mandatory. By default, the port link type is the Access type.
Add a Hybrid port to a specified VLAN in a specified mode. | switchport hybrid { untagged | tagged } vlan vlan-list | Mandatory. By default, the Hybrid port is added into VLAN1 in Untagged mode.

Configure PVIDs for Ports

Port VLAN ID (PVID) is an important parameter of a port. When a port receives an Untag packet, it adds a VLAN tag to the packet, and the VLAN ID of the VLAN tag is the PVID of the port.

The PVID of an Access port is the ID of the VLAN to which it belongs, so the PVID of the Access port can be configured only by changing the VLAN to which it belongs. The Trunk port and hybrid port can belong to multiple VLANs, and their PVIDs can be configured according to the actual requirement.

The Trunk port and Hybrid port must be added into the VLAN to which their PVIDs belong; otherwise, packets of the VLAN to which their PVIDs belong cannot be forwarded, and the port discards the received Untag packets.

Table 3‑8 Configuring PVIDs for ports

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configuring the PVID for the Trunk port. | switchport trunk pvid vlan vlan-id | Mandatory. Select one option according to the port link type. By default, the port PVID is VLAN1.
Configuring the PVID for the Hybrid port. | switchport hybrid pvid vlan vlan-id

l In configuring the PVID for a port, the VLAN to which the PVID belongs must have been created; otherwise, the configuration fails, and an error message is prompted.


3.2.3 VLAN Monitoring and Maintaining

Table 3‑13 VLAN monitoring and maintaining

Command | Description
show running-config vlan | Displays VLAN configuration information.
show vlan [ vlan-id ] | Displays the information about a specified VLAN or all existing VLANs.
show vlan statistics | Displays the number of existing VLANs.
show { interface interface-name | link-aggregation link-aggregation-id } vlan status | Displays the VLAN information on the specified port or aggregation group.


3.3 VLAN Typical Configuration Example


3.3.1 Configure Port-Based VLANs

Network Requirements

l Server1 and PC1 are in the office network, while Server2 and PC2 are in the production network.

l You need to configure the port-based VLAN functions to isolate PC1 and PC2 so that PC1 can access only Server1 and PC2 can access only Server2.

Network Topology

Figure 3‑2 Networking for configuring port-based VLANs

Configuration Steps

Step 1:

On Device1, configure VLANs, and configure the port link types of the ports.

#On Device1, create VLAN2 and VLAN3.

Device1#configure terminal

Device1(config)#vlan 2-3

#On Device1, configure the link type of ports gigabitethernet0/1 and gigabitethernet0/2 to Access. Configure gigabitethernet0/1 to allow services of VLAN2 to pass and configure and gigabitethernet0/2 to allow services of VLAN3 to pass.

Device1(config)#interface gigabitethernet 0/1

Device1(config-if-gigabitethernet0/1)#switchport mode access

Device1(config-if-gigabitethernet0/1)#switchport access vlan 2

Device1(config-if-gigabitethernet0/1)#exit

Device1(config)#interface gigabitethernet 0/2

Device1(config-if-gigabitethernet0/2)#switchport mode access

Device1(config-if-gigabitethernet0/2)#switchport access vlan 3

Device1(config-if-gigabitethernet0/2)#exit

#On Device1, configure the link type of the port gigabitethernet0/3 to Trunk and permit the services of VLAN2 and VLAN3 to pass.

Device1(config)#interface gigabitethernet 0/3

Device1(config-if-gigabitethernet0/3)#switchport mode trunk

Device1(config-if-gigabitethernet0/3)#switchport trunk allowed vlan add 2-3

Device1(config-if-gigabitethernet0/3)#exit

Step 2:

On Device3, configure VLANs, and configure the port link types of the ports.

#On Device2, create VLAN2 and VLAN3.

Device2#configure terminal

Device2(config)#vlan 2-3

#On Device2, configure the link type of ports gigabitethernet0/1 and gigabitethernet0/2 to Access. Configure gigabitethernet0/1 to allow services of VLAN2 to pass and configure gigabitethernet0/2 to allow services of VLAN3 to pass.

Device2(config)#interface gigabitethernet 0/1

Device2(config-if-gigabitethernet0/1)#switchport mode access

Device2(config-if-gigabitethernet0/1)#switchport access vlan 2

Device2(config-if-gigabitethernet0/1)#exit

Device2(config)#interface gigabitethernet 0/2

Device2(config-if-gigabitethernet0/2)#switchport mode access

Device2(config-if-gigabitethernet0/2)#switchport access vlan 3

Device2(config-if-gigabitethernet0/2)#exit

#On Device2, configure the link type of port gigabitethernet0/3 to Trunk and allow services of VLAN2 and VLAN3 to pass.

Device2(config)#interface gigabitethernet 0/3

Device2(config-if-gigabitethernet0/3)#switchport mode trunk

Device2(config-if-gigabitethernet0/3)#switchport trunk allowed vlan add 2-3

Device2(config-if-gigabitethernet0/3)#exit

Step 3:

Check the result.

#Query the VLAN information on Device1.

Device1#show vlan 2

---- ---- -------------------------------- ------- --------- -----------------------------

NO. VID VLAN-Name Owner Mode Interface

---- ---- -------------------------------- ------- --------- -----------------------------

1 2 VLAN0002 static Tagged gi0/3

Untagged gi0/1

Device1#show vlan 3

---- ---- -------------------------------- ------- --------- -----------------------------

NO. VID VLAN-Name Owner Mode Interface

---- ---- -------------------------------- ------- --------- -----------------------------

1 3 VLAN0003 static Tagged gi0/3

Untagged gi0/2

# Query the VLAN information on Device2.

Device2#show vlan 2

---- ---- -------------------------------- ------- --------- -----------------------------

NO. VID VLAN-Name Owner Mode Interface

---- ---- -------------------------------- ------- --------- -----------------------------

1 2 VLAN0002 static Tagged gi0/3

Untagged gi0/1

Device2#show vlan 3

---- ---- -------------------------------- ------- --------- -----------------------------

NO. VID VLAN-Name Owner Mode Interface

---- ---- -------------------------------- ------- --------- -----------------------------

1 3 VLAN0003 static Tagged gi0/3

Untagged gi0/2

#PC1 and PC2 cannot communicate with each other, PC1 can access only Server1, and PC2 can access only Server2.


4 MAC Address Table Management


4.1 Overview

A MAC address entry consists of the MAC address of a terminal, the device port that is connected to the terminal, and the ID of the VLAN to which the port belongs. After a device receives a data packet, it matches the destination MAC address of the packet with the MAC address table entries that are saved in the device so as to locate a packet forwarding port efficiently.

MAC addresses are categorized into two types: dynamic MAC addresses and static MAC addresses. Static MAC addresses are categorized into static forwarding MAC addresses and static filtering MAC addresses.

Dynamic MAC address learning is the basic MAC address learning mode of the devices. Each dynamic MAC address entry has aging time. If no packet whose source MAC address matches a MAC address entry is received by the corresponding VLAN and port, the device deletes the MAC address entry.

The dynamic MAC address learning/forwarding process is as follows:

l When a device receives a packet, it searches the MAC address table of the corresponding VLAN for the MAC address entry that matches the source MAC address of the packet. If no corresponding matching entry is available, the source MAC address of the packet is written into the MAC address table, and the aging time timer of the new MAC address entry is started. If a matching MAC address entry is found, the aging time of the MAC address entry is updated.

l In the corresponding VLAN, the device searches the MAC address table for MAC address entry that matches the destination MAC address of the packet. If no matching entry is available, the packet is flooded to the other ports with the same VLAN ID. If a matching MAC address entry is available, the packet is forwarded through the specified port.

Static filtering MAC addresses are used to isolate devices which are aggressive, preventing the devices from communicating with external devices.

The configuration/forwarding process of static filtering MAC addresses is as follows:

l Static filtering MAC addresses can only be configured by users.

l If the destination MAC address of a packet matches a static filtering MAC address entry in the corresponding VLAN, the packet is discarded.

Static forwarding MAC addresses are used to control the routing principle of packets, and prevent frequent MAC address migration of MAC address entries in the table. MAC address migration means that: A device learns a MAC address from port A, then the device receives packets whose source MAC address is the same as the MAC address from port B, and port B and port A belong to the same VLAN. At this time, the forwarding port saved in the MAC address entry is updated from port A to port B.

The configuration/forwarding process of static forwarding MAC addresses is as follows:

l Static forwarding MAC addresses are configured by users.

l If the destination MAC address of a packet matches a static MAC address entry in the corresponding VLAN, the packet is forwarded through the specified port.

One port can learn the same MAC address from different VLANs, but one MAC address can only be learnt by one port in one VLAN.


4.2 MAC Address Management Function Configuration

Table 4‑1 MAC address management function list

Configuration Tasks
Configure management properties of MAC addresses. | Configure the MAC address aging time.
 | Configure the MAC address learning capability.
Configure limitations on MAC address learning. | Configure limitations on port-based dynamic MAC address learning.
 | Configure limitations on VLAN-based dynamic MAC address learning.
 | Configure limitations on system-based dynamic MAC address learning.
Configure static MAC addresses. | Configure static filtering MAC addresses.
 | Configure static forwarding MAC addresses that are bound to a port.
 | Configure static forwarding MAC addresses that are bound to an aggregation group.


4.2.1 Configure Management Properties of MAC Addresses

MAC address management properties include: MAC address aging time, and the MAC address learning capability of ports.

Each dynamic MAC address entry has aging time. If no packet whose source MAC address matches a MAC address entry is received by the specified VLAN, the device deletes the MAC address entry. If the specified VLAN receives a packet whose source MAC address matches a MAC address entry, the device resets the aging time of the MAC address entry.

Static MAC addresses can only be configured and deleted by users, so static MAC addresses cannot age.

If devices in the network have idle ports and the ports do not allow free use, then the MAC address learning capability can be disabled on the port. Then, the packets received by the port will all be discarded. In this way, these ports cannot access the network, and hence the security of the network is improved. (MP1800X series does not support disabling the MAC learning.)

Configuration Condition

None

Configure the MAC Address Aging Time

The dynamic MAC address aging time set in a device takes effect globally. The value range of the MAC address aging time is:

l 0: MAC addresses do not age, that is, the learned dynamic MAC addresses do not age.

l 10-1000000: Aging time of dynamic MAC addresses. Unit: second. Default: 300.

If the aging time is configured too long, the MAC address table in the device may contain a large number of MAC address entries that are no long in use. In this way, the large number of invalid entries may use up MAC address resources, and new valid MAC address entries fail to be added to the device. If the aging time is configured too short, the device may frequently delete valid MAC address entries, affecting the device forwarding performance. Therefore, you need to configure a reasonable value for the aging time according to the actual environment.

Table 4‑2 Configuring the MAC address aging time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the MAC address aging time. | mac-address aging-time aging-time-value | Mandatory. By default, the MAC address aging time is set to 300 seconds.


4.2.2 Configure Static MAC Addresses

Static MAC addresses are categorized into two types: static forwarding MAC addresses and static filtering MAC addresses.

The configured MAC addresses must be legal unicast MAC addresses instead of broadcast, multicast, or all-0 addresses.

One MAC address can only be configured as a static forwarding MAC address or a static filtering MAC address in a VLAN.

Configuration Condition

None

Configure Static Filtering MAC Addresses

After static filtering MAC address entries are configured, if the destination MAC addresses of the packets that are received by the corresponding VLAN match static filtering MAC address entries, the packets are discarded. This function prevents trustless devices from accessing the network, and prevents frauding and attacking activities of illegal users.

Table 4‑7 Configuring static filtering MAC addresses

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure static filtering MAC addresses. | mac-address static mac-address-value vlan vlan-id drop | Mandatory. By default, a device is not configured with static filtering MAC addresses.

l MP1800X static filtering MAC address only supports filtering the destination MAC address.

Configure Static Forwarding MAC Addresses That Are Bound to a Port

With static forwarding MAC address entries configured, after the corresponding VLAN receives packets, the port matches the destination MAC addresses of the packets with the static forwarding MAC address entries that are configured on the device. If they match successfully, the device forwards the packets through the specified port. This function helps to control the routing principle of packets more flexibly, and prevents frequent migration of MAC address entries in the table.

Table 4‑8 Configuring static forwarding MAC addresses that are bound to a port

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure static forwarding MAC addresses that are bound to a port. | mac-address static mac-address-value vlan vlan-id interface interface-name | Mandatory. By default, a device is not configured with static forwarding MAC addresses.


4.2.3 MAC Address Management Monitoring and Maintaining

Table 4‑10 MAC address management monitoring and maintaining

Command | Description
clear mac-address dynamic { mac-address-value | all | interface interface-list | link-aggregation link-aggregation-id | vlan vlan-id [ mac-address-value | interface interface-list | link-aggregation link-aggregation-id ] } | Clears the MAC address entries that are dynamically learned.
show mac-address interface interface-list { all | dynamic | static [ config ] } | Displays MAC address entries on a port.
show mac-address link-aggregation link-aggregation-id { all | dynamic | static [ config ] } | Displays MAC address entries in an aggregation group.
show mac-address vlan vlan-id { all | dynamic | static [ config ] } | Displays MAC address entries in a VLAN.
show mac-address drop [ mac-address-value | config ] | Displays static filtering MAC address entries in the system.
show mac-address dynamic [mac-address-value ] | Displays dynamic MAC address entries in the system.
show mac-address static [ mac-address-value | config ] | Displays the static forwarding MAC address entries information in the system.
show mac-address system-mac | Displays the MAC address of the system.
show mac-address { mac-address-value | all } | Displays the information about the system MAC address entries or a specified MAC address entry.
show mac-address aging-time | Displays the aging time of dynamic MAC address entries.
show mac-address count [ interface interface-name | link-aggregation link-aggregation-id | vlan vlan-id ] | Displays MAC address entry statistics in the system.


5 Spanning Tree


5.1 Overview

IEEE 802.1D defines the standard Spanning Tree Protocol (STP) to eliminate network loops, preventing data frames from circulating or multiplying in loops, which may result in network congestion and affect normal communication in the network. Through the spanning tree algorithm, STP can determine where loops may exist in a network, block ports on redundant links, and trim the network into a tree structure in which no loops exist to prevent devices from receiving duplicated data frames. When the active path is faulty, STP recovers the connectivity of the blocked redundant links to ensure normal services. On the basis of STP, Rapid Spanning Tree Protocol (RSTP) and Multiple Spanning Tree Protocol (MSTP) are developed. The basic principles of the three protocols are the same, while RSTP and MSTP are improved versions of STP.

In STP, the following basic concepts are defined:

l Root bridge: Root of the finally formed tree structure of a network. The device with the highest priority acts as the root bridge.

l Root Port (RP): The port which is nearest to the root bridge. The port is not on the root bridge, and it communicates with the root bridge.

l Designated bridge: If the device sends Bridge Protocol Data Unit (BPDU) configuration information to a directly connected device or directly connected LAN, the device is regarded as the designated bridge of the directly connected device or directly connected LAN.

l Designated port: The designated bridge forwards BPDU configuration information through the designated port.

l Path cost: It indicates the link quality, and it is related to the link rate. Usually, a higher link rate means a smaller path cost, and the link is better.

The devices that run STP implement calculation of the spanning tree by exchanging BPDU packets, and finally form a stable topology structure. BPDU packets are categorized into the following two types:

l Configuration BPDUs: They are also called BPDU configuration messages which are used to calculate and maintain the spanning tree topology.

l Topology Change Notification (TCN) BPDUs: When the network topology structure changes, they are used to inform other devices of the change.

BPDU packets contain information that is required in spanning tree calculation. The major information includes:

l Root bridge ID: It consists of the root bridge priority and the MAC address.

l Root path cost: It is the minimum path cost to the root bridge.

l Designated bridge ID: It consists of the designated bridge priority and the MAC address.

l Designated port ID: It consists of the designated port priority and port number.

l Message Age: Life cycle of BPDU configuration messages while they are broadcast in a network.

l Hello Time: Transmitting cycle of BPDU configuration messages.

l Forward Delay: Delay in port status migration.

l Max Age: Maximum life cycle of configuration messages in a device.

The election process of STP is as follows:

l Initial status.

The local device takes itself as the root bridge to generate BPDU configuration messages and sends the messages. In the BPDU packets, the root bridge ID and designated bridge ID are the local bridge ID, and root path cost is 0, and the specified port is the transmitting port.

Each port of the device generates a port configuration message which is used for spanning tree calculation. In the port configuration message, the root bridge ID and the designated bridge ID are the local bridge ID, the root path cost is 0, and the specified port is the local port.

l Update port configuration messages.

After the local device receives a BPDU configuration message from another device, it compares the message with the port configuration message of the receiving port. If the received configuration message is better, the device uses the received BPDU configuration message to replace the port configuration message. If the port configuration message is better, the device does not perform any operation.

The principle of comparison is as follows: The root bridge IDs, root path cost, designated bridge IDs, designated port IDs, and receiving port IDs should be compared in order. The smaller value is better. If the values of previous item are the same, compare the next item.

l Select the root bridge.

The device that sends the optimal configuration message in the entire network is selected as the root bridge.

l Select port roles and port status.

All ports of the root bridge are designated ports, and the ports are in the Forwarding status. The designated bridge selects the optimal port configuration message from all ports. The receiving port of the message is selected as the root port, and the root port is in the Forwarding status. The other ports calculate designated port configuration messages according to the root port configuration message.

The calculation method is as follows: The root bridge ID is the route ID of the root port configuration message, the root path cost is the sum of the root path cost of the root port configuration message and the root port path cost, the designated bridge ID is the bridge ID of the local device, and the designated port is the local port.

Based on the port configuration message and the calculated designated port configuration message, determine port rules: If the designated port configuration message is better, the local port is selected as the designated port, and the port is in the Forwarding status. Then, the port configuration message is replaced by the designated port configuration message, and the designated port sends port configuration messages periodically at the interval of Hello Time. If the port configuration message is better, the port is blocked. The port is then in the Discarding status, and the port configuration message is not modified.

After the root bridge, root port, and designated port are selected, the tree structure network topology is set up successfully. Only the root port and the designated port can forward data. The other ports are in the Discarding status. They can only receive configuration messages but cannot send configuration messages or forward data.

If the root port of a non-root bridge fails to receive configuration messages periodically, the active path is regarded as faulty. The device re-generates a BPDU configuration message and TCN BPDU with itself as the root bridge and sends the messages. The messages causes re-calculation of the spanning tree and then a new active path is obtained.

Before receiving new configuration messages, the other devices do not find the network topology change, so their root ports and designated port still forward data through the original path. The newly selected root port and designated port migrate to the Forwarding status after two Forward Delay periods to ensure that the new configuration message has been broadcast to the entire network and prevent occurrence of temporary loops that may be caused if both old and new root ports and designate ports forward data.

RSTP defined in IEEE 802.1w is developed based on STP, and it is the improved version of STP. RSTP realizes fast migration of port status and hence shortens the time required for a network to set up stable topology. RSTP is improved in the following aspects:

l It sets a backup port, that is, alternate port, for the root port. If the root port is blocked, the alternate port can fast switch over to become a new root port.

l It sets a backup port, that is, backup port, for the designated port. If the designated port is blocked, the backup port can fast switch over to become a new designated port.

l In a point-to-point link of two directly-connected devices, the designated port can enter the Forwarding status without delay only after a handshake with the downstream bridge.

l Some ports are not connected to the other bridges or shared links, instead, they are directly connected with user terminals. These ports are defined as edge ports. The status changes of edge ports do not affect the network connectivity, so the ports can enter the Forwarding status without delay.

However, both RSTP and STP form a single spanning tree, which has the following shortages:

l Only one spanning tree is available in the entire network. If the network size is large, the network convergence takes a long time.

l Packets of all VLANs are forwarded through one spanning tree, therefore no load balancing is achieved.

MSTP defined in IEEE 802.1s is an improvement of STP and RSTP, and it is backward compatible with STP and RSTP. MSTP introduces the concept of region and instance. MSTP divides a network into multiple regions. Each region contains multiple instances, one instance can set up mapping with one or more VLANs, and one instance corresponds to one spanning tree. One port may have different port role and status in different instances. In this way, packets of different VLANs are forwarded in their own paths.

In MSTP, definition of the following concepts is added:

l MST region: It consists of multiple devices in the switching network and the network between the devices. The devices in an MST region must meet the following requirements: The spanning tree function has been enabled on the devices. They have the same MST region, MSTP level, and VLAN mapping table. They are directly connected physically.

l Internal Spanning Tree (IST): It is the spanning tree of instance 0 in each region.

l Common Spanning Tree (CST): If each MST region is regarded as a device, then the spanning trees that connect MST regions are CSTs.

l Common and Internal Spanning Tree (CIST): It consists of the ISTs of MST regions and the CSTs between the MST regions. It is a single spanning tree that connects all devices in the network.

l Multiple Spanning Tree Instance (MSTI): Spanning trees in MST regions. Each instance has an independent MSTI.

l Common root: CIST root.

l Region root: Root of each IST and MSTI in MST regions. In MST domains, each instance has an independent spanning tree, so the region roots may be different. The root bridge of instance 0 is the region root of the region.

l Region edge ports: They are located at the edge of an MST region and they are used to connect ports of different MST regions.

l External path cost: It is the minimum path cost from a port to the common root.

l Internal path cost: It is the minimum path cost from a port to the region root.

l Master port: It is the region edge port with the minimum path cost to the common root in an MST region. The role of a master port in an MSTI is the same as its role in a CIST.

The selection rule of MSTP is similar to that of STP, that is, selecting the bridge with the highest priority in the network as the root bridge of CIST by comparing configuration messages. Each MST region calculates its IST, and MST regions calculate CSTs, and all of the constructs CIST in the entire network. Based on mapping between VLANs and spanning tree instances, each MST region calculates an independent spanning tree MSTI for each instance.


5.2 Spanning Tree Function Configuration

Table 5‑1 Spanning tree function list

Configuration Tasks
Configure basic functions of a spanning tree. | Enable the spanning tree function.
 | Configure MST regions.
Configure bridge properties. | Configure the priority of a bridge.
 | Configure Hello Time.
 | Configure Forward Delay.
 | Configure Max Age.
 | Configure the maximum number of hops in an MST region.
Configure spanning tree port properties. | Configure the priority of a port.
 | Configure the default path cost standard for a port.
 | Configure the path cost of a port.
 | Configure the BPDU packet length check
 | Configure the maximum length of the BPDU packet
 | Configure the maximum sending rate of the BPDU packet
 | Configure the source mac check of the BPDU packet
 | Configure the timeout factor of the BPDU packet
 | Configure the edge port
 | Configure the auto detection of the edge port
 | Force the auto detection of the edge port
 | Configure the port link type
Configure the working mode of a spanning tree. | Configure the working mode of a spanning tree.
Configure the spanning tree protection function. | Configure the BPDU Guard function.
 | Configure the BPDU Filter function.
 | Configure the Flap Guard function.
 | Configure the Loop Guard function.
 | Configure the Root Guard function.
 | Configure the TC Guard function
 | Configure the TC protection function.


5.2.1 Configure Basic Functions of a Spanning Tree

Configuration Condition

None

Enable the Spanning Tree Function

After the spanning tree function is enabled, devices start to run the spanning tree protocol. The devices exchange BPDU packets to form a stable tree network topology, and network loops are eliminated.

Table 5‑2 Enabling the spanning tree function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enabling the spanning tree function globally. | spanning-tree enable | Mandatory. By default, the spanning tree function is disabled globally.
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Enabling the spanning tree function on a port. | spanning-tree enable | Optional. By default, the spanning tree function is enabled on a port.

Configure MST Regions

Dividing an entire network into multiple MST regions helps to shorten the network convergence time. VLAN packets are transmitted through the corresponding MSTIs in MST regions and transmitted through CSTs between MST regions.

Table 5‑3 Configuring MST regions

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the MST region configuration mode. | spanning-tree mst configuration | -
Configure an MST region name. | region-name region-name | Mandatory. By default, the name of an MST region is the MAC address of the local device.
Configure the MSTP revision level. | revision-level revision-level | Mandatory. By default, the MSTP revision level is 0.
Configure a VLAN mapping table. | instance instance-id vlan vlan-list | Mandatory. By default, all VLANs are mapped to instance 0.
Activate MST region parameter configuration. | active configuration pending | Mandatory. By default, MST region parameters do not take effect immediately after modification.

l MST region parameters do not take effect immediately after they are modified. Instead, you need to run the active configuration pending command to activate the parameters and trigger re-calculation of the spanning tree. To cancel MST region parameter configuration, use the abort configuration pending command.


5.2.2 Configure Bridge Properties

Configuration Condition

None

Configure the Priority of a Bridge

The bridge priority and MAC address form the bridge ID. A smaller ID indicates a higher priority. The bridge with the highest priority is elected as the root bridge. One device may have different bridge priority in different spanning tree instances.

Table 5‑4 Configuring the priority of a bridge

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the priority of a bridge. | spanning-tree mst instance instance-id priority priority-value | Mandatory. By default, the priority of the bridge in all spanning tree instances is 32768.

l The step of bridge priorities is 4096, that is, the valid values include: 0, 4096, 8192, 12288, 16384, 20480, 24576, 28673, 32768, 36864, 40960, 45056, 49152, 53248, 57344, and 61440.

Configure Hello Time

After the network topology becomes stable, the root bridge sends BPDU packets at the interval of Hello Time to inform other bridges of its role as the root bridge so that the other bridges can recognize its role. The designated bridge maintains the existing spanning tree topology according to the BPDU packet, and it forwards the BPDU packet to other devices. If the designated bridge does not receive BPDU packets at a period of time as long is three times Hello Time, it regards the link as faulty. In this way, the spanning tree re-calculates the network topology to obtain a new active path, ensuring the network connectivity.

Table 5‑5 Configuring hello time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure Hello Time. | spanning-tree mst hello-time seconds | Mandatory. By default, Hello Time is 2 seconds.

l Forward Delay, Hello Time, and Max Age must meet the following requirement; otherwise, frequent network flapping may be cause.

2 × (Forward_Delay – 1.0seconds) ≥ Max_Age

Max_Age ≥ 2 × (Hello_Time + 1.0seconds)

Configure Forward Delay

In STP, when the root port or designated port migrates from the Discarding status to the Forwarding status, the topology change cannot be learned by the entire network immediately. To prevent temporary loops, the port migrates to the Learning status in the first Forward Delay, and then waits another Forward Delay to migrate to the Forwarding status.

Table 5‑6 Configuring forward delay

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure Forward Delay. | spanning-tree mst forward-time seconds | Mandatory. By default, Forward Delay is 15 seconds.

Configure Max Age

Max Age refers to the life cycle of BPDU configuration messages while they are broadcast in a network. When a configuration message is transmitted crossing regions, after it passes through an MST region, one is added to Message Age in the configuration message. If the device receives a configuration message and finds that the value of Message Age in the configuration message is larger than the value of Max Age, the device discards the configuration message, and the configuration message is no longer used in spanning tree calculation.

Table 5‑7 Configuring max age

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure Max Age. | spanning-tree mst max-age seconds | Mandatory. By default, Max Age is 20 seconds.

Configure the Maximum Number of Hops in an MST Region

You can limit the size of an MST region by configuring the maximum number of hops in the MST region. A larger number of hops in an MST region means a larger MST region. In one MST region, starting from the region root, once the configuration message is forwarded by a device, the number of hops is decreased by one. If the number of hops of a configuration message is 0, the device discards the configuration message. Therefore, the device which is beyond the maximum number of hops cannot participate in spanning tree calculation in the region.

Table 5‑8 Configuring the maximum number of hops in an MST region

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum number of hops in an MST region. | spanning-tree mst max-hops max-hops-value | Mandatory. By default, the maximum number of hops in an MST region is 20.


5.2.3 Configure Spanning Tree Port Properties

Configuration Condition

None

Configure the Priority of a Port

A port ID consists of port priority and port index. Port ID affects election of the port role. A smaller port ID indicates a higher priority. One port may have different port priority in different spanning tree instances.

Table 5‑9 Configuring the priority of a port

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configuring the priority of a port. | spanning-tree mst instance instance-id port-priority priority-value | Mandatory. By default, the priority of the port in all spanning tree instances is 128.

l The step of port priorities is 16, that is, the valid values include: 0, 16, 32, 48, 64, 80, 96, 112, 128, 144, 160, 176, 192, 208, 224, and 240.

Configure the Default Path Cost Standard for a Port

Compared with the path cost calculated based on the IEEE 802.1D-1998 standard, the path cost calculated based on the IEEE 802.1T-2001 is larger. With the increase of the link rate, the path cost value quickly decreases.

Table 5‑10 Configuring the default path cost standard for a port

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the default path cost standard for a port. | spanning-tree pathcost method { dot1D-1998 | dot1T-2001 } | Mandatory. By default, the IEEE 802.1T-2001 standard is used to calculate the default path cost of the port.

Configure the Path Cost of a Port

The port path cost affects election of the port role. A smaller port path cost means a better link. One port may have different port path cost in different spanning tree instances.

Table 5‑11 Configuring the path cost of a port

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the path cost of a port. | spanning-tree mst instance instance-id cost cost-value | Mandatory. By default, the path cost is automatically calculated according to the port rate.

Configure BPDU Packet Length Check

Configure the BPDU packet length check and you can let the port check the length of the received BPDU packet, so as to prevent the attack of the BPDU packet with the invalid length.

Table 5‑12 Configuring the BPDU packet length check

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the BPDU packet length check | spanning-tree bpdu length-check | Mandatory By default, do not enable the BPDU packet length check

Configure Maximum Length of BPDU Packet

Configure the maximum length of the BPDU packet when performing the BPDU packet length check.

Table 5‑13 Configuring the maximum length of the BPDU packet

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum length of the BPDU packet | spanning-tree bpdu max-length max-length | Mandatory By default, the maximum length od is 1500 bytes.

Configure the Maximum Transmitting Rate of BPDU Packets

The maximum transmitting rate of BPDU packets limits the number of BPDU packets that can be transmitted during the Hello Time of a device. This prevents the device from sending too many BPDU packets which may cause frequent spanning tree calculation for other devices.

Table 5‑14 Configuring the maximum transmitting rate of BPDU packets

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the maximum transmitting rate of BPDU packets. | spanning-tree transmit hold-count hold-count-number | By default, a port can send a maximum of 6 BPDU packets within Hello Time.

Configure Source MAC Address Check of BPDU Packet

Configure the source MAC address check of the BPDU packet and you can let the port check the source MAC address of the received BPDU packet, so as to prevent the attack of the BPDU packet from the invalid device.

Table 5‑15 Configuring the source MAC check of the BPDU packet

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the source mac check of the BPDU packet | spanning-tree bpdu src-mac-match src-mac | Mandatory By default, the port does not enable the source MAC address check of the BPDU packet.

Configure Timeout Factor of BPDU Packet

When the network topology is stable, the specified port will send on BPDU packet with a HELLO TIME interval. If the device does not receive the BPDU packet sent by the upstream device within three multiples of HELLO TIME, regard that the network topology changes and trigger the re-election of the spanning tree.

When the network topology is stableand if the downstream device does not receive the BPDU packet in time because the upstream device is busy or other reasons and triggers the re-election, you can configure the timeout factor to avoid the un-necessary calculation.

Table 5‑16 Configure the timeout factor of the BPDU packet

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the time factor of the BPDU packet | spanning-tree timer-facor ho times-number | By default, if the device does not receive the BPDU packet sent by the upstream device within three multiples of HELLO TIME, regard that the network topology changes and trigger the re-election of the spanning tree. In the stacking environment, it is suggested to configure the timeout factor as 6.

Configure an Edge Port

Edge ports are the ports that are directly connected to user terminals. If an edge port is UP/DOWN, it does not cause temporary loops. Therefore, an edge port can quickly migrate from the Discarding status to the Forwarding status without delay time. In addition, if an edge port is UP/DOWN, it does not send TC BPDUs. This prevents unnecessary spanning tree re-calculation.

If an edge port receives BPDU packets, it becomes a non-edge port again. Then, the port can become the edge port again only after it is reset.

Table 5‑17 Configuring edge ports

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure an edge port. | spanning-tree portfast edgeport | Mandatory. By default, a port is a not an edge port.

Configure Auto Detection of Edge Port

You can configure the auto detection of the edge port to let the port connected to the terminal be automatically identified as edge port, so as to prevent the online/offline of the terminal device from causing spanning tree re-calculation and network shock.

If receiving the BPDU packet after being identified as the edge port, re-change to the non-edge port.

Table 5‑18 Configure the auto detection of the edge port

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the auto detection of the edge port | spanning-tree portfast autoedge | Mandatory By default, the port disables the auto detection of the edge port.

Force Auto Detection of Edge Port

Because of the configuration or environment, the current port may be identified as the edge port or non-edge port wrongly. Here, the user can execute the command to trigger the port to detect the edge port, making the port correctly identify itself as the edge port.

Table 5‑19 Configure the auto detection of the edge port

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Force the auto detection of the edge port | spanning-tree portfast autoedge force | Mandatory

l The command can take effect only when the port is enabled with the auto edge port detection.

Configure the Port Link Type

If two devices are directly connected, you can configure the port link type to point-to-point link. The ports of the point-to-point link type can quickly migrate from the Discarding status to the Forwarding status without delay time.

Table 5‑20 Configuring the port link type

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the port link type. | spanning-tree link-type { point-to-point | shared } | Mandatory. By default, the port link type is set according to the port duplex mode. If the port works in the full duplex mode, the port is set to the point-to-point link type. If the port works in the half duplex mode, the port is set to the shared link type.

l The port link type should be configured according to the actual physical link. If the actual physical link of the port is not point-to-point link, but is configured as the point-to-point link wronly, it may cause the temporary loop.

l When the local port link type is the shared link type, the local port does not support the auto identify function of the edge port. If the peer port performs the auto identify function of the edge port, it may make the peer port be identified as the edge port wrongly.


5.2.4 Configure the Working Mode of a Spanning Tree

The working mode of a spanning tree determines the mode in which devices run and determines the encapsulation format of BPDU packets that are sent out. If a port that works in the MSTP mode is found to be connected to a device that runs RSTP, the port automatically migrates to the RSTP mode. If a port that works in the MSTP mode or MSTP mode is found to be connected to a device that runs STP, the port automatically migrates to the STP compatible mode.

Configuration Condition

None

Configure the Working Mode of a Spanning Tree

Table 5‑21 Configuring the working mode of a spanning tree

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the working mode of a spanning tree. | spanning-tree mode { stp | rstp | mstp } | Mandatory. By default, the working mode of a spanning tree is MSTP.


5.2.5 Configure the Spanning Tree Protection Function

Configuration Condition

None

Configure the BPDU Guard Function

For an access layer device, the access port is usually directly connected to the user terminal or file server. At this time, the port is set to the edge port to realize fast migration of port statuses. When an edge port receives BPDU packets, it automatically changes to a non-edge port to cause re-generation of the spanning tree. Normally, an edge port does not receive BPDU packets. However, if someone sends faked BPDU packets to attack the device in a malicious manner, network flapping may be caused. The BPDU Guard function is used to prevent such attacks. If an edge port on which the BPDU Guard function is enabled receives BPDU packets, the port is closed.

Table 5‑22 Configuring the BPDU guard function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the BPDU Guard function. | spanning-tree bpdu guard | Mandatory. By default, the BPDU Guard function is disabled on the port.

Configure the BPDU Filter Function

After the BPDU Filter function is enabled on an edge port, the port does not send or receive BPDU packets.

Table 5‑23 Configuring the BPDU filter function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the BPDU Filter function. | spanning-tree bpdu filter | Mandatory. By default, the BPDU Filter function is disabled.

Configure the Flap Guard Function

In a stable topology environment, the root port is usually not changed. However, if the links in the network are not stable or the network experiences attacks with external BPDU packets, frequent switchover of root ports may be caused, and finally network flapping is caused.

The Flap Guard function prevent frequent switchover of root ports. After the Flap Guard function is enabled, if the root port role change frequency of a spanning tree instance exceeds the specified threshold, the root port of the instance enters the Flap Guard status. In this case, the root port is always in the Discarding status, and it starts normal spanning tree calculation only after the recovery time times out.

Table 5‑24 Configuring the flap guard function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the Flap Guard function. | spanning-tree flap-guard enable | Mandatory. By default, the Flap Guard function is disabled.
Configure the maximum number of root port changes that are allowed within a detection period. | spanning-tree flap-guard max-flaps max-flaps-number time seconds | Optional. By default, after the Flap Guard function is enabled, if five root port role changes occurs for an instance within 10 seconds, the port enters the Flap Guard status.
Configure the Flap Guard recovery time. | spanning-tree flap-guard max-flaps count time seconds | Optional. By default, the Flap Guard recovery time is 30 seconds.

Configure the Loop Guard Function

The local device maintains the statuses of the root port and other blocked ports according to the BPDU packets that are periodically sent by the upstream device. In the case of link congestion or unidirectional link failure, the ports fail to receive BPDU packets from the upstream device, the spanning tree message on the port times out. Then, the downstream devices re-elect port roles. The downstream device ports that fail to receive BPDU packets change to designated port, while blocked ports migrate to the Forwarding status, resulting in loops in the switching network.

The Loop Guard function can restrain generation of such loops. After the Loop Guard function is enabled on a port, if the port times out owing to the failure to receive BPDU packets from the upstream device, in re-calculating the port role, the port is set to the Discarding status, and the port does not participate in spanning tree calculation. If an instance on the port receives BPDU packets again, the port participates in spanning tree calculation again.

Table 5‑25 Configuring the loop guard function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the Loop Guard function. | spanning-tree guard { loop | root | none } | Mandatory. By default, the Loop Guard function is disabled on the port.

l On a port, either the Root Guard function or the Loop Guard function can be enabled at a time.

Configure the Root Guard Function

The root bridge and backup root bridge of a spanning tree must be in the same region, especially the CIST root bridge and its backup bridge. In network design, usually the CIST root bridge and its backup bridge are placed in the core region with high bandwidth. However, owning to incorrect configuration or malicious attacks in the network, the legal root bridge in the network may receive a BPDU packet with a higher priority. In this way, the current legal bridge may lose its role as the root bridge, and improper change of the network topology is caused. The illegal change may lead the traffic that should be transmitted through a high-speed link to a low-speed link, causing network congestion.

The Root Guard function prevents occurrence of such case. If the Root Guard function is enabled on a port, the port can only act as the designated port in all instances. If the port receives a better BPDU configuration message, the port is set to the Discarding status. If it does not receive better BPDU configuration message in a period of time, the port resumes its previous status. It is recommended that you enable the Root Guard function on the specified port of the root bridge.

Table 5‑26 Configuring the root guard function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the Root Guard function. | spanning-tree guard { loop | root | none } | Mandatory. By default, the Root Guard function is disabled on the port.

l On a port, either the Root Guard function or the Loop Guard function can be enabled at a time.

Configure TC Guard Function

When the device discovers the network topology change, generate the TC packet to inform the other devices in the environment of the network topology change. When the device receives the TC packet, refresh the address. When the topology is not stable or the TC packet is man-made to attack, generate TC in the network frequently and as a result, the device refreshes the address repeatedly, affecting the spanning tree calsulation and resulting in the high CPU occupation.

TC GUARD can effectively prevent the case. After configuring TC GUARD on the current port and the device receives the TC packet, do not process the TC tag or spreading TC any more, so as to prevent the attack of the TC packet for the network.

Table 5‑27 Configure the TC Guard function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the TC Guard function | spanning-tree tc-guard enable | Mandatory By default, do not enable the TC Guard function of the port.

Configure the TC Protection Function

If the network topology changes, to ensure normal forwarding of service data during the topology change process, when devices handle TC packets, they will refresh the MAC addresses. Attacks with faked TC packets may cause the devices to refresh MAC addresses frequently. This affects calculation of the spanning tree and leads to a high CPU occupancy.

The TC protection function prevents occurrence of such case. After the TC protection function is enabled, once a TC packet is received within the TC protection interval, the TC counter counts one. If the TC counter is equal to or larger than the threshold, it enters a suppressed status. Then, the devices do not refresh MAC addresses in handling later TC packets. After the TC protection interval, the suppressed status is changed to the normal status, the TC counter is cleared and started again.

Table 5‑28 Configuring the TC protection function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the TC protection function. | spanning-tree tc-protection enable | Optional. By default, the TC protection function is enabled.
Enter the layer-2 Ethernet interface configuration mode. | interface interface-name | Either. After you enter the layer-2 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure a TC protection interval. | spanning-tree tc-protection interval seconds | Mandatory. By default, the TC protection interval is 2 seconds.
Configure the TC protection threshold. | spanning-tree tc-protection threshold threshold-value | Mandatory. By default, the TC protection threshold is 3.


5.2.6 Spanning Tree Monitoring and Maintaining

Table 5‑29 Spanning tree monitoring and maintaining

Command | Description
clear spanning-tree detected-protocols | Performs the mCheck operation globally or on a specified port.
clear spanning-tree bpdu statistics [interface interface-name | link-aggregation link-aggregation-id ] | Clears the BPDU statistics information on all or specified ports
show spanning-tree detail | Displays the detailed status information of the spanning tree
show spanning-tree guard [ configuration | interface interface-name | link-aggregation link-aggregation-id] | Displays the configuration and status information of the spanning tree protection function on the port
show spanning-tree { interface interface-name | link-aggregation link-aggregation-id } [detail] | Displays the spanning tree status information of the specified port or aggregation group
show spanning-tree mst [ configuration [ current | pending ] | detail | instance instance-id [ detail ] | { interface interface-name | link-aggregation link-aggregation-id } [ instance instance-id ] ] | Displays the configuration and status information about the spanning tree.
show configuration { current | pending } | Displays the configuration of MST regions.


5.3 Spanning Tree Typical Configuration Example


5.3.1 MSTP Typical Application

Network Requirements

l Four devices in the network are in the same MST domain. Device1 and Device2 convergence layer devices, while Device3 and Device4 are access layer devices.

l To reasonably balance traffic on the links to realize load sharing and redundancy backup, configure packets of VLAN2 to be forwarded following instance 1. The root bridge of instance 1 is Device1. Packets of VLAN3 are forwarded following instance 2. The root bridge of instance 2 is Device2. Packets of VLAN4 are forwarded following instance 0.

Network Topology

Figure 5‑1 Networking for MSTP typical application

Configuration Steps

Step 1:

Configure VLANs, and configure the link type of the ports.

#On Device1, create VLAN2-VLAN4, configure the link type of port gigabitethernet0/1 to Trunk and allow services of VLAN2-VLAN4 to pass.

Device1(config)#vlan 2-4

Device1(config)#interface gigabitethernet 0/1

Device1(config-if-gigabitethernet0/1)#switchport mode trunk

Device1(config-if-gigabitethernet0/1)#switchport trunk allowed vlan add 2-4

Device1(config-if-gigabitethernet0/1)#exit

#On Device1, configure the link type of port gigabitethernet0/2 to Trunk and allow services of VLAN3 and VLAN4 to pass. Configure the link type of port gigabitethernet0/3 to Trunk and allow services of VLAN2 and VLAN4 to pass. (Omitted)

#On Device2, create VLAN2-VLAN4. Configure the link type of ports gigabitethernet0/1-gigabitethernet0/3 to Trunk, configure gigabitethernet0/1 to allow services of VLAN2-VLAN4 to pass, gigabitethernet0/2 to allow services of VLAN2 and VLAN4 to pass, and gigabitethernet0/3 to allow services of VLAN3 and VLAN4 to pass. (Omitted)

#On Device3, create VLAN2-VLAN4, configure the link type of port gigabitethernet0/1-gigabitethernet0/2 to Trunk and allow services of VLAN2-VLAN4 to pass. (Omitted)

#On Device4, create VLAN3 and VLAN4, configure the link type of port gigabitethernet0/1-gigabitethernet0/2 to Trunk and allow services of VLAN3 and VLAN4 to pass. (Omitted)

Step 2:

Configure an MST region.

#On Device1, configure an MST region. Set the domain name to admin, the revision level to 1, map instance 1 to VLAN2, map instance 2 to VLAN3, and activate the MST region.

Device1#configure terminal

Device1(config)#spanning-tree mst configuration

Device1(config-mst-region)#region-name admin

Device1(config-mst-region)#revision-level 1

Device1(config-mst-region)#instance 1 vlan 2

Device1(config-mst-region)#instance 2 vlan 3

Device1(config-mst-region)#active configuration pending

Device1(config-mst-region)#exit

l The MST region configuration of Device2, Device3, and Device 4 is far different from that of Device1. (Omitted)

#On Device1, configure the priority of MSTI 1 to 0. On Device2, configure the priority of MSTI 2 to 0.

Device1(config)#spanning-tree mst instance 1 priority 0

Device2(config)#spanning-tree mst instance 2 priority 0

#On Device1, enable the spanning tree globally.

Device1(config)#spanning-tree enable

l The configuration for enabling the spanning tree globally on Device2, Device3, and Device 4 is far different from that on Device1. (Omitted)

Step 3:

Check the result.

#After the network topology is stable, check the calculation result of all spanning tree instances.

Device1#show spanning-tree mst

Spanning-tree enabled protocol mstp

MST Instance 00 vlans mapped: 1,4-4094

Bridge address 0000.0000.008b priority 32768

Region root address 0000.0000.008b priority 32768

Designated root address 0000.0000.008b priority 32768

root: 0, rpc: 0, epc: 0, hop: 20

Operational hello time 2, forward time 15, max age 20

Configured hello time 2, forward time 15, max age 20, max hops 20, hold count 6

Flap guard : admin false, max count 5, detect period 10s, recovery period 30s

Tc protection: admin true, threshold 3, interval 2s, rxTcCnt 0, status:NORMAL

Bpdu length-check: true, allowed bpdu max length is 1600, bpdu illegal length packets count: 0

Autoedge swap-check: true

Swap-delay time: 30

Configured timer factor: 3

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Desg FWD 20000 128.001 P2P

gi0/2 Desg FWD 20000 128.002 P2P

gi0/3 Desg FWD 20000 128.003 P2P

MST Instance 01 vlans mapped: 2

Bridge ID address 0000.0000.008b priority 1/0

Designated root address 0000.0000.008b priority 1

root: 0, rpc: 0, hop: 20

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Desg FWD 20000 128.001 P2P

gi0/3 Desg FWD 20000 128.003 P2P

MST Instance 02 vlans mapped: 3

Bridge ID address 0000.0000.008b priority 32770/32768

Designated root address 0001.7a54.5c96 priority 2

root: 32769, rpc: 20000, hop: 19

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Root FWD 20000 128.001 P2P

gi0/2 Desg FWD 20000 128.002 P2P

#On Device2, query the calculation result of all spanning tree instances. According to the result, port gigabitethernet0/2 of Device2 are blocked in both instance 0 and instance 1.

Device2#show spanning-tree mst

Spanning-tree enabled protocol mstp

MST Instance 00 vlans mapped: 1,4-4094

Bridge address 0001.7a54.5c96 priority 32768

Region root address 0000.0000.008b priority 32768

Designated root address 0000.0000.008b priority 32768

root: 32769, rpc: 20000, epc: 0, hop: 19

Operational hello time 2, forward time 15, max age 20

Configured hello time 2, forward time 15, max age 20, max hops 20, hold count 6

Flap guard : admin false, max count 5, detect period 10s, recovery period 30s

Tc protection: admin true, threshold 3, interval 2s, rxTcCnt 0, status:NORMAL

Bpdu length-check: true, allowed bpdu max length is 1600, bpdu illegal length packets count: 0

Autoedge swap-check: true

Swap-delay time: 30

Configured timer factor: 3

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Root FWD 20000 128.001 P2P

gi0/2 Alte DIS 20000 128.002 P2P

gi0/3 Desg FWD 20000 128.003 P2P

MST Instance 01 vlans mapped: 2

Bridge ID address 0001.7a54.5c96 priority 32769/32768

Designated root address 0000.0000.008b priority 1

root: 32769, rpc: 20000, hop: 19

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Root FWD 20000 128.001 P2P

gi0/2 Alte DIS 20000 128.002 P2P

MST Instance 02 vlans mapped: 3

Bridge ID address 0001.7a54.5c96 priority 2/0

Designated root address 0001.7a54.5c96 priority 2

root: 0, rpc: 0, hop: 20

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Desg FWD 20000 128.001 P2P

gi0/3 Desg FWD 20000 128.003 P2P

#On Device3, query the calculation result of all spanning tree instances.

Device3#show spanning-tree mst

Spanning-tree enabled protocol mstp

MST Instance 00 vlans mapped: 1,4-4094

Bridge address 0000.0305.070a priority 32768

Region root address 0000.0000.008b priority 32768

Designated root address 0000.0000.008b priority 32768

root: 32769, rpc: 20000, epc: 0, hop: 19

Operational hello time 2, forward time 15, max age 20

Configured hello time 2, forward time 15, max age 20, max hops 20, hold count 6

Flap guard : admin false, max count 5, detect period 10s, recovery period 30s

Tc protection: admin true, threshold 3, interval 2s, rxTcCnt 0, status:NORMAL

Bpdu length-check: true, allowed bpdu max length is 1600, bpdu illegal length packets count: 0

Autoedge swap-check: true Swap-delay time: 30

Configured timer factor: 3

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Root FWD 20000 128.001 P2P

gi0/2 Desg FWD 20000 128.002 P2P

MST Instance 01 vlans mapped: 2

Bridge ID address 0000.0305.070a priority 32769/32768

Designated root address 0000.0000.008b priority 1

root: 32769, rpc: 20000, hop: 19

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Root FWD 20000 128.001 P2P

gi0/2 Desg FWD 20000 128.002 P2P

#On Device4, query the calculation result of all spanning tree instances. According to the result, port gigabitethernet0/1 of Device4 is blocked in instance 0, and port gigabitethernet0/2 is blocked in instance 2.

Device4#show spanning-tree mst

Spanning-tree enabled protocol mstp

MST Instance 00 vlans mapped: 1,4-4094

Bridge address 0001.7a58.dc0c priority 32768

Region root address 0000.0000.008b priority 32768

Designated root address 0000.0000.008b priority 32768

root: 32769, rpc: 20000, epc: 0, hop: 19

Operational hello time 2, forward time 15, max age 20

Configured hello time 2, forward time 15, max age 20, max hops 20, hold count 6

Flap guard : admin false, max count 5, detect period 10s, recovery period 30s

Tc protection: admin true, threshold 3, interval 2s, rxTcCnt 0, status:NORMAL

Bpdu length-check: true, allowed bpdu max length is 1600, bpdu illegal length packets count: 0

Autoedge swap-check: true

Swap-delay time: 30

Configured timer factor: 3

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Alte DIS 20000 128.001 P2P

gi0/2 Root FWD 20000 128.002 P2P

MST Instance 02 vlans mapped: 3

Bridge ID address 0001.7a58.dc0c priority 32770/32768

Designated root address 0001.7a54.5c96 priority 2

root: 32769, rpc: 20000, hop: 19

Topology Change Count:4, last change occured:0 hour 1 minute 0 second(60 seconds)

Interface Role Sts Cost Prio.Nbr Type

-------------------- ----- ---- --------- --------- --------------------------

gi0/1 Root FWD 20000 128.001 P2P

gi0/2 Alte DIS 20000 128.002 P2P

Based on the spanning tree calculation result of the four devices, the tree diagrams corresponding to MSTI 0 (mapped to VLAN4), MSTI 1 (mapped to VLAN2), MSTI 2 (mapped to VLAN3) are obtained, as shown in the following figure.


6 Loopback Detection


6.1 Overview

In the Ethernet, if the destination of some packet fails to be recognized, they will be flooded in a VLAN. If a loop exists in the network, the packets circulate and multiply without limit, and finally they will use up the bandwidth. Then, the network fails to provide normal communication.

There are two types of loops, loop between different Ethernet interfaces of a device, and loop on one Ethernet interface of a device. The two types of loops can be detected through loopback detection.

After the loopback detection function is enabled, the Ethernet port sends loopback detection packets with an interval to check whether a loop exists in the network. When the Ethernet port receives the loopback detection packet sent by the local device, it determines that a loop exists in the network. Then, disable the Ethernet port to prevent the local loop from affecting the entire network.


6.2 Loopback Detection Function Configuration

Table 6‑1 Loopback Detection Function List

Configuration Tasks
Configure basic functions of loopback detection. | Enable the global loopback detection control switch.
 | Enable the loopback detection control switch of an Ethernet port or aggregation group.
Configure basic parameters of loopback detection. | Configure the interval at which loopback detection packets are sent.
 | Configure the Error-Disable action on an Ethernet port.


6.2.1 Configure Basic Functions of Loopback Detection

Configuration Condition

None

Enable the Global Loopback Detection Control Switch

The global loopback detection control switch is used to enable the global loopback detection function. The loopback detection configuration of an Ethernet port takes effect only after the global loopback detection control switch is enabled.

Table 6‑2 Enabling the Global Loopback Detection Control Switch

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the global loopback detection control switch. | loopback-detection enable | Mandatory. By default, the global loopback detection control switch is disabled.

Enable the Loopback Detection Control Switch of an Ethernet Port or Aggregation Group

After the loopback detection function is enabled, the Ethernet port sends loopback detection packets with an interval to check whether a loop exists in the network.

Table 6‑3 Enabling the Loopback Detection Control Switch of an Ethernet Port or Aggregation Group

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the L2/L3 Ethernet interface configuration mode. | interface interface-name | Either After you enter the L2/L3 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current Ethernet port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Enable the loopback detection control switch of an Ethernet port or aggregation group. | loopback-detection enable | Mandatory. By default, the loopback detection control switch of an Ethernet port or aggregation group is disabled.

l In loopback detection configuration task, you must enable the global loopback detection control switch before the loopback detection configuration on an Ethernet port takes effect.


6.2.2 Configure Basic Parameters of Loopback Detection

Configuration Condition

None

Configure the Interval at Which Loopback Detection Packets Are Sent

In a loopback detection, loopback detection packets are sent periodically to detect loops in the network. You can modify the interval at which loopback detection packets are sent according to the actual network requirement.

Table 6‑4 Configuring the Interval at Which Loopback Detection Packets Are Sent

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the L2/L3 Ethernet interface configuration mode. | interface interface-name | Either After you enter the L2/L3 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current Ethernet port. After you enter the aggregation group configuration mode, the subsequent configuration takes effect only within the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure the interval at which loopback detection packets are sent. | loopback-detection enable interval-time interval-time-value | Mandatory. By default, the interval at which loopback detection packets are sent is 30 seconds.

Configure the Error-Disable Action on an Ethernet Port

If the Ethernet port allows the Error-Disable action, the Ethernet port is controlled. After an Ethernet port detects a loop, it performs the Error-Disable action to close the Ethernet port so as to eliminate the loop. If the Ethernet port is not in the controlled status, the Ethernet port only prints loop prompt message instead of closing the Ethernet port. In this case, the loop has not been eliminated.

Table 6‑5 Configuring the Error-Disable Action on the Ethernet port

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the L2/L3 Ethernet interface configuration mode. | interface interface-name | Either After entering the L2/L3 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current Ethernet interface. After entering the aggregation group configuration mode, the subsequent configuration takes effect only on the aggregation group.
Enter the aggregation group configuration mode. | link-aggregation link-aggregation-id
Configure whether the Ethernet port allows the Error-Disable function. | loopback-detection enable control | Mandatory. By default, after the Ethernet port detects a loop, it performs the Error-Disable action.


6.2.3 Loopback Detection Monitoring and Maintaining

Table 6‑6 Loopback Detection Monitoring and Maintaining

Command | Description
show loopback-detection [ interface interface-name | link-aggregation link-aggregation-id ] | Displays the configuration information of all Ethernet ports or a specified Ethernet port in loopback detection.


6.3 Typical Configuration Example of Loopback Detection


6.3.1 Configure Remote Loopback Detection

Network Requirements

l Device1 and Device2 are directly connected, and Device2 has two L2 Ethernet ports which form a self-loop.

l On Device1, loopback detection has been enabled.

l After Device1 detects a loop, it closes the interconnected Ethernet ports to eliminate the loop.

Network Topology

Figure 6‑1 Networking for Configuring the Remote Loopback Detection Function

Configuration Steps of L2 Ethernet Interface

Step 1:

Configure VLANs, and configure the link type of the L2 Ethernet port.

#On Device1, create VLAN2.

Device1#configure terminal

Device1(config)#vlan 2

Device1(config-vlan2)#exit

#On Device1, configure the link type of L2 Ethernet port gigabitethernet0/1 to Trunk and allow services of VLAN2 to pass.

Device1(config)#interface gigabitethernet 0/1

Device1(config-if-gigabitethernet0/1)#switchport mode trunk

Device1(config-if-gigabitethernet0/1)#switchport trunk allowed vlan add 2

Device1(config-if-gigabitethernet0/1)#exit

#On Device2, create VLAN2.

Device2#configure terminal

Device2(config)#vlan 2

Device2(config-vlan2)#exit

#On Device2, configure the link type of L2 Ethernet port gigabitethernet0/1, gigabitethernet0/2, and gigabitethernet0/3 as Trunk, permitting the services of VLAN2 to pass; disable the spanning tree on L2 Ethernet interface gigabitethernet0/2 and gigabitethernet0/3.

Device2(config)#interface gigabitethernet 0/1-0/3

Device2(config-if-range)#switchport mode trunk

Device2(config-if-range)#no switchport trunk allowed vlan 1

Device2(config-if-range)#switchport trunk allowed vlan add 2

Device2(config-if-range)#exit

Device2(config)#interface gigabitethernet 0/2-0/3

Device2(config-if-range)#no spanning-tree enableDevice2(config-if-range)#exit

Step 2:

Enable the loopback detection function.

#On Device1, enable the loopback detection function globally.

Device1(config)#loopback-detection enable

#On Device1, view the loopback detection status.

Device1#show loopback-detection

-------------------------------------------------------------

Global loopback-detection : ENABLE

-------------------- -------- ------- ------------ -------

Interface Loopback Time(s) State Control

-------------------- -------- ------- ------------ -------

gi0/1 DISABLE 30 NORMAL TRUE

gi0/2 DISABLE 30 NORMAL TRUE

#On Device1, configure L2 Ethernet interface gigabitethernet0/1 as L3 Ethernet interface.

Device1(config)#interface gigabitethernet 0/1

Device1(config-if-gigabitethernet0/1)#no switchport

#On the L3 Ethernet interface gigabitethernet0/1 of Device1, enable the loopback detection function.

Device1(config-if-gigabitethernet0/1)#loopback-detection enable

Device1(config-if-gigabitethernet0/1)#exit

Step 3:

Check the result.

#On Device1, view the loopback detection status.

After detecting the loop:

Device1#show loopback-detection

-------------------------------------------------------------

Global loopback-detection : ENABLE

-------------------- -------- ------- ------------ -------

Interface Loopback Time(s) State Control

-------------------- -------- ------- ------------ -------

gi0/1 ENABLE 30 ERR-DISABLE TRUE

gi0/2 DISABLE 30 NORMAL TRUE

#On Device1, detect the loop, close L3 Ethernet port gigabitethernet0/1, and output the following prompt information on the device.

Jul 31 2014 11:29:30: %LOOP-BACK-DETECTED : loop-back send packet on gigabitethernet0/1, detected from gigabitethernet0/1

Jul 31 2014 11:29:30: %LINEPROTO-5-UPDOWN : gigabitethernet0/1 link-status changed to err-disable

Jul 31 2014 11:29:30: %LINK-INTERFACE_DOWN-3: Interface gigabitethernet0/1, changed state to down.

Jul 31 2014 11:29:30: %LINK-LINEPROTO_DOWN-3: Line protocol on interface gigabitethernet0/1, changed state to down.

#On Device1, view the status of L3 Ethernet port gigabitethernet0/1, and you can see that the status of L3 Ethernet port gigabitethernet0/1 changes to err-disabled.

Device1#show interface gigabitethernet 0/1 status err-disabled

Interface Status Reason

---------------------------------------------------------------

gi0/1 err-disabled loopback-detect


6.3.2 Configure Local Loopback Detection

Network Requirements

l Device1 and Device2 are loop-connected via two links, and all loop-connected L2 Ethernet ports are in one VLAN.

l On Device1, loopback detection has been enabled.

l After Device1 detects a loop, it closes the interconnected L2 Ethernet ports to eliminate the loop.

Network Topology

Figure 6‑2 Configure the local loopback detection function

Configuration Steps of L2 Ethernet Interface

Step 1:

Configure the VLAN and link type of the L2 Ethernet interface.

#Create VLAN2 on Device1.

Device1#configure terminal

Device1(config)#vlan 2

Device1(config-vlan2)#exit

#On Device1, configure the link type of L2 Ethernet port gigabitethernet0/1 and gigabitethernet0/2 as Trunk, permitting the services of VLAN2 to pass.

Device1(config)# interface gigabitethernet 0/1-0/2

Device1(config-if-range)#switchport mode trunk

Device1(config-if-range)#switchport trunk allowed vlan add 2

Device1(config-if-range)#exit

#On Device2, create VLAN2.

Device2#configure terminal

Device2(config)#vlan 2

Device2(config-vlan2)#exit

#Configure the link type of L 2 Ethernet port gigabitethernet0/1 and gigabitethernet0/2 as Trunk, permitting the services of VLAN2 to pass.

Device2(config)# interface gigabitethernet 0/1-0/2

Device2(config-if-range)#switchport mode trunk

Device2(config-if-range)#no switchport trunk allowed vlan 1

Device2(config-if-range)#switchport trunk allowed vlan add 2

Device2(config-if-range)#no spanning-tree enable

Device2(config-if-range)#exit

Step 2:

Enable the loopback detection function.

#On Device1, enable the loopback detection function globally.

Device1(config)#loopback-detection enable

#On Device1, view the loopback detection status.

Device1#show loopback-detection

-------------------------------------------------------------

Global loopback-detection : ENABLE

-------------------- -------- ------- ------------ -------

Interface Loopback Time(s) State Control

-------------------- -------- ------- ------------ -------

gi0/1 DISABLE 30 NORMAL TRUE

gi0/2 DISABLE 30 NORMAL TRUE

#Enable the loopback detection function on port gigabitethernet0/1 of Device1.

Device1(config)#interface gigabitethernet 0/1

Device1(config-if-gigabitethernet0/1)#loopback-detection enable

Device1(config-if-gigabitethernet0/1)#exit

Step 3:

Check the result.

#On Device1, view the loopback detection status.

After detecting the loop:

Device1#show loopback-detection

-------------------------------------------------------------

Global loopback-detection : ENABLE

-------------------- -------- ------- ------------ -------

Interface Loopback Time(s) State Control

-------------------- -------- ------- ------------ -------

gi0/1 ENABLE 30 ERR-DISABLE TRUE

gi0/2 DISABLE 30 NORMAL TRUE

# On Device1, detect the loop, close L2 Ethernet port gigabitethernet0/1, and ouput the following prompt information on the device:

Jul 30 2014 03:29:59: %LOOP-BACK-DETECTED : loop-back send tag packet in vlan2 on gigabitethernet0/1, detected in vlan2 from gigabitethernet0/2

Jul 30 2014 03:29:59: %LINK-INTERFACE_DOWN-4: interface gigabitethernet0/1, changed state to down

Jul 30 2014 03:29:59: %LINEPROTO-5-UPDOWN : gigabitethernet0/1 link-status changed to err-disable

#On Device1, view the status of L2 Ethernet port gigabitethernet0/1, and you can see that the status of L2 Ethernet port gigabitethernet0/1 changes to Down.

Device1#show interface gigabitethernet 0/1

gigabitethernet0/1 configuration information

Description :

Status : Enabled

Link : Down (Err-disabled)

Set Speed : Auto

Act Speed : Unknown

Set Duplex : Auto

Act Duplex : Unknown

Set Flow Control : Off

Act Flow Control : Off

Mdix : Auto

Mtu : 1824

Port mode : LAN

Port ability : 10M HD,10M FD,100M HD,100M FD,1000M FD

Link Delay : No Delay

Storm Control : Unicast Disabled

Storm Control : Broadcast Disabled

Storm Control : Multicast Disabled

Storm Action : None

Port Type : Nni

Pvid : 1

Set Medium : Copper

Act Medium : Copper

Mac Address : 0000.0000.008b

l When gigabitethernet 0/1 or gigabitethernet 0/2 of Device1 is L3 Ethernet interface, there is no loop in the networking environment.


7 Error-Disable Management


7.1 Overview

The Error-Disable function is an error detection and fault recovery mechanism on ports.

Exceptions on ports may degrade the performance of the entire network or bring down the entire network. The Error-Disable function can limit the abnormality within a single device or part of the network, preventing the abnormality from affecting other normal ports and preventing the abnormality from spreading.

If an exception is detected on an open port, the port is automatically closed so that the port will not forward packets. That is, if an error condition is triggered on the port, the port is automatically disabled. This is the Error-Disable management function, and the port status is the Error-Disabled status.

Currently, the following functions are supported: storm suppression, port security, link flapping, BPDU Guard, and loopback detection. (MP1800X does not support storm-control action because of the chip, so the errdisable association configuration can be delivered, but does not take effect in fact.)

If an exception is detected on a port through the above functions, the port is automatically closed, and it is set to the Error-Disabled status. However, this status cannot continue. After the fault is eliminated, the port needs to be enabled again, and the Error-Disabled status of the port needs to be cleared so that the port can continue to forward packets. Here the automatic recovery mechanism of the Error-Disable management function is involved.


7.2 Error-Disable Management Function Configuration

Table 7‑1 Error-disable management function list

Configuration Tasks
Configure Error-Disable basic functions. | Configure Error-Disable error detection.
Configure Error-Disable automatic recovery. | Configure Error-Disable automatic recovery.
 | Configure the interval for Error-Disable automatic discovery.


7.2.1 Configure Error-Disable Basic Functions

Configuration Condition

None

Configure Error-Disable Error Detection

After the Error-Disable detection of the specification function is configured, if an exception is detected on the port, the system automatically close the port and set the port to the Error-Disabled status.

Table 7‑2 Configuring error-disable error detection

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure Error-Disable error detection. | errdisable detect cause { all | bpduguard | loopback-detect | storm-control | link-flap | port-security } | Mandatory. By default, it is allowed that all the listed functions close a port and set the port to the Error-Disabled status.


7.2.2 Configure Error-Disable Automatic Recovery

Configure Error-Disable Automatic Recovery

The Error-Disable error detection mechanism enables specified functions to close a port. To quickly recover the port so that it can continue to forward packets, an automatic recovery mechanism is provided. With the mechanism, the port is automatically re-enabled after a specified interval.

Table 7‑3 Configuring error-disable automatic recovery

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure Error-Disable automatic recovery. | errdisable recovery cause { all | bpduguard | loopback-detect | storm-control | link-flap | port-security } | Mandatory. By default, a port cannot be automatically enabled, and the Error-Disabled status set by the listed functions cannot be automatically cleared. However, by default, a port can be automatically enabled and the Error-Disabled status can be automatically cleared if its status is set by the Link-Flap function.

Configure the Interval for Error-Disable Automatic Discovery

You can configure the interval for a port to automatically recover normal after it port is closed by the Error-Disable error detection mechanism.

Table 7‑4 Configuring the interval for error-disable automatic discovery

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the interval for Error-Disable automatic discovery. | errdisable recovery interval interval-value | Mandatory. By default, the interval at which a port is enabled and its Error-Disabled status is cleared is 300 seconds.


7.2.3 Error-Disable Management Monitoring and Maintaining

Table 7‑5 Error-disable management monitoring and maintaining

Command | Description
show errdisable detect | Displays whether it is allowed that all the listed functions close a port and set the port to the Error-Disabled status.
show errdisable recovery | Displays whether a port can be automatically enabled, and whether the Error-Disabled status set by the listed functions can be cleared automatically.
show { interface interface-list | link-aggregation link-aggregation-id } status err-disabled | Displays the information about Error-Disabled status setting of a specified port or aggregation group.


7.3 Typical Configuration Example of Error-Disable Management


7.3.1 Combination of Error-Disable with the Port

Network Requirements

l On Device, enable the port security function and Error-Disable function.

l When the PC not conforming to the security policy is connected to the device, disable the port via Error-Disabled, and Error-Disabled can re-enable the port according to the policy.

Network Topology

Figure 7‑1 The security combination of Error-Disable with the port

Configuration Steps

Step 1:

Configure VLAN and port link type.

#Create VLAN2 on Device.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

#Configure the link type of the port gigabitethernet0/1 of Device as Access, permitting the services of VLAN2 to pass.

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#switchport mode access

Device(config-if-gigabitethernet0/1)#switchport access vlan 2

Device(config-if-gigabitethernet0/1)#exit

Step 2:

Configure the port security function.

#On the port gigabitethernet0/1 of Device, enable the port security function, permitting the PC with the source MAC address 1.1.1 to access. When the event not conforming to the security happens, shut down the port.

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)# port-security enable

Device(config-if-gigabitethernet0/1)# port-security permit mac-address 1.1.1

Device(config-if-gigabitethernet0/1)#exit

Step 3:

Configure the Error-Disable function.

#Enable the recovery function of the port security in Error-Disable, and configure the recovery time as 30s.

Device(config)#errdisable recovery cause port-security

Device(config)#errdisable recovery interval 30

Step 4:

Check the result.

#View the Error-Disable configuration.

Device#show errdisable recovery

Error disable auto recovery config

interval:30 seconds

ErrDisable Reason Timer Status

--------------- ------------

bpduguard Enabled

link-flap Enabled

loopback-detect Enabled

port-security Enabled

storm-control Enabled

#When PC1 with the source MAC non-1.1.1 is connected to the network and sends the packet, disable the port gigabitethernet0/1, and print the following prompt information.

Jan 22 1970 07:00:07: %PORTSEC-5-VIOLATE: Receive unallowed packet, shut down interface gigabitethernet0/1

Jan 22 1970 07:00:07: %PORTMGR-LINEPROTO_DOWN-3: Line protocol on interface gigabitethernet0/1, changed state to down.

#View the status of port gigabitethernet0/1.

Device#show interface gigabitethernet 0/1

gigabitethernet0/1 configuration information

Description :

Status : Enabled

Link : Down (Err-disabled)

Set Speed : Auto

Act Speed : 1000

Def Speed : Auto

Set Duplex : Auto

Act Duplex : Full

Def Duplex : Auto

Set Flow Control : Off

Act Flow Control : Off

Mdix : Auto

Mtu : 2000

Port mode : LAN

Port ability : 10M HD,10M FD,100M HD,100M FD,1000M FD

Link Delay : No Delay

Storm Control : All Disabled

Pvid : 100

Set Medium : Copper

Act Medium : Copper

Mac Address : 0001.7a20.52f5

#After 30s, enable port gigabitethernet0/1, and print the following prompt information.

Jan 22 1970 07:07:09: %PORTMGR-AUTO_RECOVERY-5: auto recovery timer expired on interface gigabitethernet0/1, module: PORT SECURITY.

Jan 22 1970 07:07:13: %PORTMGR-LINEPROTO_UP-5: Line protocol on interface gigabitethernet0/1, changed state to up.

#View the status of the port gigabitethernet0/1.

Device#show interface gigabitethernet 0/1

gigabitethernet0/1 configuration information

Description :

Status : Enabled

Link : Up

Set Speed : Auto

Act Speed : 1000

Def Speed : Auto

Set Duplex : Auto

Act Duplex : Full

Def Duplex : Auto

Set Flow Control : Off

Act Flow Control : Off

Mdix : Auto

Mtu : 2000

Port mode : LAN

Port ability : 10M HD,10M FD,100M HD,100M FD,1000M FD

Link Delay : No Delay

Storm Control : All Disabled

Pvid : 100

Set Medium : Copper

Act Medium : Copper

Mac Address : 0001.7a20.52f5


1.1 Overview

To improve the service packet forwarding performance for the data communication device, a fast forwarding technology is designed. It shifts down and completes the routing and service handling in the layer compression mode at a time. This greatly reduces resource consumption caused by internal system task switching and packet cache management and finally improves the data forwarding performance for the overall system. This technology is a data forwarding software platform that is extensible and irrelevant to the hardware platform. It not only supports the data forwarding software platform of different products, but also supports fast forwarding of data packets, such as IPv4 unicast, IPv4 multicast, IPv6, and MPLS. These software platforms are collectively called as the fast forwarding platform.


1.2 Forwarding Function Configuration

Table 1‑1 Forwarding function list

Configuration Task
Configure the load balancing policy | Configure the load balancing policy
Enable the fast forwarding function over the interface | Enable the fast forwarding function over the interface


1.2.1 Configure Fast Forwarding Function over Interface

Configuration Condition

None

Configure Fast Forwarding Function over Interface

To enjoy the performance improvement brought by the fast forwarding, all interfaces are enabled with the fast forwarding function by default. However, there is still few applications cannot be supported in the fast forwarding mode, and therefore, the fast forwarding function must be disabled on these interfaces. In most cases, the fast forwarding function is enabled.

Table 1‑2 Disable the fast forwarding function over the interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface gigabitethernet0 | -
Enable the fast forwarding function over the interface | ip route-cache | Optional By default, the fast forwarding functions over all interfaces are enabled.


2 IPv4 Forwarding


2.1 Overview

The IPv4 forwarding includes the entire process from receiving the packet to sending out the packet. After receiving the packet, the interface uses the MEF to search for the routing, finds the corresponding outbound interface, and then sends out the packet. At the same time, if the ACL service is configured for the packet Rx and Tx interfaces, the flow forwarding records the packet handling result by the ACL. In this way, the packet can be searched for the corresponding handling result in the flow table entry and there is no need to deliver the packet to the ACL for handling. Thus, the flow forwarding accelerates the packet forwarding.


2.1.1 MEF Overview

The MEF mainly searches for the routing and obtains the forwarding information on the fast forwarding platform. The MEF table entry is the projection of the core routing table. It synchronously updates with the core routing table and searches for the routing using the LPM (Longest Prefix Match). The MEF table entry consists of two parts: FIB table and ADJ table. The MEF obtains the packet forwarding information by searching for the FIB table and ADJ table.

The MEF has all the features and benefits of fast forwarding:

l The searching speed is fast. No matter how large the forwarding table is, the routing searching can be completed upon a maximum of four times memory visits. The MEF is applicable to scenarios of all scales.

l The MEF has a stable performance. Because the complete projection of the core routing table is saved in the MEF table entry, if the driver receives the packet and the MEF fails to search the table, the packet is dropped directly. In this case, the upper CPU load is greatly relieved. This ensures that the CPU performance is given to the full play.

l The MEF is created before the packet flow. The cache entry is created without the progress switching. This improves the forwarding performance.

l The MEF will not be aging and updates synchronously with the core routing table. When the core routing table changes or the link information changes, the MEF table entry updates synchronously. No problems in the fast switching such as cache aging or invalid cache exist. Free from the routing instability, the MEF can be applied to multiple complex network scenarios.

l The link information is saved in the MEF. Complete forwarding information can be obtained by searching the forwarding table in the receiving progress, and then the forwarding is completed. There is no overhead related to the progress switching.

l The MEF provides effective load balancing mechanism and effectively utilizes the network resources by target flow, packet, and source flow.


2.1.2 Flow Forwarding Overview

The flow forwarding mainly records the forwarding and control result of the stable data flow on the fast forwarding platform and applies them to the subsequent packet forwarding of this data flow. In the common handling process, when the packet enters the router, actions such as packet resolution, link transmission protocol, ACL, NAT, PBR, QoS, and outbound routing are mandatory. Subsequently, the packet with the same header of the preceding packet will be handled in the same process when it enters the router. The flow forwarding records the results that every module on the forwarding path handles the packet to the flow table when the packet is completely handled. When the subsequent packet reaches, directly search the flow table. If such flow already exists in the flow table, handle the packet using the result of the preceding packet instead of completely handling the packet. In this way, the forwarding speed accelerates.

In the packet forwarding process, after the packet is received, a corresponding table entry is searched in the flow table. If a corresponding table entry is found, go on the subsequent handling. If a corresponding table entry fails to be found, the packet is handled based on temporary flow process, as shown in Figure 3-1.

Figure 2‑1 Handling process of the flow forwarding packet


2.2 IPV4 Forwarding Function Configuration

Table 2‑1 Flow forwarding function list

Configuration Task

Configure basic functions of the flow forwarding

Enable the flow forwarding function

Configure the maximum number of entries for the flow table

Configure the hit counts for the temporary flow

Configure the aging time for the active flow

Configure the aging time for the non-active flow


2.2.1 Configure Basic Functions of Flow Forwarding

Configuration Condition

None

Enable Flow Forwarding Function

After enabling the flow forwarding, the packet handling results will be recorded in the flow forwarding table entry.

Table 2‑2 Enable the flow forwarding function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the flow forwarding function | ip flow enable | Optional By default, the flow forwarding function is enabled.

Configure Maximum Number of Entries for Flow Table

Because the flow table entry occupies large memory, it is recommended that the user not change the maximum number of entries for the flow table.

Table 2‑3 Configure the maximum number of entries for the flow table

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Set the maximum number of entries for the flow table | ip flow-cache entries entry-number | Optional By default, the maximum number of the entries of the flow table is 262144.

l The maximum number of entries of the flow table is set in the flow forwarding initialization based on the memory size of the current device. Therefore, manual configuration is not recommended.

Configure Hit Counts for Temporary Flow

If the hit count for the temporary flow is set to 0, the packet directly searches the flow table for forwarding. If the hit count for the temporary flow is not set to 0, a formal flow table will be created when the hit count for the temporary flow reaches the configured value. The subsequent packets directly search the formal flow table for forwarding.

Table 2‑4 Configure the hit count for the temporary flow

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Set the hit count for the temporary flow | ip flow-cache headcount head-count | Mandatory By default, the hit count for the temporary flow is set to 0.

Configure Aging Time for Active Flow

If a flow table entry is hit by a packet flow in a certain time, the packet flow corresponding to the flow table entry is called the active flow. When the existence time of the active flow exceeds the aging time of the active time, the flow table entry corresponding to the active flow will be forced to age. That is, this flow table entry is deleted.

Table 2‑5 Configure the aging time for the active flow

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Set the aging time for the active flow | ip flow-cache timeout active active-time | Mandatory By default, the aging time for the active flow is 30 minutes.

Configure Aging Time for Non-active Flow

If a flow table entry is not hit by a packet flow in a certain time, the packet flow corresponding to the flow table entry is called the non-active flow. When the existence time of the non-active flow exceeds the aging time of the non-active time, the flow table entry will be forced to age. That is, this flow table entry is deleted.

Table 2‑6 Configure the aging time for the non-active flow

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Set the aging time for the non-active flow | ip flow-cache timeout inactive inactive-time | Optional By default, the aging time for the non-active flow is 60 minutes.


2.2.2 IPv4 Forwarding Monitoring and Maintaining

Table 2‑7 IPv4 forwarding monitoring and maintaining

Command | Description
clear ip cache flow statistics | Clear the statistics information of the flow forwarding
clear ip mef hit [ vrf vrf-name ] | Clear the statistics information of the hit counts in the MEF table entry
show ip cache flow | Display the detailed information of the flow entries in the flow forwarding
show ip mef | Display the MEF table entry information


3 ARP


3.1 Overview

Address Resolution Protocol (ARP) provides dynamic mapping from IP addresses to MAC addresses. The Ethernet frames to be transmitted in the Ethernet can be encapsulated properly only after MAC addresses are specified. The ARP protocol is used to obtain MAC addresses that correspond to IP addresses.


3.2 ARP Function Configuration

Table 3‑1 RP function list

Configuration Tasks
Configure basic functions of ARP. | Configure a static ARP entry.
 | Configure the maximum number of dynamic ARP entries.
 | Configure the dynamic ARP aging time.
 | Configure ARP receive queue depth.
 | Configure ARP proxy.
Configure ARP anti-attack function | Configure ARP anti-spoofing attack


3.2.1 Configure Basic Functions of ARP

Configuration Condition

None

Configure a Static ARP Entry

Configuring static ARP means that a user manually specifies the mapping between IP addresses and MAC addresses.

Table 3‑2 Configuring static ARP

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a static ARP entry. | arp [ vrf vrf-name ] { ip-address | host-name } mac-address [ alias [ advertise ] | advertise [ alias ] ] | Mandatory.

l When the configured static ARP entry contains an alias, if an ARP request for this IP address is received, the MAC address in the static ARP entry is used for response.

l When the configured static ARP entry contains the advertise option, the static ARP is notified regularly if the static ARP notification is enabled.

Configure the Maximum Number of Dynamic ARP Entries

The purpose of configuring the maximum number of dynamic ARP entries is to prevent dynamically learned ARP from occupying too many system resources.

Table 3‑3 Configuring the maximum number of dynamic ARP entries

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum number of dynamic ARP entries. | arp limited max-entries | Mandatory. By default, the maximum number of dynamic ARP entries is 2000.

Configure the Dynamic ARP Aging Time

The life cycle of a dynamically learned ARP entry is the aging time. Within the aging time, the device sends ARP requests periodically. If it receives an ARP response, it resets the aging time. If the aging time expires, the device deletes the dynamic ARP entry.

Table 3‑4 Configuring the dynamic ARP aging time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the dynamic ARP aging time. | arp timeout { seconds | disable } | Mandatory. The default aging time is 1200 seconds.

Configure ARP Receive Queue Depth

The received ARP packets will be first cached in the ARP receive queue and the system reads and handles the packets cached in the receive queue in turn. When the cached ARP packets reach the queue depth, the subsequent received ARP packets will be dropped. The user can adjust the ARP receive queue depth based on the network burst ARP.

Table 3‑5 Configure the ARP receive queue depth

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the ARP receive queue depth | arp queue-length length | Mandatory By default, the queue depth is 200 bytes.

Configure ARP Proxy

An ARP request is sent by one network host to another network, and the intermediate device between the two networks can respond to the ARP request. This process is called ARP proxy.

Table 3‑6 Configuring ARP proxy

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure ARP proxy. | ip proxy-arp | Mandatory. By default, the ARP proxy function is enabled.


3.2.2 Configure ARP Anti-attack Function

Configuration Condition

None

Configure ARP Anti-proofing Attack

In terms of the ARP proofing on the Ethernet, configure the ARP anti-proofing attack to avoid such problems.

Configuring this function includes ARP scanning, ARP binding, and static ARP notification enabling.

l ARP scanning is used to complete the ARP resolution in a specified IP address segment.

l ARP binding is used to bind the dynamic ARP as static ARP.

l Static ARP notification enabling is used to notify the ARP entries with notification tags in the static ARP.

Table 3‑7Configure the ARP anti-spoofing attack

Step | Command | Description
Execute ARP scanning | arp [ vrf vrf-name ] scan begin-ip-address end-ip-address [ bind [ alias [ advertise ] | advertise [ alias ] ] ] | Mandatory When the bind is contained, the scanned dynamic ARP is bound as the static ARP.
Execute ARP binding | arp [ vrf vrf-name ] bind { all | { begin-ip-address end-ip-address [ alias [ advertise ] | advertise [ alias ] ] } } | Optional
Enter the global configuration mode | configure terminal | -
Configure the static ARP with notification tags | arp [ vrf vrf-name ] ip-address mac-address advertise | Optional The static ARP is configured independently.
Enable the static ARP notification | arp advertise [ interval interval-time ] | Mandatory By default, this function disabled.


3.2.3 ARP Monitoring and Maintaining

Table 3‑8 ARP monitoring and maintaining

Command | Description
show arp [ vrf vrf-name ] | Queries the ARP table.
show arp attack-detection | Displays the information about the host which has been suspected of initiating static ARP attacks.


3.3 ARP Typical Configuration Example


3.3.1 Configure ARP Proxy

Network Requirements

l Device is directly connected to PC1 and PC2 respectively. The network number of the LAN in which PC1 and PC2 is located is 10.0.0.0/16.

l The MAC address of the interface VLAN1000 of Device is 0001.7a13.0102.

l Through the ARP proxy of Device, PC1 can successfully ping PC2, and PC1 can learn the MAC address of PC2.

Network Topology

Figure 3‑1 Networking for configuring ARP proxy

Configuration Steps

Step 1: | Configure the IP addresses for all interfaces. (Omitted)
Step 2: | Check the result.

#Ping the PC2 IP address 10.0.1.2 from PC1.

C:\Documents and Settings>ping 10.0.1.2

Pinging 10.0.1.2 with 32 bytes of data:

Reply from 10.0.1.2: bytes=32 time<1ms TTL=255

Reply from 10.0.1.2: bytes=32 time<1ms TTL=255

Reply from 10.0.1.2: bytes=32 time<1ms TTL=255

Reply from 10.0.1.2: bytes=32 time<1ms TTL=255

Ping statistics for 10.0.1.2:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

#Query the ARP entry of Device.

Device#show arp

Protocol Address Age (min) Hardware Addr Type Interface Switchport

Internet 10.0.0.1 - 0001.7a13.0102 ARPA VLAN1000 gigabitethernet0/0

Internet 10.0.0.2 1 B8AC.6F2D.4498 ARPA VLAN1000 gigabitethernet0/0

Internet 10.0.1.1 - 0001.7a13.0103 ARPA VLAN1001 gigabitethernet0/1

Internet 10.0.1.2 1 4437.e603.0d63 ARPA VLAN1001 gigabitethernet0/1

#Query the ARP entry of PC1.

C:\Documents and Settings>arp -a

Interface: 10.0.0.2 --- 0x5

Internet Address Physical Address Type

10.0.0.1 00-01-7a-13-01-02 dynamic

10.0.1.2 00-01-7a-13-01-02 dynamic

#Ping from PC1 to PC2 is successful, the PC1 has learned the MAC address of PC2.

l By default, ARP proxy is enabled for a device.


3.3.2 Configure a Static ARP Entry

Network Requirements

l Device and PC are directly connected.

l The MAC address of PC is 4437.e603.0d63.

l The IP address and MAC address of PC is bound to Device.

l PC can successfully ping the address of the interface VLAN1000 of Device.

Network Topology

Figure 3‑2 Networking for configuring a static ARP entry

Configuration Steps

Step 1: | Configure IP addresses for all interfaces. (Omitted)
Step 2: | Bind the IP address and MAC address of PC to Device.

#Configure Device.

Bind the IP address and MAC address of PC to Device.

Device#configure terminal

Device(config)#arp 10.0.0.1 4437.e603.0d63

Step 3:

Check the result.

#Query the ARP entry of Device.

Device#show arp

Protocol Address Age (min) Hardware Addr Type Interface Switchport

Internet 10.0.0.1 - 4437.e603.0d63 ARPA VLAN1000 gigabitethernet0/0

Internet 10.0.0.254 - 0001.7a13.0102 ARPA VLAN1000 gigabitethernet0/0

#PC pings the IP address 10.0.0.254 of the interface VLAN1000 on Device.

C:\Documents and Settings>ping 10.0.0.254

Pinging 10.0.0.254 with 32 bytes of data:

Reply from 10.0.0.254: bytes=32 time<1ms TTL=255

Reply from 10.0.0.254: bytes=32 time<1ms TTL=255

Reply from 10.0.0.254: bytes=32 time<1ms TTL=255

Reply from 10.0.0.254: bytes=32 time<1ms TTL=255

Ping statistics for 10.0.0.254:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

#PC can successfully ping the address of the interface VLAN1000 of Device.


4 IP


4.1 Overview

The Internet Protocol (IP) is based on data packets. It is used in data exchange between computer networks. The protocols that are supported by the device include: IP, Internet Control Message Protocol (ICMP), Transfer Control Protocol (TCP), and User Datagram Protocol (UDP).

Among them, IP packets are the base of the TCP/IP protocol stack. The IP layer is responsible for addressing, fragmentation, reassembly, and protocol information partitioning. As the network layer protocol, the IP protocol performs route addressing and control packet transmission.

The UDP protocol and the UDP protocol is set up based on the IP protocol. They provide connection-based reliable data transmission services and non-connection-based unreliable data transmission services respectively.

ICMP is mainly used to provide network detection services. It also provides an error report if the network layer or transmission layer protocol becomes abnormal, and it informs the related device of the abnormality to facilitate network control management.


4.2 IP Function Configuration

Table 4‑1 IP basic function list

Configuration Tasks
Configure an IP address. | Configure an IP address for an interface.
 | Configure an unnumbered IP address for an interface.
Configure basic functions of the IP protocol. | Configure the depth of the IP packet receive queue.
 | Configure the Time To Live (TTL) of transmitted IP packets.
 | Configure timeout for packet reassembly.
 | Enable IP packet receiving verification and check.
 | Configure transmitted IP packets to calculate a checksum.
 | Enable IP routing cache.
Configure basic functions of the ICMP protocol. | Enable global ICMP redirection.
 | Enable global ICMP redirection.
 | Enable ICMP destination unreachable.
 | Configure ICMP rate limit.
Configure basic functions of the TCP protocol. | Configure the size of the TCP receiving cache.
 | Configure the size of the TCP transmitting cache.
 | Configure the maximum number of TCP retransmissions.
 | Configure the maximum length of TCP packets.
 | Configure the maximum TCP round-trip time.
 | Configure the TCP connection idle time.
 | Configure TCP connection setup waiting time.
 | Configure the maximum number of TCP keep-alive times.
 | Enable the TCP timestamp.
 | Enable TCP selective retransmission.
Configure basic functions of the UDP protocol. | Configure TTL of UDP packets.
 | Configure the size of the UDP receiving cache.
 | Configure the size of the UDP transmitting cache.
 | Enable UDP verification and check.
 | Fill in UDP packet checksum.


4.2.1 Configure an IP Address

An IP address is a 32-bit binary number, divided to four “8-bit binary number” and expressed by “dotted decimal” in the (a.b.c.d) format. It is used to uniquely identify a network device that runs the IP protocol on the Internet.

An IP address consists of the following two parts:

l Network number (Net-id): It identifies the network in which the device is located.

l Host number (Host-id): It specifies the host number in the device network.

To facilitate IP address management, IP addresses are categorized into five classes, and each IP address class has its own functions. IP addresses of classes A to C are used for address allocation, IP addresses of class D is used in multicast applications, and IP addresses of class E are used for test purpose. The following table shows the IP addresses classes and their ranges.

Table 4‑2 IP address classes and their ranges

Address Type | Available Network Address Range | Description
A | 1.0.0.0-127.0.0.0 | Network number 127 is used for loopback interfaces.
B | 128.0.0.0-191.255.0.0 | -
C | 192.0.0.0-223.255.255.0 | -
D | 224.0.0.0-239.255.255.255 | Class D addresses are used for multicast.
E | 240.0.0.0-247.255.255.255 | Class E addresses are used for test purpose.

The three address segments, 10.0.0.0-10.255.255.255, 172.16.0.0-172.16.255.255, and 192.168.0.0-192.168.255.255 are private and reserved addresses, and they cannot be allocated to the public network.

With the development of the Internet, IP address resources have gradually been consumed up. Address allocation based on classes causes address waste, so the concept of "subnet" is introduced. "Subnet" takes some host numbers in the IP addresses as subnet numbers. In this way, a large network is divided into multiple subnets. This facilitates network planning and deployment.

This section describes how to configure an interface IP address and how to configure an unnumbered interface IP address.

Configuration Condition

None

Configure an IP Address for an Interface

An IP address can only be configured for an interface that supports the IP protocol. One interface can only be configured with one primary IP address but it can be configured with multiple secondary IP addresses.

Table 4‑3 Configuring an IP address for an interface

Step

Command

Description

Enter the global configuration mode.

configure terminal

-

Enter the interface configuration mode.

interface interface-name

-

Configure an IP address for an interface.

ip address ip-address
{ network-mask | mask-len }
[ secondary ]

Mandatory.

By default, the IP address of the interface is not configured.

l One interface can only be configured with one primary IP address, therefore, the newly configured primary IP address replaces the original primary IP address.

l Before an interface is configured with secondary IP addresses, the interface must be configured a primary IP address. An interface can be configured with a maximum of 500 secondary IP addresses.

l The IP addresses of different interfaces must not in the same network segment, but the primary and secondary IP addresses of one interface can be in the same network segment.

Configure an Unnumbered IP Address for an Interface

Unnumbered IP addresses save IP addresses. In the case of unnumbered IP addresses, the IP addresses of other interfaces can be borrowed instead of allocated independently. If an unnumbered interface generates an IP packet, the source IP address of the packet is the primary IP address of a borrowed interface. In configuring an unnumbered IP address for an interface, the interface to be borrowed must be specified, so that the IP address of the interface can be borrowed.

Table 4‑4 Configuring an unnumbered IP address for an interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure an unnumbered IP address for an interface. | ip unnumbered reference-interface | Mandatory. By default, the unnumbered IP address is not configured.

l The borrowed interface must be configured with the primary IP address, and the interface must not be configured with an unnumbered IP address.

l The primary IP address of an interface can be borrowed by multiple interfaces, but only the primary IP address of the interface can be borrowed.


4.2.2 Configure Basic Functions of the IP Protocol

In the TCP/IP protocol stack, the IP protocol is the network layer core protocol that is responsible for network interconnection. The IP protocol is a connectionless protocol. Before transmitting data, you need not set up a connection. The IP protocol tries best to deliver packets, but is does not ensure that all packets can reach the destination orderly.

Configuration Condition

None

Configure the Depth of the IP Packet Receive Queue

The IP packets received by a device are first cached in the IP packet receive queue of an interface. The system reads packets orderly in the queue for processing. If the cached IP packets reach the specified queue depth, the later IP packets are discarded. You can adjust the depth of the IP packet receive queue according to burst of IP packets in the network.

Table 4‑5 Configuring the depth of the IP packet receive queue

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the depth of the IP packet receive queue to a specified value. | ip option queue-length queue-size | Mandatory. By default, the depth of the IP packet receive queue is 200 bytes.
Configure the depth of the IP packet receive queue to the default value. | default ip option queue-length | Optional. By default, the depth of the IP packet receive queue is 200 bytes.

Configure the TTL of Transmitted IP Packets

The header of an IP packet contains the Time-To-Live (TTL) field, which is decreased by one once the IP packet passes a routing device. When the TTL is 0, the device discards the IP packet. By default, the TTL of IP packets transmitted by the device is 255, that is, the packet can only be transmitted for up to 255 times. If you want to limit the number of packet forwarding times, adjust the TTL value for the transmitted IP packets.

Table 4‑6 Configuring the TTL of transmitted IP packets

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the TTL of transmitted IP packets to a specified value. | ip option default-ttl ttl -value | Mandatory. By default, the TTL of transmitted IP packets is 255.
Configure the TTL of transmitted IP packets to a default value. | default ip option default-ttl | Optional. By default, the TTL of transmitted IP packets is 225.

Configure Timeout for Packet Reassembly

If an IP packet is fragmented during the transmission, after the fragments reach the destination, they need to be reassembled to form a complete IP packet. Before all fragments are received, the received fragments are cached temporarily. If reassembly times out before all fragments reach the destination, the received fragments are discarded.

Table 4‑7 Configuring timeout for packet reassembly

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configuring timeout for packet reassembly to a specified value. | ip option fragment-ttl ttl-value | Mandatory. By default, the timeout for packet reassembly is 60, and the unit is 0.5 second.
Configuring timeout for packet reassembly to the default value. | default ip option fragment-ttl | Optional. By default, the timeout for packet reassembly is 60, and the unit is 0.5 second.

l The unit for timeout of packet reassembly is 0.5 second.

Enable IP Packet Receiving Verification and Check

You can enable this function to verify and check the received IP packets. If the checksum is incorrect, the packet will be discarded.

Table 4‑8 Enabling IP packet receiving verification and check

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable IP packet receiving verification and check. | ip option recv-checksum | Mandatory. By default, the function is enabled.
Configure the method for verifying and checking the received IP packets to the default value. | default ip option recv-checksum | Optional. By default, the received packet verification and check is enabled.

Enable IP Routing Cache

After a packet is sent from socket to the IP layer, if the destination address is the same as the previous packet and the route is valid, the packet directly use the route in the cache without the need of searching for another route.

Table 4‑9 Enabling IP routing cache

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable IP routing cache. | ip upper-cache | Mandatory. By default, the IP routing cache function is enabled.


4.2.3 Configure Basic Functions of the ICMP Protocol

In the TCP/IP protocol stack, ICMP is mainly used to provide network detection services. It also provides an error report if the network layer or transmission layer protocol becomes abnormal, and it informs the related device of the abnormality to facilitate network control management.

Configuration Condition

None

Enable Global ICMP Redirection

After a device receives an IP packet to be forwarded, if it is found that the receiving interface of the packet and the transmitting interface of the packet are the same through route selection, the device forwards the packet and sends back an ICMP redirection packet to the source end, requesting the source end to reselect the correct next hop for transmission of later packets. By default, a device can send ICMP redirection packets. In some special cases, you can prohibit a device from sending ICMP redirection packets.

Table 4‑10 Enabling global ICMP redirection

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable global ICMP redirection. | ip redirect | Mandatory. By default, the global ICMP redirection function is enabled.

Enable Global ICMP Redirection

In sending ICMP redirection packets, if you need to send ICMP redirection packets, you need to enable the ICMP redirection function on the interface.

Table 4‑11 Enabling global ICMP redirection

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Enable ICMP redirection on an interface. | ip redirects | Mandatory. By default, the ICMP redirection function is enabled on an interface.

l You can send ICMP redirection packets only when the ICMP redirection function is enabled globally and on the interface.

Enable ICMP Destination Unreachable

After a device receives IP data packets, if the destination is unreachable, the packet is discarded and the ICMP destination unreachable error packet is sent back to the source end.

l If route selection of a forwarded IP packet fails, the network unreachable ICMP error packet is sent back to the source end.

l If the selected route of a forwarded IP packet is the straight-through route, but the arp of requesting for the destination IP times out, a host unreachable ICMP error packet is sent back to the source end.

l For an IP packet that can be forwarded, if you need to fragment the IP packet but a Don't Fragment (DF) bit is set in the packet, an ICMP error packet indicating that "segmentation is required but a DF bit is set" is sent to the source end.

l For an IP packet whose destination address is the local device, if the device does not support the upper-layer protocol of the device, it sends a "protocol unreachable" ICMP error packet to the source end.

l For an IP packet whose destination address is the local device, if the transport layer port of the packet of the packet does not match the port that the device process monitors, the device sends back a "port unreachable" ICMP error packet to the source end.

If a device encounters a malicious attack by a large number of ICMP destination unreachable packets, the device performance is degraded, and network traffic is increased. To prevent such case, you can disable the function of sending ICMP destination unreachable packets.

Table 4‑12 Enabling ICMP destination unreachable

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Enable ICMP destination unreachable. | ip unreachables | Optional. By default, the ICMP destination unreachable function is enabled.

Configure ICMP Rate Limit

If a device encounters a malicious attack by a large number of ICMP error packets, the device performance is degraded, and network traffic is increased. To prevent such case, you can configure ICMP packet rate limit. The types of ICMP error packets include: unreachable packets, redirection packets, TTL timeout packets, and parameter error packets. The default rate limit of the packets is 10pps, while the transmitting rate of the other types of packets is 0, that is, no rate limit. In addition, you can configure the transmitting rates for different types of packets independently. If no rate is configured for a type of packets, the default value is used.

Table 4‑13 Configuring ICMP rate limit

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable ICMP rate limit. | ip icmp ratelimit enable | Mandatory. By default, the function is disabled.
Configure ICMP rate limit. | ip icmp ratelimit { default pps | echo-reply { pps | unlimit } | mask-reply { pps | unlimit } | param-problem { pps | unlimit } | redirect { pps | unlimit } | time-exceed { pps | unlimit } | time-stamp-reply { pps | unlimit } | unreach { pps | unlimit } } | Mandatory. By default, the ICMP rate limit function is enabled.


4.2.4 Configure Basic Functions of the TCP Protocol

In the TCP/IP protocol stack, TCP is a connection-oriented transport layer protocol. Before sending data through the TCP protocol, you must first set up a connection. The TCP protocol provides congestion control and ensures reliable data transmission.

Configuration Condition

None

Configure the Size of the TCP Receiving Cache

In some special network environment, you can configure both the size of receiving cache and the size of transmitting cache of a TCP connection so that the network can reach the optimal performance. If the TCP connection receiving cache is not configured, the size of the receiving cache is the default value.

Table 4‑14 Configuring the size of the TCP receiving cache

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the size of the TCP receiving cache. | ip tcp recvbuffers buff-size | Mandatory. By default, the size of the receiving cache is 8192 bytes.

Configure the Size of the TCP Transmitting Cache

In some special network environment, you can configure both the size of receiving cache and the size of transmitting cache of a TCP connection so that the network can reach the optimal performance. If the TCP connection transmitting cache is not configured, the size of the transmitting cache is the default value.

Table 4‑15 Configuring the size of the TCP transmitting cache

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the size of the TCP transmitting cache. | ip tcp sendbuffers buff-size | Optional. By default, the size of the transmitting cache is 8192 bytes.

Configure the Maximum Number of TCP Retransmissions

After the server sends a SYN-ACK packet, if it does not receive a response packet from the client, the server retransmits the packet. If the number of retransmissions exceeds the maximum number of retransmissions defined by the system, the system disconnects the TCP connection.

Table 4‑16 Configuring the maximum number of TCP retransmissions

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum number of TCP retransmissions. | ip tcp retransmits retransmits-count | Mandatory. By default, the maximum number of TCP retransmissions is 3.

Configure the Maximum Length of TCP Packets

The maximum length of TCP packets is the maximum length of data blocks that are sent by the transmitting end of a TCP connection to the receiving end. When a connection is set up, the smaller maximum packet length of the two ends is used as the maximum packet length in sending TCP packets by the two ends. If a TCP packet exceeds the maximum packet length, the transmitting ends fragments the packet before sending it.

Table 4‑17 Configuring the maximum length of TCP packets

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum length of TCP packets. | ip tcp segment-size seg-size | Optional. By default, the maximum length of TCP packets is 512 bytes.

Configure the Maximum TCP Round-Trip Time

The TCP round trip time refers to the time between the timepoint at which the transmitting end sends a TCP packet and the timepoint at which the transmitting end receives the response packet. The maximum TCP round-trip time that is configured during TCP connection setup is taken as the initial value of the TCP round-trip time. The later TCP round-trip time is calculated according to the actual round-trip time. By default, the maximum TCP round-trip time is 3 seconds.

Table 4‑18 Configuring the maximum TCP round-trip time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum TCP round-trip time. | ip tcp round-trip round-trip-time | Mandatory. By default, the maximum TCP round-trip time is 3 seconds.

Configure the TCP Connection Idle Time

After a TCP connection is set up, if no data is exchanged, the TCP connection idle time times out. Then TCP performs a keep-alive test. After the maximum number of keep-alive times is reached, the TCP connection is disconnected. By default, the TCP connection idle time is 2 hours.

Table 4‑19 Configuring the TCP connection idle time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the TCP connection idle time. | ip tcp idle-timeout idle-time | Mandatory. By default, the TCP connection idle time is 14400, and the unit is 0.5 second.

l The unit of the TCP connection idle time is 0.5 second.

Configure TCP Connection Setup Waiting Time

The setup of a TCP connection requires three handshakes. After a TCP client sends a connection request packet, it waits for the response from the TCP server before completing connection setup. After the time for waiting for connection setup timeout before a response is received, connection setup is terminated. By default, the time for waiting for setting up a TCP connection is 75 seconds.

Table 4‑20 Configuring TCP connection setup waiting time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure TCP connection setup waiting time. | ip tcp init-timeout init-time | Mandatory. By default, the time for waiting for setting up a TCP connection is 150 seconds, and the unit is 0.5 second.

l The unit of the TCP connection setup waiting time is 0.5 second.

Configure the Maximum Number of TCP Keep-Alive Times

If no data is exchanged on a TCP connection for TCP connection idle time, a TCP keep-alive packet is sent for keep-alive test. If the keep-alive test fails, a keep-alive test is performed again. If the maximum number of TCP keep-alive times exceeds the threshold, the TCP connection will be disconnected. By default, the maximum number of TCP keep-alive times is 3.

Table 4‑21 Configuring the maximum number of TCP keep-alive times

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum number of TCP keep-alive times. | ip tcp keep-count keep-count | Mandatory. By default, the maximum number of TCP keep-alive times is 3.

Enable the TCP Timestamp

TCP automatically calculates the packet round-trip time according to the serial number of the request packet and that of the response packet. However, the calculation is not accurate. Use of TCP timestamps can revise the problem. The transmitting end adds a timestamp into a packet, and the receiving end sends back the timestamp in the response packet. The transmitting end calculates the packet round-trip time according to the returned timestamp. By default, the function is disabled.

Table 4‑22 Enabling the TCP timestamp

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the TCP timestamp. | ip tcp timestamp | Mandatory. By default, the function is disabled.

Enable TCP Selective Retransmission

After TCP sends a series of packets, if the transmission of one packet fails, the series of packets need to be retransmitted. After TCP selective transmission is enabled, only the packet that fails to be transmitted needs to be retransmitted. This reduces the system and line cost. By default, the function is disabled.

Table 4‑23 Enable TCP selective retransmission

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure TCP selective retransmission. | ip tcp selective-ack | Mandatory. By default, the function is disabled.


4.2.5 Configure TCP Anti-Attack Function

If the TCP server receives lots of SYN packets, but the peer end does not answer the SYN+ACK response of the server. As a result, lots of the server memory is consumed, occupying a half of the connection queue of the server, and the TCP server cannot serve for the normal request. As for the attack, you can configure the TCP anti-attack function to prevent.

Configuration Condition

None

Enable the TCP syncache Function

When the SYN packet is received, there is no rush to distribute TCB, but first reply one SYN+ACK packet and save the half-open connection information in a private cache until the correct response ACK packet is received.

Table 4‑24 Enable the TCP syncache function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the TCP syncache function | ip tcp syncache | Mandatory By default, the function is not enabled.

Enable the TCP syncookies Function

The function does not use any storage resource, but adopts one special algorithm to generate Sequence Number. The algorithm considers the fixed information of the peer IP and port, and local IP and port, as well as the local fixed information that the peer party does not know, such as MSS and time. After the peer ACK packet is received, re-calculate and view whether it is the same as the Sequence Number-1 in the peer response packet, so as to decide whether to distribute the TCB resource.

Table 4‑25 Enable the TCP syncookies function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the TCP syncookies function | ip tcp syncookies | Mandatory By default, the function is not enabled.


4.2.6 Configure Basic Functions of the UDP Protocol

In the TCP/IP protocol stack, UDP is a connectionless-oriented transport layer protocol. Before sending data through the TCP protocol, you need not set up a connection. The UDP protocol provides unreliable data transmission without congestion control.

Configuration Condition

None

Configure TTL of UDP Packets

Configuring TTL of UDP packets means to fill in the TTL value in the IP header of UDP packets. The header of an IP packet contains the Time-To-Live (TTL) field, which is decreased by one once the IP packet passes a routing device. When the TTL is 0, the device discards the IP packet. By default, the TTL value of the IP packet of a UDP packet is 64.

Table 4‑26 Configuring TTL of UDP packets

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure TTL of UDP packets. | ip udp default-ttl time-to-live | Mandatory. By default, the TTL value of the IP packet of a UDP packet is 64.

Configure the Size of the UDP Receiving Cache

In some special network environment, you can configure both the size of receiving cache and the size of transmitting cache of a UDP connection so that the network can reach the optimal performance. If the UDP connection receiving cache is not configured, the size of the receiving cache is the default value, 41600 bytes.

Table 4‑27 Configuring the size of the UDP receiving cache

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the size of the UDP receiving cache. | ip udp recvbuffers buffer-size | Mandatory. By default, the size of the UDP receiving cache is 41600 bytes.

Configure the Size of the UDP Transmitting Cache

In some special network environment, you can configure both the size of receiving cache and the size of transmitting cache of a UDP connection so that the network can reach the optimal performance. If the UDP connection transmitting cache is not configured, the size of the transmitting cache is the default value, 9216 bytes.

Table 4‑28 Configuring the size of the UDP transmitting cache

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the size of the UDP transmitting cache. | ip udp sendbuffers buffer-size | Mandatory. By default, the size of the UDP transmitting cache is 9216 bytes.

Enable UDP Verification and Check

To prevent errors that occur during transmission of UDP packets, after UDP packets are received, UDP verification and check need to be performed. The system compares the UDP packet verification field calculated by the receiving end and the UDP packet header checksum field. If the two values are different, the system determines that a transmission error has occurred, and then discards the packet. By default, the function is enabled.

Table 4‑29 Enabling UDP verification and check

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable UDP verification and check. | ip udp recv-checksum | Mandatory. By default, the function is enabled.

Fill in UDP Packet Checksum

To prevent UDP packets from encountering transmission errors, in transmitting UDP packets, the transmitting end fills in the UDP packet checksum to be calculated into the UDP packet header checksum field for the receiving end to perform checksum check. By default, the function is enabled.

Table 4‑30 Filling in UDP packet checksum

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure to fill in packet checksum in transmitting UDP packets. | ip udp send-checksum | Mandatory. By default, the function is enabled.


4.2.7 IP Basics Monitoring and Maintaining

Table 4‑31 IP basics monitoring and maintaining

Command | Description
clear ip icmpstat | Clears ICMP protocol statistics.
clear ip statistics | Clears IP protocol statistics.
clear ip tcpstat | Clears TCP protocol statistics.
clear ip tcp syncache statistics | Clears the syncache statistics information of the TCP protocol
clear ip udpstat | Clears UDP protocol statistics.
show ip icmpstat | Displays ICMP protocol statistics.
show ip interface [ interface-name | brief ] | Displays the interface IP address.
show ip sockets | Displays the Socket details.
show ip statistics | Displays IP protocol statistics.
show ip tcpstat | Displays TCP protocol statistics.
show ip tcp syncache detail | Displays the syncache entity information of the TCP protocol
show ip tcp syncache statistics | Displays the TCP syncache statistics information
show ip udpstat | Displays UDP protocol statistics.
show tcp tcb [ detail ] | Displays TCP protocol control block details.


5 VFR


5.1 Overview

IP fragmentation packets may be out-of-order in transmission. Because the out-of-order packets do not have the transmission layer information, these packets cannot be correctly handled by some service modules, such as the NAT and ACL. To tackle this problem, the VRF (Virtual Fragmentation Reassembly) caches the fragmented packets, analyze the packets, extract the transmission layer information, and provide the information to the NAT and ACL. The VRF supports anti-tiny fragment attack. If the IP payload length of the first fragment of the arrived packet is less than the length of the transmission layer protocol header, the tiny fragment attack is suffered. The anti-attack function can reduce the system resource consumption.


5.2 VFR Function Configuration

Table 5‑1 IP VFR function list

Configuration Task
Enable the IP VFR | Enable the IP VFR
Configure the IP VFR parameter | Configure the aging time for the IP VFR
 | Configure the automatic updating for the IP VFR
Configure the anti-tiny fragment attack | Configure the anti-tiny fragment attack


5.2.1 Enable IP VFR

Configuration Condition

None

Enable IP VFR

Enable the IP VFR on the inbound interface. When the IP fragmented packet is received, the VFR attempts to analyze the packet fragmentation. If the first fragmentation of the fragmented packet arrives at first, the transmission layer information of the fragmented packet is saved in the fragmentation records. If other fragmentation of the fragmented packet arrives at first (the fragmented packet is out-of-order), the transmission layer information cannot be obtained. The VFR attempts to cache the fragmentation, obtains the transmission layer information when the first fragment of the packet arrives, and then sends out the packet. When the first fragment of the packet does not arrive in a long time, sends out all the cached packets.

Table 5‑2 Enable the IP VFR

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the IP VFR | ip virtual-reassembly | Mandatory By default, the IP VFR is not enabled.

l When the fragmented packet arrives out of order, the VFR may increase the forwarding delay of the fragmentation, reducing the fragmentation forwarding performance.

l After configuring service modules such as the NAT and IPSec, the VFR take effect automatically instead of manual configuration.

l Configure the ip virtual-reassembly disable command to disable the VFR function.


5.2.2 Configure IP VFR Parameter

The IP VFR parameter can configure the aging time and automatic updating.

Configuration Condition

Before configuring the IP VFR parameter, first complete the following task:

l Enable the IP VFR.

Configure Aging Time for IP VFR

When the device receives the IP fragmented packet, the fragmentation record is created. When the aging time times out, the fragmentation record is deleted.

Table 5‑3 Configure the aging time for the IP VFR

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the aging time for the IP VFR | ip virtual-reassembly timeout seconds | Mandatory By default, the aging time is 1s.

Configure Automatic Updating for IP VFR

If the IP VFR automatic updating is configured, the aging time of the subsequent received fragmented packet will be updated automatically in the aging process.

Table 5‑4 Configure the automatic updating for the aging time of the fragmented records

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the automatic updating for the IP VFR | ip virtual-reassembly auto-update | Mandatory By default, the automatic updating for the IP VFR is not configured.


5.2.3 Configure Anti-tiny Fragment Attack

Configuration Condition

Before configuring the anti-tiny fragment attack function, first complete the following task:

l Enable the IP VFR.

Configure Anti-tiny Fragment Attack

If the IP payload length of the first fragment of the arrived packet is less than the length of the transmission layer protocol header, the tiny fragment attack is suffered. When a large number of such fragmented packets are received, abundant fragmentation records need to be created, resulting in excessive system resource consumption. If the anti-tiny fragment attack is configured, the fragmentation record for this tiny fragment will not be created, thus reducing the system resource consumption.

Table 5‑5 Configure the anti-tiny fragment attack

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the anti-tiny fragment attack | ip virtual-reassembly arbitrary | Mandatory By default, the anti-tiny fragment attack is not configured.


5.2.4 IP VFR Monitoring and Maintaining

Table 5‑6 IP VFR monitoring and maintaining

Command | Description
show ip virtual-reassembly statistics | View the IP VFR statistics


6 DHCP


6.1 Overview

It is hard to manage a large network. For example, in a network in which IP addresses are manually allocated, IP address conflicts are common. The only way of solving the problem is to dynamically allocate IP addresses to the hosts. The Dynamic Host Configuration Protocol (DHCP) allocates IP address to requesting hosts from an IP address pool. DHCP also provides other information, such as gateway IP and DNS server address. DHCP reduces the workload of the administrator in recording and tracking manually allocated IP addresses.

DHCP is a protocol that is based on UDP broadcast. The process for a DHCP client to obtain an IP address and other configuration information contains four phases.

DISCOVER phase. When the DHCP client accesses the network for the first time, it sends a DHCP DISCOVER packet with the source address 0.0.0.0 and destination address 255.255.255.255 to the network.

OFFER phase. After the DHCP server receives the DHCP DISCOVER broadcast packet sent by the client, it selects an IP address from the corresponding IP address pool according to the policy, and sends the IP address and other parameters to the client in a DHCP OFFER packet.

REQUEST phase. If the DHCP client receives response messages from multiple DHCP servers on the network, it selects one DHCP OFFER (usually the one that arrives first). Then it sends a DHCP REQUEST packet to the network, telling the entire DHCP server the IP address of which server it will accept.

ACK phase. After the DHCP server receives the DHCP REQUEST packet from the DHCP server, it sends a DHCP ACK message containing the provided IP address and other configuration to the DHCP client, telling the DHCP client that the DHCP client can use the provided IP address.

The IP address that the DHCP server allocates to the DHCP client has a lease. After the lease expires, the server will take back the allocated IP address. When the lease term of the IP address of the DHCP client has passed half time, the DHCP client sends a DHCP REQUEST packet to the DHCP server requesting to update its IP address lease. If the DHCP server allows the DHCP client to use its IP address, the DHCP server responds with a DHCP ACK packet, requesting the DHCP client to update the lease. If the DHCP server does not allow the DHCP client to continue to use the IP address, the DHCP server responds with a DHCP NAK packet.

During dynamic IP address acquisition, request packets are sent in broadcast mode; therefore, DHCP is applied only when the DHCP client and server are in the same subnet. If multiple subnets exist in a network and the hosts of the subnets need to obtain configuration information such as IP address through the DHCP server, the hosts of the subnets communicate with the DHCP server through a DHCP relay to obtain IP addresses and other configuration information.


6.2 DHCP Function Configuration

Table 6‑1 DHCP function list

Configuration Tasks
Configure a DHCP address pool. | Create a DHCP address pool.
 | Bind an IP address to a DHCP host.
 | Configure an IP address range.
 | Configure a domain suffix.
 | Configure the address of the NETBIOS server.
 | Configure a DNS server address.
 | Configure the default route.
 | Configure the lease of an IP address.
 | Configure VRF properties.
 | Configure user-defined options.
 | Configure the address pool of the specified manufacturer
Configure other parameters of a DHCP server. | Configure the range of reserved IP addresses.
 | Configure DHCP ping detection parameters.
 | Configure the DHCP service switch
 | Configure DHCP not to detect the transaction ID
 | Configure DHCP to detect the packet interface
 | Configure the ARP auto binding function of the DHCP server
Configure the functions of a DHCP client. | Configure a DHCP client.
 | Configure the DHCP routing distance
 | Configure the Option60
 | Configure the DHCP client not to request the default route
Configure the DHCP relay function | Configure the DHCP relay
 | Configure the Option 82 function
 | Configure the source address of the DHCP relay packet as the relay address


6.2.1 Configure a DHCP Address Pool

Configuration Condition

None

Create a DHCP Address Pool

A DHCP server needs to select and allocate IP addresses and other parameters from a DHCP address pool. Therefore, a DHCP address pool must be created for the DHCP server.

Table 6‑2 Creating a DHCP address pool

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Create a DHCP address pool and enter the DHCP configuration mode. | ip dhcp pool pool-name | Mandatory. By default, no DHCP address pool has been created by the system.

l Address pools fall into three types: Host, Network, and Range. The three types of address pools can be configured respectively through the host, network, and range commands.

l To modify the type of an address pool, delete the address pool type with the no command, and then configure it to another type.

Bind an IP Address to a DHCP Host

An address pool of the Host type has only one IP address, so a hardware address or client ID that matches a DHCP host must be configured. The DHCP server allocates the IP address from the address pool of the Host type only to the DHCP host that meets the specific conditions.

Table 6‑3 Binding an IP address to a DHCP host

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Bind an IP address to a DHCP host. | host ip-address [ network- mask ] | Mandatory. By default, no IP address of any host is bound to a DHCP address pool.
Specify the address of hardware that matches the client. | hardware-address ha | Optional. By default, no address of hardware that matches the client is specified.
Specify a client ID. | client-identifier cid | Optional. By default, no client ID is specified for the DHCP address pool.

l The host command is used to configure only one DHCP host address. A newly configured host address may overwrite the existing host address.

l If an address range has been configured for the address by using the network or range command, you must use the no command to delete the address range before use the host command for configuration.

l The hardware-address and client-identifier commands are only used for the address pool of the Host type, and at least one command must be used. They cannot be used for address pools of the Network type or the Range type.

l In the case of the hardware-address and client-identifier commands, only the last configured parameters take effect. Newly configured parameters overwrite the existing configuration parameters.

Configure an IP Address Range

On a DHCP server, each DHCP address pool must be configured with an IP address range to allocate IP addresses to DHCP clients.

Table 6‑4 Configuring an IP address range

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Configure an IP address range for an address pool of the Network type. | network ip-address [ network- mask ] | Optional. By default, an IP address range is not configured for an address pool.
Configure an IP address range for an address pool of the Range type. | range low-ip-addres high-ip-address [ network-mask ] | Optional. By default, an IP address range is not configured for an address pool.

l After an IP address range is configured for an address pool by using the network or range command, if you run the network or range command again, the new IP address range configuration overwrites the existing configuration.

Configure a Domain Suffix

On a DHCP server, you can configure a domain suffix respectively for each DHCP address pool. When a DHCP server allocates an IP address for a DHCP client, it also sends the domain suffix to the client.

When the DHCP client uses the domain name, you can input only part of the domain name while the system automatically adds the domain suffix for domain name resolution.

Table 6‑5 Configuring a domain suffix

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Configure a domain for a client. | domain-name domain-name | Mandatory. By default, no domain name is configured.

Configure the Address of the NETBIOS Server

A DHCP client that runs on the Windows Operating System (OS) can obtain a mapping from the host name to the IP address from the WINS server through the NETBIOS protocol.

On a DHCP server, you can configure the NETBIOS server address respectively for each DHCP address pool. The DHCP server specifies the NETBIOS server address when it allocates an IP address for a client.

Table 6‑6 Configuring the address of the NETBIOS server

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Configure the address of the NETBIOS server. | netbios-name-server ip-address&<1-8> | Mandatory. By default, the NETBIOS server address is not configured.

Configure a DNS Server Address

On a DHCP server, you can configure the DNS server address respectively for each DHCP address pool. When a DHCP server allocates an IP address for a DHCP client, it also sends the DNS server address to the client.

When the DHCP client starts dynamic domain name resolution, it queries the DNS server.

Table 6‑7 Configuring a DNS server address

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Configure a DNS server address. | dns-server { ip-address&<1-8> | auto-config } | Mandatory. By default, the DNS server address is not configured.

Configure the Default Route

On a DHCP server, you can specify the address of a gateway corresponding to clients for each DHCP address pool. When the server allocates an IP address to a client, it also sends the gateway address to the client.

When a DHCP client accesses a server or host that is not in the network segment, its data is forwarded through the gateway.

Table 6‑8 Configuring the default route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Configure the default route. | default-router ip-address&<1-8> | Mandatory. By default, no default route is configured.

Configure the Lease of an IP Address

The IP address that the DHCP server allocates to the DHCP client has a lease. After the lease expires, the server will take back the allocated IP address. If the DHCP client wants to continue to use the IP address, it must have the IP address lease updated.

On the DHCP server, you can configure an IP address lease for each DHCP address pool.

Table 6‑9 Configuring the lease of an IP address

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Configure an IP address lease. | lease days [ hours [ minutes ] ] | Mandatory. By default, the value of days is 1, the value of hours is 6, and the value of minutes is 0.

Configure VRF Properties

Virtual Route Forwarding (VRF) is a basic concept of the Multi Protocol Label Switching (MPL) Layer 3 Virtual Private Network (L3 VPN) network technology. Each VRF can be regarded as a virtual router which has an independent routing table. In addition, VRF has independent address space, a group of interfaces that belong to the VRF, and a group of routing protocols that are applied only to the VRF. The VRF technology is used to isolate different VPN users and solve the problem of network address overlapping.

Table 6‑10 Configuring VRF properties

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Configure VRF properties. | vrf vrf-name | Mandatory. By default, an address pool is not configured with VRF properties.

Configure User-Defined Options

For some options, RFC does not give specifications; therefore, you can define these options according to the actual requirement.

Table 6‑11 Configuring user-defined options

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Configuring user-defined options. | option option-code{ ascii ascii-string| hex hex-string| ip ip-address&<1-8>} | Mandatory. By default, user-defined options are not configured.

Configure the Address Pool of Specified Manuafcturer

When the client requests for the IP address, it may carry the option60, indicating the manufacturer ID. The customer can specify different IP address segments for different manufacturers.

Table 6‑12 Configure the address pool of the DHCP manufacturer

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the DHCP configuration mode. | ip dhcp pool pool-name | -
Configure the address pool of the manufacturer and enter the DHCP manufacturer address pool configuration mode | vendor-class-identifier vendor_id | By default, do not configure the manufacturer address pool.
Configure the manufacturer address pool range | ip range low-ip-address high-ip-address | By default, do not configure the range.
Configure the option 43 content returned for the specified manufacturer | option 43 { ascii ascii-string| hex hex-string| ip ip-address&<1-8>} | By default, do not configure.


6.2.2 Configure Other Parameters of a DHCP Server

Configuration Condition

None

Configure the Range of Reserved IP Addresses

In a DHCP address pool, some IP addresses are reserved for some special devices, and some IP addresses conflict with the IP addresses of other hosts in the network. Therefore, the IP addresses cannot be dynamically allocated.

Table 6‑13 Configuring the range of reserved IP addresses

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the range of reserved IP addresses. | ip dhcp excluded-address low-ip-address [ high-ip-address ] | Mandatory. By default, the range of reserved IP addresses is not configured. The IP addresses in the reserved IP address range will not be allocated.

Configure DHCP Ping Detection Parameters

To prevent an IP address conflict, before dynamically allocating an IP address to a DHCP client, a DHCP server must detect the IP address. The detection operation is performed through the ping operation. The DHCP server determines whether an IP address conflict exists by checking whether an ICMP response packet is received within the specified time.

Table 6‑14 Configuring DHCP ping detection parameters

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure DHCP ping detection parameters. | ip dhcp ping { packets packet-num | timeout time } | Mandatory. By default, the number of ping packets is 1, and the timeout time is 500 ms.

Configure DHCP Service Switch

The switch is used to control whether to provide the DHCP service.

Table 6‑15 Configure the DHCP service switch

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the DHCP service switch | ip dhcp service | Mandatory By default, enable the DHCP service.

Configure DHCP not to Detect Transaction ID

The xid (transaction ID) in the DHCP packet is one random number generated by the DHCP client, mainly used by the DHCP server and client to match the request and response packets.

Table 6‑16 Configure the DHCP not to detect the transaction ID

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the DHCP not to detect the transaction ID | ip dhcp check-xid disable | Mandatory By default, detect the transaction ID.

Configure DHCP to Detect Packet Interface

The DHCP server should receive the DHCP packets of one DHCP client from one interface every time.

Table 6‑17 Configure the DHCP to detect the interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure DHCP to detect the packet interface | ip dhcp check-interface | Mandatory By default, detect the packet interface.

Configure the ARP Auto Binding Function of the DHCP Server

The DHCP server binds the distributed IP address with the MAC address of the client as the static ARP.

Table 6‑18Configure the ARP auto binding function of the DHCP server

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the ARP auto binding function of the DHCP server | ip dhcp arp-binding enable | Mandatory By default, do not enable the ARP auto binding function.


6.2.3 Configure the Functions of a DHCP Client

Configuration Condition

None

Configure a DHCP Client

A DHCP client interface obtains an IP address and other parameters through DHCP.

Table 6‑19 Configuring a DHCP Client

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the DHCP client to obtain an IP address. | ip address dhcp [ request-ip-address ip-address | network-mask] | Mandatory. By default, the DHCP client is not configured to obtain an IP address.

Configure DHCP Routing Distance

In the IP routing table, each protocol has a management distance to control the routing, that is, routing distance. The routing distance is used to decide the routing for the same network segment of different protocols. The routing with a short distance has a high priority.

Table 6‑20 Configure the DHCP routing distance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the DHCP routing distance | ip dhcp route-distance distance | Mandatory By default, the DHCP routing distance is 254.

Configure Option 60

The content of DHCP Option 60 is the manufacturer ID. When the DHCP client requests, it can carry option 60. The server can make the policy for distributing the IP address according to the option.

Table 6‑21 Configure the DHCP Option 60 function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the option 60 function | ip dhcp vendor-class-identifier {disable | content hex-string} | By default, carry the option 60.

Configure the DHCP Client Not to Request Default Route

When the DHCP client requests the IP address, request the default route by default. The user can specify the DHCP client not to request the default route, but configure the route by itself.

Table 6‑22 Configure the DHCP client not to request the default route

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the DHCP client not to request the default route | ip dhcp router-option disable | Mandatory By default, the DHCP client requests the default route.


6.2.4 Configure the Function of a DHCP Relay

Configuration Condition

None

Configure a DHCP Relay

If multiple subnets exist in a network and the hosts of the subnets need to obtain configuration information such as IP address through the DHCP server, the hosts of the subnets communicate with the DHCP server through a DHCP relay to obtain IP addresses and other configuration information.

Table 6‑23 Configuring a DHCP relay

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the DHCP relay function. | ip dhcp-server ip-address | Mandatory. By default, the DHCP relay function is not configured.

Configure the Option82 Function

Option82 is a trunk information option, which records the location of a DHCP client. If a DHCP relay receives a request packet sent by a DHCP client to a DHCP server, it adds Option82 into the request packet and sends the packet to the DHCP server. If the DHCP relay receives a DHCP response packet which contains Option82, it deletes Option82 and forwards the packet to the DHCP client.

Table 6‑24 Configuring the Option82 function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the Option82 function. | ip dhcp relay information { option | remote-id { ascii ascii-string| hex hex-string}| circuit-id { ascii ascii-string| hex hex-string} } | Mandatory. By default, the Option82 function is not configured.

Configure the Source Address of the DHCP Relay Packet as the Relay Address

When the DHCP relay sends the packet, the default used source address of the packet is the auto selected address of the system. In some special environments, the DHCP server cannot communicate the address, so the user can configure the DHCP relay to fill in the source address of the packet as the relay address.

Table 6‑25 Configure the source address of the DHCP relay packet as the relay address

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the source address of the DHCP relay packet as the relay address | ip dhcp relay source-address relay-address | Mandatory By default, the source address of the DHCP relay packet is the auto selected address.


6.2.5 DHCP Monitoring and Maintaining

Table 6‑26 DHCP monitoring and maintaining

Command | Description
clear ip dhcp binding { all | ip-address} | Clears the address binding in the DHCP server
clear ip dhcp pool [ pool-name ] binding | Clears the IP, MAC binding of the DHCP address pool
clear ip dhcp relay statistics | Clears statistics from the relay server.
show ip dhcp binding [ ip-address ip-address | mac-address mac-addressme] | Displays the lease information of the DHCP server
show ip dhcp excluded-pool | Displays the reserved IP address range in the system.
show ip dhcp lease | Displays the lease information of DHCP clients.
show ip dhcp ping | Displays the ping parameters that are used by the DHCP server to perform address validity check.
show ip dhcp pool [ pool-name ] | Displays the configuration information of a DHCP address pool in the system.
show ip dhcp pool-binding | Displays the number of the IP, MAC binding in the system
show ip dhcp pool-statistic | Displays the statistics of DHCP address pools in the system.
show ip dhcp relay statistics | Clears statistics on the relay server.


6.3 DHCP Typical Configuration Example


6.3.1 Configure a DHCP Server to Statically Allocate IP Addresses

Network Requirements

l Device2 acts as a DHCP server to allocate IP addresses, gateway IP addresses, and DNS server IP addresses in a static manner.

l The DHCP server allocates an IP address to PC1 in MAC binding mode, and it allocates an IP address to PC2 in Client ID binding mode.

Network Topology

Figure 6‑1 Configuring a DHCP server to statically allocate IP addresses

Configuration Steps

Step 1: | Configure IP addresses for interface of Device2. (Omitted) Device2#configure terminal Device2(config)#interface gigabitethernet 0/0 Device2(config-if-gigabitethernet0/0)#switchport access vlan 100 Device2(config-if-gigabitethernet0/0)#exit Device2(config)#interface vlan 100 Device2(config-if-vlan100)#ip address 1.0.0.3 255.255.255.0
Step 2: | Configure statically bound address pools and parameters.

#Configure the address pool mac-binding, and allocate an IP address to PC1 in static MAC binding mode.

Device2(config)#ip dhcp pool mac-binding

Device2(dhcp-config)#host 1.0.0.11 255.255.255.0

Device2(dhcp-config)#hardware-address 00e0.00c1.013d

Device2(dhcp-config)#default-router 1.0.0.1

Device2(dhcp-config)#dns-server 1.0.0.2

Device2(dhcp-config)#exit

#Configure the address pool client-id-binding, and allocate an IP address to PC2 in static client ID binding mode.

Device2(config)#ip dhcp pool client-id-binding

Device2(dhcp-config)#host 1.0.0.12 255.255.255.0

Device2(dhcp-config)#client-identifier 0100.e04c.113c.f2

Device2(dhcp-config)#default-router 1.0.0.1

Device2(dhcp-config)#dns-server 1.0.0.2

Device2(dhcp-config)#exit

Step 3:

Check the result.

#On Device2, use the show ip dhcp binding command to display the IP addresses that are allocated to PC1 and PC2.

Device2#show ip dhcp binding

Current DHCP binding information

Hardware-Address IP-Address Lease Status

00e0.00c1.013d 1.0.0.11 1Day 05:59:38 ACKED

00e0.4c11.3cf2 1.0.0.12 1Day 05:59:41 ACKED

On PC1 and PC2, check whether the obtained IP addresses, gateway IP addresses, and DNS server IP addresses are correct.


6.3.2 Configure a DHCP Server to Dynamically Allocate IP Addresses

Network Requirements

l Two Ethernet interfaces of Device, gigabitethernet0/1 and gigabitethernet0/1, are respectively configured with IP addresses in the 1.0.0.3/24 and 2.0.0.3/24 network segments.

l The DHCP server Device dynamically allocates IP addresses in the 1.0.0.0/24 and 2.0.0.0/24 network segments to the two clients in the directly-connected physical network.

l The IP addresses in network segment 1.0.0.0/24 have a one-day lease, the gateway address is 1.0.0.3, the DNS server address is 2.0.0.4, and there is no Winds server. The IP addresses in network segment 2.0.0.0/24 have a three-day lease the gateway address is 2.0.0.3, the DNS server address is 2.0.0.4, and the Wins server address is 2.0.0.5.

l The first 10 IP addresses in network segments 1.0.0.0/24 are reserved and cannot be allocated, and the domain suffix in the network segments is xxyyzz.com.

Network Topology

Figure 6‑2 Networking for configuring the DHCP server to dynamically allocate IP addresses

Configuration Steps

Step 1: | Configure IP addresses for all interfaces. (Omitted)
Step 2: | On the DHCP server Device, configure two dynamic address pools and their parameters.

#Configure the first 10 IP addresses in the two address pools to be reserved.

Device#configure terminal

Device(config)#ip dhcp excluded-address 1.0.0.1 1.0.0.10

Device(config)#ip dhcp excluded-address 2.0.0.1 2.0.0.10

#Configure address pool dynamic-pool1 and its parameters (including address range, gateway, DNS, address lease, and local domain name).

Device(config)#ip dhcp pool dynamic-pool1

Device(dhcp-config)#network 1.0.0.0 255.255.255.0

Device(dhcp-config)#default-router 1.0.0.3

Device(dhcp-config)#dns-server 2.0.0.4

Device(dhcp-config)#domain-name xxyyzz.com

Device(dhcp-config)#lease 1 0 0

Device(dhcp-config)#exit

#Configure address pool dynamic-pool2 and its parameters (including address range, gateway, DNS address, address lease, Wins server address, and local domain name).

Device(config)#ip dhcp pool dynamic-pool2

Device(dhcp-config)#network 2.0.0.0 255.255.255.0

Device(dhcp-config)#default-router 2.0.0.3

Device(dhcp-config)#dns-server 2.0.0.4

Device(dhcp-config)#netbios-name-server 2.0.0.5

Device(dhcp-config)#domain-name xxyyzz.com

Device(dhcp-config)#lease 3 0 0

Device(dhcp-config)#exit

Step 3:

Check the result.

#On Device, query the IP addresses that are allocated to clients.

Device#show ip dhcp binding

Current DHCP binding information

Hardware-Address IP-Address Lease Status

0010.9400.0001 2.0.0.11 2Day 23:59:52 ACKED

00e0.00c1.013d 1.0.0.13 23:59:28 ACKED

#On Device, query the IP address pool allocation statistics.

Device#show ip dhcp pool-statistic

DHCP pool statistic

pool name free address allocated address total

--------- ------------ ----------------- -----

dynamic-pool1 243 1 244

dynamic-pool2 243 1 244

Free address: 486 Allocated address: 2 Total: 488

Total 20 address excluded

On the DHCP clients, query whether the IP addresses have been obtained properly.

l The IP addresses in the address pool must be within the network segment range of the interface that provides the service.


6.3.3 Configure a DHCP Relay

Network Requirements

l The DHCP clients and the DHCP server are not in the same physical network.

l The DHCP clients are in network segment 1.0.0.0/24, and the DHCP server is in network segment 2.0.0.0/24.

l The IP address of the DHCP server Device1 is 2.0.0.1.

l The address pool of the DHCP server provides services to the client in network segment 1.0.0.0/24, and the first 10 IP addresses are reserved.

l The DHCP server allocates IP addresses to the DHCP clients that are in different physical networks by use of a DHCP relay.

l Device2 acts as the DHCP relay.

Network Topology

Figure 6‑3 Networking for configuring a DHCP relay

Configuration Steps

Step 1: | Configure IP addresses for all interfaces. (Omitted)
Step 2: | Configure an IP address pool for the DHCP server Device 1, and configure the reserved IP addresses.

#Configure IP addresses which are from 1.0.0.1 to 1.0.0.10 not to be allocated.

Device1#configure terminal

Device1(config)#ip dhcp excluded-address 1.0.0.1 1.0.0.10

Device1(config)#exit

#Configure IP address pool dynamic-pool for Device1.

Device1(config)#ip dhcp pool dynamic-pool

Device1(dhcp-config)#network 1.0.0.0 255.255.255.0

Device1(dhcp-config)#default-router 1.0.0.1

Device1(dhcp-config)#lease 1 0 0

Device1(dhcp-config)#exit

#Configure a static route to network segment 1.0.0.0/24.

Device1(config)#ip route 1.0.0.0 255.255.255.0 2.0.0.2

Step 3:

On the DHCP relay, configure the IP address of the DHCP relay server to 2.0.0.1.

Device2(config)#ip dhcp-server 2.0.0.1

Step 4:

Check the result.

#On Device1, query the IP addresses that have been allocated.

Device1#show ip dhcp binding

Current DHCP binding information

Hardware-Address IP-Address Lease Status

0010.9400.0001 1.0.0.12 23:57:44 ACKED

Use the show ip dhcp binding command to query the IP addresses that have been allocated to clients. The result shows that a client has obtained the IP address 1.0.0.12.


6.3.4 Configure the DHCP Relay to Support Option82

Network Requirements

l On the DHCP relay device, Option82 is enabled.

l For request packets that contain Option82, the processing policy keeps unchanged.

l For Option82 sub-option Remote ID, 0102030405 is specified.

l The DHCP relay Device adds Option82 in a request packet and forwards the request to DHCP server. The DHCP server then allocates IP addresses in the 1.0.0.0/24 network segment to the client.

Network Topology

Figure 6‑4 Networking for configuring the DHCP relay to support Option82

Configuration Steps

Step 1: | Configure IP addresses for all interfaces. (Omitted)
Step 2: | Configure the DHCP server.(Omitted)
Step 3: | Configure the DHCP relay Device and Option82 parameters.

#Set the IP address of the relay server to 2.0.0.1.

Device#configure terminal

Device(config)#ip dhcp-server 2.0.0.1

#Enable Option82, and set sub-option Remote-ID to 0102030405.

Device(config)#ip dhcp relay information option

Device(config)#ip dhcp relay information remote-id hex 0102030405

Step 4

Check the result.

On the DHCP client, query the IP address that the network adapter has obtained from network segment 1.0.0.0/24.

l After Option82 is enabled, it sub-option Circuit ID is filled with the receiving interface index and the system ID of the relay device.


7 DNS


7.1 Overview

Domain Name System (DNS) is a distributed database that maps domain names and IP addresses. It provides conversion between domain names and IP addresses. With the use of DNS, when users access the Internet, they can use easy-to-memory and meaningful domain names. Then the domain name server in the network resolves the domain names into correct IP addresses. DNS is categorized into static DNS and dynamic DNS.

Static domain name resolution is conducted through a static DNS table. In the static DNS table, domain names and IP addresses are mapped, and some frequently used domain names are added. When a client requests for the IP address of a domain name, the DNS server first searches static DNS table for the corresponding IP address. This improves the efficiency of domain name resolution.

Dynamic domain name resolution is implemented by querying the DNS. A DNS client sends a domain name resolution request to a DNS server. After the DNS server receives the domain name resolution request, it first determines whether the requested domain name is located in its authorized management sub-domain. If yes, it searches the database for the required IP address and then sends the query result to the client. If the domain name is not in the authorized management sub-domain, the DNS server starts a recursive resolution with other DNS server, and then it sends the resolution result to the client. Alternatively, it specifies the address of the next DNS server in the response packet to the DNS client. Then, the client sends another domain name resolution request to the domain name server. This is so called iterative resolution mode.


7.2 DNS Function Configuration

Table 7‑1 DNS function list

Configuration Tasks
Configure the DNS client function. | Configure static domain name resolution.
 | Configure dynamic domain name resolution.
Configure the DNS proxy function | Configure the DNS proxy
Configure the DNS detection function | Configure the domain name list
 | Detect the domain name resolution


7.2.1 Configure the DNS Client Function

Configuration Condition

None

Configure Static Domain Name Resolution

In configuring static domain name resolution, you can configure a domain names to map an IPv4 address.

Table 7‑2 Configuring static domain name resolution

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a domain name to map a IP address. | ip host [ vrf vrf-name ] domain-name ip-address | Mandatory. By default, no domain name and its corresponding IP address is configured.

Configure Dynamic Domain Name Resolution

In configuring dynamic domain name resolution, you need to configure the IP address of a domain name server. Then, domain resolution requests can be sent to the proper domain server for resolution.

Users can pre-configure a domain suffix. Then, when the users use a domain name, they can input only part fields of the domain name, and the system automatically adds pre-configured domain suffix for resolution.

Table 7‑3 Configuring dynamic domain name resolution

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a domain suffix. | ip domain-name [ vrf vrf-name ] domain-name | Mandatory. By default, no domain suffix is configured.
Configure a DNS server address. | ip name-server [ vrf vrf-name ] ip-address | Mandatory. By default, the DNS server address is not configured.
Configure domain name resolution order. | ip name-order { dns-first | dns-only | local-first } | Optional By default, the system resolution order is local-first.


7.2.2 Configure DNS Proxy Function

Configuration Condition

None

Configure DNS Proxy

The DNS proxy does not have the DNS resolution function. It just forwards the resolution request from the DNS client to the DNS server, and forwards the resolution result from the DNS server to the DNS client.

Table 7‑4 Configure the DNS proxy

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the DNS proxy function | dns proxy enable [ vrf vrf-name ] | Mandatory By default, do not enable the DNS proxy function.
Configure the DNS proxy cache | dns proxy cache [ vrf vrf-name] | Optional By default, do not configure the DNS proxy cache function.
Configure the life time of the DNS proxy cache entry | dns proxy ttl ttl-value[ vrf vrf-name] | Optional By default, the life time of the DNS proxy cache entry is 1800s.


7.2.3 Configure the DNS Detection Function

Configuration Condition

None

Configure the Domain List

You can add some common domain names to the domain name list by configuring the domain name list. When necessary, directly specify the index of the domain name list.

Table 7‑5 Configure the domain name list

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the domain name list | dns-query name-list index domain-name | Mandatory By default, do not configure the domain name list.

Detect the Domain Name Resolution

You can detect whether the DNS server can resolve the specified domain name correctly by detecting the domain name resolution.

Table 7‑6 Detect the domain name resolution

Step | Command | Description
Detect the domain name resolution | dns-query [ vrf vrf-name] ip-address [ name domain-name | name-list index] [ count packet-num] [ timeout time] | Mandatory By default, do not detect the domain name resolution.


7.2.4 DNS Monitoring and Maintaining

Table 7‑7 DNS monitoring and maintaining

Comamnd | Description
clear hosts dynamic | Clears the dynamic domain name entry
show dns-query | Displays the domain name list
show dns proxy config | Displays the DNS proxy configuration information
show dns proxy client | Display the information of the DNS client that does not receive the resolution result on the DNS proxy
show hosts | Displays the domain name resolution table information
show name-server | Displays the DNS configuration information


7.3 DNS Typical Configuration Example


7.3.1 Configure Static Domain Name Resolution

Network Requirements

l Device and PC are interconnected, and the route is reachable.

l The host name of PC is host.xxyyzz.com, and the IP address is 1.0.0.2/24.

l On Device, access the host host.xxyyzz.com through static domain name resolution.

Network Topology

Figure 7‑1 Networking for Configure Static Domain Name Resolution

Configuration Steps

Step 1: | Configure IP addresses for all interfaces. (Omitted)
Step 2: | Configure a static domain name.

#On Device, configure the host name host.xxyyzz.com to correspond to IP address 1.0.0.2.

Device#configure terminal

Device(config)#ip host host.xxyyzz.com 1.0.0.2

Step 3:

Check the result.

#On Device, ping host host.xxyyzz.com. Device obtains the IP address 1.0.0.2 that corresponds to the host name through local domain name resolution.

Device#ping host.xxyyzz.com

%Bad IPv6 address or unknown hostname!

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 1.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/6/16 ms.

l In pinging a host name, the IPv6 address corresponding to the host name is first resolved, and then the IPv4 address.


7.3.2 Configure Dynamic Domain Name Resolution

Network Requirements

l The IP address of the DNS server is 1.0.0.3/24, the IP address of Device is 1.0.0.1/24, and the IP address of PC is 1.0.0.2/24.

l The DNS server, Device, and PC are interconnected through a LAN, and the route is reachable. On the DNS server, the DNS record of host.xxyyzz.com and 1.0.0.2 exists.

l Device access PC through dynamic resolution of host.xxyyzz.com through the DNS server.

Network Topology

Figure 7‑2 Networking for configure dynamic domain name resolution

Configuration Steps

Step 1: | Configure IP addresses for all interfaces. (Omitted)
Step 2: | Configure the DNS server.(Omitted)
Step 3: | Configure the DNS client.

#Specify a DNS server for the client, and the IP address is 1.0.0.3.

Device#configure terminal

Device(config)#ip name-server 1.0.0.3

Step 4:

Check the result.

#On Device, ping host host.xxyyzz.com. Device obtains the IP address 1.0.0.2 that corresponds to the host name through the DNS server.

Device#ping host.xxyyzz.com

%Bad IPv6 address or unknown hostname!

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 1.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/6/16 ms.


8 3322DDNS


8.1 Overview

DDNS (Dynamic Domain Name Server) maps the dynamic IP address of the user to a fixed domain name. When the user accesses the network, the DDNS client sends the dynamic IP address of the host to the DDNS sever through the message interactive. This ensures that the DDNS server can correctly provide the DNS service and parse the dynamic domain name.

For the users (dialing users for example) obtaining the dynamic IP address, the IP address of the host is allocated in random, which is difficult to associate the dynamic IP address with the fixed domain name. This restricts the user to use the domain name and restricts users to enjoy personalized services such as the enterprise network deployment, FTP downloading, and E-mails. Therefore, the DDNS provides a new solution, which captures the changed IP address of the user every time and then corresponds it to the domain name. In this way, users can provide services via the domain name.

The device realizes the DDNS client function with the protocol type as 3322.org.

The DDNS with the protocol type as 3322.org adopts the client/server mode. The 3322-defined protocol is used for communication between the client and server. The protocol interaction process is as follows:

1. The client initiates a connection to the GETIP server and then sends an IP address detection request packet when the connection succeeds to obtain the IP address of the local communication interface.

2. The server responds the IP address detection request packet and fills the IP address that is expected by the client to the IP address detection response packet.

3. The client obtains the IP address of the interface by parsing the IP address detection response, then encapsulates the domain name/IP address to bind the request packet, and then sends to the DDNS updating server for DDNS service application.

4. The DDNS server parses the service request packet on the client to decide whether to deploy the service, and then sends the status packet to the client to inform whether the request of the client is received.

5. The DDNS server does not define the keep-alive action. The client periodically repeats step 3 and step 4 to update and keep alive.


8.2 3322DDNS Function Configuration

Table 8‑1 DDNS function list

Configuration Task
Configure the DDNS instance | Create the DDNS instance
 | Configure the client parameter for the DDNS instance
 | Configure the server parameter for the DDNS instance
Configure the DDNS global parameter | Configure the updating interval for the global domain name


8.2.1 Configure 3322DDNS Instance

Configuration Condition

None

Create DDNS Instance

To run the DDNS, the DDNS instance must be created at first.

Table 8‑2 Create the DDNS instance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the DDNS instance and enter the DDNS configuration mode | ddns instance instance-name | Mandatory By default, the DDNS instance is not configured.

Configure Client Parameter for DDNS Instance

Before the DDNS client communicates with the DDNS server, determine the protocol type for the DDNS instance at first. For security, the DDNS server will authenticate the client. Therefore, the user account and password for the DDNS instance must be configured at first. To parse the dynamic domain name, the domain name for the DDNS instance must be configured.

Table 8‑3 configure the client parameter for the DDNS instance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the DDNS configuration mode | ddns instance instance-name | -
Configure the protocol type for the DDNS | type type-name | Optional By default, the DDNS protocol type is 3322.org.
Configure the user account for the DDNS instance | user user-name | Mandatory By default, the user account for the DDNS instance is not configured.
Configure the password for the DDNS instance | password [ encrypt ] password | Mandatory By default, the password for the DDNS instance is not configured.
Configure the domain name for the DDNS instance | domain-name domain-name | Mandatory By default, the domain name registered using the DDNS instance is not configured in the system.
Configure the updating interval for the DDNS instance | update-timer time | Optional By default, the updating interval registered using the DDNS instance is the updating interval of the global domain names.

Configure Server Parameter for DDNS Instance

The DDNS server includes the GETIP server and update server. The DDNS client communicates with the GETIP server to obtain the IP address of the client communication interface and inform the IP address of the client and the corresponding domain name to the update server.

Table 8‑4 Configure the serve r parameter for the DDNS instance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the DDNS configuration mode | ddns instance instance-name | -
Configure the GETIP server of the DDNS instance | getip-server {ip-address | domain-name domain-name} [ port-number ] | Mandatory By default, the GETIP server is not configured.
Configure the update server of the DDNS instance | update-server {ip-address | domain-name domain-name} [ port-number ] | Mandatory By default, the update server is not configured.
Configure the DDNS instance requiring the server supporting wildcard | wildcard | Optional By default, the server is not required to support the wildcard.


8.2.2 Configure 3322DDNS Global Parameters

Configuration Condition

None

Configure Updating Interval for Global Domain Names

The DDNS global parameters currently only contain the updating interval of the domain names.

The DDNS instance uses the client parameter and server parameter of the DDNS instance by priority. If a certain parameter is not configured in the DDNS instance, then the DDNS uses the global parameter.

Table 8‑5 Configure the updating interval for the global domain names

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the updating interval for the global domain names | ddns update-timer time | Optional By default, the updating interval for the global domain names is 10 minutes.


8.3 3322DDNS Typical Configuration Example


8.3.1 Configure 3322DDNS Basic Functions

Network Requirements

l PC is the host connecting to the Internet and Device accesses the Internet via PPPOE dialing over the interface gigabitethernet0/0.

l The user registers a user account at www.3322.org and applies for a domain name device.com. Every time after Device dialing succeeds, the PC can visit Device via device.com.

Network Topology

Figure 8‑1 Networking of configuring the DDNS basic function

Configuration Steps

Step 1: | Configure PPPOE dialing to obtain the IP address dynamically. (Omitted)
Step 2: | Register as a user at www.3322.org and apply for the dynamic domain name device.com. (Omitted)
Step 3: | Configure the DDNS instance.

#Configure the user account and password registered at www.3322.org.

Device#configure terminal

Device(config)#ddns instance Device

Device(config-ddns)#user admin

Device(config-ddns)#password admin

#Configure the GETIP server, domain name update server, domain name update period, and applied domain name.

Device(config-ddns)#getip-server domain-name www.3322.org

Device(config-ddns)#update-server domain-name www.3322.org

Device(config-ddns)#update-timer 1

Device(config-ddns)#domain-name device.com

Device(config-ddns)#exit

l When the GETIP server and domain name server are specified as www.3322.org, Device must be ensured to parse the domain name.

Step 4:

Check the result.

#Through pinging domain name device.com on the PC, it can be parsed that Device is using the IP address 171.216.119.12.

C:\>ping device.com

Pinging device.com [171.216.119.12] with 32 bytes of data:

Reply from 171.216.119.12: bytes=32 time=18ms TTL=62

Reply from 171.216.119.12: bytes=32 time=14ms TTL=62

Reply from 171.216.119.12: bytes=32 time=17ms TTL=62

Reply from 171.216.119.12: bytes=32 time=16ms TTL=62

Ping statistics for 171.216.119.12:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 14ms, Maximum = 18ms, Average = 16ms

#When Device redials and obtains the new IP address 171.217.168.122, ping domain name device.com on the PC. The new IP address can be parsed.

C:\>ping device.com

Pinging device.com [171.217.168.122] with 32 bytes of data:

Reply from 171.217.168.122: bytes=32 time<1ms TTL=255

Reply from 171.217.168.122: bytes=32 time<1ms TTL=255

Reply from 171.217.168.122: bytes=32 time=1ms TTL=255

Reply from 171.217.168.122: bytes=32 time<1ms TTL=255

Ping statistics for 171.217.168.122:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 1ms, Average = 0ms


9 Oray DDNS


9.1 Overview

DDNS (Dynamic Domain Name Server) maps the dynamic IP address of the user to a fixed domain name. When the user accesses the network, the DDNS client sends the dynamic IP address of the host to the DDNS sever through the message interactive. This ensures that the DDNS server can correctly provide the DNS service and parse the dynamic domain name.

For the users (dialing users for example) obtaining the dynamic IP address, the IP address of the host is allocated in random, which is difficult to associate the dynamic IP address with the fixed domain name. This restricts the user to use the domain name and restricts users to enjoy personalized services such as the enterprise network deployment, FTP downloading, and E-mails. Therefore, the DDNS provides a new solution, which captures the changed IP address of the user every time and then corresponds it to the domain name. In this way, users can provide services via the domain name.

The device realizes the DDNS client function with the protocol type as Oray.

When using the Oray DDNS client, it is necessary to register the account and password on the Oray website, and apply for the domain name.

The Oray DDNS adopts the client/server mode. The protocol defined by Oray is used for communication between the client and server. The protocol interaction process is as follows:

1. The client initiates the TCP connection to the server, and then sends the user name and encrypted password to the server, verifying the account information.

2. The server gets the domain name list of the account via the TCP connection, and then, disconnects TCP.

3. The client uses the UDP protocol to keep connecting with the server, and sends the update packet to the server every 60s. The server auto monitors the IP change of the client via the packet.

4. If the server does not receive the update request of the client within 5 minutes, automatically delete all registered domain names of the client.


9.2 Oray DDNS Function Configuration

Table 9‑1Oray DDNS function configuration list

Configuration task

Configure the basic functions of Oray DDNS

Configure the Oray DDNS client


9.2.1 Configure Oray DDNS Function

Configuration Condition

None

Configure Oray DDNS Client

Table 9‑2 Configure the Oray DDNS client

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the address or domain name of the Oray DDNS server | oray-ddns server-addr { ipaddress | domain } | Optional By default, the domain name of the DDNS server is phddns60.oray.net.
Configure the TTL value pf the registered DNS entry | oray-ddns ttl ttl-value | Optional By default, it is 600 and the unit second.
Configure the Oray account registered to the server and enable the protocol | oray-ddns register user-name password | Mandatory By default, do not enable the DDNS protocol.


9.2.2 Oray DDNS Monitoring and Maintaining

Table 9‑3 Oray DDNS monitoring and maintaining

Command | Description
show oray-ddns | Displays the DDNS running information


9.3 Oray DDNS Typical Configuration Example

Network Requirements

l PC is the host connected to Internet, and Device is connected to Internet via the PPPOE dialing of gigabitethernet0/0.

l The user registers the user name on Orag website (phddns60std.oray.net) and applies for the domain name (device.com) for the user; PC can access Device via device.com after Device is connected to Internet via normal dialing.

Network Topology

Figure 9‑1 The networking of configuring the basic functions of Oray DDNS

Configuration Steps

Step 1: | Register the user on phddns60std.oray.net, and apply for the dynamic domain name device.com. (omitted)
Step 2: | Configure the PPPoE dialing to get the IP address dynamically.
 | Device#configure terminal Device(config)#dialer-list 1 protocol ip permit Device(config)#interface dialer0 Device(config-if-dialer0)#ip address negotiated Device(config-if-dialer0)#dialer in-band Device(config-if-dialer0)#dialer pool 1 Device(config-if-dialer0)#dialer-group 1 Device(config-if-dialer0)#exit Device(config)#interface vlan100 Device(config-if-vlan100)#pppoe-client dial-pool-number 1 Device(config-if- vlan100)#exit Device(config)#ip route 0.0.0.0 0.0.0.0 dialer0
Step 3: | Configure Oray DDNS.

Device(config)#oray-ddns register hellomp hellomp@123

Device(config)#oray-ddns server-addr phddns60std.oray.net

Step 4:

Check the result.

#On Device, view that the register status of the Orag DDNS client is okKeepAliveRecved:

Device#show oray-ddns

ORAY DDNS IS RUNING(Registered):

APPKEY Configured: default(Key) default(ClientInfo)

Server-Addr Configured: phddns60std.oray.net

APPKEY Running: default(Key) default(ClientInfo)

Server-Addr Running: phddns60std.oray.net

DDNS User: hellomp

User Type: 0

Client Internet IP: 221.10.47.41

Protocol Status: okKeepAliveRecved

User Domains:device.com

Domains Count: 1

#On the PC, ping the domain name device.com, and the IP address got by Device (221.10.47.41) can be resolved.

C:\>ping device.com

Pinging device.com [221.10.47.41] with 32 bytes of data:

Reply from 221.10.47.41: bytes=32 time=13ms TTL=62

Reply from 221.10.47.41: bytes=32 time=14ms TTL=62

Reply from 221.10.47.41: bytes=32 time=13ms TTL=62

Reply from 221.10.47.41: bytes=32 time=13ms TTL=62

Ping statistics for 221.10.47.41:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 14ms, Maximum = 18ms, Average = 16ms

#After Device re-dials to get the new IP address (125.71.215.223) successfully, you can view that the register status of the DDNS client is okKeepAliveRecved on Device:

Device#show oray-ddns

ORAY DDNS IS RUNING(Registered):

APPKEY Configured: default(Key) default(ClientInfo)

Server-Addr Configured: phddns60std.oray.net

APPKEY Running: default(Key) default(ClientInfo)

Server-Addr Running: phddns60std.oray.net

DDNS User: hellomp

User Type: 0

Client Internet IP: 125.71.215.223

Protocol Status: okKeepAliveRecved

User Domains:device.com

Domains Count: 1

#On the PC, ping the domain name device.com, and the new IP address can be resolved (125.71.215.223).

C:\>ping device.com

Pinging device.com [125.71.215.223] with 32 bytes of data:

Reply from 125.71.215.223: bytes=32 time<12ms TTL=255

Reply from 125.71.215.223: bytes=32 time<12ms TTL=255

Reply from 125.71.215.223: bytes=32 time=11ms TTL=255

Reply from 125.71.215.223: bytes=32 time<12ms TTL=255

Ping statistics for 125.71.215.223:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 0ms, Maximum = 1ms, Average = 0ms


10 NAT


10.1 Overview

The NAT (Network Address Translate) translates the IP address of the IP packet header to another IP address. In actual application, a private IP address is translated to a public Ip address. The intranet only needs to use a few public IP addresses to communicate with the Internet. The NAT can relieve the IP address exhaustion problem.

The NAT generally locates at the boundary of the Internet and intranet. The intranet can visit the Internet after the IP address is translated by the NAT. the Internet only knows the translated IP address, but do not know the IP address of the intranet. Therefore, the NAT hide the internal private network, improving the security.

Generally, the NAT supports the IP address mapping relationship of static creating and dynamic generating. Based on the generating methods of the IP address mapping relationship, the IP addresses can be divided into static NAT and dynamic NAT.

l Static NAT

The IP address mapping relationship between the Internet and intranet is determined and statically corresponds with each other. Each intranet IP address corresponds to an Internet IP address.

l Dynamic NAT

The IP address mapping relationship between the intranet and Internet is determined by packets. The dynamic translation rule needs to associate to visit the ACL and the IP address pool. Through the packets filtered in the ACL, an IP address is selected from the IP address pool to create the mapping relationship. When the session of this IP address visiting the Internet ends, the IP address resource in the IP address pool is released to other users.

The NAT locates at the boundary of the Internet and intranet and divided into inside source NAT and outside source NAT.

l Inside source NAT

The inside source translation translates the private IP address of the intranet to the public IP address of the Internet. Generally, the internal IP address adopts the reserved network segment IP address such as 192 and 127. However, compared with the external IP address, these IP addresses do not have corresponding routings. To enable the intranet visits the Internet, the inside source translation is required. The source IP address that the intranet visiting the Internet packet is translated by the NAT to a corresponding Internet IP address.

l outside source NAT

The outside source translation translates the public IP address of the Internet to the private IP address of the intranet. The source IP address that the Internet visiting the intranet packet is translated by the NAT to a corresponding intranet IP address.

The following describes some NAT-related terms:

IL (Inside Local): indicates the intranet IP address, which will not be publicized to the Internet.

IG (Inside Global): indicates the IP address that is translated from the intranet IP address by the NAT, through which the Internet can visit the intranet devices.

OL (Outside Localind): indicates the Internet IP address allocated to the Internet devices, which will not be publicized to the intranet.

OG (Outside Global): indicates the IP address that is translated from the Internet IP address by the NAT, through which the intranet can visit the Internet devices.

ALG (Application Layer Gateway): mainly handles the application layer protocol packets that are incompatible with the NAT, enabling the application layer data flow can be handled by the NAT normally like the common data flow. The following describes the detailed functions:

l Parse the IP address port information contained in the data packet and translate the IP address as required.

l Extract the data channel information and establish a connection channel for the subsequent packets.

l Detect the application layer status of the packet and drop the status error packet.

Translation table: After the IP data flow is translated by the NAT, a translation table entry is created. The subsequent packets of the data flow are translated by the IP address port information recorded in the translation table entry and all the translation table entries are saved in the translation table.


10.2 NAT Function Configuration

Table 10‑1 NAT function list

Configuration Task
Configure the NAT interface | Configure the NAT internal interface
 | Configure the NAT external interface
Configure the NAT IP address pool | Configure the NAT IP address pool
 | Configure the available ports of the NAT pool addresses
Configure the static NAT | Configure the inside source NAT static port translation
 | Configure the inside source NAT static address translation
 | Configure the outside source NAT static port translation
 | Configure the outside source NAT static address translation
Configure the dynamic NAT | Configure the inside source NAT dynamic port translation
 | Configure the inside source NAT dynamic address translation
 | Configure the outside source NAT dynamic address translation
Configure the destination NAT | Configure the destination IP address NAT
Configure the aging time of the NAT table entry | Configure the aging time of the NAT table entry
Configure the NAT concurrent connections | Configure the maximum number of the NAT concurrent connections
 | Configure the NAT ICMP concurrent connections
 | Configure the NAT ALG concurrent connections
Configure the NAT retry translation | Configure the NAT retry translation
Configure NAT to create the translation entry fast | Configure NAT to create the translation entry fast
Configure the NAT sending logs | Configure the NAT sending logs


10.2.1 Configure NAT Interface

The NAT locates at the boundary of the Internet and intranet. To realize the NAT function, at least an internal interface (connecting to the intranet) and an external interface (connecting to the Internet) need to be configured.

Configuration Condition

None

Configure NAT Internal Interface

After the internal interface is configured, the network connected to the NAT internal interface is called intranet.

Table 10‑2 Configure the NAT internal interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the NAT internal interface | ip nat inside | Mandatory By default, the current interface is not configured as the NAT internal interface.

Configure NAT External Interface

After the external interface is configured, the network connecting to the NAT external interfaces called Internet.

Table 10‑3 Configure the NAT external interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the NAT external interface | ip nat outside | Mandatory By default, the current interface is not configured as the NAT external interface.


10.2.2 Configure NAT IP Address Pool

Configuration Condition

None

Configure the NAT IP address pool

A defined IP address pool needs to be associated when configuring the dynamic NAT rule.

Table 10‑4 Configure the NAT IP address pool

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the NAT IP address pool | ip nat pool pool-name start-IP end-IP { netmask network-mask | prefix-length prefix-length } [ type rotary ] | Mandatory By default, the NAT IP address pool is not configured.

l An IP address cannot be defined in two different IP address pool.

l An IP address pool can only be associated for one time and different NAT rules must associate different IP address pool.

Configure Available Ports of NAT Pool Addresses

NAT dynamic port translation (PAT translation) maps different internal addresses to different ports of one pool address. The available port range of the pool address can be configured. After configuring the available port range of the pool address, the source ports of all packets translated by the PAT rule are in the configured available port range.

Table 10‑5 Configure the available ports of the NAT address pool

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the available ports of the NAT address pool | ip nat port-range start start-port end end-port | Mandatory By default, the available ports of the NAT pool addresses are 10001-65535.


10.2.3 Configure Static NAT

The NAT shields the intranet host. If the intranet needs to provide external services, such as FTP service and web service, static NAT is important here. Through configuring the static NAT rule, an intranet IP address can be mapped to a fixed Internet IP address, providing external services. The static NAT rule can map the "intranet IP address+port" to the fixed "Internet IP address+port", providing external services.

Configuration Condition

None

Configure Inside Source NAT Static Port Translation

The inside source NAT static port translation (SPT) maps the "intranet IP address+port" to "Internet IP address+port".

After the intranet packet is handled by the NAT, the source IP address and port are translated to the configured Internet IP address and port. When the response packet arrives, the destination IP address and port are translated to the corresponding intranet IP address and port.

Table 10‑6 Configure the inside source NAT static port translation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the inside source NAT static port translation rule | ip nat inside source static { tcp | udp } { local-IP local-port { global-IP | interface interface-name } global-port | range local-IP local-port-min local-port-max { global-IP | interface interface-name } global-port-min global-port-max } [ flow-enable ] [ vrf vrf-name ] | Mandatory By default, the inside source NAT static port translation rule is not configured.

Configure InsideSource NAT Static Address Translation

The inside source NAT static address translation (SAT) maps the intranet IP address to the Internet IP address.

After the intranet packet is handled by the NAT, the source IP address is translated to the configured Internet IP address. When the response packet arrives, the destination IP address is translated to the corresponding intranet IP address.

Table 10‑7 Configure the inside source NAT static address translation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the inside source NAT static address translation rule | ip nat inside source static { network local-subnet global-subnet netmask | [ esp ] local-IP global-IP } [ flow-enbale ] [ vrf vrf-name ] | Mandatory By default, the inside source NAT static address translation rule is not configured.

Configure Outside Source NAT Static Port Translation

The outside source NAT static port translation (OSPT) rule has almost the same function with the SPT with different translation directions. The OSPT rule maps the "Internet+port" to "intranet+port".

After the Internet packet is handled by the NAT, the source IP address and port are translated to the configured intranet IP address and port. When the response packet arrives, the destination IP address and port are translated to the corresponding Internet IP address and port.

Table 10‑8 Configure the outside source NAT static port translation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the outside source NAT static port translation rule | ip nat outside source static { tcp | udp } { global-IP global-port local-IP local-port | range global-IP global-port-min global-port-max local-IP local-port-min local-port-max } [ flow-enable ] [ vrf vrf-name ] | Mandatory By default, the outside source NAT static port translation rule is not configured.

Configure Outside Source NAT Static Address Translation

The outside source NAT static address translation (OSAT) has almost the same function as the SAT but with different translation directions. The OSAT maps the Internet IP address to the intranet IP address.

After the Internet packet is handled by the NAT, the source IP address is translated to the configured intranet IP address. When the response packet arrives, the destination IP address is translated to the corresponding Internet IP address.

Table 10‑9 Configure the outside source NAT static address translation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the outside source NAT static address translation rule | ip nat outside source static { network global-subnet local-subnet netmask | [ esp ] global-IP local-IP } [ flow-enable ] [ vrf vrf-name ] | Mandatory By default, the outside source NAT static address translation rule is not configured.


10.2.4 Configure Dynamic NAT

After the NAT dynamic translation rule is configured, the response packet of the intranet visiting the Internet packet can be handled by the NAT. when the reversible parameter of the NAT dynamic translation rule is configured, the Internet is restrictedly allowed to visit the hosts in the intranet. The reversible parameter can be set to two levels: restrict (partially allowed) and full (completely allowed). When the intranet IP address visits the Internet, a mapping relationship of intranet IP address to the Internet IP address is established. Before the mapping relationship breaks, the restrict level allows the Internet IP addresses visited by the intranet to visit the intranet by the mapped Internet IP address. The full level allows other Internet IP address visits the intranet by the mapped Internet IP address.

Configuration Condition

Before configuring the dynamic NAT, first complete the following tasks:

l Configure the ACL.

l Configure the NAT IP address pool.

Configure Inside Source NAT Dynamic Port Translation

The inside source NAT dynamic port address translation (PAT) allows multiple intranet IP addresses mapping to the same Internet IP address. When the PAT rule is configured, a few public IP addresses can satisfy the requirements of intranet visiting the Internet.

The PAT translates the "intranet IP address+port" to "Internet IP address+port". Source IP addresses of packets from different intranet IP address are mapped to the same Internet IP address, but the port numbers are translated to different port numbers of the same IP address. This reserves the difference between packets. When the response packet arrives, the PAT can identify which Internet IP address the packet should be translated to based on the IP address and port number of the response packet.

The mapping relationship between the PAT "intranet IP address+port" and "Internet IP address+port" is generated dynamically. When the session of the intranet IP address visiting the network ends, the corresponding mapping relationship breaks and the IP address in the IP address pool can be used by other users.

Table 10‑10Configure the inside source NAT dynamic port translation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the inside source NAT dynamic port translation rule | ip nat inside source list access-list-name { pool pool-name [ special interface interface-name ] | interface interface-name } overload [ flow-enable ] [ vrf vrf-name ] [ reversible { full | restrict } ] | Mandatory By default, the inside source NAT dynamic address translation rule is not configured.

Configure Inside Source NAT Dynamic Address Translation

The inside source NAT dynamic address translation (NAT) translates the intranet IP address to the Internet IP address dynamically. The number of Internet IP addresses in the IP address pool is limited. When all the pool addresses establish mapping relationship with the intranet IP addresses, the new NAT translation request will be rejected.

The mapping relationship between the NAT intranet IP address and Internet IP address is generated dynamically. When the session of the intranet IP address visiting the Internet ends, the corresponding mapping relationship breaks and the IP address in the IP address pool can be used by other users.

Table 10‑11 Configure the inside source NAT dynamic address translation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the inside source NAT dynamic address translation rule | ip nat inside source list access-list-name pool pool-name [ special interface interface-name ] [ flow-enable ] [ vrf vrf-name ] [ reversible { full | restrict } ] | Mandatory By default, the inside source NAT dynamic address translation rule is not configured.

Configure Outside Source NAT Dynamic Address Translation

The outside source NAT dynamic address translation (ONAT) translates the Internet IP address to the intranet IP address dynamically. The number of intranet IP addresses in the IP address pool is limited. When all the pool addresses establish mapping relationship with the Internet IP addresses, the new NAT translation request will be rejected.

The mapping relationship between the ONAT intranet IP address and Internet IP address is generated dynamically. When the session of the Internet IP address visiting the intranet ends, the corresponding mapping relationship breaks and the IP address in the IP address pool can be used by other users.

The ONAT does not support reversible visit.

Table 10‑12Configure the outside source NAT dynamic address translation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the outside source NAT dynamic address translation rule | ip nat outside source list access-list-name pool pool-name [ flow-enable ] [ vrf vrf-name ] | Mandatory By default, the outside source NAT dynamic address translation rule is not configured.


10.2.5 Configure Destination IP Address NAT

If multiple hosts providing the same service exist in the intranet (multiple web servers with continuous intranet IP addresses for example), simple TCP load sharing can be realized by configuring the DAT (destination NAT) rule. The DAT rule maps multiple host IP addresses in the intranet to a virtual IP address. External services are provided through the virtual IP address.

When configuring the ACL associated with the DAT rule, the IP packet whose destination IP address is the virtual IP address is allowed for DAT. The pool addresses of the DAT rule is the IP address of the host providing intranet services. When configuring the DAT IP address pool, the IP address pool type is set to type rotary.

Configuration Condition

Before configuring the destination IP address NAT, first complete the following tasks:

l Configure the ACL.

l Configure the NAT IP address pool.

Configure Destination IP Address NAT

Table 10‑13 Configure the destination IP address NAT

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the destination IP address NAT rule | ip nat inside destination list access-list-name pool pool-name [flow-enable ] [ vrf vrf-name ] | Mandatory By default, the destination IP address NAT rule is not configured.

l If there is only one host in the intranet, the TCP load sharing is unnecessary. Do not perform this configuration.

l This configuration is only valid for the TCP packet. If the host provides services of other protocols, do not perform this configuration.

l The destination NAT does not support the ICMP or FTP protocol.


10.2.6 Configure Aging Time of NAT Table Entry

Configuration Condition

None

Configure the aging time of the NAT table entry

The unused NAT table entries will be aged and deleted. The user can configure different aging time for the NAT table entries for data flow of different types to satisfy different application requirements.

Table 10‑14Configure the aging time of the NAT table entry

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the aging time of the NAT table entry | ip nat translation { dns-timeout | finrst-timeout | icmp-timeout | icmperr-timeout | syn-timeout | tcp-timeout | timeout | udp-timeout } { timeout | never } | Optional By default, the aging time is 600s.


10.2.7 Configure Number of NAT Concurrent Connections

Configuration Condition

None

Configure Number of NAT Concurrent Connections

The user can configure the maximum number of the NAT concurrent connections. When the number of NAT table entries reaches the maximum number of concurrent connections. The NAT does not create new table entry.

Table 10‑15 Configure the number of NAT concurrent connections

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the number of NAT concurrent connections | ip nat translation max-entries entries-number | Optional By default, the number of NAT concurrent connections is 200000.

Configure NAT ICMP Concurrent Connections

The user can configure the ICMP concurrent connections. When the number of the ICMP packet translation entries reaches the number threshold of the concurrent connections, NAT does not create new ICMP packet translation entry.

Table 10‑16 Configure NAT ICMP concurrent connections

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure NAT ICMP concurrent connections | ip nat translation max-icmp-entries entries-number | Optional By default, the number of the NAT ICMP concurrent connections is 200000.

Configure NAT ALG Concurrent Connections

The user can configure the ALG concurrent connections. When the number of the ALG packet translation entries reaches the number threshold of the concurrent connections, NAT does not create new ALG packet translation entry.

Table 10‑17 Configure the NAT ALG concurrent connections

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the NAT ALG concurrent connections | ip nat translation max-proxy-entries entries-number | Optional By default, the number of the NAT ALG concurrent connections is 4000.


10.2.8 Configure NAT Retry Translation

Configuration Condition

None

Configure NAT Retry Translation

When the NAT pool addresses, available ports and other share resources are all distributed or the translation entry quantity reaches the threshold, the new connection will be rejected and the packet of requesting for creating the translation entry is dropped. If the flow forwarding of the system is enabled, the flow is set to DROP and the subsequent packets are directly dropped. Before the flow entry is aged, the dropped flow will not be translated by NAT, even the NAT share resources and translation entry quantity restores to the normal state.

After configuring the NAT retry translation, the NAT DROP packet is valid only for one packet. The DROP action will not be recorded in the flow result and the subsequent packets of one flow continue to try creating the translation entry. If the NAT share resources and translation entry quantity limit recover, you can create the new translation entry at once. After configuring the NAT retry translation, the NAT response speeds up, but if the NAT share resources are all distributed and when the translation entry quantity reaches the threshold, there are still lots of packets requesting for NAT translation and the system performance is affected. In this case, you need to disable the NAT retry translation function.

Table 10‑18 Configure the NAT retry translation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the NAT retry translation | ip nat translation retry | Optional By default, the NAT retry translation function is enabled.


10.2.9 Configure NAT to Create Translation Entry Fast

NAT can create the translation entry on the fast forwarding path and the slow forwarding path. Creating the translation entry on the fast forwarding path can improve the performance of the NAT creating the translation entry.

Configuration Condition

None

Configure NAT to Create Translation Entry Fast

Table 10‑19 Configure NAT to create the translation entry fast

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure NAT to create the translation entry fast | ip nat translation fastforward | Optional By default, the function of NAT creating the translation entry fast is enabled.


10.2.10 Configure NAT Sending Logs

Configuration Condition

Before configuring the NAT sending logs, first complete the following tasks:

l Enable the system log function.

l Configure the log server.

Configure NAT Sending Logs

The NAT table entry traces and records the information of the user visiting the network. These records are sent to the external log server in the log message format. If necessary, these logs are used to trace the network visiting of the user. The NAT log is sent to the log server in a fixed format. The logs are in the following format:

Protocol type InsideLocal InsideGlobal OutsideLocal OutsideGlobal Duration

After configuring the NAT sending logs function, the NAT sends logs to the log server.

Table 10‑20 Configure the NAT sending logs

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the NAT sending logs | ip nat log-trap enable | Mandatory By default, the NAT does not send logs.


10.2.11 NAT Monitoring and Maintaining

Table 10‑21 The NAT monitoring and maintaining

Command | Description
clear ip nat statistics | Clear the NAT statistics data
clear ip nat translation [ vrf vrf-name ] all | Clear the NAT table
show running-config ip nat | Display the NAT information in the configuration file
show ip nat statistics | Display the NAT statistics data
show ip nat pool | Display all the NAT IP address pools
show ip nat rule | Display all the NAT rules
show ip nat translation [static] | Display all the activated NAT table entries
show ip nat alg statistics | Display the NAT ALG statistics data
show ip nat alg watch | Display all the NAT ALG watch table


10.3 NAT Typical Configuration Example


10.3.1 Configure Inside Source NAT Static Address/Port Translation

Network Requirements

l PC1 and PC2 are hosts in the internal private network, Web Server is the web server in the public network, Device is the NAT device, vlan1000 is the NAT internal interface, and vlan1001 is the NAT external interface. Configure the static IP address/port translation using the inside source NAT.

l PC1 in the internal private network can successfully visit Web Server and the source IP address of the packet is translated from the private IP address 100.0.0.2 to the public IP address 201.16.16.2. PC2 can successfully visit Web Server through the source port 1024. The source IP address of the packet is translated from the private IP address 100.0.0.3 to the public IP address 201.16.16.2 and the source port 1024 is translated to 2048.

Network Topology

Figure 10‑1 Networking of configuring the inside source NAT static address/port translation

Configuration Steps

Step 1: | Configure the IP addresses and routings for all the interfaces. (Omitted)
Step 2: | Configure the NAT interface attribute and NAT rule for Device.

#Configure the inside interface with vlan1000 as the NAT.

Device#configure terminal

Device(config)#interface vlan1000

Device(config-if-vlan1000)#ip nat inside

Device(config-if-vlan1000)#exit

#Configure the outside interface with vlan1001 as the NAT.

Device(config)#interface vlan1001

Device(config-if-vlan1001)#ip nat outside

Device(config-if-vlan1001)#exit

#Configure the inside source NAT static address/port translation rule, the internal private IP addresses 100.0.0.2 and 100.0.0.3 are translated to the public IP address 201.16.16.2 and the source port 1024 of 100.0.0.3 is translated to 2048.

Device(config)#ip nat inside source static 100.0.0.2 201.16.16.2

Device(config)#ip nat inside source static tcp 100.0.0.3 1024 201.16.16.2 2048

Step 3:

Check the result.

#When PC1 in the internal private network visits Web Serve, the NAT table entry with the type setting to SAT can be viewed on Device. When PC2 visits Web Server through the source port 1024, the NAT table entry with the type setting to SPT can be viewed on Device.

Device#show ip nat translations static

Type Pro Inside Global Inside Local Outside Local Outside Global

----- ---- -------------------- -------------------- -------------------- --------------------

SPT TCP 201.16.16.2:2048 100.0.0.3:1024 (----------) (----------)

SAT (--) 201.16.16.2 100.0.0.2 (----------) (----------)

Type Pro Inside Global Inside Local Outside Local Outside Global Age

----- ---- -------------------- -------------------- -------------------- -------------------- -----

SAT TCP 201.16.16.2:4580 100.0.0.2:4580 17.1.1.2:80 17.1.1.2:80 60 (FINRST)(2:4)

SPT TCP 201.16.16.2:2048 100.0.0.3:1024 17.1.1.2:80 17.1.1.2:80 1800 (NORMAL:0)(2:1)


10.3.2 Configure Inside Source NAT Dynamic Address Translation

Network Requirements

l PC1 and PC2 are hosts in the internal private network, Web Server is the web server in the public network, Device is the NAT device, vlan1000 is the NAT internal interface, and vlan1001 is the NAT external interface. Configure the inside source NAT dynamic address translation.

l User in the internal private network segment 100.0.0.0/24 can successfully visit Web Server. The IP addresses used in the public network are 201.16.16.2 and 201.16.16.3.

Network Topology

Figure 10‑2 Networking of configuring the inside source NAT dynamic address translation

Configuration Steps

Step 1: | Configure the IP addresses and routings for all the interfaces. (Omitted)
Step 2: | Configure the NAT interface attribute and NAT rule for Device.

#Configure the inside interface with vlan1000 as the NAT.

Device#configure terminal

Device(config)#interface vlan 1000

Device(config-if-vlan1000)#ip nat inside

Device(config-if-vlan1000)#exit

#Configure the outside interface with vlan1001 as the NAT.

Device(config)#interface vlan 1001

Device(config-if-vlan1001)#ip nat outside

Device(config-if-vlan1001)#exit

#Configure the NAT IP address pool, pool1, containing twp public network IP addresses 201.16.16.2 and 201.16.16.3.

Device(config)#ip nat pool pool1 201.16.16.2 201.16.16.3 netmask 255.255.255.0

#Configure the ACL 1001, only permitting PCs in the internal private network segment 100.0.0.0/24 to visit Web Server.

Device(config)#ip access-list extended 1001

Device(config-ext-nacl)#permit ip 100.0.0.0 0.0.0.255 any

Device(config-ext-nacl)#exit

#Configure the inside source NAT dynamic address translation rule, translating the internal IP addresses 100.0.0.2 and 100.0.0.3 as the public IP addresses 201.16.16.2 and 201.16.16.3, respectively.

Device(config)#ip nat inside source list 1001 pool pool1

Step 3:

Check the result.

#When PC1 and PC2 in the internal private network visit Web Server, the NAT table entry can be viewed on Device.

Device#show ip nat translations

Type Pro Inside Global Inside Local Outside Local Outside Global Age

----- ---- -------------------- -------------------- -------------------- -------------------- -----

NAT TCP 201.16.16.2:1024 100.0.0.2:1024 17.1.1.2:80 17.1.1.2:80 1800 (NORMAL:0)(2:1)

NAT TCP 201.16.16.3:1024 100.0.0.3:1024 17.1.1.2:80 17.1.1.2:80 1800 (NORMAL:0)(2:1)


10.3.3 Configure Inside Source NAT Dynamic Port Translation

Network Requirements

l PC1 and PC2 are hosts in the internal private network, Web Server is the web server in the public network, Device is the NAT device, vlan1000 is the NAT internal interface, and vlan1001 is the NAT external interface. Configure the inside source NAT dynamic port translation.

l Users in the internal private network segment 100.0.0.0/24 can successfully visit Web Server, using the same public network IP address 201.16.16.2 through mapping the TCP port number.

Network Topology

Figure 10‑3 Networking of configuring the inside source NAT dynamic port translation

Configuration Steps

Step 1: | Configure the IP addresses and routings for all the interfaces. (Omitted)
Step 2: | Configure the NAT interface attribute and NAT rule for Device.

#Configure the inside interface with vlan1000 as the NAT.

Device#configure terminal

Device(config)#interface vlan 1000

Device(config-if-vlan1000)#ip nat inside

Device(config-if-vlan1000)#exit

#Configure the outside interface with vlan1001 as the NAT.

Device(config)#interface vlan 1001

Device(config-if-vlan100t1)#ip nat outside

Device(config-if-vlan1001)#exit

#Configure the NAT IP address pool, pool1, containing only one public network IP address 201.16.16.2.

Device(config)#ip nat pool pool1 201.16.16.2 201.16.16.2 netmask 255.255.255.0

#Configure the ACL 1001, only permitting PCs in the internal private network segment 100.0.0.0/24 to visit Web Server.

Device(config)#ip access-list extended 1001

Device(config-ext-nacl)#permit ip 100.0.0.0 0.0.0.255 any

Device(config-ext-nacl)#exit

#Configure the PAT translation rule, translating the internal IP addresses 100.0.0.2 and 100.0.0.3 as the public IP addresses 201.16.16.2.

Device(config)#ip nat inside source list 1001 pool pool1 overload

Step 3:

Check the result.

#When PC1 and PC2 in the internal private network visit Web Server, the NAT table entry can be viewed on Device.

Device#show ip nat translations

Type Pro Inside Global Inside Local Outside Local Outside Global Age

----- ---- -------------------- -------------------- -------------------- -------------------- -----

PAT TCP 201.16.16.2:10001 100.0.0.2:1024 17.1.1.2:80 17.1.1.2:80 1800 (NORMAL:0)(2:1)

PAT TCP 201.16.16.2:10002 100.0.0.3:1024 17.1.1.2:80 17.1.1.2:80 1800 (NORMAL:0)(2:1)


10.3.4 Configure Destination IP Address NAT

Network Requirements

l Web Server1 and Web Server2 are the internal Web Server, providing external Web services. PC is the Internet host, Device is the NAT device, vlan1000 is the NAT internal interface, and vlan1001 is the NAT external interface. Configure the destination IP address NAT.

l When the PC in the external public network visits the public network IP address 201.16.16.2, the NAT balance the load to the internal WEB Server1 and WEB Server2.

Network Topology

Figure 10‑4 Networking of configuring the destination IP address NAT

Configuration Steps

Step 1: | Configure the IP addresses and routings for all the interfaces. (Omitted)
Step 2: | Configure the NAT interface attribute and NAT rule for Device.

#Configure the inside interface with vlan1000 as the NAT.

Device#configure terminal

Device(config)#interface vlan 1000

Device(config-if-vlan1000)#ip nat inside

Device(config-if-vlan1000)#exit

#Configure the outside interface with vlan1001 as the NAT.

Device(config)#interface vlan 1001

Device(config-if-vlan1001)#ip nat outside

Device(config-if-vlan1001)#exit

#Configure the NAT IP address pool, pool1, containing two private network IP addresses 100.0.0.2 and 100.0.0.3with the type setting to rotary. This enables the TCP flow can be evenly allocated to the two IP addresses.

Device(config)#ip nat pool pool1 100.0.0.2 100.0.0.3 netmask 255.255.255.0 type rotary

#Configure the ACL 1001, only permitting PCs of port 80 visiting 201.16.16.2 to visit Web Server.

Device(config)#ip access-list extended 1001

Device(config-ext-nacl)#permit tcp any host 201.16.16.2 eq 80

Device(config-ext-nacl)#exit

#Configure the destination IP address NAT rule, translating the destination IP address 201.16.16.2 as the internal private network IP address 100.0.0.2 and 100.0.0.3.

Device(config)#ip nat inside destination list 1001 pool pool1

Step 3:

Check the result.

# When the PC in the external public network visits the port 80 of the public network IP address 201.16.16.2, the NAT table entry can be viewed on Device.

Device#show ip nat translations

Type Pro Inside Global Inside Local Outside Local Outside Global Age

----- ---- -------------------- -------------------- -------------------- -------------------- -----

DAT TCP 201.16.16.2:80 100.0.0.2:80 203.18.10.2:1027 203.18.10.2:1027 60 (FINRST)(2:4)

DAT TCP 201.16.16.2:80 100.0.0.3:80 203.18.10.2:1028 203.18.10.2:1028 60 (FINRST)(2:4)


10.3.5 Configure Outside Source NAT Static Address/Port Translation

Network Requirements

l PC1 is the internal host, PC2 and PC3 are the external hosts, Device is the NAT device, vlan1000 is the NAT internal interface, and vlan1001 is the NAT external interface. Configure the outside source NAT static address/port translation.

l The external host PC2 can successfully visit PC1. The source IP address of the packet is translated from the Internet IP address 17.1.1.2 to the intranet IP address 100.0.0.1. PC3 can successfully visit PC1 through the source port 1024. The source IP address of the packet is translated from the Internet IP address 17.1.1.3 to the intranet IP address 100.0.0.1 and the source port 1024 is translated to 2048.

Network Topology

Figure 10‑5 Networking of configuring outside source NAT static address/port translation

Configuration Steps

Step 1: | Configure the IP addresses and routings for all the interfaces. (Omitted)
Step 2: | Configure the NAT interface attribute and NAT rule for Device.

#Configure the inside interface with vlan1000 as the NAT.

Device#configure terminal

Device(config)#interface vlan 1000

Device(config-if-vlan1000)#ip nat inside

Device(config-if-vlan1000)#exit

#Configure the outside interface with vlan1001 as the NAT.

Device(config)#interface vlan 1001

Device(config-if-vlan1001)#ip nat outside

Device(config-if-vlan1001)#exit

#Configure the outside source NAT static address/port translation rule, translating the Internet IP address 17.1.1.2 and 17.1.1.3 to the intranet IP address 100.0.0.1 and the source port 1024 of 17.1.1.3is translated to 2048.

Device(config)#ip nat outside source static 17.1.1.2 100.0.0.1

Device(config)#ip nat outside source static tcp 17.1.1.3 1024 100.0.0.1 2048

Step 3:

Check the result.

# When PC2 visits PC1, the NAT table entry with the type setting to OSAT can be viewed on Device. When PC3 visits PC1, the NAT table entry with the type setting to OSPT can be viewed on Device.

Device#show ip nat translations static

Type Pro Inside Global Inside Local Outside Local Outside Global

----- ---- -------------------- -------------------- -------------------- --------------------

OSAT (--) (----------) (----------) 100.0.0.1 17.1.1.2

OSPT TCP (----------) (----------) 100.0.0.1:2048 17.1.1.3:1024

Type Pro Inside Global Inside Local Outside Local Outside Global Age

----- ---- -------------------- -------------------- -------------------- -------------------- -----

OSAT 253 100.0.0.2:0 100.0.0.2:0 100.0.0.1:0 17.1.1.2:0 600 (----)(2:1)

OSPT TCP 100.0.0.2:1024 100.0.0.2:1024 100.0.0.1:2048 17.1.1.3:1024 1800 (NORMAL:0)(2:1)


10.3.6 Configure Outside Source NAT Dynamic Address Translation

Network Requirements

l PC1 is the internal host, PC2 and PC3 are the external hosts, Device is the NAT device, vlan1000 is the NAT internal interface, and vlan1001 is the NAT external interface. Configure the outside source NAT dynamic address translation

l Users in the external IP address segment 17.1.1.0/24 can successfully visit PC1, using the internal IP address 100.0.0.3 and 100.0.0.4.

Network Topology

Figure 10‑6 Networking of configuring the outside source NAT dynamic address translation

Configuration Steps

Step 1: | Configure the IP addresses and routings for all the interfaces. (Omitted)
Step 2: | Configure the NAT interface attribute and NAT rule for Device.

#Configure the inside interface with vlan1000 as the NAT.

Device#configure terminal

Device(config)#interface vlan 1000

Device(config-if-vlan1000)#ip nat inside

Device(config-if-vlan1000)#exit

#Configure the outside interface with vlan1001 as the NAT.

Device(config)#interface vlan 1001

Device(config-if-vlan1001)#ip nat outside

Device(config-if-vlan1001)#exit

#Configure the NAT IP address pool, pool1, containing two IP addresses 100.0.0.3 and 100.0.0.4.

Device(config)#ip nat pool pool1 100.0.0.3 100.0.0.4 netmask 255.255.255.0

# Configure the ACL 1001, only permitting PCs of the source IP address segment 17.1.1.0/24 to visit PC1.

Device(config)#ip access-list extended 1001

Device(config-ext-nacl)#permit ip 17.1.1.0 0.0.0.255 any

Device(config-ext-nacl)#exit

#Configure the outside source NAT dynamic address translation rule, translating the Internet IP addresses 17.1.1.2 and 17.1.1.3 to the intranet IP addresses 100.0.0.3 and 100.0.0.4.

Device(config)#ip nat outside source list 1001 pool pool1

Step 3:

Check the result.

# When PC2 and PC3 visit PC1, the NAT table entry can be viewed on Device.

Device#show ip nat translations

Type Pro Inside Global Inside Local Outside Local Outside Global Age

----- ---- -------------------- -------------------- -------------------- -------------------- -----

ONAT 253 100.0.0.2:0 100.0.0.2:0 100.0.0.3:0 17.1.1.2:0 600 (----)(2:1)

ONAT 253 100.0.0.2:0 100.0.0.2:0 100.0.0.4:0 17.1.1.3:0 600 (----)(2:1)


11 localstat


11.1 Overview

When being connected to Internet via the NAT device, the resources provided for the Intranet user are limited. For example, the bandwidth and address resources provided for the user are limited, and the translated address quantity provided by the NAT device for the user is limited. With the increasing of the user applications, more and more bandwidth and connection resources are needed. Therefore, under the limited resources, providing as fair resources as possible for each user and preventing that one or some users occupy too many resources and as a result, the other users cannot get the reasonable resources become a subject.

localstat provides IP-based user bandwidth limit and connection limit function for the NAT device.


11.2 Localstat Function Configuration

Table 11‑1 localstat function configuration

Configuration Task
Configure localstat basic functions | Enable the localstat function
Configure the localstat list | Configure the localstat list
 | Configure the localstat list rule
Configure the localstat connection limit function | Enable the localstat connection limit
 | Configure the network segment-based connection limit
 | Configure the list-based connection limit
 | Configure the connection limit based on the destination port
Configure the localstat bandwidth limit function | Configure the network segment-based bandwidth limit
 | Configure the list-based bandwidth limit
 | Configure the total bandwidth limit of the interface
Configure the localstat user quantity limit function | Configure the user quantity limit
Configure the localstat global parameters | Configure the localstat log output function
 | Configure the localstat max. entries
 | Configure the bandwidth limit of the non-NAT translated packet
 | Configure processing the ICMP packet first
 | Configure the interval of the entry aging check
 | Configure the age time of the entry


11.2.1 Configure localstat Basic Functions

Configuration Condition

Before configuring the localstat basic functions, first complete the following tasks:

l Configure the NAT translation rule, and the localstat function takes effect for the NAT translated packet.

Enable the localstat Function

Table 11‑2Enable the localstat function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the localstat function | localstat enable | Mandatory By default, do not enable the localstat function.


11.2.2 Configure the localstat list

The localstat list is the auxiliary function of the localstat configuration. It organizes multiple segments to form a list. If the localstat configuration parameters of multiple segments are the same, you can adopt the list mode to configure.

Configuration Condition

Before configuring the localstat list, first complete the following task:

l Configure the NAT translation rule, and the localstat function takes effect for the NAT translated packet.

l Enable the localstat function.

Configure the localstat List

Table 11‑3Configure the localstat list

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the localstat list | localstat list lst-name | Mandatory By default, do not configure the localstat list.

Configure the localstat List Rule

Table 11‑4 Configure the localstat list rule

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the localstat list configuration mode | localstat list lst-name | Mandatory
Configure the localstat list rule | [ rule number ] network network mask mask | Mandatory By default, do not configure the localstat list rule.

l Before deleting the localstat list, it is necessary to delete all limit rules based on the localstat list first. Otherwise, there is error prompt.


11.2.3 Configure the localstat Connection Limit Function

The localstat connection limit function limits the connections initiated for the NAT intranet host or device, ensuring that the NAT resources are not used by one or a few users completely. Localstat distributes one commit and burst for each intranet user. When the NAT resources are sufficient, the connection quantity initiated by the intranet user is the maximum value (burst). When the NAT resources are not sufficient, the connection quantity that can be initiated by the intranet user is the commit value. The NAT resources are the supported maximum connections. If the current connections do not reach 80% of the maximum connections, it is regarded that the NAT resources are sufficient. Otherwise, it is regarded that the NAT resources are not sufficient.

The localstat connection limit takes effect for the TCP, UDP and other protocols separately. For example, if the connections distributed to the user with the address 1.1.1.1 are 350, the user can create 350 TCP connections, 350 UDP connections, and 350 other protocol connections at the same time.

Configuration Condition

Before configuring the localstat connection limit function, first complete the following task:

l Configure the NAT translation rule, and the localstat function takes effect for the NAT translated packet.

l Enable the localstat function.

Enable the localstat Connection Limit

Table 11‑5Enable the localstat connection limit

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the localstat connection limit | localstat connect enable | Mandatory By default, do not enable the localstat connection limit function.

Configure the Segment-based Connection Limit

The segment-based connection limit function can limit the connections of the configured IP address in the segment. The segment-based connection limit supports the total and non-total modes. The connection limit rules in the two modes are as follows:

When being configured as the total mode, all IP addresses in the segment share the configured connections. The connections of each IP are the configured connections/online IP addresses. If there is only one IP address online, the IP independently share all connections; when there are two IP addresses online, each IP can use 1/2 connections, and so on. When the connections distributed to each IP is lower than the system lower limit of commit or the system lower limit of burst (the system lower limit of commit is 10 and the system lower limit of burst is 20), do not distribute any more. After configuring the total option, the online IP addresses are limited, and every time when there is IP address getting online or offline, re-calculate the connection parameters of the online IP addresses.

When being configured as the non-total mode, each IP address in the segment uses the same connection limit parameters, not related with the online IP address quantity. Each new online IP address is distributed with the connection limit parameters by the configured parameters.

If the source address of one intranet packet can match multiple localstat configurations at the same time, match by the longest mask and confirm the connection limit parameters of the IP.

Table 11‑6Configure the segment-based connection limit

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the segment-based connection limit | localstat connect network mask { [ total ] commit c-value burst b-value | unlimited } [ timerange tr-name ] | Mandatory By default, do not configure the segment-based connection limit.

Configure the List-based Connection Limit

The list-based connection limit can limit the connections for the segment IP address in the localstat list. If the connection limit parameters of multiple segments are the same, the list-based connection limit can simplify the configuration.

If the source address of the intranet packet can match multiple localstat configurations at the same time, match by the longest mask, and confirm the connection limit parameters of the IP.

Table 11‑7Configure the list-based connection limit

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the list-based connection limit | localstat connect list lst-name { commit c-value burst b-value | unlimited } [ timerange tr-name ] | Mandatory By default, do not configure the list-based connection limit.

Configure the Connection Limit Based on Destination Port

The connection limit based on the destination port limits the connections of the intranet IP address accessing one destination port. The configuration takes effect only for the TCP and UDP protocol packets.

Table 11‑8 Configure the connection limit based on the destination port

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the connection limit based on the destination port | localstat connect dest-port { tcp | udp } {port| range port-start port-end} limit limit-value | Mandatory By default, do not configure the connection limit based on the destination port.


11.2.4 Configure localstat Bandwidth Limit Function

The localstat bandwidth limit function limits the uplink and downlink bandwidths of the NAT intranet IP address. Localstat distributes one commit bandwidth value (cir) for the intranet IP address and the maximum bandwidth (bir). With the total bandwidth of the interface, it can realize the flexible bandwidth control.

When the network is not congested, and the total bandwidth of the interface has some idle, the bandwidth the intranet IP can get is bir; when the network is congested, and the total bandwidth of the interface has no idle, the bandwidth the intranet IP can get is cir. In the actual application, the bandwidth the intranet IP can get is between cir and bir.

The localstat bandwidth limit function needs to be configured on the NAT external interface, and takes effect only for the packet processed by the internal NAT translation rule, but does not take effect for the packet processed by the external NAT translation rule.

Configuration Condition

Before configuring the localstat bandwidth limit function, first complete the following tasks:

l Configure the NAT translation rule, and the localstat function takes effect for the packet translated by NAT.

l Enable the localstat function.

Configure Segment-based Bandwidth Limit

The segment-based bandwidth limit can limit the bandwidth of the configured IP address in the segment. The segment-based bandwidth limit supports the total and non-total modes. The bandwidth limit rules in the two modes are as follows:

When being configured as the total mode, all IP addresses in the segment share the configured bandwidth. The bandwidth of each IP is the configured bandwidth/online IP addresses. If there is only one IP address online, the IP independently share all bandwidth; when there are two IP addresses online, each IP can use 1/2 bandwidth, and so on. When the c bandwidth distributed to each IP is 1kbps, do not distribute any more. After configuring the total option, the online IP addresses are limited, and every time when there is IP address getting online or offline, re-calculate the bandwidth of the online IP addresses.

When being configured as the non-total mode, each IP address in the segment uses the same bandwidth limit parameters, not related with the online IP address quantity. Each new online IP address is distributed with the bandwidth limit parameters by the configured parameters.

If the source address of one intranet IP address can match multiple localstat configurations at the same time, match by the longest mask and confirm the bandwidth limit parameters of the IP.

Table 11‑9 Configure the segment-based bandwidth limit

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the segment-based bandwidth limit | localstat bandwidth network mask[ total ] { ingress | egress } cir cir-value bir bir-value [ timerange tr-name ] | Mandatory By default, do not configure the segment-based bandwidth limit.

Configure the List-based Bandwidth Limit

The list-based bandwidth limit function limits the bandwidth for the segment IP address in the localstat list. If the bandwidth limit parameters of multiple segments are the same, the list-based bandwidth limit can simplify the configuration.

If one intranet IP address can match multiple localstat configurations at the same time, match by the longest mask, and confirm the bandwidth limit parameters of the IP.

Table 11‑10 Configure the list-based bandwidth limit

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the list-based bandwidth limit | localstat bandwidth list lst-name { ingress | egress } cir cir-value bir bir-value [ timerange tr-name ] | Mandatory By default, do not configure the list-based bandwidth limit.

Configure the Total Bandwidth Limit of the Interface

The total bandwidth limit function of the interface limits the total bandwidth of all users on the interface. When configuring the total bandwidth of the interface separately, all users adopt the preempt mode to share the total bandwidth.

The total bandwidth limit of the interface is used with the other two bandwidth limits to realize the flexible bandwidth control. After configuring the segment-based bandwidth limit or the list-based bandwidth limit, the available bandwidth value of the intranet user is cir-bir. When the bandwidth value of the intranet user exceeds cir, but does not exceed bir, check the total bandwidth limit. If the total bandwidth has some idle, the packet of the intranet user can be forwarded normally. Otherwise, the packet of the intranet user is dropped.

Table 11‑11 Configure the total bandwidth limit of the interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the total bandwidth limit of the interface | localstat bandwidth { total-egress | total-ingress } value | Mandatory By default, do not configure the total bandwidth limit of the interface.


11.2.5 Configure localstat User Quantity Limit Function

Each IP address of the NAT intranet is one user. Configure the user quantity limit, and you can limit the number of the extranet IP addresses accessed by the NAT intranet.

Configuration Condition

Before configuring the localstat user quantity limit function, first complete the following tasks:

l Configure the NAT translation rule, and the localstat function takes effect for the packet translated by NAT.

l Enable the localstat function.

Configure the User Quantity Limit

Table 11‑12 Configure the user quantity limit

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the user quantity limit | localstat user-limit [number ] | Mandatory By default, do not configure the user quantity limit.


11.2.6 Configure localstat Global Parameters

Configuration Condition

Before configuring the localstat global parameters, first complete the following tasks:

l Enable the localstat function.

Configure localstat Log Output Function

By default, localstat does not output the log information. If localstat needs to output the log, it is necessary to enable the log output function. Currently, localstat has two log outputs, that is, the connections each the upper limit and the connections are restored to normal.

Table 11‑13 Configure the localstat log output function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the localstat log output function | localstat logging enable | Mandatory By default, do not configure the localstat log output function.

Configure Max. localstat Entries

The entries that localstat can create are limited. Both the localstat connection limit function and bandwidth limit function need to have the corresponding entries. When the localstat entries reach the upper limit, you cannot create new entry. In such situation, you need to configure the maximum localstat entries.

Table 11‑14 Configure the maximum localstat entries

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the maximum localstat entries | localstat ip-entries number | Mandatory By default, the maximum localstat entries is 65536.

Configure the Bandwidth Limit of Non-NAT Translated Packet

By default, the localstat bandwidth limit function is for the NAT translated packet. After configuring the bandwidth limit of the non-NAT translated packet, the bandwidth of the packet not translated by NAT is also limited by localstat.

Table 11‑15 Configure the bandwidth limit of the non-NAT translated packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the bandwidth limit of the non-NAT translated packet | localstat untranslated | Mandatory By default, do not configure the bandwidth limit of the non-NAT translated packet.

Configure Prioritizing the ICMP Packet

The command is used to improve the processing priority of the ICMP packet.

Table 11‑16 Configure prioritizing the ICMP packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure prioritizing the ICMP packet | localstat priority icmp | Mandatory By default, do not configure prioritizing the ICMP packet.

Configure the Interval of the Entry Aging Check

Table 11‑17 Configure the interval of the entry aging check

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the interval of the entry aging check | localstat record aging interval value | Mandatory By default, the interval of the entry aging check is 5s.

Configure the Entry Aging Time

Configure the aging time of the entry. The aging time of the connection limit entry indicates the existing time of the entry when the connections of the entry are 0. The aging time of the bandwidth limit entry indicates the existing time of the entry when there is no bandwidth limit entry.

Table 11‑18 Configure the entry aging time

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the entry aging time | localstat record aging timeout value | Mandatory By default, the aging time of the entry is 120s.

l The existing time of the localstat entry should be larger than the inactive time of the flow table. Otherwise, when the flow table is enabled, the bandwidth limit may be wrong. By default, the existing time of the localstat entry is larger than the inactive time of the flow table.


11.2.7 localstat Monitoring and Maintaining

Table 11‑19 localstat monitoring and maintaining

Command | Description
clear localstat connect record | Clears all connect entries of localstat
show localstat bandwidth interface interface-name | Displays the localstat bandwidth limit entry of the specified interface
show localstat connect | Displays the localstat connection limit entry
show localstat connect dest-port [port-start port-end ] | Displays the localstat connection limit entry based on the destination port
show localstat ip-entity | Displays the current entry quantity of localstat
show localstat list | Displays the localstat list configuration information
show running-config localstat | Displays all configuration information of localstat


11.3 localstat Typical Configuration Example


11.3.1 Configure localstat Flexible Bandwidth Limit

Network Requirements

l PC1 and PC2 are the internal private network host, Web Server is the web server of the public network, Device is the NAT device, vlan1000 is the NAT internal interface, vlan1001 is the NAT external interface, and configure the dynamic port translation of the internal source NAT.

l The users of the segment 100.0.0.0/24 in the internal private network all can access Web Server successfully, copy one public network address by mapping the TCP port number, and the used public network address is 201.16.16.2.

l The maximum uplink bandwidth distributed to the PC with the address 100.0.0.2 in the interval private network is 800kbps, and the minimum is 400kbps, the maximum downlink bandwidth is 1600kbps, the minimum downlink bandwidth is 800 kbps. The default maximum uplink bandwidth distributed to the other addresses in the segment 100.0.0.0/24 is 1600kbps, the minimum is 800 kbps, the maximum downlink bandwidth is 2400kbps, and the minimum is 1600kbps.

Network Topology

Figure 11‑1 Networking of configuring the localstat flexible bandwidth limit

Configuration Steps

Step 1: | Configure the IP address and the route of the interface. (Omitted)
Step 2: | Configure the NAT interface attributes and NAT translation rule of Device.

#Configure the interface vlan1000 as the inside interface of NAT.

Device#configure terminal

Device(config)#interface vlan 1000

Device(config-if-vlan1000)#ip nat inside

Device(config-if-vlan1000)#exit

#Configure the interface vlan1001 as the outside interface of NAT.

Device(config)#interface vlan 1001

Device(config-if-vlan1001)#ip nat outside

Device(config-if-vlan1001)#exit

#Configure the NAT address pool (pool1), only containing one public network address 201.16.16.2.

Device(config)#ip nat pool pool1 201.16.16.2 201.16.16.2 netmask 255.255.255.0

#Configure the ACL 1001, only permitting the PC of the segment 100.0.0.0/24 in the internal private network to access Web Server.

Device(config)#ip access-list extended 1001

Device(config-ext-nacl)#permit ip 100.0.0.0 0.0.0.255 any

Device(config-ext-nacl)#exit

#Configure the PAT translation rule, translating the internal private network address 100.0.0.2 and 100.0.0.3 to the public network address 201.16.16.2.

Device(config)#ip nat inside source list 1001 pool pool1 overload

Step 3:

Check the NAT connection status.

#When the internal private network PC1 and PC2 access Web Server, you can see the NAT translation entry on Device.

Device#show ip nat translations

Type Pro Inside Global Inside Local Outside Local Outside Global Age

----- ---- -------------------- -------------------- -------------------- -------------------- -----

PAT TCP 201.16.16.2:10001 100.0.0.2:1024 17.1.1.2:80 17.1.1.2:80 1800 (NORMAL:0)(2:1)

PAT TCP 201.16.16.2:10002 100.0.0.3:1024 17.1.1.2:80 17.1.1.2:80 1800 (NORMAL:0)(2:1)

Step 4:

Configure the localstat flexible bandwidth limit.

#Configure localstat list and apply.

Device(config)#localstat list default

Device(config-local-list)#network 100.0.0.0 mask 255.255.255.0

Device(config-local-list)#exit

Device(config)#localstat list 1

Device(config-local-list)#network 100.0.0.2 mask 255.255.255.255

Device(config-local-list)#exit

#Apply localstat list on the interface vlan1001 of Device, and configure the bandwidth limit.

Device(config)#interface vlan 1001

Device(config-if-vlan1001)#localstat bandwidth list default egress cir 800 bir 1600

Device(config-if-vlan1001)#localstat bandwidth list default ingress cir 1600 bir 2400

Device(config-if-vlan1001)#localstat bandwidth list 1 egress cir 400 bir 800

Device(config-if-vlan1001)#localstat bandwidth list 1 ingress cir 800 bir 1600

Device(config-if-vlan1001)#exit

#Enable localstat.

Device(config)#localstat enable

Step 5:

Check the localstat bandwidth limit result.

#When PC1 and PC2 of the internal private network access the web server, you can see the flexible bandwidth limit entry on Device, the download bandwidth limit for the address 100.0.0.2 is 800<->1600 (kbps), and the upload bandwidth limit is 400<->800(kbps). By default, the download bandwidth limit of the other addresses is 1600<->2400 (kbps), and the upload bandwidth limit is 800<->1600(kbps).

Device#show localstat bandwidth interface vlan 1001

bindwidth entity numbers:2

Source address Down bw (kbps) Up bw (kbps) Recv|avg [pkts:bits]/s Send|avg [pkts:bits]/s age

-------------- -------------- -------------- ---------------------- ---------------------- ---

100.0.0..2 800<->1600 400<->800 0:0|0:0 209:184536|209:184536 120

100.0.0..3 1600<->2400 800<->1600 0:0|0:0 209:184536|580:510930 120


11.3.2 Configure localstat Flexible Connection Limit

Network Requirements

l PC1 and PC2 are the internal private network host, Web Server is the web server of the public network, Device is the NAT device, vlan1000 is the NAT internal interface, vlan1001 is the NAT external interface, and configure the dynamic port translation of the internal source NAT.

l The users of the segment 100.0.0.0/24 in the internal private network all can access Web Server successfully, copy one public network address by mapping the TCP port number, and the used public network address is 201.16.16.2.

l The PC of the address 100.0.0.2 in the internal private network can connect 2000 TCP, UDP, and other ports at most and 600 at least respectively; the other addresses can connect 600 at most, and 350 TCP, UDP and other ports at least

Network Topology

Figure 11‑2 Networking of configuring the localstat flexible connection limit

Configuration Steps

Step 1: | Configure the IP address and the route of the interface. (Omitted)
Step 2: | Configure the NAT interface attributes and NAT translation rule of Device.

#Configure the interface vlan1000 as the inside interface of NAT.

Device#configure terminal

Device(config)#interface vlan 1000

Device(config-if-vlan1000)#ip nat inside

Device(config-if-vlan1000)#exit

#Configure the interface vlan1001 as the outside interface of NAT.

Device(config)#interface vlan 1001

Device(config-if-vlan1001)#ip nat outside

Device(config-if-vlan1001)#exit

#Configure the NAT address pool (pool1), only containing one public network address 201.16.16.2.

Device(config)#ip nat pool pool1 201.16.16.2 201.16.16.2 netmask 255.255.255.0

#Configure the ACL 1001, only permitting the PC of the segment 100.0.0.0/24 in the internal private network to access Web Server.

Device(config)#ip access-list extended 1001

Device(config-ext-nacl)#permit ip 100.0.0.0 0.0.0.255 any

Device(config-ext-nacl)#exit

#Configure the PAT translation rule, translating the internal private network address 100.0.0.2 and 100.0.0.3 to the public network address 201.16.16.2.

Device(config)#ip nat inside source list 1001 pool pool1 overload

Step 3:

Check the NAT connection status.

#When the internal private network PC1 and PC2 access Web Server, you can see the NAT translation entry on Device.

Device#show ip nat translations

Type Pro Inside Global Inside Local Outside Local Outside Global Age

----- ---- -------------------- -------------------- -------------------- -------------------- -----

PAT TCP 201.16.16.2:10001 100.0.0.2:1024 17.1.1.2:80 17.1.1.2:80 1800 (NORMAL:0)(2:1)

PAT TCP 201.16.16.2:10002 100.0.0.3:1024 17.1.1.2:80 17.1.1.2:80 1800 (NORMAL:0)(2:1)

Step 4:

Configure the localstat flexible connection limit.

#Configure localstat list and apply.

Device(config)#localstat list default

Device(config-local-list)#network 100.0.0.0 mask 255.255.255.0

Device(config-local-list)#exit

Device(config)#localstat list 1

Device(config-local-list)#network 100.0.0.2 mask 255.255.255.255

Device(config-local-list)#exit

#Apply localstat list to the flexible connection limit.

Device(config)# localstat connect list default commit 350 burst 600

Device(config)# localstat connect list 1 commit 600 burst 2000

Device(config)#exit

# Enable localstat list and flexible connection limit.

Device(config)#localstat connect enable

Device(config)#localstat enable

Step 5:

Check the localstat connection limit result.

#When PC1 and PC2 of the internal private network access the web server, you can see the flexible connection limit entry on Device, the port connection limit for the address 100.0.0.2 is 600 <-> 2000, and the current limit value is 2000. By default, the port connection limit of the other addresses is 350 <-> 600, and the current limit value is 600.

Device#show localstat connect

IP entity numbers:2 Connection numbers:4

Source address Limit range Permit count Current count(tcp|udp|other) age

-------------- ----------- ------------ ---------------------------- ---

100.0.0.2 600 <-> 2000 2000 2|0|0 120

100.0.0.3 350 <-> 600 600 2|0|0 120

If the connections of the internal PC1 reach the upper limit 2000, Current count keeps 2000, and do not permit the IP to create new connections unless the old connection is cut off.

l After enabling the connection limit, enable localstat to clean up and re-create the NAT entries and localstat entries, which may cause the network interruption for a moment.


12 GRE


12.1 Overview

Generic Routing Encapsulation (GRE) is a generic tunnel encapsulation protocol which defined how to use a network protocol to encapsulate another network protocol.

GRE tunnel is one tunnel technology among a lot of tunnel technologies. The starting point and end point of a tunnel need to be manually configured. The tunnel is a virtual end-to-end connection. It provides a transmission channel for the encapsulated packets. The two ends of the tunnel encapsulates and de-capsulates data packets respectively.

l GRE encapsulation:

If a data packet needs to be transmitted through a GRE tunnel, the tunnel adds a GRE header to the packet header, and adds an IP header to the GRE header. Set the protocol number of the IP header to 47 (GRE protocol number in the IP header), set the source address of the IP header to the source address of the tunnel, and set the destination address of the IP header to the destination address of the tunnel.

l GRE packet structure

Payload packet: The network layer packet (such as IP packet) before it enters the tunnel is taken as the valid payload of the tunnel packet. The protocol of the packet is called the passenger protocol of the GRE tunnel.

GRE header: It refers to the GRE header that is added to the payload packet after the payload packet enters the tunnel. The GRE header contains the GRE protocol and some information related to the passenger protocol.

Delivery header: The encapsulated external protocol header (such as IP header) is the header of the protocol for the network in which the tunnel is located. It is a transmission tool which helps one protocol packet to traverse the network of another protocol.

l GRE packet forwarding

After a packet is encapsulated at the starting point of a GRE tunnel, it selects a route according to the destination after encapsulation, and then it is sent out through the corresponding network interface. Intermediate devices take the packet as a common packet until the packet reaches the end of the tunnel.

l GRE decapsulation:

Decapsulation is the reverse process of encapsulation. After the end point of the tunnel receives the packet, it analyzes Delivery header. If the end point of the tunnel finds that the destination is its own address, it checks the protocol field of the IP header. If the protocol field is 47 (GRE protocol number), the end point of the tunnel hands over the packet to the GRE tunnel for processing. The tunnel first removes Delivery header and then checks the protocol number, checksum, and keyword in the GRE header. After required processing, the tunnel removes the GRE header, and hands over the Payload packet to the passenger protocol for later processing. Then, the decapsulation is completed.


12.2 GRE Function Configuration

Table 10‑1 GRE function list

Configuration Tasks

Configure a GRE tunnel.

Configure a GRE tunnel.


12.2.1 Configure a GRE Tunnel

Configuration Condition

Before configuring a GRE tunnel, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l Tunnel interfaces have been created and the basic parameters have been configured. (Refer to tunnel interface configuration manual.)

l A unicast protocol has been configured so that the routes at the two ends of the tunnel are reachable.

Configure a GRE Tunnel

Table 10‑2 Configuring a GRE tunnel

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the tunnel interface configuration mode. | interface tunnel tunnel-number | -
Configure the tunnel interface address. | ip address ip-address { mask | mask-length } | Mandatory. By default, no address is configured for the tunnel interface.
Configure the tunnel interface mode to GRE over IPv4. | tunnel mode gre ip | Optional. By default, the tunnel interface mode is GRE over IPv4.
Configure the source address or interface name on the tunnel interface. | tunnel source { ip-address | interface-name } | Mandatory. By default, the source address and interface name are not configured on the tunnel interface.
Configure the destination address or host name on the tunnel interface. | tunnel destination { ip-address | hostname } | Mandatory. By default, the destination address and host name are not configured on the tunnel interface.
Configure the verification function on the tunnel interface | tunnel checksum | Optional By default, the verification function on the tunnel interface is not configured. The verification function cannot be configured at the both ends of the tunnel.
Configure the keywords on the tunnel interface | tunnel key key-number | Optional By default, the keyword on the tunnel interface is not configured. The keywords on the both ends of the tunnel must be consistent. Otherwise, the tunnel transmission will fail.
Configure the keep-alive action on the tunnel interface | keepalive [ period [ retries ] ] | Optional By default, the keep-alive function on the tunnel interface is not configured.

l On the two end of a tunnel, the source addresses and destination addresses must be configured. The source address of one end is the destination end of the other end.

l In configuring the source of a tunnel, if the interface mode is adopted, the primary address of the source interface is used as the source address of the tunnel.

l The two ends of a tunnel must be configured with the same tunnel mode; otherwise, transmission through the tunnel fails.

l On one device, two or more tunnels with the same tunnel mode, source address and destination address are not allowed.

l The keep-alive function only takes effect on the GRE over IPv4 tunnel. When the keep-alive function is configured, the tunnel will send the keep-alive packet periodically. If consecutive N keep-alive packets (N indicates the configured retries value) are not responded, the peer end is considered as not working normally. Then, disable the local tunnel interface. The tunnel will also send the keep-alive packet periodically when the tunnel is disabled. The keep-alive function is not required to be configured at the both ends of the tunnel.


12.2.2 GRE Monitoring and Maintaining

Table 10‑3 GRE monitoring and maintaining

Command | Description
clear gre statistics | Clears statistics of GRE tunnels.
show gre config [ tunnel tunnel-number ] | Displays the configuration information of all GRE tunnel interface or a specified GRE tunnel interface.
show gre kernel [ tunnel tunnel-number ] | Displays the information about all active GRE tunnel interfaces or a specified active GRE tunnel interface.
show gre statistics | Displays statistics of GRE tunnels.


12.3 GRE Typical Configuration Example


12.3.1 Configure GRE Basic Functions

Network Requirements

l IP Network1 and IP Network2 are two private networks of Device1 and Device3.

l IP Network1 and IP Network2 communicate with each other through the GRE tunnel between Device1 and Device3.

Network Topology

Figure 10‑1 Networking for configuring GRE basic functions

Configuration Steps

Step 1: | Configure IP addresses for all interfaces. (Omitted)
Step 2: | Configure Open Shortest Path First (OSPF).

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 1.0.0.0/24 [110/65536] via 2.0.0.1, 00:18:40, vlan2

C 2.0.0.0/24 is directly connected, 00:22:27, vlan2

C 192.168.100.0/24 is directly connected, 00:00:28, vlan3

l The method for querying the routing table of Device 1 and Device2 is the same as that for Device 3, so the processes are not described here.

Step 3:

Configure a GRE tunnel.

#On Device1, configure GRE tunnel tunnel1, set the source address to 1.0.0.1, destination address to 2.0.0.2, and IP address to 10.0.0.1.

Device1(config)#interface tunnel 1

Device1(config-if-tunnel1)#tunnel source 1.0.0.1

Device1(config-if-tunnel1)#tunnel destination 2.0.0.2

Device1(config-if-tunnel1)#ip address 10.0.0.1 255.255.255.0

Device1(config-if-tunnel1)#exit

#On Device3, configure GRE tunnel tunnel1, set the source address to 2.0.0.2, destination address to 1.0.0.1, and IP address to 10.0.0.2.

Device3(config)#interface tunnel 1

Device3(config-if-tunnel1)#tunnel source 2.0.0.2

Device3(config-if-tunnel1)#tunnel destination 1.0.0.1

Device3(config-if-tunnel1)#ip address 10.0.0.2 255.255.255.0

Device3(config-if-tunnel1)#exit

#Query the GRE tunnel information of Device3.

Device3#show gre kernel

GRE tunnel kernel information:

GRE Tunnel Interface 0 (0x1100b):

Tunnel mode is gre ip

Tunnel state is active/up Destination address is 1.0.0.1

Source address is 2.0.0.2

Source interface is vlan2 (0x4)

Time To Live (TTL) is 255

Type Of Service (TOS) is not set

VRF is global (0x0)

Source interface VRF is global (0x0)

GRE header length is 4 Packet checksum validation is disabled

Security validation key is not set

Keepalive is disabled

Internal flags is 0x230000

l The method for querying the GRE tunnel information of Device 1 is the same as that for Device 3, so the process is not described here.

l If a tunnel is located at different network segments, both the two devices at the two ends of the tunnel must be configured with a static route that reaches the peer tunnel with the tunnel interface as the output interface.

Step 4:

Configure the static route.

#On Device1, configure the static route to the egress interface tunnel1 of IP Network2.

Device1(config)#ip route 192.168.100.0 255.255.255.0 tunnel1

#On Device3, configure the static route to the egress interface tunnel1 of IP Network1.

Device3(config)#ip route 192.168.1.0 255.255.255.0 tunnel1

#View the route table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 1.0.0.0/24 [110/65536] via 2.0.0.1, 00:43:30, vlan2

C 2.0.0.0/24 is directly connected, 00:47:17, vlan2

C 10.0.0.0/24 is directly connected, 00:17:12, tunnel1

S 192.168.1.0/24 [1/100000] is directly connected, 00:00:10, tunnel1

l The method for querying the routing table of Device 1 is the same as that for Device 3, so the process is not described here.


13 IPIP


13.1 Overview

The IPIP (IPv4 over IPv4) tunnel is one of the tunnel technologies. Similar to the GRE (Generic Routing Encapsulation) tunnel, the start and end of the IPIP tunnel are manually configured. It serves a virtual PTP link and provides a transmission tunnel for the encapsulated packet. The start and end of the tunnel encapsulate and decapsulated the data packet. The IPIP tunnel encapsulates only the IPv4 data packets and enables the encapsulated data packets to be transmitted over other IPv4 network.

l IPIP encapsulation

When the IP data packet is transmitted over the IPIP tunnel, the tunnel adds an IP packet header. In the IP packet header, the protocol number is set to 4, the source IP address is set to the source IP address of the tunnel, and the destination IP address is set to the destination IP address of the tunnel.

l IPIP packet structure

IP Payload: indicates the IP packet payload before the packet entering the tunnel. It is a valid payload of the tunnel packet.

IP header: indicates the IP packet heeder before the packet entering the tunnel.

Outer IP header: indicates the encapsulated outer IP packet header. It is a transmission tool which enables the IP packet to be transmitted over another IP network.

l IPIP packet forwarding

After the packet is encapsulated at the start of the IPIP tunnel, a routing is selected for the packet based on the encapsulated destination IP address and then the packet is sent out from the corresponding network interface. The intermediate equipment forwards the packet as the common IP packet until the packet reaches the end of the tunnel.

l IPIP decapsulation

Contrary to the encapsulation process, in the decapsulation process, the end of the tunnel first analyzes the outer IP header when it receives the packet. If the destination IP address is the IP address of the end of the tunnel, check the protocol field of the IP packet header. If the protocol field is 4, transmit the packet to the IPIP tunnel for handling. The tunnel removes the outer IP header of the packet and chooses a routing for the packet based on the destination IP address of the decapsulated packet. The subsequent handling is performed based on the routing result.


13.2 IPIP Function Configuration

Table 13‑1 IPIP function list

Configuration Task

Configure the IPIP tunnel

Configure the IPIP tunnel


13.2.1 Configure IPIP Tunnel

Configuration Condition

Before configuring the IPIP tunnel, first complete the following tasks:

l Configure the interface IP address, enabling that the adjacent nodes on the network layer are reachable.

l Create the tunnel interface and configure the basic parameters. For details, refer to the Tunnel Interface Configuration Manual.

l Configure any unicast routing protocol, enabling the routing to the both ends of the tunnel is reachable.

Configure IPIP Tunnel

Table 13‑2 Configure the IPIP tunnel

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the tunnel interface configuration mode | interface tunnel tunnel-number | -
Configure the tunnel interface IP address | ip address ip-address { mask | mask-length } | Mandatory By default, the IP address on the tunnel interface is not configured.
Configure the tunnel interface mode as IPv4 over IPv4 | tunnel mode ipip | Mandatory By default, the tunnel interface mode is GRE over IPv4.
Configure the source IP address or the interface name for the tunnel interface | tunnel source { ip-address | interface-name } | Mandatory By default, the source IP address and the interface name are not configured for the tunnel interface.
Configure the destination IP address or the host name for the tunnel interface | tunnel destination { ip-address | hostname } | Mandatory By default, the destination IP address and the host name are not configured for the tunnel interface.

l The start and end of the tunnel must be configured with the source IP address and the destination IP address. The IP address at the start and end of the tunnel are complementary source IP address and destination IP address for each other.

l When configuring the tunnel source IP address, the source IP address of the tunnel adopts the master IP address of the source IP address if the interface mode is used.

l The start and end of the tunnel must be configured with the same tunnel mode. Otherwise, the tunnel transmission fails.

l Two or more tunnels with the same tunnel mode, source IP address, and destination IP address cannot be configured on the same device.


13.2.2 IPIP Monitoring and Maintaining

Table 13‑3 The IPIP monitoring and maintaining

Command | Description
clear iptl statistics | Clear the PIP tunnel statistics information
show iptl config [ tunnel tunnel-number ] | Display the configuration information of all or the specified IPIP tunnel interface
show iptl kernel [ tunnel tunnel-number ] | Display all or specified IPIP tunnel interface in the active state
show iptl statistics | Display the statistics information of the IPIP tunnel


13.3 IPIP Typical Configuration Example


13.3.1 Configure IPIP Basic Function

Network Requirements

l IP Network1 and IP Network2 are two private networks for Device1 and Device3, respectively.

l IP Network1 communicates with IP Network2 through the IPIP tunnel between Device1 and Device3.

Network Topology

Figure 13‑1 Networking of configuring the IPIP basic function

Configuration Steps

Step 1: | Configure the IP addresses for all interfaces. (Omitted)
Step 2: | Configure the OSPF.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#View the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 1.0.0.0/24 [110/65536] via 2.0.0.1, 00:18:40, vlan2

C 2.0.0.0/24 is directly connected, 00:22:27, vlan2

C 192.168.100.0/24 is directly connected, 00:00:28, vlan3

l Device1 and Device2 are viewed in the same way as Device3. The viewing process is omitted.

Step 3:

Configure the IPIP tunnel.

#Configure the IPIP tunnel, tunnel1 on Device1 with source IP address as 1.0.0.1, destination IP address as 2.0.0.2, and the IP address as 10.0.0.1.

Device1(config)#interface tunnel 1

Device1(config-if-tunnel1)#tunnel mode ipip

Device1(config-if-tunnel1)#tunnel source 1.0.0.1

Device1(config-if-tunnel1)#tunnel destination 2.0.0.2

Device1(config-if-tunnel1)#ip address 10.0.0.1 255.255.255.0

Device1(config-if-tunnel1)#exit

#Configure the IPIP tunnel, tunnel1 on Device3 with source IP address as 2.0.0.2, destination IP address as 1.0.0.1, and the IP address as 10.0.0.2.

Device3(config)#interface tunnel 1

Device3(config-if-tunnel1)#tunnel mode ipip

Device3(config-if-tunnel1)#tunnel source 2.0.0.2

Device3(config-if-tunnel1)#tunnel destination 1.0.0.1

Device3(config-if-tunnel1)#ip address 10.0.0.2 255.255.255.0

Device3(config-if-tunnel1)#exit

#View the IPIP tunnel information of Device3.

Device3#show iptl kernel

show iptl kernel

IP tunnel kernel information:IP Tunnel Interface 1 (0xd):

Tunnel mode is ipip

Tunnel state is up Destination address is 1.0.0.1

Source address is 2.0.0.2

Source interface is vlan2 (0x4)

Time To Live (TTL) is 255

Type Of Service (TOS) is not set

VRF is global (0x0)

Source interface

VRF is global (0x0)

Internal flags is 0x30000

l Device1 is viewed in the same way as Device3. The viewing process is omitted.

l When the tunnel does not exist in the same network segment, devices at the both ends of the tunnel are configured with a static routing to the peer end. And the outbound interface is the tunnel interface.

Step 4:

Configure the static route.

#On Device1, configure the static route to the egress interface tunnel1 of IP Network2.

Device1(config)#ip route 192.168.100.0 255.255.255.0 tunnel1

#On Device3, configure the static route to the egress interface tunnel1 of IP Network1.

Device3(config)#ip route 192.168.1.0 255.255.255.0 tunnel1

#View the route table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not setO 1.0.0.0/24 [110/65536] via 2.0.0.1, 00:43:30, vlan2

C 2.0.0.0/24 is directly connected, 00:47:17, vlan2

C 10.0.0.0/24 is directly connected, 00:17:12, tunnel1

S 192.168.1.0/24 [1/100000] is directly connected, 00:00:10, tunnel1

l Device1 is viewed in the same way as Device3. The viewing process is omitted.


14 L2TP


14.1 Overview

VPDN (Virtual Private Dial-up Network) provides connection services for the remote users expecting to connect to the enterprise network through the ISP (Internet Service Provider). The VPDN allows independent protocol domain to enjoy the common visit infrastructure, such as the modem, visiting server, and the ISDN router. The enterprise can purchase or rent the remote access infrastructure from the ISP to enable its remote work team to visit the intranet.

The VPDN uses the Layer 2 Tunneling Protocol, such as Layer 2 Forwarding and Point-to-Point Tunneling Protocol, to enable the ISP or other visiting servers to create a virtual channel to connect the customers' remote sites or remote users of the with the main network of the enterprise.

The network visiting server of the ISP can be dialed by remote users. Frames without any links and transparent bytes are encapsulated using the preceding tunnel protocol, such as the L2TP and are forwarded through the corresponding channels. The main gateway of the customer (enterprise network) receives these L2TP frames, decapsulates the L2TP links, and processes these entered frames for the corresponding interfaces.

L2TP (Layer 2 Tunneling Protocol) is one of the VPDN technologies. The L2TP allows users to dial in the ISP and allows the dialed-in users to incorporate the connections into the enterprise network. This enables the enterprise network to allow the ISP to keep its point at the logical attribute for all the dial-in connections through all logical attribute, such as authenticating the network layer attribute.

The L2TP uses the following two VPDN peer devices to construct a L2TP tunnel: LAC (L2TP Access Concentrator) and LNS (L2TP Network Server). When the user dials in the LAC, the LAC initiates the L2TP tunnel connection with the LNS. The LNS locates at the edge of the enterprise network or behind the firewall of the internal enterprise network.

Before all the sessions between the LAC and LNS are established, the control connection message must be used to establish the tunnel. This tunnel can send the PPP grouping from the LAC to the LNS. Establishing the control connection includes confirming the peer device, L2TP version, sub frame, and channel carrier.

The L2TP uses three message exchanges to establish the control connection. The following figure shows the process of establishing a tunnel.

Figure 14‑1 Establish the L2TP

1. The LAC sends the SCCRQ (Start Control Connection Request) to the LNS.

2. The LNS sends the SCCRP (Start Control Connection Reply) to the LAC.

3. The LAC sends the SCCCN (Start Control Connection Connected) to the LNS.

4. The LNS sends the ZLB (Zero-Length Body) to the LAC.

After the tunnel is established successfully, an independent L2TP session will be established. The following figure shows the process of creating a session:

Figure 14‑2 Establish the L2TP session

1. The host initiates the PPP connection with the LAC through the standard analog phone or the ISDN. The LAC receives the connection and establishes the data link layer.

2. The LAC checks part hosts, that is, checking whether the user is a VPDN client through the user name. If the user is not a VPDN user, check the user using the user name database provided by the local ISP for other connections. If the identified user name is a VPDN user, the L2TP session will be established subsequently.

3. The LAC initiates the L2TP session containing the ICRQ (Incoming Call Request) message.

4. The LNS receives the L2TP session containing the ICRP (Incoming Call Reply) message.

5. The LAC sends the L2TP session established by the ICCN (Incoming Call Connected).

6. The LNS replies to confirm the ZLB (Zero-Length Body) message.

7. The LAC forwards the user name and password to the LNS to complete the identification process.

8. The LAC forwards all the LCP (Link Control Protocol) negotiation options to the LNS. The LNS will establish a virtual access interface, which is copied from a virtual template. At this time, the user completes the identification of the LNS and all the other LCP negotiation options. If the user cannot perform the identification, the LNS will send a disconnection message to the LAC.

9. The data can be forwarded between the LAC and LNS through the L2TP tunnel.


14.2 L2TP Function Configuration

Table 14‑1 The L2TP function list

Configuration Task
Configure the VPDN group | Enable the VPDN
 | Configure the VPDN group of the LAC
 | Configure the VPDN group of the LNS
Configure the VPDN authentication | Configure the VPDN authentication
Configure the VPDN group parameter | Configure the keep-alive time of the VPDN tunnel
 | Configure the receive window size of the VPDN tunnel
Configure the spontaneous tunnel | Configure the L2TP spontaneous tunnel


14.2.1 Configure the VPDN group

Configuration Condition

None

Enable the VPDN

To configure any VPDN technology, enable the VPDN at first. Then other VPDN commands can be used.

Table 14‑2 Enable the VPDN

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the VPDN | vpdn enable | Mandatory By default, the VPDN function is not enabled.

Configure VPDN Group of LAC

The VPDN group is a mechanism, organizing all the VPDN commands related to all the VPDN peer devices into an independent structure. This mechanism specifies the LAC request dial-in or the LNS dial-in. once the VPDN group is configured as a specific L2TP device, you cannot change the configuration.

If the VPDN group is configured as the request dial-in mode, the VPDN group is identified as the LAC L2TP device.

Table 14‑3 Configure the VPDN group of the LAC

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the VPDN | vpdn enable | Mandatory By default, the VPDN function is not enabled.
Create the VPDN group and enter the VPDN configuration mode | vpdn-group group-name | Mandatory By default, the VPDN group is not created.
Configure permitting the VPDN request dial-in and enter the VPDN request dial-in configuration mode | request-dialin | Mandatory By default, the request dial-in is not configured for the VPDN group. The VPDN group is identifies as the LAC.
Configure the VPDN group application protocol type | protocol l2tp | Mandatory By default, the application protocol is not configured for the VPDN group. The application VPDN protocol is specified for the VPDN group. Currently, only the L2TP protocol is supported.
Configure the VPDN group domain name | domain domain-name | Mandatory By default, the domain name is not configured for the VPDN group. When the user dials in the LAC, the LAC needs to send user data to the specified LNS. That is, use the domain name to map the user to the LNS.
Return to the VPDN configuration mode | exit | -
Configure the destination IP address of the L2TP IPV4 tunnel | initiate-to ip ip-address | Mandatory By default, the destination IP address of the L2TP IPV4 tunnel is not configured for the VPDN group.
Configure the destination address of the L2TP IPV6 tunnel | initiate-to ipv6 ipv6-address | Mandatory By default, the VPDN group does not configure the destination address of the L2TP IPV6 tunnel.
Configure the LAC name | local name host-name | Optional By default, the LAC name is not configured.

Configure the VPDN group of the LNS

If the VPDN group is configured as the accept dial-in mode, the VPDN group is identified as the LNS L2TP device.

Table 14‑4 Configure the VPDN group of the LNS

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the VPDN | vpdn enable | Mandatory By default, the VPDN function is not enabled.
Create the VPDN group and enter the VPDN configuration mode | vpdn-group group-name | Mandatory By default, the VPDN group is not configured.
Configure permitting VPDN accept dial-in and enter the VPDN accept dial-in configuration mode | accept-dialin | Mandatory By default, the accept dial-in is not configured for the VPDN group. The VPDN group is identified as the LNS.
Configure the VPDN group application protocol type | protocol l2tp | Mandatory By default, the VPDN application protocol is not configured for the VPDN group. The application VPDN protocol is specified in the VPDN group. Currently, only the L2TP protocol is supported.
Configure the VPDN group virtual template interface | virtual-temple virtual-temple-number | Mandatory By default, the virtual template interface is not configured for the VPDN group. The L2TP packet is the PPP packet with extra data header. If the data header is removed, the PPP packet must take effect. Therefore, an interface can parse the PPP data is required, that is, the virtual interface.
Return to the VPDN configuration mode | exit | -
Configure the LNS peer end name | terminate-from hostname lac-hostname | Optional By default, the LNS peer device name is not configured for the VPDN group.
Configure the LNS name | local name host-name | Optional By default, the LNS name is not configured.


14.2.2 Configure VPDN Authentication

Configuration Condition

Before configuring the VPDN authentication function, first complete the following task:

l The corresponding VPDN group is created.

Configure VPDN Authentication

The L2TP uses a simple and configurable CHAP (Challenge Handshake Authentication Protocol) in the control connection establishment process. If the LAC or the LNS needs to be authenticated, then the AVP (Attribute Value Pairs) in the SCCRQ or SCCRP control packet contains the challenge message. Any party receives such SCCRQ or SCCRP must send the SCCRP or SCCCN control packet to response. If the response does not match the peer device expectation, the tunnel is not allowed to be established correctly.

Table 14‑5 Configure the VPDN authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the VPDN group and enter the VPDN configuration mode | vpdn-group group-name | Mandatory By default, the VPDN group is not created.
Enable the VPDN authentication function | l2tp tunnel authentication | Mandatory By default, the authentication function foe the VPDN is enabled.
Configure the VPDN identification password | l2tp tunnel password { [ 0 | 7 ] password } | Mandatory By default, the authentication password for the VPDN is not configured.


14.2.3 Configure VPDN Group Parameter

Configuration Condition

Before configuring the VPDN authentication function, first complete the following task:

l The corresponding VPDN group is created.

Configure Keep-alive Time of VPDN Tunnel

After the L2TP tunnel is established successfully, to detect whether the peer device can communicate normally, the L2TP device sends the keep-alive packet periodically to confirm the connectivity of the peer device.

Table 14‑6 Configure the keep-alive time of the VPDN tunnel

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the VPDN group and enter the VPDN configuration mode | vpdn-group group-name | Mandatory By default, the VPDN group is not created.
Configure the keep-alive time of the VPDN tunnel | l2tp tunnel hello time-value | Mandatory By default, the VPDN tunnel keep-alive time is 60s. After the L2TP tunnel is created, the packet is sent periodically to check whether the tunnel can communicate normally.

Configure Receive Window Size of VPDN Tunnel

The control packets in the L2TP tunnel and session establishment of the L2TP use the queue mechanism to ensure the packet sequence. The user can specify the capacity of the maximum cached control packets in the VPDN group.

Table 14‑7 Configure the receive window size of the VPDN tunnel

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the VPDN group and enter the VPDN configuration mode | vpdn-group group-name | Mandatory By default, the VPDN group is not configured.
Configure the receive window size of the VPDN tunnel | l2tp tunnel receive-window window-size | Mandatory By default, the VPDN tunnel receive window size is 20 packets.


14.2.4 Configure Spontaneous Tunnel

The L2TP tunnel establishment is initiated by the PPP dialing client. Generally, the PPP dialing client is separated from the LAC. In the spontaneous L2TP tunnel mode, the PPP dialing client and the LAC are in the same device.

The spontaneous tunnel is enabled in the following three steps:

l Create the pseudo-wire template and specify the data encapsulation type as L2TPv2.

l Create the virtual PPP interface and configure the PPP dialing authentication user name and password.

l Associate the pseudo-wire template to trigger the tunnel establishment on the virtual PPP interface.

Configuration Condition

None

Configure the L2TP spontaneous tunnel

Table 14‑8 Configure the L2TP spontaneous tunnel

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the pseudo-wire template and enter the pseudo-wire template configuration mode | pseudowire-class class-name | Mandatory By default, the pseudo-wire types are not created. For the detailed commands, refer to the L2TPv3 command manual.
Configure the encapsulation data type | encapsulation l2tpv2 | Mandatory By default, the encapsulation type for the pseudo-wire template is L2TPv3. The data type for the encapsulation pseudo-wire template is L2TP.
Associate the interface of the source IPv4 address | ip local interface interface-name | Mandatory By default, do not configure the source IPv4 address of the pseudo wire template.
Associate the interface of the source IPv6 address | ipv6 local interface interface-name ipv6-address | Mandatory By default, do not configure the source IPv6 address of the pseudo wire template.
Return to the global configuration mode | exit | -
Create the virtual PPP dialing interface | interface virtual-ppp unit-number | Mandatory By default, the virtual PPP interface is not configured.
Configure the encapsulation PPP type of the virtual PPP interface | encapsulation ppp | Mandatory By default, the encapsulation type of the virtual PPP interface is PPP.
Configure the PPP authentication name and password | ppp pap sent-username username@domain.com password 0 password | Mandatory By default, the PPP authentication user name and password are not configured for the virtual PPP interface.
Configure the IP address parameter | ip address { ip-address | negotiated } | Mandatory By default, the IP address parameter is not configured for the virtual PPP interface.
IPv4 configures associating the pseudo wire template | pseudowire ip-address vc-id pw-class pw-class-name | Mandatory By default, the virtual PPP interface is not configured to associate the pseudo-wire template.
IPv6 configures associating the pseudo wire template | pseudowire ipv6-address vc-id pw-class pw-class-name | Mandatory By default, the virtual PPP interface is not configured to associate the pseudo-wire template.


14.2.5 L2TP Monitoring and Maintaining

Table 14‑9 The L2TP monitoring and maintaining

Command | Description
clear vpdn l2tp [ session session-id | tunnel tunnel-name | user user-name ] | Clear all sessions and tunnels and the specified tunnels and sessions or sessions corresponding to the user name
show vpdn [ detail [ tunnel tunnel-id session session-id ] ] | Display the information related to the VPDN tunnel and session


14.3 L2TP Typical Example Configuration


14.3.1 Configure L2TP Forced Mode Combining PPPoE

Network Requirements

l Device1 acts as the PPPoE client, Device2 as the PPPoE server and LAC, and Device3 as the LNS.

l The routing between Device2 and Device3 is reachable.

l Device1 dials in Device2 through the PPPoE. The L2TP tunnel connection is triggered to be established between Device2 and Device3, realizing the communication between Device1 and Device3.

Network Topology

Figure 14‑3 Networking of configuring the forced L2TP tunnel mode combining the PPPoE

Configuration Steps

Step 1: | Configure the IP addresses for all interfaces. (Omitted)
Step 2: | Configure PPPoE client.

#Configure Device1.

Configure the dialing type to be triggered.

Device1#configure terminal

Device1(config)#dialer-list 1 protocol ip permit

Create the dialer0interface and configure the dialing-related information.

Device1(config)#interface dialer0

Device1(config-if-dialer0)#ip address negotiated

Device1(config-if-dialer0)#ppp pap sent-username admin@cctv.com password 0 admin

Device1(config-if-dialer0)#dialer in-band

Device1(config-if-dialer0)#dialer pool 1

Device1(config-if-dialer0)#dialer-group 1

Device1(config-if-dialer0)#exit

将gigabitethernet0/0加入vlan100，接口vlan100加入拨号池1中。

Device1(config)#interface gigabitethernet0/0

Device1 (config-if-gigabitethernet0/0)#switchport mode access

Device1 (config-if-gigabitethernet0/0)#switchport access vlan 100

Device1(config)#interface vlan100

Device1(config-if-vlan100)#pppoe-client dial-pool-number 1

Device1(config-if-vlan100)#pppoe-client auto-dial always

Device1(config-if-vlan100)#exit

Add a default routing with the outbound interface as dialer0.

Device1(config)#ip route 0.0.0.0 0.0.0.0 dialer0

Step 3:

Configure Device2 as the PPPoE server and the LAC.

#Configure Device2.

Configure the PPPoE server. Create virtual-template0 and encapsulation the PPP protocol Enable the PAP authentication mode.

Device2#configure terminal

Device2(config)#interface virtual-template 0

Device2(config-if-virtual-template0)#encapsulation ppp

Device2(config-if-virtual-template0)#ppp authentication pap

Device2(config-if-virtual-template0)#exit

Enable the VPDN. Create the VPDN group PPPoE and configure it as the accept dial-in request mode, using the PPPoE protocol and virtual-template0.

Device2(config)#vpdn enable

Device2(config)#vpdn-group pppoe

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol pppoe

Device2(config-vpdn-acc-in)#virtual-template 0

Device2(config-vpdn-acc-in)#exit

Device2(config-vpdn)#exit

Enable the PPPoE server on the gigabitethernet0 interface.

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#pppoe enable

Device2(config-if-gigabitethernet0)#exit

Configure the LAC. Create the VPDN group LAC and configure it as the dial-in request mode. Configure the L2TP protocol and configure the domain name as cctv.com. Specify the IP address of the LNS at the other end of the tunnel as. Configure the local device name as lac and configure the shared key of the LAC and LNS as admin. If the authentication is configured on LNS, LAC needs to configure the user name and password used for authentication on LNS.

Device2(config)#vpdn-group lac

Device2(config-vpdn)#request-dialin

Device2(config-vpdn-req-in)#protocol l2tp

Device2(config-vpdn-req-in)#domain cctv.com

Device2(config-vpdn-req-in)#exit

Device2(config-vpdn)#initiate-to ip 172.16.1.2

Device2(config-vpdn)#local name lac

Device2(config-vpdn)#l2tp tunnel password 0 admin

Device2(config-vpdn)#exit

Step 4:

Configure the LNS.

#Configure Device3.

Configure the user name and password.

Device3#configure terminal

Device3(config)#user admin@cctv.com password 0 admin

Create the local IP address pool, l2tp-pool ranging from 172.16.1.3 to 172.16.1.10.

Device3(config)#ip local pool l2tp-pool 172.16.1.3 172.16.1.10

Create virtual-template0 and encapsulation PPP protocol. Use the IP address of the interface Loopback0.the IP address is allocated to the PPPoE client from the IP address pool l2tp-pool.

Device3(config)#interface virtual-template 0

Device3(config-if-virtual-template0)#encapsulation ppp

Device3(config-if-virtual-template0)#peer default ip address pool l2tp-pool

Device3(config-if-virtual-template0)#ppp authentication pap

Device3(config-if-virtual-template0)#ip unnumbered loopback0

Device3(config-if-virtual-template0)#exit

Enable the VPDN. Create the VPDN group lns and configure it as the accept dial-in request mode, using the application L2TP protocol and virtual-template0. Only the L2TP connection request named lac is accepted. Configure the shared key of the LAC and LNS as admin.

Device3(config)#vpdn enable

Device3(config)#vpdn-group lns

Device3(config-vpdn)#accept-dialin

Device3(config-vpdn-acc-in)#protocol l2tp

Device3(config-vpdn-acc-in)#virtual-template 0

Device3(config-vpdn-acc-in)#exit

Device3(config-vpdn)#terminate-from hostname lac

Device3(config-vpdn)#l2tp tunnel password 0 admin

Device3(config-vpdn)#exit

l The shared key of the LAC and LNS must be consistent. Otherwise, the L2TP tunnel cannot be established successfully.

Step 5:

Check the result.

#View the PPPoE session information on Device1.

Device1#show pppoe session information

PPPoE Session Information:(Max Sessions=2048)

UID SID RemMAC LocMAC O-Intf state C/S ActiveTime Local-IP Peer-IP

----- ----- -------------- -------------- ---------------- ----- --- ---------- ---------------- ----------------

5 5 0001.7ade.1819 0001.7adf.8d1b vlan100 UP C 00:00:40 172.16.1.4 11.0.0.1

There are 1 PPPoE sessions up

#View the dialer0 interface information on Device1.

Device1#show interface dialer0

dialer0:

line protocol is up

Flags: (0x1c008071) POINT-TO-POINT MULTICAST ARP RUNNING

Type: PPP

Internet address: 172.16.1.4/32

Destination Internet address: 0.0.0.0

Metric: 0, MTU: 1492, BW: 56 Kbps, DLY: 20000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters never

input peak rate 243 bits/sec, 0 hour 3 minutes 45 seconds ago

output peak rate 288 bits/sec, 0 hour 3 minutes 45 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

16 packets received; 16 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

It can be observed that the dialer0 interface dialing succeeds and the negotiated IP address as 172.16.1.4.

#View the global routing table on Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

S 0.0.0.0/0 [1/178571] is directly connected, 00:00:39, dialer0

C 12.1.1.0/24 is directly connected, 00:14:51, gigabitethernet0

C 11.0.0.1/32 is directly connected, 00:00:39, dialer0

C 172.16.1.4/32 is directly connected, 00:00:39, dialer0

#View the L2TP information on Device2.

Device2#show vpdn detail

L2TP MaxTun 1000, MaxSes 1000:

tunnel free num: 999

TUNNELS:

LocID LocName RemID RemName RemAddr Vpdn Port Sess State

15 lac 45 lns 172.16.1.2 lac 1701 1 ESTAB

session free num: 999

SESSIONS:

LocID TunID RemID IfName User SysId Imsi/calling-no State

30 15 37 virtual-access0 - - ESTAB

L2TP total Tunnel and Session Information. Tunnel 1 Session 1

It can be observed that theL2TP tunnel is established successfully between Device2 and Device3.

#View the L2TP information on Device3.

Device3#show vpdn detail

L2TP MaxTun 1000, MaxSes 1000:

tunnel free num: 999

TUNNELS:

LocID LocName RemID RemName RemAddr Vpdn Port Sess State

45 lns 15 lac 172.16.1.1 lns 1701 1 ESTAB

session free num: 999

SESSIONS:

LocID TunID RemID IfName User SysId Imsi/calling-no State

37 45 30 virtual-access0 - - ESTAB

L2TP total Tunnel and Session Information. Tunnel 1 Session 1

It can be observed that the L2TP tunnel is established between Device2 and Device3.

#View the global routing table on Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 172.16.1.0/24 is directly connected, 00:11:40, gigabitethernet0

C 11.0.0.1/32 is directly connected, 03:12:05, loopback0

C 172.16.1.4/32 is directly connected, 00:00:47, virtual-access0

#The interface IP address of virtual-template0 on Device3 can be pinged through on Device1.

Device1#ping 11.0.0.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 11.0.0.1 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

l The device in the manual only supports the PPPoE client instead of the PPPoE server.


14.3.2 Configure L2TP Forced Mode Combining 4G Private Network

Network Requirements

l Device1 acts as the 4G client, the LAC acts as the operator device, and Device2 acts as the LNS and connects to the ISP. Network-Center is the data center.

l The 4G interface fastcellular1 of Device1 uses WCDMA.

l Device1 dials in the operator through 4G. The LAC of the operator builds the L2TP connection with Device2. The communication between the 4G device and the data center is realized.

Network Topology

Figure 14‑4Networking of configuring the L2TP forced mode combining the 4G private network

Device | Interface | IP Address | Device | Interface | IP Address
Device2 | Gi0 | 30.1.1.1/24 | Device2 | Loopback0 | 172.16.10.1/32
 | Gi1 | 130.255.142.29/24 |  |  |

Configuration Steps

Step 1:

Configure the IP addresses for all interfaces. (Omitted)

Step 2: Configure the 4G interface.

Device1#configure terminal

Device1(config)#interface fastcellular1

Device1(config-if-fastcellular1)#dialer config username test@jsyh.vpdn.sc password 0 admin

Device1(config-if-fastcellular1)#dialer mode auto

Device1(config-if-fastcellular1)#ip address dhcp

Device1(config-if-fastcellular1)#exit

Configure one default route with the egress interface fastcellular1.

Device1(config)#ip route 0.0.0.0 0.0.0.0 fastcellular1

l The APN name used on Device1 is provided by the carrier.

l The 4G private network can be connected by the APN and domain name, which depends on the carrier. In the example, adopt the domain name to connect.

Step 3:

Configure Device2 as the AAA client.

#Configure Device2.

Configure the authentication and authority list name as l2tp and configure the IP address, authentication port, statistics port, radius server password of the radius server. (For details, refer to the AAA chapter in the configuration manual.)

Device2#configure terminal

Device2(config)#aaa new-model

Device2(config)#aaa authentication ppp l2tp radius

Device2(config)#aaa authorization network l2tp radius

Device2(config)#radius-server host 130.255.142.11 auth-port 1645 acct-port 1646 priority 0 key l2tp

Step 4:

Configure the LNS.

#Configure Device2.

Configure virtual-template0 and use the AAA authentication and authority list named l2tp.

Device2(config)#interface virtual-template 0

Device2(config-if-virtual-template0)#encapsulation ppp

Device2(config-if-virtual-template0)#peer default ip address 64.19.245.249

Device2(config-if-virtual-template0)#ppp authentication chap l2tp

Device2(config-if-virtual-template0)#ppp authorization l2tp

Device2(config-if-virtual-template0)#ip unnumber loopback0

Device2(config-if-virtual-template0)#exit

Enable the VPDN. Create the VPDN group lns and configure it as the accept dial-in request mode. Use the application L2TP protocol and virtual-template0. Configure the shared key between the LAC and LNS as admin.

Device2(config)#vpdn enable

Device2(config)#vpdn-group lns

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol l2tp

Device2(config-vpdn-acc-in)#virtual-template 0

Device2(config-vpdn-acc-in)#exit

Device2(config-vpdn)#local name lns

Device2(config-vpdn)#l2tp tunnel password 0 admin

Device2(config-vpdn)#exit

l If it is not necessary to perform the tunnel authentication with LAC, run the no l2tp tunnel authentication command on the LNS to disable the authentication.

Step 5:

Check the result.

#View the information of interface fastcellular1 on Device1.

Device1#show interface fastcellular 1

Fastcellular1:

line protocol is up

Flags: (0xc208063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 64.19.245.249/30

Broadcast address: 64.19.245.251

Metric: 0, MTU: 1500, BW: 100000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.7ab8.d858 Last clearing of "show interface" counters never

input peak rate 596 bits/sec, 1 hour 58 minutes 8 seconds ago

output peak rate 715 bits/sec, 1 hour 58 minutes 8 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

618 packets received; 1807 packets sent

4 multicast packets received

29 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

Rate: auto Duplex: auto

rxframes 618, rx bytes 52160, rx arps 21

txframes 1807, tx bytes 308654, tx arps 25

rx errors 0, tx errors 0

It can be observed that the 4G interface dialing succeeds and the negotiated IP address is 64.19.245.249.

#View the L2TP information on Device2.

Device2#show vpdn detail

L2TP MaxTun 1000, MaxSes 1000:

tunnel free num: 999

TUNNELS:

LocID LocName RemID RemName RemAddr Vpdn Port Sess State

21 lns 63 GGSNCD01 119.6.10.116 lns 1701 1 ESTAB

session free num: 999

SESSIONS:

SESSIONS:

LocID TunID RemID IfName User SysId msi/calling-no State

79 21 4236 virtual-access2 admin - ESTAB

L2TP total Tunnel and Session Information. Tunnel 1 Session 1

It can be observed that the L2TP tunnel is successfully established between the operator LAC and Device2.

#The interface IP address of virtual-template0 on Device2 can be pinged through on Device1.

Device1#ping 172.16.10.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 172.16.10.1 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.


14.3.3 Configure L2TP Spontaneous Mode Combining 4G Public Network

Network Requirements

l Device1acts as the 4G client, Device1 as the LAC, and Device2 as the LNS. The LNS can visit the public network. Network-Center is the data center.

l Device1 dials in the operator through 4G. After connecting with Device2, Device1 builds the L2TP connection with Device2, realizing the communication between 4G client and Network-Center.

Network Topology

Figure 14‑5 Networking of configuring the L2TP spontaneous mode combining the 4G public network

Device | Interface | IP Address | Device | Interface | IP Address
Device2 | Gi0 | 171.217.50.205/24 | Device2 | Loopback0 | 100.0.0.1/32

Configuration Steps

Step 1: | Configure the IP addresses for all interfaces. (Omitted)
Step 2: | Configure the auto dialing of the 4G interface.

Device1#configure terminal

Device1(config)#interface fastcellular1

Device1(config-if-fastcellular1)#dialer mode auto

Device1(config-if-fastcellular1)#ip address dhcp

Device1(config-if-fastcellular1)#dialer config apn cdmptx.sc

Device1(config-if-fastcellular1)#exit

Configure one route to Device2, pointing to the 4G interface.

Device1(config)#ip route 171.217.50.205 255.255.255.255 fastcellular1

#Check the 4G interface information of Device1.

Device1#show interface fastcellular1

fastcellular1:

line protocol is up

Flags: (0xc0080f1) POINT-TO-POINT MULTICAST RUNNING

Type: PPP

Internet address: 10.159.125.38/32

Destination Internet address: 172.22.209.210

Metric: 0, MTU: 1500, BW: 384 Kbps, DLY: 100000 usec, VRF: global

Reliability 255/255, Txload 5/255, Rxload 1/255

Last clearing of "show interface" counters never

input peak rate 1035 bits/sec,  0 hour 2 minutes 35 seconds ago

output peak rate 10877 bits/sec,  0 hour 2 minutes 5 seconds ago

2 minutes 50 seconds input rate 0 bit/sec, 0 packet/sec

2 minutes 50 seconds output rate 9000 bits/sec, 10 packets/sec

37 packets received; 1898 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

LCP:OPENED

IPCP:OPENED

encap-type: simply PPP

Rx chars: 2538, Tx chars 209016

Rx overrun 0, Tx underrun 0

It can be observed that the 4G interface dialing succeeds and the negotiated IP address is 10.159.125.38.

#View the global routing table on Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

S   171.217.50.205/32 [1/26041] is directly connected, 00:02:19, fastcellular1

C   10.159.125.38/32 is directly connected, 00:02:19, fastcellular1

C   172.22.209.210/32 is directly connected, 00:02:19, fastcellular1

#The public network IP address on Device2 can be pinged through on Device1.

Device1#ping 171.217.50.205

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 171.217.50.205 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

Step 3:

Configure the LAC and client.

#Configure Device1.

Configure the pseudo-wire template name as l2tp-1, encapsulation protocol type as L2TPv2, key as admin, and local device name as lac. Use cellular1/0.

Device1(config)#pseudowire-class l2tp-1

Device1(config-pw-class)#encapsulation l2tpv2

Device1(config-pw-class)#password 0 admin

Device1(config-pw-class)#hostname lac

Device1(config-pw-class)#ip local interface cellular1/0

Device1(config-pw-class)#exit

Configure virtual PPP interface virtual-ppp0 and encapsulation the PPP protocol. Use the PAP authentication mode to send the user name as admin and password as admin. Use the pseudo-wire template l2tp-1 to build he L2TP tunnel with Device2.

Device1(config)#interface virtual-ppp0

Device1(config-if-virtual-ppp0)#encapsulation ppp

Device1(config-if-virtual-ppp0)#ip address negotiated

Device1(config-if-virtual-ppp0)#ppp pap sent-username admin password 0 admin

Device1(config-if-virtual-ppp0)#pseudowire 171.217.50.205 1 pw-class l2tp-1

Device1(config-if-virtual-ppp0)#exit

Configure the outbound interface of the default routing as virtual-ppp0.

Device1(config)#ip route 0.0.0.0 0.0.0.0 virtual-ppp0

Step 4:

Configure the LNS device.

#Configure Device2.

Configure the PPP-authenticated user name as admin and password as admin.

Device2#configure terminal

Device2(config)#user admin password 0 admin

Configure virtual-template 0 and use the PAP authentication mode.

Device2(config)#interface virtual-template 0

Device2(config-if-virtual-template0)#encapsulation ppp

Device2(config-if-virtual-template0)#ip unnumber loopback0

Device2(config-if-virtual-template0)#peer default ip address 100.0.0.2

Device2(config-if-virtual-template0)#ppp authentication pap

Device2(config-if-virtual-template0)#exit

Enable the VPDN. Create the VPDN group lns and configure it as the accept dial-in request mode. Use the application L2TP protocol and virtual-template0. Configure the shared key between the LAC and LNS as admin.

Device2(config)#vpdn enable

Device2(config)#vpdn-group lns

Device2(config-vpdn)#accept-dialin

Device2(config-vpdn-acc-in)#protocol l2tp

Device2(config-vpdn-acc-in)#virtual-template 0

Device2(config-vpdn-acc-in)#exit

Device2(config-vpdn)#local name lns

Device2(config-vpdn)#l2tp tunnel password 0 admin

Device2(config-vpdn)#exit

Step 5:

Check the result.

#View the information of interface virtual-ppp0 on Device1.

Device1#show interface virtual-ppp 0

virtual-ppp0:

line protocol is up

Flags: (0x80080f1) POINT-TO-POINT MULTICAST RUNNING

Type: PPP

Internet address: 100.0.0.2/24

Destination Internet address: 100.0.0.1

Metric: 0, MTU: 1500, BW: 64 Kbps, DLY: 20000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters never

input peak rate 649 bits/sec, 0 hour 1 minute 11 seconds ago

output peak rate 649 bits/sec, 0 hour 1 minute 11 seconds ago

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

59 packets received; 64 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

LCP:OPENED

IPCP:OPENED

encap-type: simply PPP

#View the L2TP information on Device1.

Device1#show vpdn detail

L2TP MaxTun 1024, MaxSes1024:

tunnel free num: 1023

TUNNELS:

LocID LocName RemID RemName RemAddr Vpdn Port Sess State

1 lac 33 lns 171.217.50.205 lns 1701 1 ESTAB

session free num: 599

SESSIONS:

LocID TunID RemID IfName User SysId Imsi/calling-no State

81 1 66 virtual-ppp0 admin - - ESTAB

L2TP total Tunnel and Session Information. Tunnel 1 Session 1

It can be observed that the L2TP tunnel between Device1 and Device2 is successfully established.

#The IP address of the interface virtual-template0 on Device2 can be pinged through on Device1.

Device1#ping 100.0.0.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 100.0.0.1 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.


15 L2TPv3


15.1 Overview

The L2TPv3 (Layer 2 Tunneling Protocol version 3) is the previous Cisco proprietary protocol of the UTI (Universal Transport Interface). The UTI aims to provide the IP-based tunnel technology mechanism of high performance for the connectivity of layer 2 similar to the circuit on the group-based core network. It is an application mode for the layer 2 VPN (Virtual Private Network) transmission technology.

The L2TPv3 is the extension of the layer 2 tunnel UTI by the IETF standard. To overcome the UTI restrictions, the L2TPv3 builds the UTI encapsulation format and combines with a large number of the optional signaling mechanism from the L2TPv2 control plane to provide the pseudo-wire connectivity. The basic L2TPv3 protocol is completed by the control channel signaling of the extended L2TPv2. The signaling supports other attributes which are transferred in the AVP (Attribute Value Pairs) message format.

The L2TPv3 control channel signaling operates on two stages: control connection establishment and session connection establishment. It uses three message exchanges to build the control connection. The following figure shows the tunnel establishment process.

Figure 15‑1 The L2TPv3 tunnel establishment process

l After the L2TPv3 node is defined on the PE (Provider Edge), the SCCRQ (Start Control Connection Request) message is sent to initiate the control channel to the PE and inform the performance supported by the local PE.

l The PE sends the SCCRP (Start Control Connection Reply) message to announce its performance settings. This message indicates that the control connection can continue.

l At last, the SCCCN (Start Control Connection Connected) message is the response message of the SCCRP message. The SCCCN message confirms that the SCCRP message is received and the control connection establishment is completed.

After the control co9nnection is established, the two nodes send the keep-alive message to detect the invalid node at a regular interval, which is called the keep-alive mechanism. Due to the overdue keep-alive timer or other key errors, use the StopCCN (Stop Control Connection Notification) message to release the control channel.

After the tunnel is established successfully, the independent L2TPv3 session can be established. The session negotiation uses the three-way handshake mechanism. The following figure shows the session establishment process.

Figure 15‑2 The L2TPv3 session establishment process

l When the junction circuit switches to the active state, the PE router sends CRQ (Incoming Call Request) message to exchange the parameter information of the session.

l When the remote PE receives the ICRQ message, the PE sends a ICRP (Incoming Call Reply) message to indicates that the ICRQ message is received.

l The ICCN (Incoming Call Connected) message is sent as the response message for receiving the ICRQ message.

Each pseudo-wire that needs to be dynamically established requires three-way handshake. To send the signaling of the single session state, any PE can send the SLI (Set Link Information) message to indicate the junction circuit state changes. When a node receives the message, the session and related resources must be released.


15.2 L2TPv3 Function Configuration

Table 15‑1 L2TPv3 function list

Configuration Task
Configure the L2TPv3 template | Configure the L2TPv3 basic template
 | Configure the L2TPv3 packet not allowing fragmentation
 | Configure the cookie
 | Configure the control connection authentication
 | Configure the timeout retransmission parameter
Enable the L2TPv3 function | Enable the dynamic L2TPv3 session
 | Enable the static L2TPv3 session


15.2.1 Configure L2TPv3 Template

Configuration Condition

None

Configure L2TPv3 Basic Template

The L2TPv3 template is the aggregation to save the tunnel and session related features, including the data encapsulation type, tunnel and session signaling protocol, source IP address, and other related attributes, such as authentication, fragmentation, and serial number mechanism.

Table 15‑2 Configure the L2TPv3 basic template

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the pseudo-wire template and enter the pseudo-wire configuration mode | pseudowire-class class-name | Mandatory By default, the pseudo-wire template is not created.
Configure the data encapsulation type | encapsulation l2tpv3 | Mandatory By default, the data encapsulation is not configured.
Configure the signaling protocol | protocol { l2tpv3 | none } | Optional By default, the static session mode (none) is used.
Associate the interface of the source IP address | ip local interface interface-name | Mandatory By default, the interface of the source IP address if not associated.

l When enabling the dynamic session, run the protocol { l2tpv3 | none } command to configure the L2TPv3 signaling protocol. The static session is configured as none.

Configure L2TPv3 Packet not Allowing Fragmentation

The IP packet, the encapsulated L2 packet by the L2TPv3, can be set to allow or mot allow the fragmentation in the introduced pseudo-wire template. By default, the packet is allowed to be fragmented.

Table 15‑3 Configure the L2TPv3 packet not allowing fragmentation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the pseudo-wire template configuration mode | pseudowire-class class-name | -
Configure the L2TPv3 packet not allowing fragmentation | ip dfbit set | Mandatory By default, the L2TPv3 packet is allowed to be fragmented.

Configure Cookie

The cookie filed is the optional field in the L2TPv3 protocol header. This field is extended and the value is random with a maximum of 64 bits. The cookie value further ensures that the received data is correctly associated with the local circuit based on the session ID. The randomly selected cookie can only prevent blind insertion attack. Like the session ID, the cookie value only can be used locally. During the session, the AVP local session ID and specified cookie are informed to the peer PE.

Table 15‑4 Configure the cookie

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the pseudo-wire template configuration mode | pseudowire-class class-name | -
Configure the cookie | cookie size { 4 | 8 } | Mandatory By default, the cookie is not configured.

Configure Control Connection Authentication

The L2TPv3 uses a simple and configurable CHAP in the control connection establishment process. If both ends or any end of the PE need authentication, then an AVP containing the CHAP message exist in the SCCRQ or SCCRP control packet. The end initiates the authentication will transmit data to the peer end randomly and the expected hashed value is calculated based on the random number and shared password on the local end. Upon receiving such type of authentication, the SCCRP or SCCCN control packet with the hashed value is sent to respond, respectively. If the responded hashed value does not match the expected hashed value, the tunnel cannot be established.

Table 15‑5 Configure the control connection authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the pseudo-wire template configuration mode | pseudowire-class class-name | -
Co9nfigure the host name | hostname host-name | Optional By default, the host name is used.
Enable the control connection authentication | authentication | Mandatory By default, the control connection authentication is not enabled.
Configure the authentication password | password 0 password | Mandatory By default, the authentication password is not configured.

Configure Timeout Retransmission Parameter

To ensure the reliable transmission of the protocol control packet, the L2TPv3 adopts the packet retransmission mechanism. The retransmission times and retransmission interval of the protocol control packet are set in the pseudo-wire template as required.

Table 15‑6 Configure the timeout retransmission parameter

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the pseudo-wire template configuration mode | pseudowire-class class-name | -
Configure the session connection establishment interval | retransmit initial timeout timeout-value | Optional By default, the timeout time for the session is 5s.
Configure the retransmission times of the tunnel connection establishment | retransmit initial retries retries-value | Optional By default, the retransmission times for the tunnel connection establishment request packet is 2.
Configure the retransmission times of the protocol packet | retransmit retries retry-value | Optional By default, the retransmission number of the control packet (except the tunnel connection establishment request packet) is 10.
Configure the timeout time of the protocol packet | retransmit timeout { max | min } timeout-value | Optional By default, the maximum timeout time and minimum timeout time for the control packet is 8s and 1s.


15.2.2 Enable L2TPv3 Function

Configuration Condition

Before enabling the L2TPv3 function, first complete the following task:

l Configure the L2TPv3 template to enable the normal communication between local pseudo-wire source IP address and the peer pseudo-wire source IP address.

Enable Dynamic L2TPv3 Session

The dynamic L2TPv3 session negotiated to establish the tunnel and session by the L2TPv3 protocol and negotiates the session-related attribute, including the session ID, cookie value, and pseudo-wire type. When the L2TPv3 function is enabled on the VLAN interface, if Ethernet without VLAN tag is required for the pseudo-wire type, choose the ethernet parameter option; if Ethernet with VLAN tag is required for the pseudo-wire type, choose the vlan parameter option or do not set the parameter. There are corresponding pseudo-wire types for other types of interfaces.

Table 15‑7 Enable the dynamic L2TPv3 session

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the dynamic L2TPv3 session | xconnect peer-ip-address vc-id pw-class pw-name [ vlan | ethernet ] | Mandatory By default, the dynamic L2TPv3 session on the interface is not enabled.

l When the L2TPv3 session is enable, a tunnel can be established between the source IP address and the destination IP address. Considering the simple and clear configuration, a destination can only configure a tunnel. Otherwise corresponding error message will be displayed.

l Only when the L2TPv3 function is enabled on the VLAN interface, the Ethernet or vlan parameter can be chose. The VLAN interface is the pseudo-wire of Ethernet with VLAN tag by default.

Enable Static L2TPv3 Session

Different from the dynamic session, the static session does not use the L2TPv3 protocol to negotiate the session establishment process or the session related attribute. For example, parameters such as the session ID and cookie value must be configured and ensured the correctness when the static session is enabled. That is, the session ID and cookie value at both ends are consistent.

Table 15‑8 Enable the static L2TPv3 session

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the static L2TPv3 session | xconnect peer-ip-address vc-id pw-class pw-name manual [ vlan | ethernet ] | Mandatory By default, the static L2TPv3 session is not enabled on the interface.
Configure the session ID at both ends | l2tp id local-id remote-id | Mandatory By default, the session ID is not configured for the static session.
Configure the session cookie at the local end | l2tp cookie local { 4 cookie-value | 8 low-cookie-value high-cookie-value } | Optional By default, the session cookie is not configured for the local end.
Configure the session cookie at the peer end | l2tp cookie remote { 4 cookie-value | 8 low-cookie-value high-cookie-value } | Optional By default, the session cookie is not configured for the peer end.


15.2.3 L2TPv3 Monitoring and Maintaining

Table 15‑9 The L2TPv3 monitoring and maintaining

Command | Description
clear l2tpv3 [ session vc-id | tunnel tunnel-id ] | Clear all sessions and tunnels and the specified tunnels and sessions
show l2tun detail | Display the detailed information of all the L2TPv3 session and tunnel
show l2tun session [ vc-id | all | brief | circuit | packets | sequence | state ] [ ip-addr ip-address [ vcid vc-id ] | tunnel { id tunnel-idsession-id | remote-name remote-namelocal-name } | vcid vc-id ] | Display the related information of the L2TPv3 session
show l2tun tunnel [ tunnel-id | all | packets | state | summary ] [ id tunnel-id | local-name local-name remote-name | remote-name remote-name local-name ] | Display the related information of the L2TPv3 tunnel


15.3 L2TPv3 Typical Configuration Example


15.3.1 Configure Dynamic Session Established over Exchange Interface

Network Requirements

l The OSPF is used for router advertisement between PE1 and PE2. The dynamic L2TPv3 session is established between PE1 and PE2, enabling the communication between CE1 and CE2.

l The IP addresses of CE1 and CE2 exist in the same network segment.

Network Topology

Figure 15‑3 Networking of configuring the dynamic session over the exchange interface

Configuration Steps

Step 1: | Configure the IP addresses for all interfaces. (Omitted)
Step 2: | Configure the OSPF to enable the routing between the loopback interfaces of PE1 and PE2 is reachable.

#Configure PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 10.0.0.201 0.0.0.0 area 0

PE1(config-ospf)#network 11.0.0.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#Configure P.

P#configure terminal

P(config)#router ospf 100

P(config-ospf)#network 11.0.0.0 0.0.0.255 area 0

P(config-ospf)#network 12.0.0.0 0.0.0.255 area 0

P(config-ospf)#exit

#Configure PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 10.0.0.203 0.0.0.0 area 0

PE2(config-ospf)#network 12.0.0.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#View the global routing table of PE1.

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 11.0.0.0/24 is directly connected, 00:19:49, vlan100

O 12.0.0.0/24 [110/2] via 11.0.0.1, 00:18:59, vlan100

C 127.0.0.0/8 is directly connected, 00:21:05, lo0

C 10.0.0.201/32 is directly connected, 00:19:55, loopback0

O 10.0.0.203/32 [110/3] via 11.0.0.1, 00:18:59, vlan100

It can be observed that PE1 has learnt the routing of Loopback0 to PE2.

l P and PE2 are viewed in the same way as PE1. The viewing process is omitted.

Step 3:

Configure L2TPv3.

#Configure PE1.

Configure the pseudo-wire template as l2tpv3-1 and encapsulated protocol type as L2TPv3. Use Loopback0.

PE1(config)#pseudowire-class l2tpv3-1

PE1(config-pw-class)#encapsulation l2tpv3

PE1(config-pw-class)#protocol l2tpv3

PE1(config-pw-class)#ip local interface loopback0

PE1(config-pw-class)#exit

Create VLAN2, configure the link type of the port gigabitethernet0/0 as Trunk, permit the servces of VLAN2 to pass, and PVID is configured as 2.

PE1(config)#vlan 2

PE1(config-vlan2)#exit

PE1(config)#interface gigabitethernet0/0

PE1(config-if-gigabitethernet0/0)#switchport mode trunk

PE1(config-if-gigabitethernet0/0)#switchport trunk allowed vlan add 2

PE1(config-if-gigabitethernet0/0)#switchport trunk pvid vlan 2

PE1(config-if-gigabitethernet0/0)#exit

On the interface VLAN2, configure L2TPv3, use the pseudo-wire template l2tpv3-1 to set up the L2TPv3 dyanmic session with PE2.

PE1(config)#interface vlan2

PE1(config-if-vlan2)#xconnect 10.0.0.203 370 pw-class l2tpv3-1

PE1(config-if-vlan2)#exit

#Configure PE2.

Configure the pseudo-wire template as l2tpv3-1 and encapsulated protocol type as L2TPv3. Use Loopback0.

PE2(config)#pseudowire-class l2tpv3-1

PE2(config-pw-class)#encapsulation l2tpv3

PE2(config-pw-class)#protocol l2tpv3

PE2(config-pw-class)#ip local interface loopback0

PE2(config-pw-class)#exit

Create VLAN2, configure the link type of the port gigabitethernet0/0 as Trunk, permit the servces of VLAN2 to pass, and PVID is configured as 2.

PE2(config)#vlan 2

PE2(config-vlan2)#exit

PE2(config)#interface gigabitethernet 0/0

PE2(config-if-gigabitethernet0/0)#switchport mode trunk

PE2(config-if-gigabitethernet0/0)#switchport trunk allowed vlan add 2

PE2(config-if-gigabitethernet0/0)#switchport trunk pvid vlan 2

PE2(config-if-gigabitethernet0/0)#exit

On the interface VLAN2, configure L2TPv3, use the pseudo-wire template l2tpv3-1 to set up the L2TPv3 dyanmic session with PE2.

PE2(config)#interface vlan2

PE2(config-if-vlan2)#xconnect 10.0.0.201 370 pw-class l2tpv3-1

PE2(config-if-vlan2)#exit

Step 4:

Check the result.

#View the L2TPv3 tunnel information of PE1.

PE1#show l2tun detail

L2TPv3 established Tunnel 1. established Session 1

L2TPv3 total Tunnel and Session Information. Tunnel 1 Session 1

TUNNELS:

LocID LocName RemID RemName RemAddr Port Sess State

20 PE1 50 PE2 10.0.0.203 0 1 ESTAB

SESSIONS:

LocID RemID TunID State Type Vcid Interface

1 1 20 ESTAB dynamic 370 vlan2

It can be observed that the L2TPv3 tunnel is successfully established between PE1 and PE2.

#View the L2TPv3 session information of PE1.

PE1#show l2tun session

L2TPv3 established Tunnel 1. established Session 1

L2TPv3 total Tunnel and Session Information. Tunnel 1 Session 1

Session id 1 is up, tunnel id 20

Call serial number is 24464

Remote tunnel

Internet address is 10.0.0.203

Local tunnel

Internet address is 10.0.0.201

Session is L2TP signaled

Session state is established, time since change 21:43:57

0 Packets sent, 0 Packets received

0 Bytes sent, 0 Bytes received

Session vcid is 370

Session Layer 2 circuit, type is Ethernet-Tagged-Mode, name is vlan2

Circuit state is UP

Remote session id is 1, remote tunnel id 50

DF bit off

Session cookie information:

FS cached header information:

encap size = 28 bytes

45000000 00004000 ff730000 0a0000cb 0a0000c9

00000437 00000000

decap size = 28 bytes

forward IF = 25

It can be observed that the dynamic L2TPv3 session is successfully established between PE1 and PE2.

l PE2 is viewed in the same way as PE1. The viewing process is omitted.

#On CE1, you can ping the VLAN2 interface address of CE2.

CE1#ping 3.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 3.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.


15.3.2 Configure Static Session over Exchange Interface

Network Requirements

l The OSPF is used for router advertisement between PE1 and PE2. The static L2TPv3 session is established between PE1 and PE2, enabling the communication between CE1 and CE2.

l The IP addresses of CE1 and CE2 exist in the same network segment.

Network Topology

Figure 15‑4Networking of configuring the static session established over the exchange interface

Configuration Steps

Step 1: | Configure the IP addresses for all interfaces. (Omitted)
Step 2: | Configure the OSPF to enable the routing between the loopback interfaces of PE1 and PE2 is reachable.

#Configure PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 10.0.0.201 0.0.0.0 area 0

PE1(config-ospf)#network 11.0.0.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#Configure P.

P#configure terminal

P(config)#router ospf 100

P(config-ospf)#network 11.0.0.0 0.0.0.255 area 0

P(config-ospf)#network 12.0.0.0 0.0.0.255 area 0

P(config-ospf)#exit

#Configure PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 10.0.0.203 0.0.0.0 area 0

PE2(config-ospf)#network 12.0.0.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#View the global routing table of PE1.

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 11.0.0.0/24 is directly connected, 00:19:49, gigabitethernet0

O 12.0.0.0/24 [110/2] via 11.0.0.1, 00:18:59, gigabitethernet0

C 127.0.0.0/8 is directly connected, 00:21:05, lo0

C 10.0.0.201/32 is directly connected, 00:19:55, loopback0

O 10.0.0.203/32 [110/3] via 11.0.0.1, 00:18:59, gigabitethernet0

It can be observed that PE1 has learnt the routing of Loopback0 to PE2.

l P and PE2 are viewed in the same way as PE1. The viewing process is omitted.

Step 3:

Configure L2TPv3.

#Configure PE1.

Configure the pseudo-wire template as l2tpv3-1 and the encapsulated protocol type as L2TPv3. Use Loopback0.

PE1(config)#pseudowire-class l2tpv3-1

PE1(config-pw-class)#encapsulation l2tpv3

PE1(config-pw-class)#protocol none

PE1(config-pw-class)#ip local interface loopback0

PE1(config-pw-class)#exit

Create VLAN2 and configure the link type of gigabitethernet0/0 as Trunk, permitting services of VLAN2 to pass. Configure the PVID as 2.

PE1(config)#vlan 2

PE1(config-vlan2)#exit

PE1(config)#interface gigabitethernet0/0

PE1(config-if-gigabitethernet0/0)#switchport mode trunk

PE1(config-if-gigabitethernet0/0)#switchport trunk allowed vlan add 2

PE1(config-if-gigabitethernet0/0)#switchport trunk pvid vlan 2

PE1(config-if-gigabitethernet0/0)#exit

Configure L2TPv3 on the VLAN 2 interface. Use the pseudo-wire template l2tpv3-1 to establish the static L2TPv3 session with PE2.

PE1(config)#interface vlan2

PE1(config-if-vlan2)#xconnect 10.0.0.203 370 pw-class l2tpv3-1 manual

PE1(config-if-xconn)#l2tp id 1 1

PE1(config-if-xconn)#l2tp cookie local 4 1111

PE1(config-if-xconn)#l2tp cookie remote 8 2222 2222

PE1(config-if-xconn)#exit

PE1(config-if-vlan2)#exit

#Configure PE2.

Configure the pseudo-wire template as l2tpv3-1 and the encapsulated protocol type as L2TPv3. Use Loopback0.

PE2(config)#pseudowire-class l2tpv3-1

PE2(config-pw-class)#encapsulation l2tpv3

PE2(config-pw-class)#protocol none

PE2(config-pw-class)#ip local interface loopback0

PE2(config-pw-class)#exit

Create VLAN2 and configure the link type of gigabitethernet0/0 as Trunk, permitting services of VLAN2 to pass. Configure the PVID as 2.

PE1(config)#vlan 2

PE1(config-vlan2)#exit

PE1(config)#interface gigabitethernet0/0

PE1(config-if-gigabitethernet0/0)#switchport mode trunk

PE1(config-if-gigabitethernet0/0)#switchport trunk allowed vlan add 2

PE1(config-if-gigabitethernet0/0)#switchport trunk pvid vlan 2

PE1(config-if-gigabitethernet0/0)#exit

Configure L2TPv3 on the VLAN2 interface. Use the pseudo-wire template l2tpv3-1 to establish the static L2TPv3 session with PE1.

PE2(config)#interface vlan2

PE2(config-if-vlan2)#xconnect 10.0.0.201 370 pw-class l2tpv3-1 manual

PE2(config-if-xconn)#l2tp id 1 1

PE2(config-if-xconn)#l2tp cookie remote 4 1111

PE2(config-if-xconn)#l2tp cookie local 8 2222 2222

PE2(config-if-xconn)#exit

PE2(config-if-vlan2)#exit

Step 4:

Check the result.

#View the L2TPv3 tunnel information of PE1.

PE1#show l2tun detail

L2TPv3 established Tunnel 0. established Session 1

L2TPv3 total Tunnel and Session Information. Tunnel 0 Session 1

TUNNELS:

LocID LocName RemID RemName RemAddr Port Sess State

NO TUNNELS

SESSIONS:

LocID RemID TunID State Type Vcid Interface

1 1 0 ESTAB manual 370 vlan2

It can be observed that the static L2TPv3session between PE1 and PE2 is successfully established.

#View the L2TPv3 session information of PE1.

PE1#show l2tun session

L2TPv3 established Tunnel 0. established Session 1

L2TPv3 total Tunnel and Session Information. Tunnel 0 Session 1

Session id 1 is up, tunnel id 0

Call serial number is 24464

Remote tunnel

Internet address is 10.0.0.203

Local tunnel

Internet address is 10.0.0.201

Session is manually signalled

Session state is established, time since change 21:43:57

0 Packets sent, 0 Packets received

0 Bytes sent, 0 Bytes received

Session vcid is 370

Session Layer 2 circuit, type is Ethernet-Tagged-Mode, name is vlan2

Circuit state is UP

Remote session id is 1, remote tunnel id 0

DF bit off

Session cookie information:

local cookie, size 4 bytes, value 1111

remote cookie, size 8 bytes, value 2222 2222

FS cached header information:

encap size = 36 bytes

45000000 00004000 ff730000 0a0000c9 0a0000cb

00000001 000008ae 000008ae 00000000

decap size = 32 bytes

forward IF = 7

It can be observed that the static L2TPv3 session between PE1 and PE2 is established successfully.

l PE2 is viewed in the same way as PE1. The viewing process is omitted.

#The IP address of the VLAN2 interface of CE2 can be pinged through on CE1.

CE1#ping 3.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 3.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.


15.3.3 Configure L2TPv3 over IPsec

Network Requirements

l The Gi1 interface of Device2 sets up the IPsec tunnel with the Gi1 interface of Device3.

l The Gi0 interface of Device2 sets up the L2TPv3 tunnel with the Gi0 interface of Device3.

l Configure the L2TPv3 over IPsec environment to realize that Device1 and Device4 can communicate with each other via the L2TPv3 tunnel, and the communication is protected by the IPsec tunnel.

Network Topology

Figure 15‑5 Networking of configuring L2TPv3 over IPsec

Configuration Steps

Step 1: | Configure the IP addresses for all interfaces. (Omitted)
Step 2: | Configure IPSEC.

#Configure Device2.

#On Device2, configure the IKE proposal ikepro, use the encryption algorithm aes256, authentication algorithm SHA1; configure the IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm aes256 and authentication algorithm SHA1.

Device2#configure terminal

Device2(config)#crypto ike key admin any

Device2(config)#crypto ike proposal ikepro

Device2(config-ike-prop)#encryption aes256

Device2(config)#crypto ipsec proposal ippro

Device2(config-ipsec-prop)#esp aes256 sha1

Device2(config-ipsec-prop)#exit

Device2(config)#crypto tunnel tun

Device2(config-tunnel)#local address 178.0.0.1

Device2(config-tunnel)#peer address 178.0.0.2

Device2(config-tunnel)#set authentication pre

Device2(config-tunnel)#set authentication preshared

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#set auto-up

Device2(config-tunnel)#exit

Device2(config)#crypto policy pol

Device2(config-policy)#flow host 178.0.0.1 host 178.0.0.2 ip tunnel tun

Device2(config-policy)#exit

#Configure Device3.

#On Device3, configure the IKE proposal ikepro, use the encryption algorithm aes256, authentication algorithm SHA1; configure the IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm aes256 and authentication algorithm SHA1.

Device3#configure terminal

Device3(config)#crypto ike key admin any

Device3(config)#crypto ike proposal ikepro

Device3(config-ike-prop)#encryption aes256

Device3(config-ike-prop)#exit

Device3(config)#crypto ipsec proposal ippro

Device3(config-ipsec-prop)#esp aes256 sha1

Device3(config-ipsec-prop)#exit

Device3(config)#crypto tunnel tun

Device3(config-tunnel)#local address 178.0.0.2

Device3(config-tunnel)#peer any

Device3(config-tunnel)#set authentication preshared

Device3(config-tunnel)#set ike proposal ikepro

Device3(config-tunnel)#set ipsec proposal ippro

Device3(config-tunnel)#set auto-up

Device3(config-tunnel)#exit

Device3(config)#crypto policy pol

Device3(config-policy)#flow host 178.0.0.2 host 178.0.0.1 ip tunnel tun

Device3(config-policy)#exit

#On Device2, view the tunnel setup information.

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

8 STATE_QUICK_I2 178.0.0.1 178.0.0.2 178.0.0.2

5 STATE_MAIN_I4 178.0.0.1 178.0.0.2 178.0.0.2

Device2#show crypto ipsec sa

policy name : pol

f (src, dst, protocol, src port, dst port) : 178.0.0.1/32 178.0.0.2/32 ip any any

local tunnel endpoint : 178.0.0.1 remote tunnel endpoint : 178.0.0.2

the pairs of ESP ipsec sa : id : 8, algorithm : AES256 HMAC-SHA1-96

inbound esp ipsec sa : spi : 0x61e9859f(1642694047) crypto m_context(s_context) : 0x977f8b0 / 0x15e17368

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 27663/4294967295

uptime is 0 hour 18 minute 57 second

outbound esp ipsec sa : spi : 0x8a864d3e(2324057406) crypto m_context(s_context) : 0x977fb20 / 0x977f570

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 27663/4294967295

uptime is 0 hour 18 minute 57 second

total sa and sa group is 1

You can see that Device2 and Device3 set up the Ipsec tunnel successfully.

l The method of Device3 viewing whether the IP sec tunnel is set up successfully is the same as Device2, so the viewing process is omitted here.

Step 3:

Configure L2TPv3.

#Configure Device2.

Configure the pseudo wire template l2tpv3-1, and the encrypted protocol type is L2TPv3.

Device2(config)#pseudowire-class l2tpv3-1

Device2(config-pw-class)#encapsulation l2tpv3

Device2(config-pw-class)#protocol l2tpv3

Device2(config-pw-class)#ip local interface vlan100

Device2(config-pw-class)#exit

On the vlan interface, configure L2TPv3, use the pseudo wire template l2tpv3-1 to set up the L2TPv3 dynamic session with Device3.

Device2(config)#interface vlan200

Device2(config-if-vlan200)#xconnect 178.0.0.2 1 pw-class l2tpv3-1

Device2(config-if-vlan200)#exit

#Configure Device3.

Configure the pseudo wire template l2tpv3-1, and the encrypted protocol type is L2TPv3.

Device3(config)# pseudowire-class l2tpv3-1

Device3(config-pw-class)#protocol l2tpv3

Device3(config-pw-class)#ip local interface gigabitethernet 1

Device3(config-pw-class)#exit

On the Ethernet interface, configure L2TPv3, use the pseudo wire template l2tpv3-1 to set up the L2TPv3 dynamic session with Device3.

Device3(config)#interface gigabitethernet 0

Device3(config-if-gigabitethernet0)#xconnect 178.0.0.1 1 pw-class l2tpv3-1

Device3(config-if-gigabitethernet0)exit

#On Device2, view the L2TPV3 tunnel setup information.

Device2#show l2tun detail

L2TPv3 established Tunnel 1. established Session 1

L2TPv3 total Tunnel and Session Information. Tunnel 1 Session 1

TUNNELS:

LocID LocName RemID RemName RemAddr Port Sess State

58 Device2 94 Device3 178.0.0.2 0 1 ESTAB

SESSIONS:

LocID RemID TunID State Type Vcid Interface

1095 1100 58 ESTAB dynamic 1 vlan100

Device2#show l2tun session

L2TPv3 established Tunnel 1. established Session 1

L2TPv3 total Tunnel and Session Information. Tunnel 1 Session 1

Session id 1095 is up, tunnel id 58 *

Call serial number is 2536

Remote tunnel name is Device3

Internet address is 178.0.0.2

Local tunnel name is Device2

Internet Address is 178.0.0.1

Session is L2TP signaled

Session state is established, time since change 00:08:56

0 Packets sent, 0 Packets received

0 Bytes sent, 0 Bytes received

Session vcid is 1

Session Layer 2 circuit, type is Ethernet, name is gigabitethernet0

Circuit state is UP

Remote session id is 1100, remote tunnel id 94

DF bit off

Session cookie information:

FS cached header information:

encap size = 24 bytes

45000000 00000000 ff730000 b2000001 b2000002

0000044c

decap size = 24 bytes

forward IF = 4

You can see that Device2 and Device3 set up the L2TPv3 dynamic session successfully.

l The method of Device3 viewing whether the L2TPv3 tunnel is set up successfully is the same as Device2, so the viewing process is omitted here.

Step 4:

Check the result.

#On Device1, you can ping the interface address of Device4.

Device1#ping 196.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 196.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.


1.1 Overview

After a device receives a packet through an interface, the device selects a route according to the destination of the route and then forwards the packet to another interface. This process is called routing. In network devices, routes are stored in a routing table database. The packets search the routing table to determine the next hop and output interface according to the destination of the packets. Routes are categorized into three types according to their sources.

l Direct route: The route is generated based on the interface address. After a user configures the IP address of an interface, the device generates a direct route of the network segment according to the IP address and mask.

l Static route: The route is manually configured by the user.

l Dynamic route: The route is discovered through the dynamic route discovery protocol. Based on whether the dynamic routing protocol is used within an autonomous domain, two types of dynamic routing protocols are available: Interior Gateway Protocol (IGP) and Exterior Gateway Protocol (EGP). Here an autonomous domain refers to a network which has a unified management organization and unified routing policy. A routing protocol that is used within an autonomous domain is an IGP. Common IGPs include Routing Information Protocol (RIP) and Open Shortest Path First (OSPF). EGPs are usually used for routing among multiple autonomous domains. A common EGP is BGP.

Routing supports load balancing, that is, multiple routes to the same destination. In forwarding packets, a device transmits packets in load balancing mode according to the routing table search result.


1.2 Routing Basic Function Configuration

Table 1‑1 Routing basic function list

Configuration Tasks
Configure load balancing for routing. | Configure the maximum number of load balancing entries.
 | Configure the common ID for the load balancing.
 | Configure the calculation method for the load balancing.
Configure the capacity of routes for Virtual Route Forwarding (VRF) routes. | Configure the capacity of VRF routes.


1.2.1 Configure Load Balancing for Routing

Configuration Condition

None

Configure the Maximum Number of Load Balancing Entries

If the costs of several paths to one destination are the same, the paths form load balancing. Configuring the maximum number of load balancing entries helps to improve the link utility rate and reduce the load of links.

Table 1‑2 Configuring the maximum number of load balancing entries

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the maximum number of load balancing entries. | route path-limit max-number | Optional. By default, the maximum number of load balancing entries for routing is 6.

Configure Common ID for Load Balancing

When the load balancing calculation method based on the source IP address and destination IP address is used, if each node uses the same algorithm, the packet will choose a fixed path. To avoid such situation, the common ID is introduced based on the source IP address and destination IP address to ensure different algorithms for nodes.

Table 1‑3 Configure the common ID for the load balancing

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the common ID for the load balancing | ip load-sharing algorithm universal universal-id | Optional By default, the ID is allocated in random.

Configure Calculation Method for Load Balancing

The load balancing has the following three calculation methods:

l Calculation method based on the source and destination IP address: The source IP address and destination IP address are used to identify a flow. Packets on the same flow choose the same path without disorder. When the load on the flow is unbalanced, the load on the line is unbalanced.

l Calculation method based on the source IP address: Only the source IP address is used to identify a flow. Packets on the same flow choose the same path without disorder. When the flow load is unbalanced, load on the line may be unbalanced.

l Calculation method based on packets: Packets to the same destination IP address choose different paths, attempting to realize load balancing on paths. However, the packet disorder may occur.

Table 1‑4 Configure the calculation method for the load balancing

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the load balancing for packets | ip load-sharing { per-destination | per-packet | per-source } | Optional By default, the calculation method based on the source IP address and destination IP address is used.


1.2.2 Configure Capacity of VRF Routes

Configuration Condition

None

Configure the Capacity of VRF Routes

To ensure normal use of devices and prevents a large number of routes from consuming too many resources, you can use the routing-table limit command to limit the capacity of routes for each Virtual Route Forwarding (VRF). When the capacity of routes reaches the threshold, an alarm is generated.

Table 1‑5 Configure the capacity of VRF routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the VRF configuration mode. | ip vrf vrf-name | -
Configure the capacity of VRF routes. | routing-table limit limit-value { threshold-value | syslog-alert } | Optional. By default, the capacity for routes is 50000. When the number of routes reaches 80% of the total capacity, alarm information is printed.

l This command cannot limit the capacity of routes for global VRF.

l If the number of routing entries exceeds the threshold, new routing information gets lost.

l For VRF-related configuration, refer to the MPLS L3VPN chapter of the configuration manual.


1.2.3 Routing Basics Monitoring and Maintaining

Table 1‑6 Routing basics monitoring and maintaining

Command | Description
clear ip route [ vrf vrf-name ] { ip-address mask | all } | Clears the specified IP route in the routing table.
show ip route [ vrf vrf-name ] [ bgp | connected | irmp | isis | ospf | rip | static | statistic [ all ] | ip-address { mask | mask-len } ] | Display IP route information.
show route-path limit | Display the maximum number of load balancing paths


2 Static Routes


2.1 Overview

A static route is a self-defined route which is manually configured by a user. It specifies a path for transmitting IP packets which are targeted at a specified destination.

Compared with dynamic routing, static routing has higher security and lower device resource occupancy. The disadvantage is that when the network topology changes, manual configuration is required, and there is no automatic re-configuration mechanism.

Static routes do not occupy line bandwidth or occupy CPU to calculate and advertise routes periodically, improving the device and network performance.

Static routes can be used to ensure the security of a small-scale network, for example, in a network where there is only one path connecting to an external network. In a large-scale network, static routes can implement security control on services or links of certain types. A majority of networks adopt dynamic routing protocols but you can still configure some static routes for special purposes.

Static routes can be re-distributed to a dynamic routing protocol, but dynamic routes cannot be re-distributed to static routes. Note that improper static route configuration may cause routing loops.

The default route is a special route which can be a static route. In a routing table, the default route is a route to network 0.0.0.0 with the mask 0.0.0.0. You can use the show ip route command to check whether the route is valid. When the destination address of a received packet does not match any entry in the routing table, the packet takes the default route. If no default route is available and the destination is not in the routing table, the packet is discarded, and an ICMP packet is returned to the source end reporting that the destination address or network is not reachable. To prevent the routing table from becoming too large, you can set a default route. The packet that fails to find a matching routing table entry takes the default route for forwarding.

Null0 is a special route, with the route output interface as the Null0 interface. The Null0 interface is always in the UP status but it cannot forward packets. The packets that are sent to the interface will be discarded. If you configure a static route and specify the output interface for a certain network segment to Null0, the packets that are sent to the network segment will be discarded. Therefore, you can configure realize packet filtration by configuring Null0 static routes.


2.2 Static Routing Function Configuration

Table 2‑1 Static route configuration function list

Configuration Tasks
Configure a static route. | Configure a static route.
Configure the default administrative distance. | Configure the default administrative distance.
Configure the recursive function. | Configure the recursive function.
Configure load balancing routes. | Configure load balancing routes.
Configure a floating route. | Configure a floating route.
Configure a static route to coordinate with BFD. | Configure a static route to coordinate with BFD.
Configure a static route to coordinate with Track. | Configure a static route to coordinate with Track.


2.2.1 Configure Static Route

Configuration Condition

Before configuring a static route, ensure that:

l The link layer protocol has been configured to ensure normal communication at the link layer.

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

Configure a Static Route

According to the parameters that have been specified, static routes are categorized into the following three types:

l Interface route: For an interface route, only the output interface is specified.

l Gateway route: For a gateway route, only the gateway address is specified.

l Interface gateway route: For an interface gateway route, both the output interface and the gateway address are specified.

Configured static routes become invalid if some of the following conditions are met:

1) The destination address is the local interface address.

2) The destination address is the network of the local direct interface.

3) The administrative distance of the route is 255.

4) The output interface of the route is DOWN.

5) No IP address has been configured for the output interface of the route.

6) The gateway address is not reachable.

7) The output interface and the gateway of the route conflict.

8) The output interface of the route does not exist.

9) The TRACK object that is associated with the route is "fake".

10) The status of the Bidirectional Forwarding Detection (BFD) session that is associated with the route is DOWN.

If an interface route meets any one condition among 1, 2, 3, 4, 5, 9, and 10, the route is invalid. If a gateway route meets any one condition among 1, 2, 3, 4, 6, 8, 9, and 10, the route is invalid. If an interface gateway route meets any of the above conditions, the route is invalid.

Table 2‑2 Configuring a static route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a static route. | ip route [ vrf vrf-name1] destination-ip-address destination-mask { interface-name / [ nexthop-ip-address [ vrf vrf-name2 ] ] } [ name nexthop-name ] [ tag tag-value ] [ track track-id ] [ administrative-distance ] | Mandatory By default, the static IPv4 routing is not configured. The field administrative-distance is the administrative distance of the static route. If it is not specified, the default administrative distance is used.

l For a default route, the destination network and mask must be set to 0.0.0.0.

l The output interface of the Null0 route is Null0.

l The output interface of the Null0 interface need not be configured with an IP address.


2.2.2 Configure Default Administrative Distance

Configuration Condition

None

Configure Default Administrative Distance

The smaller the administrative distance that is specified for a static route in configuring the static route is, the higher the priority of the route is. If the administrative distance is not specified, the default administrative distance is used. You can modify the default administrative distance dynamically. After the default administrative distance is re-configured, the new default administrative distance is valid only for new static routes.

Table 2‑3 Configuring the default administrative distance

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enters the static route configuration mode. | router static | -
Configure the default administrative distance. | distance administration-distance | Optional. The default value of the default administrative distance is 1.

l When you use the ip route command to configure a static route, you can specify an independent administrative distance for the route. If you do not specify the administrative distance, the default administrative distance is used.


2.2.3 Configure Recursive Function

Configuration Condition

None

Configure Recursive Function

If the gateway address that is configured for a route is valid only when a route to the gateway is reachable, you must enable the recursive function of the static route to validate the route. By default, the recursive function is enabled for a static route.

Table 2‑4 Configure the recursive function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enters the static route configuration mode. | router static | -
Configure a static route to support the recursive function. | recursion | Optional. By default, the recursive function is enabled for the static routing and the routing can only have a three-level recursion.


2.2.4 Configure Load Balancing Routes

Configuration Condition

None

Configure Load Balancing Routes

Load balancing routes means that multiple routes are configured to the same destination network. The output interfaces and the gateway addresses of the routes are different, but the administrative distances (priorities) of the routes are the same. Load balancing routes help to improve the link utility rate.

Table 2‑5 Configuring load balancing routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the first load balancing route. | ip route destination-ip-address destination-mask interface-name1 distance | Mandatory By default, the load balancing route is not configured. The output interface is interface-name1.
Configure the second load balancing route. | ip route destination-ip-address destination-mask interface-name2 distance | Mandatory. By default, the load balancing route is not configured. The output interface is interface-name2.

l In configuring load balancing routes, you must configure the values of distance for the routes to the same.


2.2.5 Configure Floating Route

Configuration Condition

None

Configure a Floating Route

Multiple routes are available to the same destination network. The output interfaces or gateway addresses of the routes are different, and the priorities of the routes are also different. The route with the higher priority becomes the primary route while the route with the lower priority becomes the floating route. In the routing table, only the primary route is visible. The floating table appears in the routing table only when the primary route becomes invalid. Therefore, the floating route is usually used as a backup route.

Table 2‑6 Configuring a floating route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure the primary route. | ip route destination-ip-address destination-mask interface-name1 distance1 | Mandatory. By default, the primary route is not configured. The output interface of the primary route is interface-name1 and the priority of the route is distance1.
Configure the floating route. | ip route destination-ip-address destination-mask interface-name2 distance2 | Mandatory. By default, the floating route is not configured. The output interface of the floating route is interface-name2, the priority is distance2. The value of distance2 must be larger than the value of distance1.

l In configuring the priorities of the routes, not that the smaller the distance value is, the higher the priority is.


2.2.6 Configure Static Route to Coordinate with BFD

Configuration Condition

None

Configure a Static Route to Coordinate with BFD

The Bidirectional Forwarding Detection (BFD) protocol provides a method for detecting the connectivity of the forwarding path between two adjacent routers with light load. A protocol neighbor can quickly detect the connectivity fault of a forwarding path. Different from other dynamic protocol routes, static routes cannot learn communication link failures. BFD provides a method for quickly detecting communication link failures for static routes. After a static route is configured to coordinate with BFD, fast switchover of routes can be implemented. Currently, a static route only supports the asynchronous BFD detection mode. Therefore, you need to configure the route to coordinate with BFD on the devices at the two end of the link.

If the status of BFD that is coordinated with the static route is DOWN, the static route becomes invalid.

Table 2‑7 Configuring a static route to coordinate with BFD

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a static route. | ip route destination-ip-address destination-mask interface-name nexthop-ip-address | Mandatory. By default, the static route is not configured. Only the static route with both output interface and gateway address specified can coordinate with BFD.
Configure the output interface and the next-hop address for the route that is coordinated with BFD. | ip route static bfd interface-name nexthop-ip-address | Mandatory. By default, the static route is not configured to coordinate with BFD. The field nexthop-ip-address specifies the directly connected next-hop address.

l For introduction of BFD and how to configure its basic functions, refer to the BFD chapter in the configuration manual.


2.2.7 Configure Static Route to Coordinate with Track

Configuration Condition

None

Configure a Static Route to Coordinate with Track

Some modules in the system need to monitor some system information and then determine their working modes based on the information. The objects that are monitored by the other modules are called monitoring objects. To simplify the relations between the modules and monitoring objects, Track objects are used. A Track object can contain multiple monitoring objects, and it displays the comprehensive status of the monitoring object to external modules. The external modules are associated only with Track objects and they do not care about monitoring objects contained in the Track objects any more. A Track object has two statuses, "true" and "false". The external modules that are associated with the Track object determine its working modes according to the Track object status.

A static route can associate with a Track object to monitor system information and determine whether the route is valid according to the status reported by the Track object. If the Track object reports "true", the conditions required by the static route are satisfied, and the route is added to the routing table. If the Track object reports "false", the route is deleted from the routing table.

Table 2‑8 Configuring a static route to coordinate with track

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Create a Track object and enter the configuration mode of the Track object. | track track-id | Mandatory
Configure the track object to monitor the link status of the specified interface. | interface interface-name line-protocol | Optional By default, the track object is not configured to monitor the link status of the specified interface.
Return to the global configuration mode. | Exit | -
Configure a static route and associate it with the Track object. | ip route destination-ip-address destination-mask interface-name track track-id | Mandatory By default, the static route is not configured. When the link layer of the monitoring interface is UP, the route is valid; otherwise, the route is invalid.


2.2.8 Static Route Monitoring and Maintaining

Table 2‑9 Static route monitoring and maintaining

Command | Description
show ip route [ vrf vrf-name ] static | Display the static routes in the routing table.
show running-config ip route | Display the configuration information about static routes.


2.3 Typical Configuration Example of Static Routes


2.3.1 Configure Static Routing Basic Functions

Network Requirement

l On Device1, Device2 and Device3, configure static routes so that PC1 and PC2 can communicate with each other.

Network Topology

Figure 2‑1 Networking for configuring static routing basic functions

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure static routes.

#Configure Device1.

Device1#configure terminal

Device1(config)#ip route 20.1.1.0 255.255.255.0 10.1.1.2

Device1(config)#ip route 100.1.1.0 255.255.255.0 10.1.1.2

#Configure Device2.

Device2#configure terminal

Device2(config)#ip route 110.1.1.0 255.255.255.0 10.1.1.1

Device2(config)#ip route 100.1.1.0 255.255.255.0 20.1.1.2

#Configure Device3.

Device3#configure terminal

Device3(config)#ip route 0.0.0.0 0.0.0.0 20.1.1.1

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:06:47, vlan1001

S 20.1.1.0/24 [1/10] via 10.1.1.2, 00:00:13, vlan1001

S 100.1.1.0/24 [1/10] via 10.1.1.2, 00:00:05, vlan1001

C 110.1.1.0/24 is directly connected, 00:08:21, vlan1000

C 127.0.0.0/8 is directly connected, 28:48:33, lo0

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:00:37, vlan1000

C 20.1.1.0/24 is directly connected, 00:00:27, vlan1001

S 100.1.1.0/24 [1/10] via 20.1.1.2, 00:00:05, vlan1001

S 110.1.1.0/24 [1/10] via 10.1.1.1, 00:00:13, vlan1000

C 127.0.0.0/8 is directly connected, 30:13:18, lo0

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 20.1.1.1 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 20.1.1.1, 00:00:07, vlan1000

C 20.1.1.0/24 is directly connected, 00:00:08, vlan1000

C 100.1.1.0/24 is directly connected, 00:00:13, vlan1001

C 127.0.0.0/8 is directly connected, 29:17:19, lo0

Step 3:

Check the result. Use the ping command to verify the connectivity between PC1 and PC2

#On PC1, use the ping command to check the connectivity.

C:\Documents and Settings\Administrator>ping 100.1.1.2

Pinging 100.1.1.2 with 32 bytes of data:

Reply from 100.1.1.2: bytes=32 time<1ms TTL=125

Reply from 100.1.1.2: bytes=32 time<1ms TTL=125

Reply from 100.1.1.2: bytes=32 time<1ms TTL=125

Reply from 100.1.1.2: bytes=32 time<1ms TTL=125

Ping statistics for 100.1.1.2:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

PC1 and PC2 can communicate with each other.


2.3.2 Configure Floating Static Route

Network Requirements

l On Device1, configure two static routes to reach network segment 192.168.1.0/24. One route passes Device2, and the other route passes Device3.

l Device1 first uses the route between Device1 and Device2 to forward packets. If the link is faulty, Device1 switches over to the route between Device1 and Device3 for communication.

Network Topology

Figure 2‑2 Networking for configuring a floating static route

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure static routes.

#On Device1, configure two routes to network segment 192.168.1.0/24 through Device2 and Device3.

Device1#configure terminal

Device1(config)#ip route 192.168.1.0 255.255.255.0 10.1.1.2

Device1(config)#ip route 192.168.1.0 255.255.255.0 20.1.1.2

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 02:16:43, vlan1000

C 20.1.1.0/24 is directly connected, 03:04:15, vlan1001

C 127.0.0.0/8 is directly connected, 14:53:00, lo0

S 192.168.1.0/24 [1/10] via 10.1.1.2, 00:00:05, vlan1000

[1/10] via 20.1.1.2, 00:00:02, vlan1001

According to the routing tables, two routes from Device1 to network segment 192.168.1.0/24 are reachable, and the route form load balancing.

Step 3:

Configure a floating route.

#Configure Device1. Modify the administrative range of the route with the gateway address 20.1.1.2 to 15 so that the route becomes a floating route.

Device1(config)#ip route 192.168.1.0 255.255.255.0 20.1.1.2 15

Step 4:

Check the result.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 02:28:25, vlan1000

C 20.1.1.0/24 is directly connected, 03:15:58, vlan1001

C 127.0.0.0/8 is directly connected, 15:04:42, lo0

S 192.168.1.0/24 [1/10] via 10.1.1.2, 00:11:47, vlan1000

According to the routing table, because the route with the administrative range 1 has a higher priority than the route with the administrative range 15, the route with the gateway 20.1.1.2 is deleted.

#After the route between Device1 and Device2 becomes faulty, query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 20.1.1.0/24 is directly connected, 03:23:44, vlan1001

C 127.0.0.0/8 is directly connected, 15:12:28, lo0

S 192.168.1.0/24 [15/10] via 20.1.1.2, 00:00:02, vlan1001

According to the routing table, the route with a larger administrative range has been added to the routing table to forward packets through Device3.

l The most significant feature of the floating static route is that it acts as a backup route.


2.3.3 Configure Static Route with the Null0 Interface

Network Requirements

l On Device1 and Device2, configure a default static route respectively, and configure the gateway addresses to the peer interface addresses of the two devices. On Device1, configure a static with the Null0 interface to filter only data that is sent to PC2.

Network Topology

Figure 2‑3 Networking for configuring a static route with the null0 interface

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure static routes.

#Configure Device1.

Device1#configure terminal

Device1(config)#ip route 0.0.0.0 0.0.0.0 50.1.1.2

#Configure Device2.

Device2#configure terminal

Device2(config)#ip route 0.0.0.0 0.0.0.0 50.1.1.1

#On PC1, use the ping command to check the connectivity with PC2.

C:\Documents and Settings\Administrator>ping 100.1.1.2

Pinging 100.1.1.2 with 32 bytes of data:

Reply from 100.1.1.2: bytes=32 time<1ms TTL=126

Reply from 100.1.1.2: bytes=32 time<1ms TTL=126

Reply from 100.1.1.2: bytes=32 time<1ms TTL=126

Reply from 100.1.1.2: bytes=32 time<1ms TTL=126

Ping statistics for 100.1.1.2:

Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

Minimum = 0ms, Maximum = 0ms, Average = 0ms

Step 3:

Configure a static route with the Null0 interface.

#Configure Device1.

Device1(config)#ip route 100.1.1.2 255.255.255.255 null0

Step 4:

Check the result.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 50.1.1.2 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 50.1.1.2, 00:07:28, vlan1000

C 50.1.1.0/24 is directly connected, 00:07:34, vlan1000

C 110.1.1.0/24 is directly connected, 00:00:08, vlan1001

C 127.0.0.0/8 is directly connected, 11:46:35, lo0

S 100.1.1.2/32 [1/1] is directly connected, 00:02:31, null0

In the routing table, the static route with the Null0 interface has been added.

#On PC1, use the ping command to check the connectivity with PC2.

C:\Documents and Settings\Administrator>ping 100.1.1.2

Pinging 100.1.1.2 with 32 bytes of data:

Request timed out.

Request timed out.

Request timed out.

Request timed out.

Ping statistics for 100.1.1.2:

Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

The ICMP packets sent by PC1 are found to be targeted at interface Null0 according to the routing table in Device1; therefore, the packets are discarded. In this way, PC1 fails to communicate with PC2.

l A static route with the Null0 interface is a special route. The packets sent to the Null0 interface will be discarded. Therefore, configuring a route with the Null0 interface implements packet filtration.


2.3.4 Configure Static Recursive Route

Network Requirements

l On Device1, configure two static routes to reach network segment 192.168.1.1/32. One route passes Device2, and the other passes Device3. Device1 first uses the route that passes Device3 to forward packets.

l On Device1, configure a static recursive route to reach network segment 200.0.0.0/24, with the gateway address being the loopback interface address 192.168.1.1 of Device3. After the route between Device1 and Device3 is faulty, Device1 switches to the route that passes Device2 for communication.

Network Topology

Figure 2‑4 Networking for configuring a static recursive static route

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure static routes.

#Configure Device1.

Device1#configure terminal

Device1(config)#ip route 192.168.1.1 255.255.255.255 10.1.1.2

Device1(config)#ip route 192.168.1.1 255.255.255.255 20.1.1.2 10

#Configure Device2.

Device2#configure terminal

Device2(config)#ip route 192.168.1.1 255.255.255.255 30.1.1.2

Step 3:

Configure a static recursive route.

#Configure Device1.

Device1(config)#ip route 200.0.0.0 255.255.255.0 192.168.1.1

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:04:07, vlan1000

C 20.1.1.0/24 is directly connected, 00:03:58, vlan1001

C 127.0.0.0/8 is directly connected, 73:10:12, lo0

S 200.0.0.0/24 [1/10] via 192.168.1.1, 00:00:08, vlan1000

S 192.168.1.1/32 [1/10] via 10.1.1.2, 00:01:46, vlan1000

According to the routing table, the gateway address of the route to 200.0.0.0/24 is 192.168.1.1, the output interface is vlan1000, and the route relies on the route to 192.168.1.1/32.

Step 4:

Check the result.

#After the route between Device1 and Device3 becomes faulty, query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 20.1.1.0/24 is directly connected, 00:09:04, vlan1001

C 127.0.0.0/8 is directly connected, 73:15:18, lo0

S 200.0.0.0/24 [1/10] via 192.168.1.1, 00:00:02, vlan1001

S 192.168.1.1/32 [10/10] via 20.1.1.2, 00:00:02, vlan1001

Comparing the routing table information with the routing table information in Step 3, the output interface has changed to vlan1001, indicating that the route has been switched to the route to Device2.


2.3.5 Configure Static Route to Coordinate with BFD

Network Requirements

l On Device1, configure two static routes to network segment 201.0.0.0/24. One route passes Device2 while the other route passes Route3. Device first uses the route that passes Device 3 to forward packets. Similarly, on Device3, configure two static routes to network segment 200.0.0.0/24. Device3 first uses the route that passes Device1 to forward packets.

l On Device1 and Device3, configure static routes to coordinate with BFD. When the route between Device1 and Device3 is faulty, they can quickly switch over to the route that passes Device2.

Network Topology

Figure 2‑5 Networking for configuring a static route to coordinate with BFD

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure static routes.

#On Device1, configure two static routes to network segment 201.0.0.0/24.

Device1#configure terminal

Device1(config)#ip route 201.0.0.0 255.255.255.0 vlan1000 10.1.1.2

Device1(config)#ip route 201.0.0.0 255.255.255.0 vlan1001 20.1.1.2 10

#On Device2, configure two static routes to network segments 200.0.0.0/24 and 201.0.0.0/24 respectively.

Device2#configure terminal

Device2(config)#ip route 200.0.0.0 255.255.255.0 20.1.1.1

Device2(config)#ip route 201.0.0.0 255.255.255.0 30.1.1.2

#On Device3, configure two static routes to network segment 200.0.0.0/24.

Device3#configure terminal

Device3(config)#ip route 200.0.0.0 255.255.255.0 vlan1000 10.1.1.1

Device3(config)#ip route 200.0.0.0 255.255.255.0 vlan1001 30.1.1.1 10

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:07:41, vlan1000

C 20.1.1.0/24 is directly connected, 00:07:29, vlan1001

C 127.0.0.0/8 is directly connected, 101:56:14, lo0

C 200.0.0.0/24 is directly connected, 00:15:33, gigabitethernet2

S 201.0.0.0/24 [1/10] via 10.1.1.2, 00:02:23, vlan1000

#Query the routing table of Device3.

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:10:21, vlan1000

C 30.1.1.0/24 is directly connected, 00:10:09, vlan1001

C 127.0.0.0/8 is directly connected, 126:44:08, lo0

S 200.0.0.0/24 [1/10] via 10.1.1.1, 00:06:12, vlan1000

C 201.0.0.0/24 is directly connected, 00:20:37, gigabitethernet2

Step 3:

Configure a static route to coordinate with BFD.

#Configure Device1.

Device1(config)#ip route static bfd vlan1000 10.1.1.2

#Configure Device3.

Device3(config)#ip route static bfd vlan1000 10.1.1.1

Step 4:

Check the result.

#Query the BFD session of Device1.

Device1#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

10.1.1.1 10.1.1.2 15/22 UP 5000 vlan1000

#Query the BFD session of Device3.

Device3#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

10.1.1.2 10.1.1.1 22/15 UP 5000 vlan1000

The BFD sessions have been normally set up on Device1 and Device3, indicating that the static routes are configured to coordinate with BFD successfully.

#When the route between Device1 and Device3 is faulty, BFD quickly detects the line fault and switch over to the route that passes Device2 for communication. Query the BFD session and routing table of Device1.

Device1#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

10.1.1.1 10.1.1.2 15/0 DOWN 5000 vlan1000

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:29:07, vlan1000

C 20.1.1.0/24 is directly connected, 00:28:55, vlan1001

C 127.0.0.0/8 is directly connected, 102:17:40, lo0

C 200.0.0.0/24 is directly connected, 00:36:58, gigabitethernet2

S 201.0.0.0/24 [10/10] via 20.1.1.2, 00:00:09, vlan1001

The BFD handling method on Device3 is the same as that on Device1.


3 RIP


3.1 Overview

On the current Internet, it is impossible to run only one gateway protocol. You can divide it into multiple Autonomous Systems (ASs) and each has its own routing technology. The internal routing protocols within an AS are Interior Gateway Protocols (IGPs). Routing Information Protocol (RIP) is one type of IGP. RIP adopts the Vector-Distance algorithm. RIP features simple and easy-to-use, so it is widely used in numerous small-sized networks.

RIP has two versions: RIPv1 and RIPv2. RIPv1 does not support classless routing, and RIPv2 supports classless routing. Usually, RIPv2 is used.

RIP is a simple protocol which provides simple configuration. However, the number of routes to be advertised by RIP is directly proportional to the number of routes in the routing table. If the number of routes is large, a lot of device resources and network resources are consumed. In addition, RIP specifies that the maximum number of hops that a routing path that passes routers is 15, so RIP is applicable only to simple small- and medium-sized network. RIP is applicable for most campus networks and LANs with a simple structure and strong continuity. For a more complex environment, RIP is not recommended.

RIPv1 was introduced earlier in RFC1058, but it has many deficiencies. To improve the deficiencies of RIPv1, RFC1388 introduced RIPv2, which was then revised in RFC 1723 and RFC 2453.


3.2 RIP Function Configuration

Table 3‑1 RIP function list

Configuration Tasks
Configure basic functions of RIP. | Enables RIP globally.
 | Enable RIP for VRF.
 | Configure RIP versions.
Configure RIP route generation. | Configure RIP to advertise the default route.
 | Configure RIP to re-distribute routes.
Configure RIP route control. | Configure the administrative distance of RIP.
 | Configure an RIP route summary.
 | Configure the RIP metric offset.
 | Configure RIP route filtration.
 | Configure the metric of the RIP interface.
 | Configure the routing flag for an RIP interface.
 | Configure the maximum load balancing for RIP.
Configure RIP network authentication. | Configure RIP network authentication.
Configure RIP network optimization. | Configure RIP timers.
 | Configure RIP split horizon and toxicity reverse of RIP.
 | Configure source address check.
 | Configure a static RIP neighbor.
 | Configure a passive RIP interface.
 | Configure RIP to trigger updates.
 | Configure an RIP backup interface.
Configure RIP to coordinate with BFD. | Configure RIP to coordinate with BFD.


3.2.1 Configure Basic Functions of RIP

Configuration Condition

Before configuring the basic functions of RIP, ensure that:

l The link layer protocol has been configured to ensure normal communication at the link layer.

l The network layer addresses of the interfaces have been configured so that the adjacent network nodes are reachable at the network layer.

Enable RIP Globally

Before using RIP, make the following configurations:

l Create an RIP process.

l Configure RIP to cover a directly connected network or interface.

Table 3‑2 Enabling RIP globally

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Create an RIP process and enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure RIP to cover a specified network segment or interface. | network { ip-address | interface-name } | Mandatory. By default, RIP does not cover any directly connected network or interface.

l The covered network segment is categorized into classful addresses.

l The network ip-address command cannot cover the super network addresses. To cover super network addresses, use the network interface-name command.

Enable RIP for VRF

To enable RIP to support VRF functions, make the following configurations:

l Configure a VRF and add an interface to the VRF.

l Enable the RIP function in the VRF address family.

l Configure RIP to cover a VRF directly connected network or interface.

Table 3‑3 Enable RIP for VRF

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Create an RIP process and enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Enter the VRF address family configuration mode of the RIP protocol. | address-family { ipv4 vrf vrf-name } | Mandatory. By default, the VRF address family mode is disabled.
Configure RIP to cover a specified network segment or interface. | network { ip-address | interface-name } | Mandatory. By default, RIP does not cover any directly connected network or interface.

l To enable RIP in VRF mode, you must first create VRF-related configurations.

Configure RIP Versions

RIP has two versions, RIPv1 and RIPv2. They can be configured in three modes: global configuration mode, VRF configuration mode, and interface configuration mode.

l By default, RIPv1 is enabled in global configuration mode and VRF configuration mode, and it is not configured in interface configuration mode.

l The version configuration command in interface configuration mode is a higher priority than the version configuration command in global or VRF configuration mode.

l If the version configuration command is not configured, the command in VRF configuration mode of the interface to which the VRF belongs or the command global configuration mode is used.

l In interface configuration mode, the RIP transmit version and the RIP receive version can be configured independently.

l After versions are configured, RIP has strict packet transmitting and receiving processing: In the case of RIPv1, the interface transmits and receives only RIPv1 broadcast and unicast packets. In the case of RIPv2, the interface can transmit and receive RIPv2 unicast, multicast, and broadcast packets. In the case of RIPv1 compatible mode, the interface can transmit RIPv2 unicast and broadcast packets.

Table 3‑4 Configure RIP versions

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Create an RIP process and enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure the global RIP version. | version { 1 | 2 } | Mandatory. By default, RIPv1 is enabled.
Enter the RIP VRF configuration mode. | address-family { ipv4 vrf vrf-name } | Mandatory. By default, the VRF address family mode is disabled.
Configure the RIP version in RIP VRF configuration mode. | version { 1 / 2 } | Mandatory. By default, RIPv1 is enabled.
Return to the RIP configuration mode. | exit-address-family | -
Return to the global configuration mode. | exit | -
Enter the interface configuration mode. | interface interface_name | -
Configure the RIP transmit version of the interface. | ip rip send version {{ 1 / 2 } | 1-compatible } | Optional. By default, the interface transmits packets based on the global RIP version.
Configure the RIP receive version of the interface. | ip rip receive version { 1 / 2 } | Optional. By default, the interface receives packets based on the global RIP version.


3.2.2 Configure RIP Route Generation

Configuration Condition

Before configuring RIP route generation, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l RIP is enabled.

Configure RIP to Advertise the Default Route

Through configuration, a device can send the default route on all RIP interfaces to set itself as the default gateway of other neighbor devices.

Table 3‑5 Configure RIP to advertise the default route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure RIP to advertise the default route. | default-information originate [metric metric-value] | Mandatory. By default, RIP does not advertise the default route.

l If a default route (0.0.0.0/0) is learnt, the default route (0.0.0.0/0) advertised by the local device is replaced. When loops exists in a network, network flapping may be caused. In using this command, prevent other devices in the same routing domain from enabling the command at the same time.

Configure RIP to Redistribute Routes

By redistributing routes, you can introduce the routes generated by other protocols to RIP.

Table 3‑6 Configure RIP to redistribute routes

Step

Command

Description

Enter the global configuration mode.

configure terminal

-

Enter the RIP configuration mode.

router rip

Mandatory.

By default, the RIP process is disabled.

Configure the default metric for the routes of other protocols introduced to RIP.

default-metric metric-value

Optional.

By default, the default metric of the introduced routes of other protocols is 1.

Configure RIP to redistribute routes.

redistribute
protocol [ protocol-id ]
[ metric metric-value ]
[ route-map route-map-name ]
[ match route-sub-type ]

Mandatory.

By default, route redistribution is not configured.

l If the metric command option is specified during redistribution, the redistributed route adopts the metric.

l In configuring RIP to redistribute routes, the available match options for the applied routing policy include ip address, route type, and tag, and the available set options for the applied routing policy include interface, ip next-hop, route source, and metric.


3.2.3 Configure RIP Route Control

Configuration Condition

Before configuring RIP route control, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l RIP is enabled.

Configure the Administrative Distance of RIP

One device can run multiple routing protocols at the same time. The device selects the optimal route from the routes that are learnt from different protocols based on the administrative distances. The smaller the administrative distance is, the higher the priority is.

Table 3‑7 Configure the administrative distance of RIP

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | -
Configure the administrative distance of RIP. | distance distance-value | Mandatory. By default, the administrative distance of RIP is 120.

Configure an RIP Route Summary

Through RIP route summary, a routing device summarizes subnet routes in a natural network segment to form a summary route. The summary route and the original subnet routes all exist in the RIP routing table.

After RIP route summary is configured, the device advertises only the route summary. This greatly decreases the size of adjacent RIP routing tables in a medium- and large-sized network and decreases the consumption of the network bandwidth by routing protocol packets.

A route summary takes the minimum value among metrics of all subnet routes as its metric.

RIPv1 supports automatic route summary mode, and RIPv2 supports the automatic route summary mode and the manual summary mode.

1. RIP auto route summary

Different from manual route summary, auto route summary enables RIP to automatically generate a natural mask route based on subnet routes in one natural network segment.

Table 3‑8 Configure the auto route summary function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure the auto route summary function of RIPv2. | auto-summary | Mandatory. By default, the auto route summary function of RIPv2 is disabled, but the auto route summary function of RIPv1 is enabled.

l RIPv1 does not support the route summary command.

l The tag of a route summary is 0, and minimum metric of the routes is taken as the route summary metric. If the auto route summary is configured, auto route summary has the priority.

l Exercise caution in using the auto route summary function. Ensure that it is necessary to perform auto route summary; otherwise, routing loops may be caused.

l When the auto route summary function of RIPv2 is enabled, if the interface of the advertised route and the route are in the same natural network segment, the update packet sent from the interface does not result in summary of all subnet routes in the natural network segment; otherwise, routes are gathered to form a natural network segment and then it is advertised.

2. Manual route summary

In manual route summary, a combination of a destination address and a mask need to be configured. The combination gathers all routes in the covered network segment for route summary.

Table 3‑9 Configure the manual route summary function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the manual route summary function of RIPv2 on the interface. | ip summary-address rip prefix-address | -

Configure the RIP Metric Offset

By default, RIP applies the route metric advertised by the neighbor device to the received routes. To modify the metric in some special application scenarios, you can configure the RIP metric offset to correct the metric of the specified route.

If the metric in the incoming direction is configured, RIP modifies the metric of the received routes and saves the routes into the routing table. When RIP advertises a metric to the neighbor devices, it advertises the new metric. If the metric in the outgoing direction is configured, the metric is modified only when RIP advertises a metric to the neighbor devices.

Table 3‑10 Configure the RIP metric offset

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure RIP to modify the metric of the specified route. | offset-list access-list-name { in | out } metric-offset [ interface-name ] | Mandatory. By default, no metric is configured for any interface.

l Route metric offset supports only matching a standard access list.

Configure RIP Route Filtration

A router can filter the received or advertised routes by configuring an Access Control List (ACL) or prefix list. In receiving RIP routes, you can filter some learnt routes; or in announcing RIP routes, you can filter some routes that are advertised to neighbor devices.

Table 3‑11 Configure RIP route filtration

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure the RIP route filtering function. | distribute-list { access-list-name | prefix prefix-list-name } { in | out } [ interface-name ] | Mandatory. By default, the route filtering function is not configured. During the configuration process of the route filtering function, if no interface is specified, route filtering is enabled for all routes that are received and transmitted by all the interfaces covered by RIP.

l In filtration based on ACL, only a standard ACL is supported.

Configure Metric of RIP Interface

If an interface is overwritten by an RIP process, the corresponding direct route is generated in the database, with the default metric 1. When the route is in the RIP database or it is advertised to neighbor devices, if the interface is configured with a metric, the interface metric is used as the metric of the route.

If the interface metric is changed, the RIP database immediately updates the corresponding direct route of RIP and advertises the new metric to the neighbor devices.

Table 3‑12 Configure the Metric of the RIP interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the metric of the RIP interface. | ip rip metric metric-value | Mandatory. By default, the RIP interface metric is 1.

l Configuring the RIP interface metric affects only the metric of the direct subnet of the interface while it does not affect the metric learned by routes.

Configure the Routing Flag for an RIP Interface

The network administrator can attach tags to some routes. Then, in applying a routing policy, the network administrator can perform route filtering or route property advertisement based on the tags.

Only the routing tags of RIPv2 are supported.

Table 3‑13 Configure the routing flag for an RIP interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure a tag for the route of the direct subnet of the interface. | ip rip tag tag-value | -

Configure the Maximum Number of RIP Load Balancing Entries

This command helps you to control the number of RIP load balancing entries for routing.

Table 3‑14 Configure the maximum number of RIP load balancing entries

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure the maximum number of RIP load balancing entries. | maximum-paths max-number | Optional. By default, the maximum number of RIP load balancing entries is 4.


3.2.4 Configure RIP Network Authentication

RIPv2 supports protocol packet authentication, therefore, it can satisfy the high security requirement of some networks. Currently, plain text authentication and Message Digest 5 (MD5) authentication are supported. Plain text authentication features low security because it transmits plain text. MD5 converts an authentication code into the MD5 code for transmission, ensuring higher security.

Owing to the limit of RIPv2 packets, a packet that advertises a route contains only 16 bytes. Therefore, the length of a plain text authentication string must not exceed 16 bytes. Meanwhile, the MD5 code that is converted from any character string is a standard 16-byte code, meeting the requirement on the string length.

Table 3‑15 Configure RIP network authentication

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure RIPv2 network authentication. | ip rip authentication { { key { 0 | 7 } key-string } | { key-chain key-chain-name } | { mode { text | md5 | sm3 } } } | Mandatory. By default, the IPv2 authentication function is not configured.

l Before implementing MD5 authentication, pay attention to the following points:

l RIPv1 does not support network authentication.

l RIPv2 supports one authentication mode at a time.

l Key ID must be carried in the MD5 authentication information. If you use the ip rip authentication key command to configure a password, the key ID is 1. If you use the ip rip authentication key-chain command to configure a password, the key ID is the key ID in Key-chain.

l In obtaining a packet transmit authentication password from Key-chain, select a Key ID in the sequence of from small to large. Therefore, the Key ID with the smallest valid transmit password will be selected.

l In obtaining a packet receive authentication password from Key-chain, select the first valid receive password whose Key ID is equal to or larger than the packet receive Key ID. Therefore, if Key IDs are different for the two ends of authentication, the end with the larger Key ID can pass the authentication while the end with the smaller Key ID fails in the authentication.


3.2.5 Configure RIP Network Optimization

Configuration Condition

Before configuring RIP network optimization, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l RIP is enabled.

Configure RIP Timers

RIP does not maintain neighbor relations and it does not support route withdrawn; therefore, the protocol provides four configurable timers to control the network convergence speed. The four timers are: route update timer, router timeout timer, route dampening update timer, and route clear timer.

The route timeout time must be at least three times of the route update time. If no route update packet is received within the route timeout time, the route becomes invalid and it enters a dampening cycle. The length of the dampening cycle is determined by the dampening update time. During the cycle, the route will not be cleared. After the dampening cycle is completed, the route enters the clear cycle. During the cycle, the route can be updated. However, if no route update packet is received during the cycle, the route will be deleted.

Table 3‑16 Configuring RIP timers

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | routerrip | Mandatory. By default, the RIP process is disabled.
Configure RIP timers. | timers basic update-interval invalid-interval holddown-interval flush-interval | Optional. By default, the RIP update interval is 30s, the valid time for advertisement is 180s, the dampening time is 180s, and the clear time is 240s.

l In the same RIP routing domain, the timer basic configurations on all the devices must be the same to prevent network flapping.

Configure RIP Split Horizon and Toxicity Reverse of RIP

Split horizon and toxicity reverse are mechanisms that are used to prevent route loops.

1. Configure split horizon.

RIP does not advertise routes that it has learnt from an interface to the interface, preventing routing loops.

Table 3‑17 Configure RIP split horizon

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configuring RIP split horizon. | ip split-horizon | Mandatory. By default, the split horizon function is disabled.

2. Configure toxicity reverse.

RIP announces routes that have been learnt from an interface to the interface, but the route metric is the maximum number of hops, 16, preventing routing loops.

Table 3‑18 Configure RIP toxicity reverse

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure RIP toxicity reverse. | ip split-horizon poisoned | Optional. By default, the toxicity reverse function is enabled.

l The split horizon and toxicity reverse functions are valid only for the learnt routes, direct routes in the network covered by RIP, and the redistributed direct and static routes.

l The split horizon function and the toxicity reversion function cannot be used at the same time.

Configure RIP Source Address Check

Through source address check, RIP checks the source addresses of the received packets. RIP processes only the packets whose source addresses meet the requirements. The check items include: the packet source address is in the same network segment as the input interface address; the packet source address matches the peer end address of the Point-to-Point (P2P) interface.

By default, RIP is enabled to check whether the source addresses received through the Ethernet port are in the same network segment as the address of the interface, and this function cannot be cancelled.

Table 3‑19 Configure RIP source address check

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure RIP to start source address check on the P2P interface. | validate-update-source check-p2p-destination | Mandatory. By default, the peer address of the P2P interface is not checked.

Configure a Static RIP Neighbor

RIP does not maintain neighbor relations, so it does not have the concept of neighbor. Here the neighbor refers to the neighbor RIP routing device. After a static RIP neighbor is specified, RIP sends RIP packets to the neighbor in unicast mode. The configuration is applied to a network that does not support broadcast or multicast, such as point-to-point links. If the configuration is applied to a broadcast or multicast network, it may cause repeated RIP packets in the network.

Table 3‑20 Configure a static RIP neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure advertisement of routes to a neighbor in unicast mode. | neighbor ip-address | Mandatory. The parameter ip-address is the IP address of the peer direct-connect interface.

l RIP advertises routes only to the interfaces that it covers, and the passive interfacesetting cannot prevent an interface from sending packets to its static neighbor.

Configure a Passive RIP Interface

To decrease the network bandwidth consumed by the routing protocol, the dynamic routing protocol uses the passive interface function. RIP receives only route update packets on a passive interface, and it does not send route update packets on the passive interface. In a low-speed network with small bandwidth, the passive interface function and the neighbor function cooperate to effectively reduce interactions of RIP routes.

Table 3‑21 Configure a passive RIP interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Configure a passive RIP interface. | passive-interface { default | interface-name } | Mandatory. By default, no passive interface is configured.

l The passive interface function does not restrain an interface from sending unicast route updates to its neighbor devices. When the passive interface function is used with the neighbor command, the function does not restrain an interface from sending unicast route updates to its neighbor devices. This application mode controls a router so that it sends route updates only to some neighbor devices in unicast mode instead of sending route updates to all neighbor devices in broadcast mode (or multicast mode in the case of RIPv2).

Configure RIP to Trigger Updates

After a device receives an RIP update packet, to reduce the possibility of introducing loops owning to routing table differences, the device advertises the update packet of the route to its neighbor devices immediately instead of waiting for the update timer to time out before an update. The update trigger mechanism speeds up network convergence.

Table 3‑22 Configure RIP to trigger updates

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure RIP to trigger updates on the interface. | ip rip triggered | Optional. By default, the update trigger function is disabled.

Configure an RIP Standby Interface

To speed up backup route convergence, RIP newly supports a backup interface (standby interface) function. On the main route interface of RIP, specify a backup interface for the main interface. In a specific application environment, RIP learns RIP routes only from one line, and the backup line does not provide routing information interaction. If the main interface gets offline, RIP sends Request packets to the peer end through the backup interface periodically (Default: 1s) to request for all routes. If the backup interface receives a Response packet from the peer route, RIP cancels sending of Request packets. It updates the local routing table, and advertises the local routing table to the backup interface. If the backup interface fails to receive a Response packet from the peer end before timeout, RIP cancels sending of Request packets.

Table 3‑23 Configure an RIP backup interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure an RIP backup interface. | ip rip standby interface-name [ timeout timeout-value ] | Optional. By default, the backup interface function is disabled, and the default timeout-value is 300s.


3.2.6 Configure RIP to Coordinate with BFD

A backup interface can be used only in a specific application environment, but it cannot meet the real-time backup requirement. At this time, RIP provides the point-to-point Bidirectional Forwarding Detection (BFD) function to realize fast convergence and switchover of routes. BFD provides a method for quickly detecting the status of a line between two devices. When BFD detection is enabled between two adjacent RIP devices, if the line between the two devices is faulty, BFD can quickly find the fault and notify RIP. RIP then deletes the RIP route that is associated with the BFD interface. If the route has a backup route, a switchover to the backup route will be performed in a very short period of time (which is determined by BFD settings). Currently, RIP only supports single-hop bi-directional BFD detection.

Table 3‑24 Configure RIP to coordinate with BFD

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the RIP configuration mode. | router rip | Mandatory. By default, the RIP process is disabled.
Enable the BFD function on all the interfaces that are covered by the RIP process. | bfd all-interfaces | Mandatory. By default, the BFD function is disabled on all the interfaces that are covered by the RIP process.
Return to the global configuration mode. | exit | -
Enter the interface configuration mode. | interface interface-name | -
Enable the BFD function on the interface. | ip rip bfd | Mandatory. By default, the BFD function is disabled on the interface.

l For the related configuration of BFD, refer to Reliability-the chapters of BFD commands and BFD configuration.


3.2.7 RIP Monitoring and Maintaining

Table 3‑25 RIP monitoring and maintaining

Command | Description
show ip rip [ vrf vrf-name ] | Display the basic information about the RIP protocol.
show ip rip [ vrf vrf-name ] database [ detail | prefix/mask [ [ detail | longer-prefixes [ detail ] ] ] ] | Display the information about the RIP routing database.
show ip rip [ vrf vrf-name ] statistics | Display the RIP protocol statistics.
show ip rip interface [ interface-name ] | Display the RIP interface information.
clear ip rip [ vrf vrf-name ] { process | statistics } | Clear RIP process and statistics.


3.3 RIP Typical Configuration Example


3.3.1 Configure RIP Version

Network Requirements

l RIPv2 runs between Device1 and Device2 for route interaction.

Network Topology

Figure 3‑1 Networking for configuring the RIP version

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure RIP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router rip

Device1(config-rip)#network 1.0.0.0

Device1(config-rip)#network 100.0.0.0

Device1(config-rip)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router rip

Device2(config-rip)#network 1.0.0.0

Device2(config-rip)#network 50.0.0.0

Device2(config-rip)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1001vlan1001

R 50.0.0.0/8 [120/1] via 1.0.0.2, 00:13:26, vlan1001vlan1001

C 100.0.0.0/24 is directly connected, 00:23:06, vlan1000vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1000vlan1000

C 50.0.0/24 is directly connected, 00:23:06, vlan1001vlan1001

R 100.0.0.0/8 [120/1] via 1.0.0.1, 00:13:26, vlan1000vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

According to the routing table, the route advertised by the device uses a 8-bit natural mask.

Step 3:

Configure the RIP version.

#Configure Device1.

Device1(config)#router rip

Device1(config-rip)#version 2

Device1(config-rip)#exit

#Configure Device2.

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#exit

Step 4:

Check the result.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1001vlan1001

R 50.0.0.0/24 [120/1] via 1.0.0.2, 00:13:26, vlan1001vlan1001

C 100.0.0.0/24 is directly connected, 00:23:06, vlan1000vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1000vlan1000

C 50.0.0/24 is directly connected, 00:23:06, vlan1001vlan1001

R 100.0.0.0/24 [120/1] via 1.0.0.1, 00:13:26, vlan1000vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

According to the routing table, the route advertised by the device uses a 24-bit accurate mask.


3.3.2 Configure RIP to Redistribute Routes

Network Requirements

l OSPF runs between Device1 and Device2. Device2 learns OSPF routes 100.0.0.0/24 and 200.0.0.0/24 advertised by Device1.

l RIPv2 runs between Device2 and Device3. Device2 redistributes OSPF route 100.0.0.0/24 to RIP and advertises the route to Device3.

Network Topology

Figure 3‑2 Networking for configuring RIP to redistribute routes

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 100.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 200.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1000

C 2.0.0.0/24 is directly connected, 00:13:06, vlan1001O 100.0.0.0/24 [110/2] via 1.0.0.1, 00:04:12, vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0O 200.0.0.0/24 [110/2] via 1.0.0.1, 00:04:12, vlan1000

According to the routing table, Device2 has learnt the OSPF routes that have been advertised by Device1.

Step 3:

Configure RIP.

#Configure Device2.

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 2.0.0.0

Device2(config-rip)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router rip

Device3(config-rip)#version 2

Device3(config-rip)#network 2.0.0.0

Device3(config-rip)#exit

Step 4:

Configure the routing policy.

#On Device2, configure route-map to invoke ACL to match 100.0.0.0/24 and filter 200.0.0.0/24.

Device2(config)#ip access-list standard 1

Device2(config-std-nacl)#permit 100.0.0.0 0.0.0.255

Device2(config-std-nacl)#exit

Device2(config)#route-map OSPFtoRIP

Device2(config-route-map)#match ip address 1

Device2(config-route-map)#exit

l In configuring a routing policy, you can create a filtration rule based on a prefix list or ACL. The prefix list can precisely match routing masks while the ACL cannot match routing masks.

Step 5:

Configure RIP to redistribute routes.

#Configure Device2.

Device2(config)#router rip

Device2(config-rip)#redistribute ospf 100 route-map OSPFtoRIP

Device2(config-rip)#exit

Step 6:

Check the result.

#Query the RIP routing table of Device2.

Device2#show ip rip database

Types: N - Network, L - Learn, R - Redistribute, D - Default config, S - Static config

Proto: C - connected, S - static, R - RIP, O - OSPF, E - IRMP,

o - SNSP, B - BGP, i-ISIS

RIP routing database in VRF kernel (Counter 3):

T/P Network ProID Metric Next-Hop From Time Tag Interface

N/C 2.0.0.0/24 none 1 -- -- -- 0 vlan1001

R/O 100.0.0.0/24 1 1 1.0.0.1 -- -- 0 vlan1000

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 2.0.0.0/24 is directly connected, 00:23:06, vlan1000

R 100.0.0.0/24 [120/1] via 2.0.0.1, 00:13:26, vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

By querying the RIP routing table on Device2 and the querying the routing table on Device3, it is found that route 100.0.0.0/24 on Device2 has been redistributed to RIP and route 200.0.0.0/24 has been successfully filtered out.

l In an actual application, if there are two or more AS boundary routers, it is recommended that you do not redistribute routes between different routing protocols. If route redistribution must be configured, you are required to configure route control policies such as route filtering and filtration summary on the AS boundary routers to prevent routing loops.


3.3.3 Configure RIP Metric Offset

Network Requirements

l RIPv2 runs between Device1, Device2, Device3, and Device4.

l Device1 learns route 200.0.0.0/24 from both Device2 and Device3.

l On Device1, set the route metric offset in the receive direction so that Device1 selects the route advertised by Device2 with priority.

Network Topology

Figure 3‑3 Networking for configuring the RIP metric offset

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure RIP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router rip

Device1(config-rip)#version 2

Device1(config-rip)#network 1.0.0.0

Device1(config-rip)#network 2.0.0.0

Device1(config-rip)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 1.0.0.0

Device2(config-rip)#network 3.0.0.0

Device2(config-rip)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router rip

Device3(config-rip)#version 2

Device3(config-rip)#network 2.0.0.0

Device3(config-rip)#network 4.0.0.0

Device3(config-rip)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router rip

Device4(config-rip)#version 2

Device4(config-rip)#network 3.0.0.0

Device4(config-rip)#network 4.0.0.0

Device4(config-rip)#network 200.0.0.0

Device4(config-rip)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1000

C 2.0.0.0/24 is directly connected, 00:22:56, vlan1001

R 3.0.0.0/24 [120/1] via 1.0.0.2, 00:13:26, vlan1000

R 4.0.0.0/24 [120/1] via 2.0.0.2, 00:11:04, vlan1001

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

R 200.0.0.0/24 [120/2] via 1.0.0.2, 00:08:31, vlan1000

[120/2] via 2.0.0.2, 00:08:31, vlan1001

According to the routing table of Device1, two routes to 200.0.0.0/24 are available.

Step 3:

Configure the ACL.

#Configure Device1.

Device1(config)#ip access-list standard 1

Device1(config-std-nacl)#permit 200.0.0.0 0.0.0.255

Device1(config-std-nacl)#exit

Step 4:

Configure a metric offset.

#On Device1, configure the metric offset list and increase the metric of the route that has been learnt from interface vlan1001 and matches ACL to 3.

Device1(config)#router rip

Device1(config-rip)#offset-list 1 in 3 vlan1001

Device1(config-rip)#exit

Step 5:

Check the result.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:33:59, vlan1000

C 2.0.0.0/24 is directly connected, 00:33:50, vlan1001

R 3.0.0.0/24 [120/1] via 1.0.0.2, 00:24:20, vlan1000

R 4.0.0.0/24 [120/1] via 2.0.0.2, 00:21:57, vlan1001

C 127.0.0.0/8 is directly connected, 77:01:54, lo0

R 200.0.0.0/24 [120/2] via 1.0.0.2, 00:19:25, vlan1000

According to the routing table of Device1, the next-hop output interface of route 200.0.0.0/24 is only vlan1000, indicating that Device1 has selected the route advertised by Device2 with priority.

l The route metric offset list can be applied to all interfaces or a specified interface, and it can be used in both the receive and advertisement directions.


3.3.4 Configure RIP Route Filtration

Network Requirements

l RIPv2 runs between Device1 and Device2 for route interaction.

l Device1 learns two routes 2.0.0.0/24 and 3.0.0.0/24 that have been advertised by Device2, and then it filters route 3.0.0.0/24 in the advertisement direction of Device2.

Network Topology

Figure 3‑4 Networking for configuring RIP Route filtration

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure RIP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router rip

Device1(config-rip)#version 2

Device1(config-rip)#network 1.0.0.0

Device1(config-rip)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 1.0.0.0

Device2(config-rip)#network 2.0.0.0

Device2(config-rip)#network 3.0.0.0

Device2(config-rip)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1000

R 2.0.0.0/24 [120/1] via 1.0.0.2, 00:13:26, vlan1000

R 3.0.0.0/24 [120/1] via 1.0.0.2, 00:13:26, vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

According to the routing table, Device1 has learnt two routes advertised by Device2.

Step 3:

Configure the ACL.

#Configure Device2.

Device2(config)#ip access-list standard 1

Device2(config-std-nacl)#permit 2.0.0.0 0.0.0.255

Device2(config-std-nacl)#exit

l In configuring route filtration, you can create a filtration rule based on a prefix list or ACL. The prefix list can precisely match routing masks while the ACL cannot match routing masks.

Step 4:

Configure route filtration.

#Configure route filtering in the output direction of interface vlan1000 of Device2.

Device2(config)#router rip

Device2(config-rip)#distribute-list 1 out vlan1000

Device2(config-rip)#exit

Step 5:

Check the result.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1000

R 2.0.0.0/24 [120/1] via 1.0.0.2, 00:13:26, vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

According to the routing table, Device2 does not advertise route 3.0.0.0/24 to Device1, but the route is deleted from the routing table of Device only after the route times out.

l The distribute-list can be applied to all interfaces or a specified interface, and it can be used in both the receive and advertisement directions.


3.3.5 Configure RIP Route Summary

Network Requirements

l RIPv2 runs between Device1, Device2, Device3, and Device4 for route interaction.

l Device1 learns two routes 100.1.0.0/24 and 100.2.0.0/24 from Device2. To reduce the size of the routing table of Device1, it is required that Device advertises only the route summary of the two route to Device1.

Network Topology

Figure 3‑5 Networking for configuring RIP route summary

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure RIP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router rip

Device1(config-rip)#version 2

Device1(config-rip)#network 1.0.0.0

Device1(config-rip)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 1.0.0.0

Device2(config-rip)#network 2.0.0.0

Device2(config-rip)#network 3.0.0.0

Device2(config-rip)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router rip

Device3(config-rip)#version 2

Device3(config-rip)#network 2.0.0.0

Device3(config-rip)#network 100.0.0.0

Device3(config-rip)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router rip

Device4(config-rip)#version 2

Device4(config-rip)#network 3.0.0.0

Device4(config-rip)#network 100.0.0.0

Device4(config-rip)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1000

R 2.0.0.0/24 [120/1] via 1.0.0.2, 00:13:26, vlan1000

R 3.0.0.0/24 [120/1] via 1.0.0.2, 00:13:26, vlan1000

R 100.1.0.0/24 [120/2] via 1.0.0.2, 00:08:31, vlan1000

R 100.2.0.0/24 [120/2] via 1.0.0.2, 00:08:31, vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

Step 3:

Configure a summary of routes on an interface.

#On Device2, configure a route summary 100.0.0.0/8.

Device2(config)#interface vlan1000

Device2(config-if-vlan1000)#ip summary-address rip 100.0.0.0/8

Device2(config-if-vlan1000)#exit

Step 4:

Check the result.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:24:06, vlan1000

R 2.0.0.0/24 [120/1] via 1.0.0.2, 00:14:26, vlan1000

R 3.0.0.0/24 [120/1] via 1.0.0.2, 00:14:26, vlan1000

R 100.0.0.0/8 [120/2] via 1.0.0.2, 00:00:31, vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

On Device1, the route summary 100.0.0.0/8 advertised by Device2 and learnt by Device1 is displayed. The two routes that are contained in the route summary can be deleted only after timeout.

l RIP supports global auto route summary and interface manual route summary. In RIPv2, the global auto route summary function is disabled.


3.3.6 Configure RIP to Coordinate with BFD

Network Requirements

l RIPv2 runs between Device1, Device2, and Device3 for route interaction.

l Device1 learns route 3.0.0.0/24 from Device2 and Device3. Then, configure route metric offset so that Device1 selects the route advertised by Device2 with priority. At this time, the line between Device1 and Device2 becomes the main line of the route. The line between Device1 and Device3 becomes and backup line of the route.

l Configure BFD between Device1 and Device2. When the line between Device1 and Device2 becomes faulty, configure RIP to coordinate with BFD between Device1 and Device2 to quickly detect line faults. When BFD finds a main line failure, it triggers an RIP route update. Then the route 3.0.0.0/24 is switched over to the backup line.

Network Topology

Figure 3‑6 Networking for configuring RIP to coordinate with BFD

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure RIP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router rip

Device1(config-rip)#version 2

Device1(config-rip)#network 1.0.0.0

Device1(config-rip)#network 2.0.0.0

Device1(config-rip)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 1.0.0.0

Device2(config-rip)#network 3.0.0.0

Device2(config-rip)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router rip

Device3(config-rip)#version 2

Device3(config-rip)#network 2.0.0.0

Device3(config-rip)#network 3.0.0.0

Device3(config-rip)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 01:30:23, vlan1000

C 2.0.0.0/24 is directly connected, 01:30:14, vlan1001

R 3.0.0.0/24 [120/1] via 1.0.0.2, 01:20:44, vlan1000

[120/1] via 2.0.0.2, 00:00:02, vlan1001

C 127.0.0.0/8 is directly connected, 77:58:18, lo0

Device1 has learnt route 3.0.0.0/24 from both Device2 and Device3.

Step 3:

Configure a route metric offset.

#On Device1, configure a route metric offset in the input direction of interface vlan1001 so that the metric of the routes that match ACL is increased to 3.

Device1(config)#ip access-list standard 1

Device1(config-std-nacl)#permit 3.0.0.0 0.0.0.255

Device1(config)#exit

Device1(config)#router rip

Device1(config-rip)#offset-list 1 in 3 vlan1001

Device1(config-rip)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 01:30:23, vlan1000

C 2.0.0.0/24 is directly connected, 01:30:14, vlan1001

R 3.0.0.0/24 [120/1] via 1.0.0.2, 01:20:44, vlan1000

C 127.0.0.0/8 is directly connected, 77:58:18, lo0

After a route metric offset is configured, Device1 selects route 3.0.0.0/24 advertised by Device2.

Step 4:

Configure BFD.

#Configure Device1.

Device1(config)#interface vlan1000

Device1(config-if-vlan1000)#ip rip bfd

Device1(config-if-vlan1000)#exit

#Configure Device2.

Device2(config)#interface vlan1000

Device2(config-if-vlan1000)#ip rip bfd

Device2(config-if-vlan1000)#exit

Step 5:

Check the result.

#On Device1, query the BFD information.

Device1#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

1.0.0.1 1.0.0.2 2/4 UP 5000 vlan1000

#If the line between Device1 and Device2 becomes faulty, the route can quickly switch over to the backup line.

#On Device1, query the route information.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 2.0.0.0/24 is directly connected, 02:07:47, vlan1001

R 3.0.0.0/24 [120/4] via 2.0.0.2, 00:01:14, vlan1001

C 127.0.0.0/8 is directly connected, 78:35:51, lo0


3.3.7 Configure RIP Backup Interface

Network Requirements

l RIPv2 runs between Device1, Device2, and Device3 for route interaction.

l Device1 learns route 3.0.0.0/24 from Device2 and Device3. Then, configure route metric offset so that Device1 selects the route advertised by Device2 with priority. At this time, the line between Device1 and Device2 becomes the main line of the route. The line between Device1 and Device3 becomes and backup line of the route.

l On Device1, configure an RIP backup interface. If the main line is normal, the route passes the main line. If the main line is faulty, the route quickly switches to the backup line.

Network Topology

Figure 3‑7 Networking for configuring an RIP backup interface

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure RIP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router rip

Device1(config-rip)#version 2

Device1(config-rip)#network 1.0.0.0

Device1(config-rip)#network 2.0.0.0

Device1(config-rip)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 1.0.0.0

Device2(config-rip)#network 3.0.0.0

Device2(config-rip)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router rip

Device3(config-rip)#version 2

Device3(config-rip)#network 2.0.0.0

Device3(config-rip)#network 3.0.0.0

Device3(config-rip)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 01:30:23, vlan1000

C 2.0.0.0/24 is directly connected, 01:30:14, vlan1001

R 3.0.0.0/24 [120/1] via 1.0.0.2, 01:20:44, vlan1000

[120/1] via 2.0.0.2, 00:00:02, vlan1001

C 127.0.0.0/8 is directly connected, 77:58:18, lo0

Device1 has learnt route 3.0.0.0/24 from both Device2 and Device3.

Step 3:

Configure a route metric offset.

#On Device1, configure a route metric offset in the input direction of interface vlan1001 so that the metric of the routes that match ACL is increased to 3.

Device1(config)#ip access-list standard 1

Device1(config-std-nacl)#permit 3.0.0.0 0.0.0.255

Device1(config)#exit

Device1(config)#router rip

Device1(config-rip)#offset-list 1 in 3 vlan1001

Device1(config-rip)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 01:30:23, vlan1000

C 2.0.0.0/24 is directly connected, 01:30:14, vlan1001

R 3.0.0.0/24 [120/1] via 1.0.0.2, 01:20:44, vlan1000

C 127.0.0.0/8 is directly connected, 77:58:18, lo0

After the route metric offset is configured, Device1 selects route 3.0.0.0/24 advertised by Device2.

Step 4:

Configure a backup interface.

#On Device1, configure interface vlan1001 as the RIP backup interface of vlan1000.

Device1(config)#interface vlan1000

Device1(config-if-vlan1000)#ip rip standby vlan1001

Device1(config-if-vlan1000)#exit

Step 5:

Check the result.

#If the line between Device1 and Device2 becomes faulty, the route can quickly switch over to the backup line between Device1 and Device3.

#On Device1, query the route information.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 2.0.0.0/24 is directly connected, 02:07:47, vlan1001

R 3.0.0.0/24 [120/4] via 2.0.0.2, 00:01:14, vlan1001

C 127.0.0.0/8 is directly connected, 78:35:51, lo0


3.3.8 Configure Passive RIP Interface

Network Requirements

l RIPv2 runs between Device1 and Device2 for route interaction.

l On Device1, configure a passive interface which does not send update packets to Device2.

Network Topology

Figure 3‑8 Networking for configuring an RIP passive interface

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure RIP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router rip

Device1(config-rip)#version 2

Device1(config-rip)#network 1.0.0.0

Device1(config-rip)#network 100.0.0.0

Device1(config-rip)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 1.0.0.0

Device2(config-rip)#network 50.0.0.0

Device2(config-rip)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1001

R 50.0.0.0/24 [120/1] via 1.0.0.2, 00:13:26, vlan1001

C 100.0.0.0/24 is directly connected, 00:23:06, vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1000

C 50.0.0/24 is directly connected, 00:23:06, vlan1001

R 100.0.0.0/24 [120/1] via 1.0.0.1, 00:13:26, vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

Step 3:

Configure a passive interface.

#Configure Device1.

Device1(config)#router rip

Device1(config-rip)#passive-interface vlan1001

Device1(config-rip)#exit

vlan1001 of Device1 is configured as a passive interface which does not send update packets to Device2, but Device2 can still receive update packets.

Step 4:

Check the result.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:23:06, vlan1001

R 50.0.0.0/24 [120/1] via 1.0.0.2, 00:13:26, vlan1001

C 100.0.0.0/24 is directly connected, 00:23:06, vlan1000

C 127.0.0.0/8 is directly connected, 76:51:00, lo0

Route 50.0.0.0/24 is still kept on Device1. On Device2, after the RIP route times out and is deleted, route 100.0.0.0/24 is deleted from the routing table.

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:25:06, vlan1000

C 50.0.0/24 is directly connected, 00:25:06, vlan1001

C 127.0.0.0/8 is directly connected, 77:51:00, lo0


4 OSPF


4.1 Overview

Open Shortest Path First (OSPF) is a dynamic routing protocol that is based on link statuses. It uses the Dijkstra's Shortest Path First (SPF) algorithm to calculate routes within a single Autonomous System (AS).

OSPF, which is developed by the Internet Engineering Task Force (IETF), solves the problems of slow convergence and liability to form loops for distance vector routes. It is applicable to medium- and large-sized networks. Currently, OSPF version 2 is available. It complies with RFC2328 and supports OSPF extended functions defined in other related RFCs.

In OSPF, each device maintains a database that describes the link status of an AS network. The databases of devices in the same area are the same. After the databases are completely synchronized, each device takes itself as the root and uses the SPF algorithm to calculate the shortest path tree without loops to describe the shortest paths it knows to reach each destination. Then each device constructs its routing table based on the shortest path tree.

The main features of OSPF include:

l Fast convergence: After the topology of the network changes, it sends an update packet immediately so that the change is synchronized in the AS.

l Loop free: OSPF runs SPF to calculate routes based on the link status database. The algorithm ensures that no routing loop will be formed.

l Dividing areas: OSPF allows dividing an AS into multiple areas to reduce network bandwidth occupancy, making it possible to construct layered network.

l Authentication support: Once an OSPF device receives a routing protocol packet, it verifies the authentication information contained in the packet to prevent information leakage or malicious attacks in the network.

l Supports subnet with different lengths: The routes advertised by OSPF carry network masks to support subnets with different lengths.

l Support load balancing: OSPF supports multiple equivalent routes to the same destination.


4.2 OSPF Function Configuration

Table 4‑1 OSPF function list

Configuration Tasks
Configure basic OSPF functions. | Enable OSPF.
Configure OSPF areas. | Configure an OSPF NSSA area.
 | Configure an OSPF Stub area.
 | Configure an OSPF virtual link.
Configure the OSPF network type. | Configure the network type of an OSPF interface to broadcast.
 | Configure the network type of an OSPF interface to P2P.
 | Configure the network type of an OSPF interface to NBMA.
 | Configure the network type of an OSPF interface to P2MP.
Configure the OSPF network authentication. | Configure OSPF area authentication.
 | Configure OSPF interface authentication.
Configure OSPF route generation. | Configure OSPF to redistribute routes.
 | Configure the default OSPF route.
 | Configure the OSPF host route.
Configure OSPF route control. | Configure route summary on inter-area OSPF routes.
 | Configure OSPF external route summary.
 | Configure route filtering on inter-area OSPF routes.
 | Configure OSPF external route filtration.
 | Configure OSPF route installation filtration.
 | Configure the cost value of an OSPF interface.
 | Configure the OSPF reference bandwidth.
 | Configure the OSPF administrative distance.
 | Configure the maximum number of OSPF load balancing routes.
 | Configure OSPF to be compatible with RFC1583.
Configure OSPF network optimization. | Configure the keep-alive time of an OSPF neighbor.
 | Configure an OSPF passive interface.
 | Configure an OSPF demand circuit.
 | Configure the priority of an OSPF interface.
 | Configure the MTU of an OSPF interface.
 | Configure the LSA transmit delay of an OSPF interface.
 | Configure OSPF LSA retransmission.
 | Configure OSPF to prevent LSA flooding.
 | Configure OSPF SPF calculation time.
 | Configure OSPF database overflow.
Configure OSPF to coordinate with BFD. | Configure OSPF to coordinate with BFD.


4.2.1 Configure Basic OSPF Functions

Before configuring OSPF functions, you must first enable the OSPF protocol before the other functions can take effect.

Configuration Conditions

Before configuring the basic OSPF functions, ensure that:

l The link layer protocol has been configured to ensure normal communication at the link layer.

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

Enable OSPF

To enable OSPF, you must create an OSPF process, specify the address range of the networks with which the process is associated, and specify the area to which the address range belongs. If the IP address of an interface is in the network segment of an area, the interface belongs to the area and the OSPF function is enabled, and OSPF advertises the direct route of the interface.

A device that runs OSPF must have a Router ID, which is used to uniquely identify a device in an OSPF AS. You must ensure that the Router IDs are unique in an AS; otherwise, setup of neighbors and route learning are affected. A Router ID can be specified when the OSPF process is created. If the Router ID is not specified, it can be elected according to the following rules:

l Select the biggest IP address from loopback interface IP addresses as the Router ID.

l If no loopback interface is configured with an IP address, select the biggest IP address from the IP addresses of other interfaces as the Router ID.

l Only when an interface is in the UP status can the IP address of the interface be elected as the Router ID.

OSPF supports multiple processes, which are identified by different process numbers. The processes are independent of each other, and they do not affect each other.

Table 4‑2 Enable OSPF

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Create an OSPF process and enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | Mandatory. Enable the OSPF process or enable the OSPF process from VRF. By default, OSPF is disabled. If you enable OSPF from VRF, the OSPF process that belongs to a VRF can manage only interfaces under the VRF.
Configure network segments that are covered by an OSPF area. | network ip-address wildcard-mask area area-id | Mandatory. By default, an interface does not belong to any OSPF process or area. A interface can only belong to an OSPF process and area.
Configure the Router ID of the OSPF process. | router-id ip-address | Optional. By default, the election rule based on Router ID is generated. Modifying the Router ID does not make the OSPF neighbor become invalid. To make the new Router ID take effect, you need to reset the process manually.


4.2.2 Configure OSPF Areas

To prevent a large amount of database information from occupying too much CPU and memory, you can divide an OSPF AS into multiple areas. An area can be identified with a 32-bit area ID, a decimal number in the range of 0-4294967295, or an IP address in the range of 0.0.0.0-255.255.255.255. Area 0 or 0.0.0.0 represents an OSPF backbone area, while other non-zero areas are non-backbone areas. All routing information between areas must be forwarded through the backbone area. Non-backbone areas cannot directly exchange routing information.

OSPF defines several types of routers:

l Internal router: All interfaces belong to the devices in one area.

l Area Border Router (ABR): It is connected to devices from different areas.

l Autonomous System Boundary Router (ASBR): It is a device that introduces external routes to the OSPF AS.

Configuration Condition

Before configuring an OSPF area, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l Enable OSPF.

Configure an OSPF NSSA Area

A Not-So-Stub-Area (NSSA) does not allow injection of Type-5 Link State Advertisement (LSA) but it allows injection of Type-7 LSA. External routes can be introduced to an NSSA area through redistribution of configuration. The ASBR in the NSSA area generate Type-7 LSAs and flood LSAs to the NSSA area. The ABR in an NSSA area converts Type-7 LSAs into Type-5 LSAs, and floods the converted Type-5 LSAs into the entire AS.

The OSPF NSSA area that is configured by using the area area-id nssa no-summary command is called a totally NSSA area. An OSPF totally NSSA area does not allow cross-area routes to flood in the area. At this time, the ABR generates a default route and flood it into the NSSA area. The devices in the NSSA area access a network outside the area through the default route.

Table 4‑3 Configure an OSPF NSSA area

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure an NSSA area. | area area-id nssa [ [ default-information-originate [ metric metric-value / metric-type type-value ] / no-redistribution / no-summary / translator-role { always | candidate | never } ] | [ translate-always | translate-candidate | translate-never ] ] | Mandatory. By default, an area is not an NSSA area.

l A backbone area cannot be configured as an NSSA area.

l All devices in one NSSA area must be configured as NSSA areas, because devices with different area types cannot form neighbor relations.

Configure an OSPF Stub Area

A Stub area does not allow external route outside an AS to flood in the area so as to reduce the size of the link status database. After an area is configured as a Stub area, the ABR which is located at the Stub border generates a default route and flood the route into the Stub area. The devices in the Stub area access a network outside the area through the default route.

The OSPF Stub area that is configured by using the area area-id stub no-summary command is called a totally Stub area. An OSPF totally Stub area does not allow inter-area routes and external routes to flood in the area. The devices in the area access a network outside the area and outside the OSPF AS through the default route.

Table 4‑4 Configure an OSPF stub area

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure a Stub area. | area area-id stub [ no-summary ] | Mandatory. By default, an area is not a Stub area.
Configure the ABR in the Stub area to generate the cost value of the default route. | area area-id default-cost cost-value | Optional. By default, the ABR of the Stub area sets the cost value of the default route to 1.

l A backbone area cannot be configured as a Stub area.

l All devices in one Stub area must be configured as Stub areas, because devices with different area types cannot form neighbor relations.

Configure an OSPF Virtual Link

The non-backbone areas in OSPF must synchronize and exchange data through the backbone area. Therefore, all non-backbone areas must keep connected with the backbone area.

If the requirement fails to be met in certain cases, you can solve the problem by configuring a virtual link. After configuring a virtual link, you can configure an authentication mode for the virtual link and modify the Hello interval. The meanings of the parameters are the same as the meanings of the parameter of common OSPF interfaces.

Table 4‑5 Configure an OSPF virtual link

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure an OSPF virtual link. | area transit-area-id virtual-link neighbor-id [ [ authentication [ message-digest | null ] | authentication-key key | message-digest-key key-id { md5 | sm3 } key ] / dead-interval seconds hello-interval seconds / retransmit-interval seconds / transmit-delay seconds ] | Mandatory. By default, no virtual link is created.

l A virtual link must be configured between two ABRs.

l Two ABRs on which the virtual link is configured must be in the same public area. This area is also called the transit area of the virtual link.

l The transit area of a virtual link must not be a Stub area or NSSA area.


4.2.3 Configure OSPF Network Type

According to the link protocol types, OSPF classifies networks into four types:

l Broadcast Network: When the link protocol of the network is Ethernet or Fiber Distributed Data Interface (FDDI), the default OSPF network type is broadcast network.

l Point To Point Network (P2P Network): When the link protocol is Point to Point Protocol (PPP), Link Access Procedure Balanced (LAPB), or High-level Data Link Control (HDLC), the default OSPF network type is P2P network.

l Non-Broadcast Multi-Access Network (NBMA Network): When the link protocol is ATM, frame relay, or X.25, the default OSPF network type is NBMA.

l Point To Multi-Point Network (P2MP): No link protocol will be regarded by OSPF as the P2MP network by default. Usually, the NBMA network that is not totally connected is configured as the OSPF P2MP network.

You can modify the network type of an OSPF interface according to the actual requirement. The network types of the interfaces through which OSPF neighbors are set up must be the same; otherwise, normal learning of routes is affected.

Configuration Condition

Before configuring the OSPF network type, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l Enable OSPF.

Configure the Network Type of an OSPF Interface to Broadcast

A broadcast network supports multiple devices (more than two devices). These devices can exchange information with all the devices in the network. OSPF uses Hello packets to dynamically discover neighbors.

Table 4‑6 Configure the network type of an OSPF interface to broadcast

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the network type of an OSPF interface to broadcast. | ip ospf network broadcast | Mandatory. By default, the network type of an OSPF interface is determined by the link layer protocol.

Configure the Network Type of an OSPF Interface to P2P

A P2P network is a network that consists of two devices. Each device is located at one end of a P2P link. OSPF uses Hello packets to dynamically discover neighbors.

Table 4‑7 Configure the network type of an OSPF interface to P2P

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the OSPF network type to P2P. | ip ospf network point-to-point | Mandatory. By default, the network type of an OSPF interface is determined by the link layer protocol.

Configure the Network Type of an OSPF Interface to NBMA

An NBMA network supports multiple devices (more than two devices), but the devices does not have the broadcast capability, therefore, you must specify a neighbor manually.

Table 4‑8 Configure the network type of an OSPF interface to NBMA

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the OSPF network type to NBMA. | ip ospf network non-broadcast | Mandatory. By default, the network type of an OSPF interface is determined by the link layer protocol.
Enter the global configuration mode. | exit | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure a neighbor for the NBMA network. | neighbor neighbor-ip-address [ cost cost-value / priority priority-value / poll-interval interval-value ] | Mandatory. In an NBMA network, a neighbor must be specified manually.

Configure the Network Type of an OSPF Interface to P2MP

When an NBMA network is not fully connected, you can configure its network type to P2MP to save network overhead. If the network type is configured to P2MP unicast, you need to specify a neighbor manually.

Table 4‑9 Configure the network type of an OSPF interface to P2MP

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the OSPF network type to P2MP. | ip ospf network point-to-multipoint [ non-broadcast ] | Mandatory. By default, the network type of an OSPF interface is determined by the link layer protocol.
Enter the global configuration mode. | exit | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure a neighbor for the P2MP unicast network. | neighbor neighbor-ip-address [ cost cost-value / priority priority-value / poll-interval interval-value ] | If the interface network type is set to P2MP unicast, it is mandatory.


4.2.4 Configure OSPF Network Authentication

To prevent information leakage or malicious attacks to OSPF devices, all packet interaction between OSPF neighbors has the authentication capability. The authentication types include: NULL (no authentication), plain text authentication, and MD5 authentication.

If authentication is configured, an OSPF interface requires authentication before receiving OSPF protocol packets. The OSPF interface receives only packets that have passed authentication. Therefore, the OSPF interfaces through which neighbor relations are set up, their authentication modes, Key IDs, and authentication passwords must be the same.

An authentication mode and an authentication password are configured independently. If an authentication password has been configured but no authentication mode is configured, the authentication mode corresponding to the authentication password will be automatically configured.

An OSPF authentication mode can be configured on an area, interface, or interface address. The priorities that are sorted from low to high include: area authentication, interface authentication, and interface address authentication. That is, the interface address authentication is first used, and then the interface authentication, and finally the area authentication.

Configuration Condition

Before configuring OSPF authentication, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l Enable OSPF.

Configure OSPF Area Authentication

To validate OSPF area authentication, you must configure not only the area authentication mode but also the corresponding authentication password on the interface.

Table 4‑10 Configure OSPF area authentication

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure the area authentication mode. | area area-id authentication [ message-digest ] | Mandatory. By default, area authentication is not configured. The keyword message-digest in the command indicates MD5 authentication; otherwise, plain text authentication is configured.
Enter the interface configuration mode. | interface interface-name | -
Configure a password for plain text authentication. | ip ospf [ ip-address ] authentication-key { 0 | 7 } password | Mandatory. By default, no password is configured for plain text authentication.
Configure a password for MD5 authentication. | ip ospf [ ip-address ] message-digest-key key-id { md5 | sm3 } { 0 | 7 } password | Mandatory. By default, no password is configured for MD5 or SM3 authentication.

Configure OSPF Interface Authentication

If an OSPF interface has multiple IP addresses, you can set an authentication mode or authentication password for one IP address of the interface. If you do not specify an interface address, all addresses of the interface use the specified authentication mode or authentication password.

Table 4‑11 Configure OSPF interface authentication

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the interface authentication mode. | ip ospf [ ip-address ] authentication [ message-digest | null ] | Mandatory. By default, interface authentication mode is not configured. The keyword message-digest in the command indicates MD5 authentication, and the keyword null indicates no authentication; otherwise, plain text authentication is configured.
Configure a password for plain text authentication. | ip ospf [ ip-address ] authentication-key { 0 | 7 } password | Mandatory. By default, no password is configured for plain text authentication.
Configure a password for MD5 authentication. | ip ospf [ ip-address ] message-digest-key key-id { md5 | sm3 } { 0 | 7 } password | Mandatory. By default, no password is configured for MD5 or SM3 authentication.


4.2.5 Configure OSPF Route Generation

OSPF uses the network command to cover routes of the directly connected network segment. It can also redistribute external routes or use the host command to add host routes.

Configuration Condition

Before configuring OSPF route generation, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l Enable OSPF.

Configure OSPF to Redistribute Routes

If multiple routing protocols run on one device, routes of other protocols can be introduced to OSPF through redistribution. By default, class 2 external routes of OSPF are generated, with the routing metric 20. When you introduces external routes through redistribution, you can modify the external route type, metric, and tag field, and configure the required routing policy to perform route control and management.

Table 4‑12 Configure OSPF to redistribute routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure OSPF to redistribute routes. | redistribute protocol [ protocol-id ] [ metric metric-value / metric-type metric-type / tag tag-value / route-map route-map-name / match route-type ] | Mandatory. By default, route redistribution is not configured for OSPF.
Configure the metric of the OSPF external routes. | default-metric metric-value | Optional.

l If the metric value of external routes are configured by using both the r edistribute protocol [ protocol-id ] metric command and the default-metric command, the value that is configured by using the former command has a higher priority.

Configure the Default OSPF Route

After an OSPF Stub area or a totally NSSA areas is configured, a Type-3 default route is generated. For an NSSA area, no default route is automatically generated. You can use the area area-id nssa default-information-originate command to introduce a Type-7 default route to the NSSA area.

OSPF cannot use the redistribute command to introduce a Type-5 default route. To do this, use the default-information originate [ always ] command.

Table 4‑13 Configure the default OSPF route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure OSPF to introduce a default route. | default-information originate [ always / metric metric-value / metric-type metric-type / route-map route-map-name ] | Mandatory. By default, no external default route is introduced to an OSPF AS. The default metric of the introduced default route is 1, and the type is external type 2. The field always means to force the OSPF AS to generate a default route; otherwise, the default route is generated only when there is a default route in the local routing table.

Configure the OSPF Host Route

Table 4‑14 Configure the OSPF host route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure the OSPF host route. | host ip-address area area-id [ cost cost ] | Mandatory. By default, no host route is generated.


4.2.6 Configure OSPF Route Control

Configuration Condition

Before configuring OSPF route control, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l Enable OSPF.

Configure Route Summary on Inter-Area OSPF Routes

When an ABR in OSPF advertises inter-area routes to other areas, it advertises each route separately in the form of Type-3 LSA. You can use the inter-area route summary function to summarize some continuous network segments to form a summary route. Then the ABR advertises the summary route, reducing the size of OSPF databases.

Table 4‑15 Configure route summary on inter-area OSPF routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure route summary on inter-area OSPF routes. | area area-id range ip-address/mask-length [ advertise [ cost cost ] | cost cost | not-advertise ] | Mandatory. By default, an ABR does not summarize inter-area routes.

l The OSPF inter-area route summary function is valid only for ABRs.

l By default, the minimum cost value among the cost values of the routes in the route summary is used as the cost value of the route summary.

Configure OSPF External Route Summary

When OSPF redistributes external routes, it advertises each route separately in the form of external LSA. You can use the external route summary function to summarize some continuous network segments to form a summary route. Then OSPF advertises the summary route, reducing the size of OSPF databases.

If you run the summary-address command on an ASBR, you can summarize all Type-5 LSAs and Type-7 LSAs within the address range.

Table 4‑16 Configure OSPF external route summary

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure OSPF to summarize external routes. | summary-address ip-address mask [ not-advertise | tag tag-value ] | Mandatory. By default, an ABR does not summarize external routes.

l The OSPF external route summary function is valid only for ASBRs.

Configure Route Filtering on Inter-Area OSPF Routes

When an ABR receives inter-area routes, it performs filtration in the incoming direction based on an ACL or prefix list. When the ABR advertises inter-area routes, it performs filtration in the outgoing direction based on an ACL or prefix list.

Table 4‑17 Configure route filtering on inter-area OSPF routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure route filtering on intra-area OSPF routes. | area area-id filter-list { access { access-list-name | access-list-number } | prefix prefix-list-name } { in | out } | Mandatory. By default, an ABR does not filter inter-area routes.

l In filtration based on ACL, only a standard ACL is supported.

l The OSPF inter-area route filtering function is valid only for ABRs.

Configure OSPF External Route Filtration

Configuring OSPF external route filtering is to apply an ACL or prefix list to allow or not allow external routes of an OSPF AS to flood into the OSPF AS.

Table 4‑18 Configure OSPF external route filtration

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure a distribution list to filter external routes. | distribute-list { access-list-name | access-list-number | prefix prefix-list-name } out [ routing-protocol [ process-id ] ] | Mandatory. By default, an ASBR does not filter external routes.

l In filtration based on ACL, only a standard ACL is supported.

l The OSPF external route filtering function is valid only for ASBRs.

Configure OSPF Route Installation Filtration

After OSPF calculates routes through LSA, to prevent certain routes from being added into the routing table, OSPF filters the calculated OSPF routing information.

Three filtration methods are available:

l Filtration based on the prefix. An ACL or prefix list is used to filter the destination addresses of routes.

l Filtration based on the next hop. A prefix list is used to filter the next hops of the routes. You can also use a prefix list to filter both the destination addresses and next hops of the routes.

l Filtration of routes based on the routing policy.

Table 4‑19 Configure OSPF route installation filtration

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure OSPF to prohibit installed routes. | distribute-list { access-list-name | access-lsit-number | gateway prefix-list-name1 | prefix prefix-list-name2 [ gateway prefix-list-name3 ] | route-map route-map-name } in [ interface-name ] | Mandatory. By default, the installed routes are not filtered.

l Filtration based on prefix, gateway, and route-map is mutual exclusive with filtration based on ACL. For example, if you have configured filtration based on prefix, you cannot configure filtration based on ACL again.

l Filtration based on route-map and prefix is mutual exclusive with filtration based on gateway.

l Filtration based on prefix and filtration based on gateway overwrite each other.

Configure the Cost Value of an OSPF Interface

By default, the cost of an OSPF interface is calculated based on the following formula: Reference bandwidth/Interface bandwidth.

Table 4‑20 Configure the cost value of an OSPF interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the cost value of an OSPF interface. | ip ospf [ ip-address ] cost cost-value | Optional. By default, the cost value is calculated through the formula Reference bandwidth/Interface bandwidth.

Configure the OSPF Reference Bandwidth

The reference bandwidth of an interface is used to calculate the cost value of the interface. The default value is 100Mbit/s. The formula for calculating the cost value of the OSPF interface is: Reference bandwidth/Interface bandwidth. If the calculation result is larger than 1, use the integer part. If the calculation result is smaller than 1, use the value 1. Therefore, in a network whose bandwidth is larger than 100Mbit/s, the optimal route fails to be selected. In this case, you can use the auto-cost reference-bandwidth command to configure a proper reference bandwidth to solve the problem.

Table 4‑21 Configure the OSPF reference bandwidth

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configuring the OSPF interface reference bandwidth. | auto-cost reference-bandwidth reference-bandwidth | Optional. By default, the reference bandwidth is 100Mbit/s.

Configure the OSPF Administrative Distance

An administrative distance is used to indicate the reliability of the routing protocol. If the routes to the same destination network are learnt by different routing protocols, the route with the smallest administrative distance is selected with priority.

Table 4‑22 Configure the OSPF administrative distance

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure the OSPF administrative distance. | distance { distance [ source-ip-address wildcard-mask [ access-list-number | access-list-name ] ] | ospf { external distance | inter-area distance | intra-area distance } } | Optional. By default, the administrative distance of intra-area and inter-area OSPF routes is 110, and the administrative distance of external routes is 150.

Configure the Maximum Number of OSPF Load Balancing Routes

If multiple equivalent paths are available to reach the same destination, load balancing is achieved. This improves the utility rate of links and reduces the load of the links.

Table 4‑23 Configure the maximum number of OSPF load balancing routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure the maximum number of OSPF load balancing routes. | maximum-path max-number | Optional. By default, the maximum number of OSPF load balancing routes is 4.

Configure OSPF to Be Compatible with RFC1583

If there exist multiple paths to an ASBR or external route forwarding address, RFC1583 and RFC2328 define different routing rules. If OSPF is configured to be compatible with RFC1583, the intra-area or inter-area paths in the backbone area is selected with priority. If OSPF is configured not to be compatible with RFC1583, the intra-area paths in non-backbone networks are selected with priority.

Table 4‑24 Configure OSPF to be compatible with RFC1583

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure OSPF to be compatible with RFC1583. | compatible rfc1583 | Mandatory. By default, OSPF is not compatible with RFC1583.

l In an OSPF AS, the routing rules of all the devices must be the same, that is, they must be all configured to be compatible with or not compatible with RFC1583 to prevent routing loops.


4.2.7 Configure OSPF Network Optimization

Configuration Condition

Before configuring OSPF network optimization, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l Enable OSPF.

Configure the Keep-alive Time of an OSPF Neighbor

OSPF Hello packets are used to set up neighbor relations and keep the relations alive. The default transmission interval of Hello packets is determined by the network type. For broadcast networks and P2P networks, the default transmission interval of Hello packets is 10s. For P2MP networks and NBMA networks, the default transmission interval of Hello packets is 30s.

Neighbor dead time is used to determine the validity of a neighbor. By default, the neighbor dead time is four times the Hello interval. If an OSPF device fails to receive Hello packets from a neighbor after the neighbor dead time times out, the OSPF device regards the neighbor as invalid, and then it deletes the neighbor in an active manner.

Table 4‑25 Configure the keep-alive time of an OSPF neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure an OSPF Hello interval. | ip ospf [ ip-address ] hello-interval interval-value | Optional. The default value is determined by the network type. For broadcast networks and P2P networks, the default value is 10s. For P2MP networks and NBMA networks, the default value is 30s.
Configure the OSPF neighbor dead time. | ip ospf [ ip-address ] dead-interval interval-value | Optional. By default, the time is four times the Hello interval.

l The Hello interval and neighbor dead time of OSPF neighbors must be the same; otherwise, they cannot set up neighbor relations.

l When you modify the Hello interval, if the current neighbor dead time is four times the Hello interval, the neighbor dead time is automatically modified to be still four times the new Hello interval. If the current neighbor dead time is not four times the Hello interval, the neighbor dead time keeps unchanged.

l If you modify the neighbor dead time, the Hello interval is not affected.

Configure an OSPF Passive Interface

The dynamic routing protocol adopts a passive interface to effectively decrease the network bandwidth consumed by the routing protocol. After an OSPF passive interface is configured, you can use the network command to advertise the routes of the directly connected network segment in which the interface is located, but the receiving and transmitting of OSPF packets are damped on the interface.

Table 4‑26 Configure an OSPF passive interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure an OSPF passive interface. | passive-interface { interface-name [ ip-address ] | default } | Mandatory. By default, no OSPF passive interface is configured.

l When a large number of interfaces need to be configured as the passive interfaces, to avoid too large configuration file, first run the passive-interface default command to configure all interfaces as passive interface. Then, run the no passive-interface command to for the interfaces that do not need to be configured as passive interfaces.

Configure an OSPF Demand Circuit

On P2P and P2MP links, to decrease the line cost, you can configure an OSPF demand circuit to suppress periodical transmitting of Hello packets and periodical update of LSA packets. This function is mainly applied on charged links such as ISDN, SVC, and X.25.

Table 4‑27 Configure an OSPF demand circuit

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure an OSPF demand circuit. | ip ospf [ ip-address ] demand-circuit | Mandatory. By default, no OSPF demand circuit is enabled.

Configure the Priority of an OSPF Interface

Interface priorities are mainly used in election of Designated Router (DR), and Backup Designated Router (BDR) in broadcast networks and NBMA networks. The value range is 0-255. The larger the value is, the higher the priority is. The default value is 1.

The DR and BDR are selected from all devices in a network segment based on interface priorities and Router IDs through Hello packets. The rules are as follows:

l First, the device whose interface has the highest priority is elected as the DR, and the device whose interface has the second highest priority is elected as the BDR. The device whose interface has the priority 0 does not participate in the election.

l If the interface priorities of two devices are the same, the device with the largest Router ID is elected as the DR, and the device with the second largest Router ID is elected as the BDR.

l If the DR fails, the BDR becomes the DR immediately, and a new BDR is elected.

Table 4‑28 Configure the priority of an OSPF interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the priority of an OSPF interface. | ip ospf priority priority-value | Optional. By default, the OSPF interface priority is 1.

l Interface priorities affect only an election process. If the DR and BDR have already been elected, modification of interface priorities does not affect the election result; instead, it affects the next election of DR or BDR. Therefore, the DR may not have the interface with the highest priority, and the BDR may not have the interface with the second highest priority.

Configure the MTU of an OSPF Interface

In encapsulating OSPF packets, to prevent fragmentation, you need to limit the packet size to equal to or smaller than Maximum Transmission Unit (MTU) of the interface. When adjacent OSPF devices exchange DD packets, MTUs are checked by default. If the MTUs are different, the devices cannot form a neighbor relation. If you have configured OSPF to ignore interface MTU check, even if MTUs are different, they can set up a neighbor relation.

Table 4‑29 Configure the MTU of an OSPF interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the MTU of an OSPF interface. | ip ospf mtu mtu-value | Optional.
Configure the OSPF interface to ignore MTU consistency check. | ip ospf [ ip-address ] mtu-ignore | Mandatory. By default, an MTU consistency check will be performed.

Configure the LSA Transmit Delay of an OSPF Interface

LSA transmit delay refers to the time it takes for an LSA to flood to other devices. The device that sends the LSA adds the interface transmit delay to the LSA aging time. By default, once the flooding LSA passes a device, the aging time is increased by 1. You can configure the LSA transmit delay according to the network conditions. The value range is 1-840. LSA transmit delay is usually configured on low-speed links.

Table 4‑30 Configure the LSA transmit delay of an OSPF interface

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the LSA transmit delay of an OSPF interface. | ip ospf transmit-delay delay-value | Optional. By default, the LSA transmit delay is 1s.

Configure OSPF LSA Retransmission

To ensure the reliability of data exchange, OSPF adopts the acknowledgement mechanism. If an LSA floods on a device interface, the LSA is added into the retransmission list of the neighbor. If no acknowledgement message is received from the neighbor after the retransmission time times out, the LSA is retransmitted until an acknowledgement message is received.

The retransmission interval remains unchanged or increases exponentially as required by the network. When the retransmission time remains unchanged, run the ip ospf retransmit-interval command to change the retransmission interval. When the retransmission interval increases exponentially, run the ip ospf retransmit-intervalcommand to change the initial transmission time. The initial retransmission interval is 5s by default. If the retransmission interval exceeds 300s, the transmission interval is considered as 300s.

Table 4‑31 Configure OSPF LSA retransmission

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure that OSPF LSA retransmission interval increases exponentially | ip ospf retransmit-control backoff | Optional By default, the retransmission interval increases exponentially.
Configure the interval of OSPF LSA retransmission. | ip ospf retransmit-interval interval-value | Optional. By default, the retransmission interval is 5s.

Configure OSPF to Prevent LSA Flooding

In actual network applications, redundant links may be used between OSPF neighbors under some circumstances. This configuration helps to decrease flooding of OSPF update packets on redundant links.

Table 4‑32 Configure OSPF to prevent LSA flooding

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Configure the OSPF interface to prevent LS-UPD flooding. | ip ospf database-filter all out | Mandatory. By default, the OSPF interface does not prevent LSA flooding.

l Configuring OSPF to prevent LSA spreading may result in loss of some routing information.

Configure OSPF SPF Calculation Time

If the OSPF network topology changes, routes need to be re-calculated. When the network continues to change, frequent route calculation occupies a lot of system resources. You can adjust the SPF calculation time parameters to prevent frequent network changes from consuming too many system resources.

Table 4‑33 Configure OSPF SPF calculation time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure OSPF SPF calculation time. | timers throttle spf delay-time hold-time max-time | Optional. By default, delay-time is 5000ms, hold-time is 10000ms, and max-time is 10000ms.

l The parameter delay-time indicates the initial calculation delay, hold-time indicates the suppression time, and max-time indicates the maximum waiting time between two SPF calculations. If network changes are not frequent, you can shorten the continuous route calculation interval to delay-time. If network changes are frequent, you can adjust the parameters, increase the suppression time to hold-time×2n-2 (n is the number of route calculation trigger times), extend the waiting time based on the configured hold-time increment and the maximum value must not exceed max-time.

Configure OSPF Database Overflow

OSPF database overflow is used to limit the number of Type-5 LSAs in the database.

Table 4‑34 Configure OSPF Databases overflow

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Configure OSPF database overflow. | overflow database external max-number seconds | Mandatory. By default, the OSPF database overflow function is disabled.

l After the database overflow function is enabled, the databases in the OSPF area may become inconsistent, and some routes get lost.


4.2.8 Configure OSPF to Coordinate with BFD

Configuration Condition

Before configuring OSPF to coordinate with BFD, ensure that:

l Interface IP addresses have been configured so that neighbor nodes are reachable at the network layer.

l Enable OSPF.

Configure OSPF to Coordinate with BFD

Bidirectional Forwarding Detection (BFD) provides a method for quickly detecting the status of a line between two devices. If BFD is started between two adjacent OSPF devices, if the line between two devices becomes faulty, BFD quickly detects the fault and informs OSPF of the fault. Then, it triggers OSPF to start route calculation and switch over to the backup line, achieving fast switchover of routes.

Table 4‑35 Configure OSPF to coordinate with BFD

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the interface configuration mode. | interface interface-name | -
Enable or disable BFD on the specified OSPF interface. | ip ospf bfd [ ip-address | disable ] | Mandatory. By default, the BFD function is disabled.
Enter the global configuration mode. | exit | -
Enter the OSPF configuration mode. | router ospf process-id [ vrf vrf-name ] | -
Enable BFD on all interfaces of the OSPF process. | bfd all-interface | Optional.

l If BFD is configured both in OSPF configuration mode and interface configuration mode, the BFD configuration on the interface has the higher priority.


4.2.9 OSPF Monitoring and Maintaining

Table 4‑36 OSPF monitoring and maintaining

Command | Description
clear ip ospf [ process-id ] process | Reset an OSPF process.
clear ip ospf process-id neighbor neighbor-ip-address [ neighbor-router-id ] | Reset an OSPF neighbor.
clear ip ospf err-statistic | Clear the OSPF error statistics information.
clear ip ospf statistics [ interface-name ] | Clear OSPF interface statistics.
clear ip ospf [ process-id ] redistribution | Re-advertises external routes.
clear ip ospf [ process-id ] route | Re-calculate OSPF routes.
show ip ospf [ process-id ] | Display the OSPF basic information.
show ip ospf [ process-id ] border-routers | Display the information about the routes that have reached the boundary devices in OSPF.
show ip ospf [ process-id ] buffers | Display the size of the OSPF packet transmitting and receiving buffer.
show ip ospf [ process-id ] database [ adv-router router-id | age lsa_age | database-summary | max-age | [ asbr-summary | external | network | nssa-external | opaque-area | opaque-as | opaque-link | router | self-originate | summary ] [ [ link-state-id ] [ adv-router advertising-router-id ] | self-originate | summary ] ] | Display the information about an OSPF database.
show ip ospf error-statistic | Display the OSPF error statistics information
show ip ospf interface [ interface-name [ detail ] ] | Display the information about an OSPF interface.
show ip ospf [ process-id ] neighbor [ neighbor-id | all | detail [ all ] | interface ip-address [ detail ] | statistic ] | Display the information about OSPF neighbors.
show ip ospf process-id retransmit-list | Display the retransmission list information
show ip ospf route [ ip-address mask | ip-address/mask-length | external | inter-area | intra-area | statistic ] | Display the information about OSPF routes.
show ip ospf [ process-id ] virtual-links | Display the information about OSPF virtual links.
show ip ospf [ process-id ] sham-links | Display the information about an interface on which OSPF sham links are configured. The information include interface status, cost value, and neighbor status.


4.3 OSPF Typical Configuration Example


4.3.1 Configure Basic OSPF Functions

Network Requirements

l Configure OSPF for all devices, and divide the devices into three areas: Area 0, Area 1, and Area 2. After configuration, all devices should be able to learn routes from each other.

l On a back-to-back Ethernet interface, to speed up set of OSPF neighbors, you can change the network type of the OSPF interface to P2P. Modify the network type of the interfaces in Area 2 to P2P. After the configuration, all devices can learn routes from each other.

Network Topology

Figure 4‑1 Networking for configuring basic OSPF functions

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure an OSPF process and let the interface cover different areas.

#On Device1, configure an OSPF process and configure the interfaces to cover area 1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 1

Device1(config-ospf)#network 100.0.0.0 0.0.0.255 area 1

Device1(config-ospf)#exit

#On Device2, configure an OSPF process and configure the interfaces to cover Area 0 and Area 1.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 10.0.0.0 0.0.0.255 area 1

Device2(config-ospf)#exit

#On Device3, configure an OSPF process and configure the interfaces to cover Area 0 and Area 2.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#router-id 3.3.3.3

Device3(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 30.0.0.0 0.0.0.255 area 2

Device3(config-ospf)#exit

#On Device4, configure an OSPF process and configure the interfaces to cover area 2.

Device4#configure terminal

Device4(config)#router ospf 100

Device4(config-ospf)#router-id 4.4.4.4

Device4(config-ospf)#network 30.0.0.0 0.0.0.255 area 2

Device4(config-ospf)#network 200.0.0.0 0.0.0.255 area 2

Device4(config-ospf)#exit

l A Router IDs can be manually configured or automatically generated. If a Router ID is not manually configured, the device automatically selects a Router ID. The device first selects the largest IP address among Loopback interface IP addresses as the Router ID. If the device is not configured with Loopback interface IP addresses, then it selects the largest IP addresses among common interface IP addresses as the Router ID. Only when an interface is in the UP status can the IP address of the interface be selected as the Router ID.

l In using the network command, the wildcard mask need not accurately match the mask length of the interface IP addresses, but the network segment needs to cover the interface IP addresses. For example, network 0.0.0.0 255.255.255.255 means to cover all interfaces.

#Query the OSPF neighbors and routing table of Device1.

Device1#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

2.2.2.2 1 Full/DR 00:00:36 10.0.0.2 gigabitethernet1

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 02:26:21, gigabitethernet1

O 20.0.0.0/24 [110/2] via 10.0.0.2, 02:25:36, gigabitethernet1

O 30.0.0.0/24 [110/3] via 10.0.0.2, 02:25:36, gigabitethernet1

C 100.0.0.0/24 is directly connected, 02:26:23, gigabitethernet0

C 127.0.0.0/8 is directly connected, 18:09:44, lo0

O 200.0.0.0/24 [110/4] via 10.0.0.2, 02:25:36, gigabitethernet1

#Query the OSPF neighbors and routing table of Device2.

Device2#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

1.1.1.1 1 Full/Backup 00:00:37 10.0.0.1 gigabitethernet0

3.3.3.3 1 Full/DR 00:00:38 20.0.0.2 gigabitethernet1

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 02:31:15, gigabitethernet0

C 20.0.0.0/24 is directly connected, 02:31:50, gigabitethernet1

O 30.0.0.0/24 [110/2] via 20.0.0.2, 02:31:40, gigabitethernet1

O 100.0.0.0/24 [110/2] via 10.0.0.1, 02:30:29, gigabitethernet0

C 127.0.0.0/8 is directly connected, 240:21:34, lo0

O 200.0.0.0/24 [110/3] via 20.0.0.2, 02:31:40, gigabitethernet1

#Query OSPF Link Status Database (LSDB) of Device2.

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.2 2.2.2.2 1777 0x8000000c 0xcb20 1

3.3.3.3 3.3.3.3 309 0x8000000a 0x9153 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

20.0.0.2 3.3.3.3 369 0x80000006 0xec12

Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Route

10.0.0.0 2.2.2.2 1757 0x80000005 0xcc59 10.0.0.0/24

100.0.0.0 2.2.2.2 1356 0x80000005 0x408a 100.0.0.0/24

30.0.0.0 3.3.3.3 9 0x80000006 0xa765 30.0.0.0/24

200.0.0.0 3.3.3.3 149 0x80000006 0x075a 200.0.0.0/24

Router Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 1775 0x80000009 0xbbda 2

2.2.2.2 2.2.2.2 1737 0x80000008 0x2dd5 1

Net Link States (Area 1)

Link ID ADV Router Age Seq# CkSum

10.0.0.2 2.2.2.2 34 0x80000006 0x39db

Summary Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Route

20.0.0.0 2.2.2.2 144 0x80000006 0x48d2 20.0.0.0/24

30.0.0.0 2.2.2.2 1186 0x80000005 0xd13f 30.0.0.0/24

200.0.0.0 2.2.2.2 14 0x80000006 0x2f35 200.0.0.0/24

For Device2, routes 30.0.0.0/24 and 200.0.0.0/24 are inter-area routes. You can query the LSA information of the related routes in Summary Link States (Area 0). In the case of intra-area routes, run the show ip ospf database routercommand to query the LSA information of the related routes.

Step 3:

Configure the network type of OSPF interfaces to P2P.

#On Device3, configure the OSPF network type of interface gigabitethernet 1 to P2P.

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip ospf network point-to-point

Device3(config-if-gigabitethernet1)#exit

#On Device4, configure the OSPF network type of interface gigabitethernet 0 to P2P.

Device4(config)#interface gigabitethernet0

Device4(config-if-gigabitethernet0)#ip ospf network point-to-point

Device4(config-if-gigabitethernet0)#exit

Step 4:

Check the result.

#Query the OSPF neighbors and routing table of Device3.

Device3#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

2.2.2.2 1 Full/Backup 00:00:36 20.0.0.1 gigabitethernet0

4.4.4.4 1 Full/ - 00:00:39 30.0.0.2 gigabitethernet1

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.0.0.0/24 [110/2] via 20.0.0.1, 00:02:53, gigabitethernet0

C 20.0.0.0/24 is directly connected, 03:20:36, gigabitethernet0

C 30.0.0.0/24 is directly connected, 03:20:26, gigabitethernet1

O 100.0.0.0/24 [110/3] via 20.0.0.1, 00:01:51, gigabitethernet0

C 127.0.0.0/8 is directly connected, 262:01:24, lo0

O 200.0.0.0/24 [110/2] via 30.0.0.2, 00:00:11, gigabitethernet1

l If OSPF neighbor relations are set up in a P2P network, no DR or BDR election will be performed.

#Query the OSPF neighbors and routing table of Device4.

Device4#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

3.3.3.3 1 Full/ - 00:00:39 30.0.0.1 gigabitethernet0

Device4#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.0.0.0/24 [110/3] via 30.0.0.1, 00:01:04, gigabitethernet0

O 20.0.0.0/24 [110/2] via 30.0.0.1, 00:01:04, gigabitethernet0

C 30.0.0.0/24 is directly connected, 03:20:25, gigabitethernet0

O 100.0.0.0/24 [110/4] via 30.0.0.1, 00:01:04, gigabitethernet0

C 127.0.0.0/8 is directly connected, 22:52:36, lo0

C 200.0.0.0/24 is directly connected, 03:20:13, gigabitethernet1

After the network type of OSPF interfaces are modified to P2P, neighbors can be set up normally, and routes can be learned normally.

l In configuring network types for OSPF interfaces, the network types of OSPF interfaces at the two ends of neighbors must be the same; otherwise, routing learning and flooding will be affected. By default, the network type of an OSPF interface is determined by the network type of the physical interface.


4.3.2 Configuring OSPF Authentication

Network Requirements

l Configure OSPF for all devices run OSPF, and configure area authentication for the devices. Configure simple text authentication for Area 0, and configure MD5 authentication for Area 1.

l Configure OSPF interface authentication, configure interface authentication of Area 0 to simple text authentication, and configure interface authentication of Area 1 to MD5 authentication.

l After configuration is completed, devices should able to normally set up neighbor relations and learn route from each other.

Network Topology

Figure 4‑2 Networking for configuring OSPF authentication

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure an OSPF process, and configure the interfaces to cover different areas, and enable area authentication. Configure the simple text authentication for Area 0, and configure the MD5 authentication for Area 1.

#On Device1, configure an OSPF process and configure the area authentication function.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#area 0 authentication

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#On Device2, configure an OSPF process and configure the area authentication function.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#area 0 authentication

Device2(config-ospf)#area 1 authentication message-digest

Device2(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 20.0.0.0 0.0.0.255 area 1

Device2(config-ospf)#exit

#On Device3, configure an OSPF process and configure the area authentication function.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#router-id 3.3.3.3

Device3(config-ospf)#area 1 authentication message-digest

Device3(config-ospf)#network 20.0.0.0 0.0.0.255 area 1

Device3(config-ospf)#exit

#Query the OSPF process information of Device1.

Device1#show ip ospf 100

Routing Process "ospf 100" with ID 1.1.1.1

Process bound to VRF default

Process uptime is 30 minutes

IETF NSF restarter support disabled

IETF NSF helper support enabled

Conforms to RFC2328, and RFC1583Compatibility flag is disabled

Supports only single TOS(TOS0) routes

Supports opaque LSA

Supports Graceful Restart

Initial SPF schedule delay 5000 msecs

Minimum hold time between two consecutive SPFs 10000 msecs

Maximum wait time between two consecutive SPFs 10000 msecs

Refresh timer 10 secs

Number of external LSA 0. Checksum Sum 0x000000

Number of opaque AS LSA 0. Checksum Sum 0x000000

Number of non-default external LSA is 0

External LSA database is unlimited.

Not Support Demand Circuit lsa number is 0, autonomy system support flood DoNotAge Lsa

Number of areas attached to this router: 1

Area 0 (BACKBONE) Number of interfaces in this area is 1(1)

Number of fully adjacent neighbors in this area is 1

Number of fully adjacent sham-link neighbors in this area is 0

Area has simple password authentication

SPF algorithm last executed 00:27:43.916 ago

SPF algorithm executed 3 times

Number of LSA 4. Checksum Sum 0x0160f7

Not Support Demand Circuit lsa number is 0,

Indication lsa (by other routers) number is: 0,

Area support flood DoNotAge Lsa

According to the queried information, the area authentication is the simple text authentication mode.

#Query the OSPF neighbors and routing table of Device1.

Device1#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

2.2.2.2 1 Full/DR 00:00:38 10.0.0.2 gigabitethernet0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:14:01, gigabitethernet0

O 20.0.0.0/24 [110/2] via 10.0.0.2, 00:10:38, gigabitethernet0

C 127.0.0.0/8 is directly connected, 20:55:08, lo0

On Device1, neighbors can be normally set up, and routes can be learnt normally.

#Query the OSPF process information of Device3.

Device3#show ip ospf 100

Routing Process "ospf 100" with ID 3.3.3.3

Process bound to VRF default

Process uptime is 28 minutes

IETF NSF restarter support disabled

IETF NSF helper support enabled

Conforms to RFC2328, and RFC1583Compatibility flag is disabled

Supports only single TOS(TOS0) routes

Supports opaque LSA

Supports Graceful Restart

Initial SPF schedule delay 5000 msecs

Minimum hold time between two consecutive SPFs 10000 msecs

Maximum wait time between two consecutive SPFs 10000 msecs

Refresh timer 10 secs

Number of external LSA 0. Checksum Sum 0x000000

Number of opaque AS LSA 0. Checksum Sum 0x000000

Number of non-default external LSA is 0

External LSA database is unlimited.

Not Support Demand Circuit lsa number is 0, autonomy system support flood DoNotAge Lsa

Number of areas attached to this router: 1

Area 1 Number of interfaces in this area is 1(1)

Number of fully adjacent neighbors in this area is 1

Number of fully adjacent sham-link neighbors in this area is 0

Number of fully adjacent virtual neighbors through this area is 0

Area has message digest authentication

SPF algorithm last executed 00:24:01.783 ago

SPF algorithm executed 5 times

Number of LSA 4. Checksum Sum 0x0337cf

Not Support Demand Circuit lsa number is 0,

Indication lsa (by other routers) number is: 0,

Area support flood DoNotAge Lsa

According to the queried information, the area authentication is the MD5 authentication mode.

#Query the OSPF neighbors and routing table of Device3.

Device3#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

2.2.2.2 1 Full/Backup 00:00:33 20.0.0.1 gigabitethernet0

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.0.0.0/24 [110/2] via 20.0.0.1, 00:09:31, gigabitethernet0

C 20.0.0.0/24 is directly connected, 00:20:36, gigabitethernet0

C 127.0.0.0/8 is directly connected, 24:00:06, lo0

On Device3, neighbors can be normally set up, and routes can be learnt normally.

Step 3:

Configure OSPF interface authentication.

#On Device1, configure interface gigabitethernet 0 with simple text authentication, and set the password to admin.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip ospf authentication

Device1(config-if-gigabitethernet0)#ip ospf authentication-key 0 admin

Device1(config-if-gigabitethernet0)#exit

#On Device2, configure interface gigabitethernet 0 with simple text authentication, and set the password to admin. Configure interface gigabitethernet 1 with MD5 authentication, set Key ID to 1, and set password to admin.

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip ospf authentication

Device2(config-if-gigabitethernet0)#ip ospf authentication-key 0 admin

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip ospf authentication message-digest

Device2(config-if-gigabitethernet1)#ip ospf message-digest-key 1 md5 0 admin

Device2(config-if-gigabitethernet1)#exit

#On Device3, configure interface gigabitethernet 0 with MD5 authentication, set Key ID to 1, and set password to admin.

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip ospf authentication message-digest

Device3(config-if-gigabitethernet0)#ip ospf message-digest-key 1 md5 0 admin

Device3(config-if-gigabitethernet0)#exit

Step 4:

Check the result.

#Query the OSPF neighbor information of Device2.

Device2#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

1.1.1.1 1 Full/Backup 00:00:33 10.0.0.1 gigabitethernet0

3.3.3.3 1 Full/DR 00:00:39 20.0.0.2 gigabitethernet1

#Query the OSPF interface information of Device2.

Device2#show ip ospf interface gigabitethernet0

gigabitethernet0 is up, line protocol is up

Internet Address 10.0.0.2, 10.0.0.255( a[10.0.0.2] d[10.0.0.255]) Area 0, MTU 1500

Process ID 100, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 1

Transmit Delay is 1 sec, State DR, Priority 1, TE Metric 0

Designated Router (ID) 2.2.2.2, Interface Address 10.0.0.2

Backup Designated Router (ID) 1.1.1.1, Interface Address 10.0.0.1

Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

Hello due in 00:00:04

Neighbor Count is 1, Adjacent neighbor count is 1

Crypt Sequence Number is 0

Hello received 406 sent 454, DD received 8 sent 6

LS-Req received 2 sent 2, LS-Upd received 11(LSA: 15) sent 10(LSA: 14)

LS-Ack received 10 sent 0, Discarded 0

Device2#show ip ospf interface gigabitethernet1

gigabitethernet1 is up, line protocol is up

Internet Address 20.0.0.1, 20.0.0.255( a[20.0.0.1] d[20.0.0.255]) Area 1, MTU 1500

Process ID 100, Router ID 2.2.2.2, Network Type BROADCAST, Cost: 1

Transmit Delay is 1 sec, State Backup, Priority 1, TE Metric 0

Designated Router (ID) 3.3.3.3, Interface Address 20.0.0.2

Backup Designated Router (ID) 2.2.2.2, Interface Address 20.0.0.1

Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

Hello due in 00:00:00

Neighbor Count is 1, Adjacent neighbor count is 1

Crypt Sequence Number is 485

Hello received 412 sent 454, DD received 9 sent 12

LS-Req received 3 sent 3, LS-Upd received 9(LSA: 10) sent 13(LSA: 16)

LS-Ack received 13 sent 8, Discarded 0

After MD5 authentication is configured, a Crypt Sequence Number is generated. In the case of simple text authentication, no sequence number is generated.

l In configuring OSPF authentication, you can configure only area authentication or interface authentication, or configure both of them.

l If both area authentication and interface authentication are configured, interface authentication takes effect first.


4.3.3 Configuring OSPF to Redistribute Routes

Network Requirements

l Run OSPF between Device1 and Device2, and run RIPv2 between Device2 and Device3.

l Device2 redistributes RIP routes to OSPF, and it uses a route policy to control the device to only redistribute route 100.0.0.0/24.

Network Topology

Figure 4‑3 Networking for configuring OSPF to redistribute routes

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF between Device and Device2. Configure RIPv2 between Device2 and Device3.

#Configure OSPF for Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure OSPF and RIPv2 for Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 20.0.0.0

Device2(config-rip)#exit

#Configure RIPv2 for Device3.

Device3#configure terminal

Device3(config)#router rip

Device3(config-rip)#version 2

Device3(config-rip)#network 20.0.0.0

Device3(config-rip)#network 100.0.0.0

Device3(config-rip)#network 110.0.0.0

Device3(config-rip)#exit

#Query the OSPF neighbor information of Device1.

Device1#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

2.2.2.2 1 Full/DR 00:00:32 10.0.0.2 gigabitethernet0

#Query the OSPF neighbor information of Device2.

Device2#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

1.1.1.1 1 Full/Backup 00:00:32 10.0.0.1 gigabitethernet0

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:21:17, gigabitethernet0

C 20.0.0.0/24 is directly connected, 00:21:33, gigabitethernet1

R 100.0.0.0/24 [120/1] via 20.0.0.2, 00:10:58, gigabitethernet1

R 110.0.0.0/24 [120/1] via 20.0.0.2, 00:10:58, gigabitethernet1

C 127.0.0.0/8 is directly connected, 30:20:17, lo0

RIP routes have been learnt by Device2.

Step 3:

Configure the routing policy.

#Configure Device2.

Device2(config)#ip access-list standard 1

Device2(config-std-nacl)#permit 100.0.0.0 0.0.0.255

Device2(config-std-nacl)#exit

Device2(config)#route-map RIPtoOSPF

Device2(config-route-map)#match ip address 1

Device2(config-route-map)#exit

The route-map is configured to invoke an ACL to match only 100.0.0.0/24 while filtering out other network segment, such as 20.0.0.0/24 and 110.0.0.0/24.

Step 4:

Configure OSPF to redistribute RIP routes and associate a routing policy.

#Configure Device2.

Device2(config)#router ospf 100

Device2(config-ospf)#redistribute rip route-map RIPtoOSPF

Device2(config-ospf)#exit

In redistributing RIP routes, the route-map matching rule is invoked for filtration.

Step 5:

Check the result.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:47:27, gigabitethernet0

OE 100.0.0.0/24 [150/20] via 10.0.0.2, 00:21:39, gigabitethernet0

C 127.0.0.0/8 is directly connected, 21:40:06, lo0

The routing table of Device1 has learnt only the OSPF external route 100.0.0.0/24 while routes 20.0.0.0/24 and 110.0.0.0/24 have been filtered out.

#Query the OSPF process information and database of Device2.

Device2#show ip ospf 100

Routing Process "ospf 100" with ID 2.2.2.2

Process bound to VRF default

Process uptime is 1 hour 4 minutes

IETF NSF restarter support disabled

IETF NSF helper support enabled

Conforms to RFC2328, and RFC1583Compatibility flag is disabled

Supports only single TOS(TOS0) routes

Supports opaque LSA

Supports Graceful Restart

This router is an ASBR (injecting external routing information)

Initial SPF schedule delay 5000 msecs

Minimum hold time between two consecutive SPFs 10000 msecs

Maximum wait time between two consecutive SPFs 10000 msecs

Refresh timer 10 secs

Number of external LSA 2. Checksum Sum 0x0161F5

Number of opaque AS LSA 0. Checksum Sum 0x000000

Number of non-default external LSA is 2

External LSA database is unlimited.

Not Support Demand Circuit lsa number is 0, autonomy system support flood DoNotAge Lsa

Number of areas attached to this router: 1

Area 0 (BACKBONE) Number of interfaces in this area is 1(1)

Number of fully adjacent neighbors in this area is 1

Number of fully adjacent sham-link neighbors in this area is 0

Area has no authentication

SPF algorithm last executed 00:37:52.833 ago

SPF algorithm executed 3 times

Number of LSA 3. Checksum Sum 0x00e746

Not Support Demand Circuit lsa number is 0,

Indication lsa (by other routers) number is: 0,

Area support flood DoNotAge Lsa

Device2#show ip ospf 100 database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 191 0x80000004 0x70a0 1

2.2.2.2 2.2.2.2 537 0x80000005 0x36ce 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.0.2 2.2.2.2 818 0x80000003 0x3fd8

AS External Link States

Link ID ADV Router Age Seq# CkSum Route

100.0.0.0 2.2.2.2 718 0x80000002 0x72be E2 100.0.0.0/24 [0x0]

According to the information about OSPF process 100, Device2 has changed its role to become an ASBR, and only one external LSA has been generated in the database.

l In an actual application, if there are two or more AS boundary routers, it is recommended that you do not redistribute routes between different routing protocols. If you really need to redistribute routes between different routing protocols, configure a routing policy to prevent routing loops.


4.3.4 Configure OSPF Multi-Processes

Network Requirements

l Configure OSPF on all devices. On Device2, enable two OSPF processes. Configure OSPF 100 of Device1 and that of Device2 to set up a neighbor relation. Configure OSPF 200 of Device3 and that of Device2 to set up a neighbor relation.

l The two OSPF processes on Device2 redistribute routes to each other. OSPF process 100 uses a routing policy to control to redistribute only route 110.0.0.0/24. OSPF process 200 uses a routing policy to control to redistribute only route 100.0.0.0/24.

Network Topology

Figure 4‑4 Networking for configuring OSPF multi-processes

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure the OSPF protocol.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 100.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 100.1.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#On Device2, create two OSPF processes, process 100 and process 200.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

Device2(config)#router ospf 200

Device2(config-ospf)#router-id 2.2.2.3

Device2(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 200

Device3(config-ospf)#router-id 3.3.3.3

Device3(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 110.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 110.1.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

l If there exist multiple OSPF processes, it is recommended that you configure different Router IDs for the OSPF processes to prevent Router ID conflict.

#Query the LSDB and neighbor information of Device2.

Device2#show ip ospf neighbor

OSPF process 100:

Neighbor ID Pri State Dead Time Address Interface

1.1.1.1 1 Full/Backup 00:00:30 10.0.0.1 gigabitethernet0

OSPF process 200:

Neighbor ID Pri State Dead Time Address Interface

3.3.3.3 1 Full/DR 00:00:33 20.0.0.2 gigabitethernet1

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 19 0x80000016 0x53bf 3

2.2.2.2 2.2.2.2 15 0x80000010 0x1ae1 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.0.2 2.2.2.2 21 0x80000001 0x43d6

OSPF Router with ID (2.2.2.3) (Process ID 200)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.3 2.2.2.3 14 0x8000000f 0xb235 1

3.3.3.3 3.3.3.3 15 0x8000001b 0x696b 3

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

20.0.0.2 3.3.3.3 15 0x80000002 0x03fe

Neighbors have been set up respectively for OSPF 100 and OSPF 200 of Device2, and the two processes have their respective OSPF databases.

#Query the OSPF routing table of Device2.

Device2#show ip ospf route

OSPF process 100:

Codes: C - connected, D - Discard, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

O 10.0.0.0/24 [1] is directly connected, gigabitethernet0, Area 0

O 100.0.0.0/24 [2] via 10.0.0.1, gigabitethernet0, Area 0

O 100.1.0.0/24 [2] via 10.0.0.1, gigabitethernet0, Area 0

OSPF process 200:

Codes: C - connected, D - Discard, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2

O 20.0.0.0/24 [1] is directly connected, gigabitethernet1, Area 0

O 110.0.0.0/24 [2] via 20.0.0.2, gigabitethernet1, Area 0

O 110.1.0.0/24 [2] via 20.0.0.2, gigabitethernet1, Area 0

OSPF process 100 and process 200 have calculated their own routes.

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:05:34, gigabitethernet0

C 20.0.0.0/24 is directly connected, 00:05:28, gigabitethernet1

O 100.0.0.0/24 [110/2] via 10.0.0.1, 00:04:42, gigabitethernet0

O 100.1.0.0/24 [110/2] via 10.0.0.1, 00:04:42, gigabitethernet0

O 110.0.0.0/24 [110/2] via 20.0.0.2, 00:04:41, gigabitethernet1

O 110.1.0.0/24 [110/2] via 20.0.0.2, 00:04:41, gigabitethernet1

C 127.0.0.0/8 is directly connected, 48:40:33, lo0

Step 3:

Configure the routing policy.

#Configure Device2.

Device2(config)#ip prefix-list 1 permit 110.0.0.0/24

Device2(config)#ip prefix-list 2 permit 100.0.0.0/24

Device2(config)#route-map OSPF200to100

Device2(config-route-map)#match ip address prefix-list 1

Device2(config-route-map)#exit

Device2(config)#route-map OSPF100to200

Device2(config-route-map)#match ip address prefix-list 2

Device2(config-route-map)#exit

The route-maps have been configured to invoke prefix list 1 and prefix list 2 to match network segment 110.0.0.0/24 and 100.0.0.0/24 respectively.

l In configuring a routing policy, you can create a filtration rule based on a prefix list or ACL. The prefix list can precisely match routing masks while the ACL cannot match routing masks.

Step 4:

Configure OSPF processes to redistribute RIP routes to each other and associate routing policies.

#Configure Device2.

Device2(config)#router ospf 100

Device2(config-ospf)#redistribute ospf 200 route-map OSPF200to100

Device2(config-ospf)#exit

Device2(config)#router ospf 200

Device2(config-ospf)#redistribute ospf 100 route-map OSPF100to200

Device2(config-ospf)#exit

Step 5:

Check the result.

#Query OSPF LSDB of Device2.

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 1663 0x80000016 0x53bf 3

2.2.2.2 2.2.2.2 216 0x80000011 0x1eda 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.0.2 2.2.2.2 1664 0x80000001 0x43d6

AS External Link States

Link ID ADV Router Age Seq# CkSum Route

110.0.0.0 2.2.2.2 216 0x80000001 0x3dfc E2 110.0.0.0/24 [0x0]

OSPF Router with ID (2.2.2.3) (Process ID 200)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.3 2.2.2.3 205 0x80000010 0xb62e 1

3.3.3.3 3.3.3.3 1658 0x8000001b 0x696b 3

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

20.0.0.2 3.3.3.3 1658 0x80000002 0x03fe

AS External Link States

Link ID ADV Router Age Seq# CkSum Route

100.0.0.0 2.2.2.3 205 0x80000001 0xb989 E2 100.0.0.0/24 [0x0]

According to the queried information, OSPF process 100 has only the LSA of external route 110.0.0.0/24, and the other routes 110.1.0.0/24 and 20.0.0.0/24 have been filtered out by the routing policy OSPF200to100. Similarly, OSPF process 200 has only the LSA of external route 100.0.0.0/24, and the other routes 100.1.0.0/24 and 10.0.0.0/24 have been filtered out by the routing policy OSPF100to200.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:40:20, gigabitethernet0

C 100.0.0.0/24 is directly connected, 03:11:36, gigabitethernet1

C 100.1.0.0/24 is directly connected, 01:00:22, gigabitethernet2

OE 110.0.0.0/24 [150/2] via 10.0.0.2, 00:15:27, gigabitethernet0

C 127.0.0.0/8 is directly connected, 97:08:23, lo0

Device1 has only learnt route 110.0.0.0/24.

#Query the routing table of Device3.

evice3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 20.0.0.0/24 is directly connected, 00:42:44, gigabitethernet0

OE 100.0.0.0/24 [150/2] via 20.0.0.1, 00:17:45, gigabitethernet0

C 110.0.0.0/24 is directly connected, 01:02:03, gigabitethernet1

C 110.1.0.0/24 is directly connected, 01:02:14, gigabitethernet2

C 127.0.0.0/8 is directly connected, 41:02:01, lo0

Device3 has only learnt route 100.0.0.0/24.

l In an actual application, if there are two or more AS boundary routers, it is recommended that you do not redistribute routes between different OSPF processes. If you really need to redistribute routes between different OSPF processes, configure a route filtering policy to prevent routing loops.


4.3.5 Configure OSPF External Route Summary

Network Requirements

l Run OSPF between Device1 and Device2, and run RIPv2 between Device2 and Device3.

l Device2 redistributes RIP routes to OSPF. To decrease the number of routes on Device1, summarize the redistributed RIP routes into summary route 20.0.0.0/16.

Network Topology

Figure 4‑5 Networking for configuring OSPF external route summary

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | #Configure OSPF and RIPv2.

#Configure OSPF for Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure OSPF and RIPv2 for Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 20.0.0.0

Device2(config-rip)#exit

#Configure RIPv2 for Device3.

Device3#configure terminal

Device3(config)#router rip

Device3(config-rip)#version 2

Device3(config-rip)#network 20.0.0.0

Device3(config-rip)#exit

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:15:46, gigabitethernet0

C 20.0.1.0/24 is directly connected, 00:15:23, gigabitethernet1

R 20.0.2.0/24 [120/1] via 20.0.1.2, 00:12:17, gigabitethernet1

R 20.0.3.0/24 [120/1] via 20.0.1.2, 00:12:06, gigabitethernet1

C 127.0.0.0/8 is directly connected, 03:34:27, lo0

Step 3:

Configure OSPF to redistribute RIP routes.

#Configure Device2.

Device2(config)#router ospf 100

Device2(config-ospf)#redistribute rip

Device2(config-ospf)#exit

#Query OSPF LSDB of Device2.

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 1071 0x80000003 0x729f 1

2.2.2.2 2.2.2.2 873 0x80000004 0x38cd 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.0.2 2.2.2.2 1070 0x80000001 0x43d6

AS External Link States

Link ID ADV Router Age Seq# CkSum Route

20.0.1.0 2.2.2.2 365 0x80000001 0x7d04 E2 20.0.1.0/24 [0x0]

20.0.2.0 2.2.2.2 365 0x80000001 0x720e E2 20.0.2.0/24 [0x0]

20.0.3.0 2.2.2.2 365 0x80000001 0x6718 E2 20.0.3.0/24 [0x0]

According to the OSPF database, three external LSA have been generated, indicating that the RIP routes have been redistributed to OSPF.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:56:40, gigabitethernet0

OE 20.0.1.0/24 [150/20] via 10.0.0.2, 00:02:40, gigabitethernet0

OE 20.0.2.0/24 [150/20] via 10.0.0.2, 00:02:40, gigabitethernet0

OE 20.0.3.0/24 [150/20] via 10.0.0.2, 00:02:40, gigabitethernet0

C 127.0.0.0/8 is directly connected, 115:12:28, lo0

Device1 has learnt redistributed RIP routes.

Step 4:

On the ASBR, configure OSPF external route summary. Now Device2 is the ASBR.

#Configure Device2 and summarize the redistributed RIP routes into 20.0.0.0/16.

Device2(config)#router ospf 100

Device2(config-ospf)#summary-address 20.0.0.0 255.255.0.0

Device2(config-ospf)#exit

Step 5:

Check the result.

#Query OSPF LSDB of Device2.

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 1437 0x80000003 0x729f 1

2.2.2.2 2.2.2.2 1240 0x80000004 0x38cd 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.0.2 2.2.2.2 144 0x80000002 0x41d7

AS External Link States

Link ID ADV Router Age Seq# CkSum Route

20.0.0.0 2.2.2.2 84 0x80000001 0x88f9 E2 20.0.0.0/16 [0x0]

Comparing the result with the result in Step 3, you will find that the three external LSAs have been deleted, and a summarized external LSA has been generated.

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:28:03, gigabitethernet0

O 20.0.0.0/16 [110/1] is directly connected, 00:04:48, null0

C 20.0.1.0/24 is directly connected, 00:27:40, gigabitethernet1

R 20.0.2.0/24 [120/1] via 20.0.1.2, 00:24:34, gigabitethernet1

R 20.0.3.0/24 [120/1] via 20.0.1.2, 00:24:23, gigabitethernet1

C 127.0.0.0/8 is directly connected, 03:46:44, lo0

l In the routing table of Device2, a summary route 20.0.0.0/16 with the output interface being Null0 has been automatically added. This route helps to prevent routing loops.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:58:40, gigabitethernet0

OE 20.0.0.0/16 [150/20] via 10.0.0.2, 00:15:26, gigabitethernet0

C 127.0.0.0/8 is directly connected, 115:17:28, lo0

The routing table of Device1 has only learnt the summary route 20.0.0.0/16.


4.3.6 Configure Route Summary on Inter-Area OSPF Routes

Network Requirements

l Configure OSPF for all devices, and divide the devices into two areas, Area 0 and Area 1.

l To decrease the number of inter-area routes, inter-area routes are summarized on the ABR. The routes in Area 0 are summarized to form 10.0.0.0/16. The routes in Area 1 are summarized to form 20.0.0.0/16.

Network Topology

Figure 4‑6 Networking for configuring route summary on inter-area OSPF routes

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure an OSPF process and let the interface cover different areas.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#network 10.0.1.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.0.2.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.0.3.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#network 10.0.1.0 0.0.0.255 area 0

Device2(config-ospf)#network 20.0.1.0 0.0.0.255 area 1

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#router-id 3.3.3.3

Device3(config-ospf)#network 20.0.1.0 0.0.0.255 area 1

Device3(config-ospf)#network 20.0.2.0 0.0.0.255 area 1

Device3(config-ospf)#network 20.0.3.0 0.0.0.255 area 1

Device3(config-ospf)#exit

#Query the OSPF LSDB and routing table of Device2.

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 1419 0x80000007 0x4f81 3

2.2.2.2 2.2.2.2 1414 0x80000004 0x4bb9 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.1.2 2.2.2.2 1419 0x80000001 0x38e0

Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Route

20.0.1.0 2.2.2.2 1437 0x80000001 0x47d7 20.0.1.0/24

20.0.2.0 2.2.2.2 1363 0x80000001 0x46d6 20.0.2.0/24

20.0.3.0 2.2.2.2 1363 0x80000001 0x3be0 20.0.3.0/24

Router Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.2 2.2.2.2 1368 0x80000004 0xe70b 1

3.3.3.3 3.3.3.3 1341 0x80000006 0x6138 3

Net Link States (Area 1)

Link ID ADV Router Age Seq# CkSum

20.0.1.1 2.2.2.2 1368 0x80000001 0x24e3

Summary Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Route

10.0.1.0 2.2.2.2 1442 0x80000001 0xc95f 10.0.1.0/24

10.0.2.0 2.2.2.2 1409 0x80000001 0xc85e 10.0.2.0/24

10.0.3.0 2.2.2.2 1409 0x80000001 0xbd68 10.0.3.0/24

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.1.0/24 is directly connected, 00:30:31, gigabitethernet0

O 10.0.2.0/24 [110/2] via 10.0.1.1, 00:23:37, gigabitethernet0

O 10.0.3.0/24 [110/2] via 10.0.1.1, 00:23:37, gigabitethernet0

C 20.0.1.0/24 is directly connected, 02:09:10, gigabitethernet1

O 20.0.2.0/24 [110/2] via 20.0.1.2, 00:22:51, gigabitethernet1

O 20.0.3.0/24 [110/2] via 20.0.1.2, 00:22:51, gigabitethernet1

C 127.0.0.0/8 is directly connected, 05:28:14, lo0

In the OSPF database of Device2, three inter-area LSAs are generated respectively for Area 0 and Area 1. The intra-area routes of the areas have also been added into the routing table.

#Query the OSPF LSDB and routing table of Device1.

Device1#show ip ospf database

OSPF Router with ID (1.1.1.1) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 249 0x80000008 0x4d82 3

2.2.2.2 2.2.2.2 191 0x80000005 0x49ba 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.1.2 2.2.2.2 471 0x80000002 0x36e1

Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Route

20.0.1.0 2.2.2.2 251 0x80000002 0x45d8 20.0.1.0/24

20.0.2.0 2.2.2.2 1988 0x80000001 0x46d6 20.0.2.0/24

20.0.3.0 2.2.2.2 1988 0x80000001 0x3be0 20.0.3.0/24

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.1.0/24 is directly connected, 00:25:11, gigabitethernet0

C 10.0.2.0/24 is directly connected, 00:24:58, gigabitethernet1

C 10.0.3.0/24 is directly connected, 00:24:44, gigabitethernet2

O 20.0.1.0/24 [110/2] via 10.0.1.2, 00:14:59, gigabitethernet0

O 20.0.2.0/24 [110/3] via 10.0.1.2, 00:14:12, gigabitethernet0

O 20.0.3.0/24 [110/3] via 10.0.1.2, 00:14:12, gigabitethernet0

C 127.0.0.0/8 is directly connected, 116:19:42, lo0

The OSPF database of Device1 contains three inter-area LSAs, and the three routes have been added into the routing table.

#Query the OSPF LSDB and routing table of Device3.

Device3#show ip ospf database

OSPF Router with ID (3.3.3.3) (Process ID 100)

Router Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.2 2.2.2.2 532 0x80000005 0xe50c 1

3.3.3.3 3.3.3.3 506 0x80000007 0x5f39 3

Net Link States (Area 1)

Link ID ADV Router Age Seq# CkSum

20.0.1.1 2.2.2.2 532 0x80000002 0x22e4

Summary Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Route

10.0.1.0 2.2.2.2 82 0x80000002 0xc760 10.0.1.0/24

10.0.2.0 2.2.2.2 382 0x80000002 0xc65f 10.0.2.0/24

10.0.3.0 2.2.2.2 262 0x80000002 0xbb69 10.0.3.0/24

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.0.1.0/24 [110/2] via 20.0.1.1, 00:24:04, gigabitethernet0

O 10.0.2.0/24 [110/3] via 20.0.1.1, 00:24:04, gigabitethernet0

O 10.0.3.0/24 [110/3] via 20.0.1.1, 00:24:04, gigabitethernet0

C 20.0.1.0/24 is directly connected, 02:09:51, gigabitethernet0

C 20.0.2.0/24 is directly connected, 02:07:21, gigabitethernet1

C 20.0.3.0/24 is directly connected, 02:07:09, gigabitethernet2

C 127.0.0.0/8 is directly connected, 360:20:45, lo0

Similarly, the OSPF database of Device3 contains three inter-area LSAs, and the three routes have been added into the routing table.

Step 3:

On the ABR, configure inter-area route summary. Now Device2 is the ABR.

#On Device2, summarize the routes in Area 0 to form route 10.0.0.0/16, and summarize the routes in Area 1 to form route 20.0.0.0/16.

Device2(config)#router ospf 100

Device2(config-ospf)#area 0 range 10.0.0.0/16

Device2(config-ospf)#area 1 range 20.0.0.0/16

Device2(config-ospf)#exit

Step 4:

Check the result.

#Query the OSPF LSDB and routing table of Device2.

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 305 0x80000009 0x4b83 3

2.2.2.2 2.2.2.2 297 0x80000006 0x47bb 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.1.2 2.2.2.2 527 0x80000003 0x34e2

Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Route

20.0.0.0 2.2.2.2 23 0x80000001 0x52cd 20.0.0.0/16

Router Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.2 2.2.2.2 277 0x80000006 0xe30d 1

3.3.3.3 3.3.3.3 332 0x80000008 0x5d3a 3

Net Link States (Area 1)

Link ID ADV Router Age Seq# CkSum

20.0.1.1 2.2.2.2 317 0x80000003 0x20e5

Summary Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Route

10.0.0.0 2.2.2.2 26 0x80000001 0xd455 10.0.0.0/16

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.0.0.0/16 [110/1] is directly connected, 00:00:31, null0

C 10.0.1.0/24 is directly connected, 00:40:31, gigabitethernet0

O 10.0.2.0/24 [110/2] via 10.0.1.1, 00:33:37, gigabitethernet0

O 10.0.3.0/24 [110/2] via 10.0.1.1, 00:33:37, gigabitethernet0

O 20.0.0.0/16 [110/1] is directly connected, 00:00:27, null0

C 20.0.1.0/24 is directly connected, 02:19:10, gigabitethernet1

O 20.0.2.0/24 [110/2] via 20.0.1.2, 00:32:51, gigabitethernet1

O 20.0.3.0/24 [110/2] via 20.0.1.2, 00:32:51, gigabitethernet1

C 127.0.0.0/8 is directly connected, 05:38:14, lo0

Comparing the result with the result of Step 2, you will find that only one summarized inter-area LSA is generated respectively for Area 0 and Area 1 in the OSPF database of Device2. Similarly, a summary route with the output interface being Null0 is automatically added into the routing table.

#Query the OSPF LSDB and routing table of Device1.

Device1#show ip ospf database

OSPF Router with ID (1.1.1.1) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 1338 0x80000009 0x4b83 3

2.2.2.2 2.2.2.2 1332 0x80000006 0x47bb 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.1.2 2.2.2.2 1563 0x80000003 0x34e2

Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Route

20.0.0.0 2.2.2.2 90 0x80000001 0x52cd 20.0.0.0/16

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.1.0/24 is directly connected, 00:40:11, gigabitethernet0

C 10.0.2.0/24 is directly connected, 00:39:58, gigabitethernet1

C 10.0.3.0/24 is directly connected, 00:39:44, gigabitethernet2

O 20.0.0.0/16 [110/2] via 10.0.1.2, 00:02:18, gigabitethernet0

C 127.0.0.0/8 is directly connected, 116:44:42, lo0

On Device1, you will find that the OSPF database contains only the summarized inter-area LSA, and the routing table leans only the summary route 20.0.0.0/16 of Area 1. Similarly, Device3 learns only the summary route 10.0.0.0/16 of Area 0.


4.3.7 Configure Route Filtering on Inter-Area OSPF Routes

Network Requirements

l Configure OSPF for all devices, and divide the devices into two areas, Area 0 and Area 1.

l On the ABR, configure inter-area route filtration. According to route filtration, Area 0 does not allow injection of route 20.0.3.0/24, and 10.0.3.0/24 is not allowed to flood into other areas.

Network Topology

Figure 4‑7 Networking for configuring route filtering on inter-area OSPF routes

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure an OSPF process and let the interface cover different areas.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#network 10.0.1.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.0.2.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.0.3.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#network 10.0.1.0 0.0.0.255 area 0

Device2(config-ospf)#network 20.0.1.0 0.0.0.255 area 1

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#router-id 3.3.3.3

Device3(config-ospf)#network 20.0.1.0 0.0.0.255 area 1

Device3(config-ospf)#network 20.0.2.0 0.0.0.255 area 1

Device3(config-ospf)#network 20.0.3.0 0.0.0.255 area 1

Device3(config-ospf)#exit

#Query the OSPF LSDB and routing table of Device2.

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 329 0x8000005b 0xa6d5 3

2.2.2.2 2.2.2.2 324 0x80000051 0xb007 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.1.2 2.2.2.2 324 0x8000004e 0x9d2e

Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Route

20.0.1.0 2.2.2.2 324 0x8000004e 0xac25 20.0.1.0/24

20.0.2.0 2.2.2.2 324 0x8000004d 0xad23 20.0.2.0/24

20.0.3.0 2.2.2.2 259 0x80000001 0x3be0 20.0.3.0/24

Router Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.2 2.2.2.2 334 0x80000055 0x4f51 1

3.3.3.3 3.3.3.3 335 0x80000059 0xca7a 3

Net Link States (Area 1)

Link ID ADV Router Age Seq# CkSum

20.0.1.2 3.3.3.3 340 0x80000001 0xeb17

Summary Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Route

10.0.1.0 2.2.2.2 365 0x80000001 0xc95f 10.0.1.0/24

10.0.2.0 2.2.2.2 319 0x80000001 0xc85e 10.0.2.0/24

10.0.3.0 2.2.2.2 256 0x80000001 0xbd68 10.0.3.0/24

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.1.0/24 is directly connected, 00:06:13, gigabitethernet0

O 10.0.2.0/24 [110/2] via 10.0.1.1, 00:05:22, gigabitethernet0

O 10.0.3.0/24 [110/2] via 10.0.1.1, 00:05:22, gigabitethernet0

C 20.0.1.0/24 is directly connected, 00:06:19, gigabitethernet1

O 20.0.2.0/24 [110/2] via 20.0.1.2, 00:05:32, gigabitethernet1

O 20.0.3.0/24 [110/2] via 20.0.1.2, 00:05:32, gigabitethernet1

C 127.0.0.0/8 is directly connected, 94:42:22, lo0

In the OSPF database of Device2, three inter-area LSAs are generated respectively for Area 0 and Area 1.The intra-area routes of the areas have also been added into the routing table.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.1.0/24 is directly connected, 00:08:41, gigabitethernet0

C 10.0.2.0/24 is directly connected, 37:59:10, gigabitethernet1

C 10.0.3.0/24 is directly connected, 38:05:36, gigabitethernet2

O 20.0.1.0/24 [110/2] via 10.0.1.2, 00:07:55, gigabitethernet0

O 20.0.2.0/24 [110/3] via 10.0.1.2, 00:07:55, gigabitethernet0

O 20.0.3.0/24 [110/3] via 10.0.1.2, 00:06:50, gigabitethernet0

C 127.0.0.0/8 is directly connected, 70:07:32, lo0

Device1 has learnt routes of Area 1.

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.0.1.0/24 [110/2] via 20.0.1.1, 00:08:44, gigabitethernet0

O 10.0.2.0/24 [110/3] via 20.0.1.1, 00:08:33, gigabitethernet0

O 10.0.3.0/24 [110/3] via 20.0.1.1, 00:07:30, gigabitethernet0

C 20.0.1.0/24 is directly connected, 00:09:31, gigabitethernet0

C 20.0.2.0/24 is directly connected, 37:59:57, gigabitethernet1

C 20.0.3.0/24 is directly connected, 38:03:35, gigabitethernet2

C 127.0.0.0/8 is directly connected, 61:26:38, lo0

Device3 has learnt routes of Area 0.

Step 3:

Configure a route filtering policy.

#Configure Device2.

Device2(config)#ip prefix-list 1 deny 10.0.3.0/24

Device2(config)#ip prefix-list 1 permit 0.0.0.0/0 le 32

Device2(config)#ip prefix-list 2 deny 20.0.3.0/24

Device2(config)#ip prefix-list 2 permit 0.0.0.0/0 le 32

Device2(config)#exit

Prefix list 1 filters out network 10.0.3.0/24 and allows all other networks. Prefix list 2 filters out network 20.0.3.0/24 and allows all other networks.

Step 4:

On the ABR, configure filtration of inter-area routes and invoke the matching rules of a prefix list.

#Configure Device2.

Device2(config)#router ospf 100

Device2(config-ospf)#area 0 filter-list prefix 1 out

Device2(config-ospf)#area 0 filter-list prefix 2 in

Device2(config-ospf)#exit

Step 5:

Check the result.

#Query OSPF LSDB of Device2.

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 679 0x8000005b 0xa6d5 3

2.2.2.2 2.2.2.2 673 0x80000051 0xb007 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

10.0.1.2 2.2.2.2 673 0x8000004e 0x9d2e

Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Route

20.0.1.0 2.2.2.2 673 0x8000004e 0xac25 20.0.1.0/24

20.0.2.0 2.2.2.2 673 0x8000004d 0xad23 20.0.2.0/24

Router Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.2 2.2.2.2 683 0x80000055 0x4f51 1

3.3.3.3 3.3.3.3 684 0x80000059 0xca7a 3

Net Link States (Area 1)

Link ID ADV Router Age Seq# CkSum

20.0.1.2 3.3.3.3 689 0x80000001 0xeb17

Summary Link States (Area 1)

Link ID ADV Router Age Seq# CkSum Route

10.0.1.0 2.2.2.2 714 0x80000001 0xc95f 10.0.1.0/24

10.0.2.0 2.2.2.2 668 0x80000001 0xc85e 10.0.2.0/24

Comparing the result with the result of Step 2, the LSA of network 20.0.3.0/24 has been deleted from Area 0 in the OSPF database. Similarly, the LSA of network 10.0.3.0/24 has been deleted from Area 1.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.1.0/24 is directly connected, 00:12:57, gigabitethernet0

C 10.0.2.0/24 is directly connected, 38:03:25, gigabitethernet1

C 10.0.3.0/24 is directly connected, 38:09:52, gigabitethernet2

O 20.0.1.0/24 [110/2] via 10.0.1.2, 00:12:11, gigabitethernet0

O 20.0.2.0/24 [110/3] via 10.0.1.2, 00:12:11, gigabitethernet0

C 127.0.0.0/8 is directly connected, 70:11:48, lo0

The route 20.0.3.0/24 does not exist in the routing table of Device1.

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.0.1.0/24 [110/2] via 20.0.1.1, 00:13:09, gigabitethernet0

O 10.0.2.0/24 [110/3] via 20.0.1.1, 00:12:58, gigabitethernet0

C 20.0.1.0/24 is directly connected, 00:13:56, gigabitethernet0

C 20.0.2.0/24 is directly connected, 38:04:22, gigabitethernet1

C 20.0.3.0/24 is directly connected, 38:08:00, gigabitethernet2

C 127.0.0.0/8 is directly connected, 64:31:03, lo0

The route 10.0.3.0/24 does not exist in the routing table of Device3.


4.3.8 Configure OSPF Totally Stub Area

Network Requirements

l Configure OSPF for all devices, and divide the devices into three areas: Area 0, Area 1, and Area 2. Configure Area 1 as a totally Stub area.

l On Device4, redistribute a static route to OSPF. After the configuration is completed, the totally Stub area cannot learn inter-area routes and external routes, while the devices of other areas can learn inter-area routes and external routes.

Network Topology

Figure 4‑8 Networking for configuring an OSPF totally stub area

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure an OSPF process and let the interfaces cover the related areas.

#Configure Device1. Configure Area 1 to a Stub area.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#area 1 stub

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 1

Device1(config-ospf)#network 100.0.0.0 0.0.0.255 area 1

Device1(config-ospf)#exit

#Configure Device2. Configure Area 1 to a totally Stub area. Devce2 is an ABR, and the no-summary command takes effect only on an ABR.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#area 1 stub no-summary

Device2(config-ospf)#network 10.0.0.0 0.0.0.255 area 1

Device2(config-ospf)#network 20.0.1.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#router-id 3.3.3.3

Device3(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 30.0.0.0 0.0.0.255 area 2

Device3(config-ospf)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router ospf 100

Device4(config-ospf)#router-id 4.4.4.4

Device4(config-ospf)#network 30.0.0.0 0.0.0.255 area 2

Device4(config-ospf)#network 110.0.0.0 0.0.0.255 area 2

Device4(config-ospf)#exit

Step 3:

On Device4, configure a static route, and redistribute the route into the OSPF.

#Configure Device4.

Device4(config)#ip route 200.1.1.0 255.255.255.0 110.0.0.2

Device4(config)#router ospf 100

Device4(config-ospf)#redistribute static

Device4(config-ospf)#exit

Step 4:

Check the result.

#Query the OSPF LSDB and routing table of Device1.

Device1#show ip ospf database

OSPF Router with ID (1.1.1.1) (Process ID 100)

Router Link States (Area 1 [Stub])

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 19 0x80000009 0x8513 2

2.2.2.2 2.2.2.2 22 0x80000005 0x51b6 1

Net Link States (Area 1 [Stub])

Link ID ADV Router Age Seq# CkSum

10.0.0.2 2.2.2.2 22 0x80000001 0x61ba

Summary Link States (Area 1 [Stub])

Link ID ADV Router Age Seq# CkSum Route

0.0.0.0 2.2.2.2 55 0x80000002 0x73c1 0.0.0.0/0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 10.0.0.2 to network 0.0.0.0

O 0.0.0.0/0 [110/2] via 10.0.0.2, 00:00:19, gigabitethernet1

C 10.0.0.0/24 is directly connected, 00:01:04, gigabitethernet1

C 100.0.0.0/24 is directly connected, 00:11:55, gigabitethernet0

C 127.0.0.0/8 is directly connected, 30:46:57, lo0

According to the information in the OSPF database, only Area 1 has an LSA for inter-area route 0.0.0.0/0, while the other areas do not have LSAs for inter-area or external routes. The ABR in the Stub area generates an inter-area route 0.0.0.0/0, which floods in the totally Stub area. Data is forwarded to outside of the area or AS through the default route.

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:01:02, gigabitethernet0

C 20.0.0.0/24 is directly connected, 00:00:59, gigabitethernet1

O 30.0.0.0/24 [110/2] via 20.0.0.2, 00:00:17, gigabitethernet1

O 100.0.0.0/24 [110/2] via 10.0.0.1, 00:00:10, gigabitethernet0

O 110.0.0.0/24 [110/3] via 20.0.0.2, 00:00:17, gigabitethernet1

C 127.0.0.0/8 is directly connected, 56:07:04, lo0

OE 200.1.1.0/24 [150/20] via 20.0.0.2, 00:00:16, gigabitethernet1

According to the queried information, you will find that Device2 is able to learn inter-area and external routes.

l If you run the area area-id stub command but do not run the no-summary command, the device in the area can learn inter-area routes but cannot learn external routes. Access to a network outside the AS is still conducted through the default route.


4.3.9 Configure OSPF NSSA Area

Network Requirements

l Configure OSPF for all devices, and divide the devices into three areas: Area 0, Area 1, and Area 2. Configure Area 1 and Area 2 as NSSA areas.

l On Device4, redistribute a static route to OSPF. After the configuration is completed, all devices can learn intra-area and inter-area routes, but external routes cannot be injected into Area 1.

l Introduce a default route to the ABR of Area 1 so that Device1 can access an external network through the default route.

Network Topology

Figure 4‑9 Networking for configuring an OSPF NSSA area

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure an OSPF process and let the interfaces cover the related areas.

#Configure Device1. Configure Area 1 to an NSSA area.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#area 1 nssa

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 1

Device1(config-ospf)#network 100.0.0.0 0.0.0.255 area 1

Device1(config-ospf)#exit

#Configure Device2. Configure Area 1 to an NSSA area.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#area 1 nssa

Device2(config-ospf)#network 10.0.0.0 0.0.0.255 area 1

Device2(config-ospf)#network 20.0.1.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3. Configure Area 2 to an NSSA area.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#router-id 3.3.3.3

Device3(config-ospf)#area 2 nssa

Device3(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 30.0.0.0 0.0.0.255 area 2

Device3(config-ospf)#exit

#Configure Device4. Configure Area 2 to an NSSA area.

Device4#configure terminal

Device4(config)#router ospf 100

Device4(config-ospf)#router-id 4.4.4.4

Device4(config-ospf)#area 2 nssa

Device4(config-ospf)#network 30.0.0.0 0.0.0.255 area 2

Device4(config-ospf)#network 110.0.0.0 0.0.0.255 area 2

Device4(config-ospf)#exit

Step 3:

On Device4, configure a static route, and redistribute the route into the OSPF.

#Configure Device4.

Device4(config)#ip route 200.1.1.0 255.255.255.0 110.0.0.2

Device4(config)#router ospf 100

Device4(config-ospf)#redistribute static

Device4(config-ospf)#exit

#Query OSPF LSDB of Device3.

Device3#show ip ospf database

OSPF Router with ID (3.3.3.3) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.2 2.2.2.2 179 0x80000004 0xe110 1

3.3.3.3 3.3.3.3 177 0x80000004 0xa345 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

20.0.0.2 3.3.3.3 182 0x80000001 0xf60d

Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Route

10.0.0.0 2.2.2.2 214 0x80000001 0xd455 10.0.0.0/24

100.0.0.0 2.2.2.2 173 0x80000001 0x4886 100.0.0.0/24

30.0.0.0 3.3.3.3 208 0x80000001 0xb160 30.0.0.0/24

110.0.0.0 3.3.3.3 171 0x80000001 0xa719 110.0.0.0/24

ASBR-Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

4.4.4.4 3.3.3.3 171 0x80000001 0x72ac

Router Link States (Area 2 [NSSA])

Link ID ADV Router Age Seq# CkSum Link count

3.3.3.3 3.3.3.3 175 0x80000004 0x686f 1

4.4.4.4 4.4.4.4 177 0x80000005 0xe46a 2

Net Link States (Area 2 [NSSA])

Link ID ADV Router Age Seq# CkSum

30.0.0.2 4.4.4.4 177 0x80000001 0xc827

Summary Link States (Area 2 [NSSA])

Link ID ADV Router Age Seq# CkSum Route

10.0.0.0 3.3.3.3 172 0x80000001 0xde48 10.0.0.0/24

20.0.0.0 3.3.3.3 214 0x80000001 0x52cb 20.0.0.0/24

100.0.0.0 3.3.3.3 172 0x80000001 0x5279 100.0.0.0/24

NSSA-external Link States (Area 2 [NSSA])

Link ID ADV Router Age Seq# CkSum Route

200.1.1.0 4.4.4.4 247 0x80000001 0x6cde N2 200.1.1.0/24 [0x0]

AS External Link States

Link ID ADV Router Age Seq# CkSum Route

200.1.1.0 3.3.3.3 176 0x80000001 0x0156 E2 200.1.1.0/24 [0x0]

According to the OSPF database, the ABR in the NSSA area (Area 2) converts NSSA-external LSAs into AS External LSAs. Therefore, the other areas can normally learn external routes that are redistributed from the NSSA area (Area 2).

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:02:53, gigabitethernet0

C 20.0.0.0/24 is directly connected, 00:02:51, gigabitethernet1

O 30.0.0.0/24 [110/2] via 20.0.0.2, 00:02:04, gigabitethernet1

O 100.0.0.0/24 [110/2] via 10.0.0.1, 00:02:04, gigabitethernet0

O 110.0.0.0/24 [110/3] via 20.0.0.2, 00:02:02, gigabitethernet1

C 127.0.0.0/8 is directly connected, 06:47:22, lo0

OE 200.1.1.0/24 [150/20] via 20.0.0.2, 00:02:02, gigabitethernet1

Device2 has learnt the external routes that have been redistributed from the NSSA area (Area 2).

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:02:29, gigabitethernet1

O 20.0.0.0/24 [110/2] via 10.0.0.2, 00:01:44, gigabitethernet1

O 30.0.0.0/24 [110/3] via 10.0.0.2, 00:01:41, gigabitethernet1

C 100.0.0.0/24 is directly connected, 01:53:00, gigabitethernet0

O 110.0.0.0/24 [110/4] via 10.0.0.2, 00:01:40, gigabitethernet1

C 127.0.0.0/8 is directly connected, 383:45:55, lo0

According to the queried information, route 200.1.1.0/24 does not exist in the routing table of Device1, indicating that the external route redistributed by Device4 has not been injected to the NSSA area (Area 1), while the routes of other areas have been added into the routing table.

Step 4:

Configure Device2, and introduce a default route to Area 1.

#Configure Device2. At this time, Device2 is the ABR of Area 1.

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#area 1 nssa default-information-originate

Device2(config-ospf)#exit

l After the area area-id nssa no-summary command is executed on the ABR of the NSSA area, the area is called a totally NSSA area. At this time, the ABR generates a default route and flood the default route into the NSSA area. After the command is configured, the number of summary LSAs and corresponding inter-area routes will be further decreased. The devices in the area access a network outside the area or outside the AS through the default route.

Step 5:

Check the result.

#Query OSPF LSDB of Device2.

Device2#show ip ospf database

OSPF Router with ID (2.2.2.2) (Process ID 100)

Router Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Link count

2.2.2.2 2.2.2.2 455 0x80000004 0xe110 1

3.3.3.3 3.3.3.3 455 0x80000004 0xa345 1

Net Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

20.0.0.2 3.3.3.3 461 0x80000001 0xf60d

Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum Route

10.0.0.0 2.2.2.2 492 0x80000001 0xd455 10.0.0.0/24

100.0.0.0 2.2.2.2 449 0x80000001 0x4886 100.0.0.0/24

30.0.0.0 3.3.3.3 487 0x80000001 0xb160 30.0.0.0/24

110.0.0.0 3.3.3.3 449 0x80000001 0xa719 110.0.0.0/24

ASBR-Summary Link States (Area 0)

Link ID ADV Router Age Seq# CkSum

4.4.4.4 3.3.3.3 449 0x80000001 0x72ac

Router Link States (Area 1 [NSSA])

Link ID ADV Router Age Seq# CkSum Link count

1.1.1.1 1.1.1.1 456 0x80000005 0x8d0f 2

2.2.2.2 2.2.2.2 457 0x80000004 0x59ad 1

Net Link States (Area 1 [NSSA])

Link ID ADV Router Age Seq# CkSum

10.0.0.2 2.2.2.2 457 0x80000001 0x61ba

Summary Link States (Area 1 [NSSA])

Link ID ADV Router Age Seq# CkSum Route

20.0.0.0 2.2.2.2 492 0x80000001 0x70b1 20.0.0.0/24

30.0.0.0 2.2.2.2 449 0x80000001 0xf71f 30.0.0.0/24

110.0.0.0 2.2.2.2 448 0x80000001 0xedd7 110.0.0.0/24

NSSA-external Link States (Area 1 [NSSA])

Link ID ADV Router Age Seq# CkSum Route

0.0.0.0 2.2.2.2 31 0x80000001 0x5b42 N2 0.0.0.0/0 [0x0]

AS External Link States

Link ID ADV Router Age Seq# CkSum Route

200.1.1.0 3.3.3.3 454 0x80000001 0x0156 E2 200.1.1.0/24 [0x0]

OSPF has generated a NSSA-external LSA for the default route.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

OE 0.0.0.0/0 [150/1] via 10.0.0.2, 00:00:22, gigabitethernet1

C 10.0.0.0/24 is directly connected, 00:07:29, gigabitethernet1

O 20.0.0.0/24 [110/2] via 10.0.0.2, 00:06:44, gigabitethernet1

O 30.0.0.0/24 [110/3] via 10.0.0.2, 00:06:41, gigabitethernet1

C 100.0.0.0/24 is directly connected, 01:58:00, gigabitethernet0

O 110.0.0.0/24 [110/4] via 10.0.0.2, 00:06:40, gigabitethernet1

C 127.0.0.0/8 is directly connected, 383:50:55, lo0

The routing table of Device1 has learnt the default route 0.0.0.0, and Device1 communicates with the network outside the AS through the default route.


4.3.10 Configure OSPF to Coordinate with BFD

Network Requirements

l Configure OSPF for all devices.

l Enable the BFD detection function on the line between Device1 and Device3. If the line becomes faulty, BFD quickly detects the fault and notify OSPF of the fault. Then, OSPF switches the route to Device2 for communication.

Network Topology

Figure 4‑10 Networking for configuring OSPF to coordinate with BFD

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure an OSPF process.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 200.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 30.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#router-id 3.3.3.3

Device3(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 30.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 201.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

Step 3:

Configure OSPF to coordinate with BFD.

#Configure Device1.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip ospf bfd

Device1(config-if-gigabitethernet0)#exit

#Configure Device3.

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip ospf bfd

Device3(config-if-gigabitethernet0)#exit

Step 4:

Check the result.

#Query the OSPF neighbors and routing table of Device1.

Device1#show ip ospf neighbor 3.3.3.3

OSPF process 100:

Neighbor 3.3.3.3, interface address 10.0.0.2

In the area 0 via interface gigabitethernet0, BFD enabled

Neighbor priority is 1, State is Full, 5 state changes

DR is 10.0.0.2, BDR is 10.0.0.1

Options is 0x42 (-|O|-|-|-|-|E|-)

Dead timer due in 00:00:31

Neighbor is up for 00:02:46

Database Summary List 0

Link State Request List 0

Link State Retransmission List 0

Crypt Sequence Number is 0

Thread Inactivity Timer on

Thread Database Description Retransmission off, 0 times

Thread Link State Request Retransmission off, 0 times

Thread Link State Update Retransmission off, 0 times

Hello received 17 sent 19, DD received 3 sent 3

LS-Req received 0 sent 0, LS-Upd received 1(LSA: 2) sent 1(LSA: 1)

LS-Ack received 1 sent 0, Discarded 0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:01:09, gigabitethernet0

C 20.0.0.0/24 is directly connected, 00:55:37, gigabitethernet1

O 30.0.0.0/24 [110/2] via 20.0.0.2, 00:02:50, gigabitethernet1

[110/2] via 10.0.0.2, 00:01:30, gigabitethernet0

C 127.0.0.0/8 is directly connected, 05:51:09, lo0

C 200.0.0.0/24 is directly connected, 00:55:12, gigabitethernet2

O 201.0.0.0/24 [110/2] via 10.0.0.2, 00:01:30, gigabitethernet0

According to the OSPF neighbor information, BFD has been enabled, and route 201.0.0.0/24 selects the line between Device1 and Device3 with priority for communication.

#Query the BFD session of Device1.

Device1#show bfd session detail

Total session number: 1

OurAddr NeighAddr LD/RD State Holddown interface

10.0.0.1 10.0.0.2 7/14 UP 5000 gigabitethernet0

Type:direct

Local State:UP Remote State:UP Up for: 0h:2m:37s Number of times UP:1

Send Interval:1000ms Detection time:5000ms(1000ms*5)

Local Diag:0 Demand mode:0 Poll bit:0

MinTxInt:1000 MinRxInt:1000 Multiplier:5

Remote MinTxInt:1000 Remote MinRxInt:1000 Remote Multiplier:5

Registered protocols:OSPF

According to the queried information, OSPF has been configured successfully to coordinate with BFD, and the session has been normally set up.

#If the line between Device1 and Device3 becomes faulty, BFD quickly detects the fault and informs OSPF of the fault. OSPF then switch the route to Device2 for communication. Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:01:59, gigabitethernet0

C 20.0.0.0/24 is directly connected, 00:56:13, gigabitethernet1

O 30.0.0.0/24 [110/2] via 20.0.0.2, 00:03:40, gigabitethernet1

C 127.0.0.0/8 is directly connected, 05:52:41, lo0

C 200.0.0.0/24 is directly connected, 00:56:02, gigabitethernet2

O 201.0.0.0/24 [110/3] via 20.0.0.2, 00:00:06, gigabitethernet1

The action of Device3 is similar to that of Device1.


5 IS-IS


5.1 Overview

The IS-IS (Intermediate System to Intermediate System) is the IGP (Interior Gateway Protocol) based on the SPF algorithm. The basic design theory and algorithm for the IS-IS protocol are consistent with the OSPF. The IS-IS protocol is the routing protocol based on the link layer, which is irrelevant to the network layer (IPv4, IPv6, and OSI). It is not restricted by the network layer, and therefore it has good extensibility.

The IS-IS protocol can support the routing of multi-protocol stacks, including IPv4, IPv6, and OSI. The IS-IS protocol is initially applied to the OSI protocol stack (ISO10589) and then extended to the routing of IPv4 protocol stack (RFC1195) and IPv6 protocol stack (RFC5308).and, it can be further extended to support the CSPF calculation of the MPLS-TE (RFC3784).

The IS-IS protocol is characterized with good capability (inconsistent extended functions between devices can be compatible perfectly), large network capacity, able to support multi-protocol stacks, able to upgrade smoothly, unlikely to be faulty compared with the OSPF. Therefore, the IS-IS protocol applies to the large-size core backbone network. This section describes how to configure the IS-IS dynamic routing protocol on the device for network interconnection.


5.2 IS-IS Function Configuration

Table 5‑1 IS-IS function list

Configuration Task
Configure the IS-IS basic function | Enable the IS-IS protocol
 | Configure the IS-IS VRF attribute
Configure the IS-IS layer attribute | Configure the IS-IS layer attribute
Configure the IS-IS route generation | Configure the IS-IS default route
 | Configure the IS-IS routing redistribution
Configure the IS-IS routing control | Configure the IS-IS metric style
 | Configure the IS-IS interface metric value
 | Configure the IS-IS administrative distance
 | Configure the IS-IS route summary
 | Configure the maximum number of load-balanced routes for the IS-IS
 | Configure the IS-IS inter-layer route leakage
 | Configure the IS-IS ATT-bit
Configure the IS-IS network optimization | Configure the IS-IS interface priority
 | Configure the IS-IS passive interface
 | Configure the IS-IS Hello packet parameter
 | Configure the IS-IS LSP packet parameter
 | Configure the IS-IS SNP packet parameter
 | Configure the IS-IS SPF calculation interval
 | Configure the maximum number of areas for the IS-IS
 | Configure the IS-IS host name mapping
 | Configure the IS-IS interface to be added to the mesh group
Configure the IS-IS network authentication | Configure the IS-IS neighboring authentication
 | Configure the IS-IS route authentication
Configure the IS-IS to coordinate with the BFD | Configure the IS-IS to coordinate with the BFD
Configure the IS-IS GR | Configure the IS-IS GR


5.2.1 Configure IS-IS Basic Function

Configuration Condition

Before using the IS-IS protocol, first complete the following tasks:

l Configure the link layer protocol to ensure the normal communication at the link layer.

l Configure the network layer IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

Enable IS-IS Protocol

Multiple IS-IS processes can operate at the same time in the system. Each process is identified by different process names.

Table 5‑2 Enable the IS-IS protocol

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the IS-IS process and enter the IS-IS configuration mode | router isis [area-tag ] | Mandatory By default, the IS-IS process does not operate in the system. The process name is area-tag.
Configure the network entity title for the IS-IS | net entry-title | Mandatory By default, the network entity title is not configured for the IS-IS.
Return to the global configuration mode | exit | -
Enter the interface configuration mode | interface interface-name | -
Enable the IS-IS protocol on the interface | ip router isis [area-tag ] | Mandatory By default, the IS-IS protocol is not enabled on the interface.

l The IS-IS protocol cannot operate without the network entity title.

Configure IS-IS VRF Attribute

Multiple IS-IS processes can exist in the same VRF, but only one IS-IS process with Level-2 attribute in the VRF.

Table 5‑3Configure the IS-IS VRF attribute

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Enter the VRF attribute for the IS-IS | vrf vrf-name | Optional By default, the IS-IS process locates at the global VRF.


5.2.2 Configure IS-IS Layer Attribute

Configuration Condition

Before configuring the IS-IS layer attribute, first complete the following tasks:

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IS-IS protocol.

Configure IS-IS Layer Attribute

The IS-IS layer attribute is divided into the global layer attribute and the interface layer attribute. The global layer attribute is the IS-IS intermediate system, which is further classified into the following three types:

l Level-1 intermediate system: Only the link status database of Level-1 is available and only the routing in the Level-1 area can be advertized and learnt.

l Level-2 intermediate system: Only the link status database of Level-2 is available and only the routing in the Level-2 area can be advertized and learnt.

l Level-1-2 intermediate system: Both the link status database of Level-1 and Level-2 are available and both the routing in the Level-1 and Level-2 area can be advertized and learnt. The Level-1-2 intermediate system is the interconnection device in the Level-1 and Level-2 area.

The layer attribute of the IS-IS interface is classified into the following three types:

l Level-1 attribute interface: Only the Level-1 packet of the IS-IS protocol can be transmitted and received and only the neighbor of Level-1 can be established.

l Level-2 attribute interface: Only the Level-2 packet of the IS-IS protocol can be transmitted and received and only the neighbor of Level-2 can be established.

l Level-1-2 attribute interface: Both the Level-1 packet and Level-2 packet of the IS-IS protocol can be transmitted and received and both the neighbors of Level-1 and Level-2 can be established.

The IS-IS interface layer attribute depends on the IS-IS global layer attribute. The Level-1 intermediate system only has the interface of Level-1 attribute, the Level-2 intermediate system only has the interface of Level-2 attribute, and the Level-1-2 intermediate system can has interfaces of all attributes.

Table 5‑4 Configure the IS-IS global layer attribute

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Configure the IS-IS global layer attribute | is-type { level-1 | level-1-2 | level-2-only } | Optional By default, the IS-IS global layer attribute is Level-1-2.

Table 5‑5 Configure the IS-IS interface layer attribute

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the interface layer attribute | isis circuit-type [ level-1 | level-1-2 | level-2 ] | Optional By default, the interface layer attribute is consistent with the global layer attribute when the interface layer attribute is not specified.

l Only one IS-IS process with the Level-2 attribute is available in a VRF.


5.2.3 Configure IS-IS Route Generation

Configuration Condition

Before configuring the IS-IS route generation, first complete the following tasks:

l Configure the IP address for the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IS-IS protocol.

Configure IS-IS Default Route

The Level-2 area of the IS-IS protocol cannot generate the default route during operating. You can configure to add a default route with the destination IP address as 0.0.0.0/0 in the Level-2 LSP and release it. When other areas of the same level in the intermediate system receive the route information, a default route will be added in the routing table.

Table 5‑6Configure the IS-IS default route

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Enter the IS-IS IPv4 address family configuration mode | address-family ipv4 unicast | -
Configure the IS-IS to release he default route | default-information originate | Mandatory By default, the default route is not released.

Configure IS-IS Routing Redistribution

The routing redistribution can be used to introduce the routing information of other routing protocols to the IS-IS protocol. This enables the interconnection between the autonomous system of the IS-IS protocol and the autonomous system of other routing protocols or the routing area. When the external routing is introduced, the routing introduction policy and the routing layer attribute after introduction are specified.

Table 5‑7Configure the IS-IS routing redistribution

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Enter the IS-IS IPv4 address family configuration mode | address-family ipv4 unicast | -
Configure the IS-IS routing redistribution | redistribute protocol [ protocol-id ] [ level-1 / level-1-2 / level-2 / metric metric-value / metric-type { external | internal } / route-map route-map-name / match route-sub-type ] | Mandatory By default, information of other routing protocols are not redistributed.


5.2.4 Configure IS-IS Routing Control

Configuration Condition

Before configuring the IS-IS routing feature, first complete the following tasks:

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IS-IS protocol.

Configure IS-IS Metric Style

Initially, the IS-IS only has the narrow metric style. When the narrow metric style is used, the maximum metric value is 63. With the expansion of the network scale, the metric style cannot satisfy the requirements. Therefore, the wide metric style emerges whose metric value can reach 16777214. Devices use different metric styles cannot advertise and learn the routing information from each other. To realize the transition between the two metric styles, the configuration method for the transition metric style is provided.

The wide metric style is recommended.

Table 5‑8Configure the IS-IS metric style

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Configure the interface metric style | metric-style {narrow | narrow transition | transition | wide | wide transition} [level-1 | level-1-2 | level-2] | Optional By default, the narrow metric style is used.

Configure IS-IS Interface Metric Value

When the IS-IS protocol is enabled on the interface, the IS-IS routing metric is the global metric value. The following command can be used to specify a metric value for each interface.

Table 5‑9 Configure the interface metric value

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Configure the IS-IS global metric value | metric metric-value [ level-1 | level-2 ] | Optional By default, the global metric value is 10.
Return to the global configuration mode | exit | -
Enter the interface configuration mode | interface interface-name | -
Configure the interface metric value | isis ipv4 metric {metric-value | maximum} [level-1 | level-2] | Optional By default, the global metric value is used.

Configure IS-IS Administrative Distance

The system chooses the primary routing based on the administrative distance. The smaller the administrative distance is, the higher priority the routing has.

Table 5‑10 Configure the IS-IS administrative distance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Enter the IS-IS IPv4 address family configuration mode | address-family ipv4 unicast | -
Configure the IS-IS routing administrative distance | distance distance-value | Optional By default, the administrative distance is 115.

Configure IS-IS Route Summary

The route summary summarizes multiple pieces of routing information as a piece of routing information. After the route summary is configured for the IS-IS, the number of advertisements to the subnet reduces effectively and the link status database and routing table size reduce. This effectively saves the memory and CPU resources. This configuration is generally applied to the Level-1-2 edge device, reducing the routing information of layer advertisement.

Table 5‑11 Configure the IS-IS route summary

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Enter the IPv4 address family configuration mode | address-family ipv4 unicast | -
Configure the IS-IS route summary | summary-prefix prefix-value [ metric metric-value / route-type {internal | external} / metric-type {internal | external} / tag tag-value / not-advertise / level-1 / level-2 / level-1-2 ] | Mandatory By default, the route summary is not performed.

Configure the maximum number of load-balanced routes for the IS-IS

There are multiple paths of the same cost to the same destination IP address. These ECMP (equal cost multipath routing) can improve the link utilization rate. The user can control the maximum number of the IS-IS ECMPs.

Table 5‑12 Configure the maximum number of load-balanced routes for the IS-IS

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Enter the IPv4 address family configuration mode | address-family ipv4 unicast | -
Configure the maximum number of load-balanced routes for the IS-IS | maximum-paths max-number | Optional By default, the maximum number of paths for load balancing is 4.

Configure IS-IS Inter-layer Route Leakage

By default, the IS-IS only leak the Level-1 routing to the Level-2, but the Level-1 area cannot know the routing of the Level-2 area. The inter-layer route leakage can be configured to introduce the Level-2 routing to the Level-1 area. When configuring the inter-layer route leakage, the routing policy can be specified to only leak the route that matches the condition.

Table 5‑13 Configure the IS-IS inter-layer route leakage

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Enter the IS-IS IPv4 address family configuration mode | address-family ipv4 unicast | -
Configure the route leakage between the IS-IS layer | propagate { level-1 into level-2 | level-2 into level-1 } [ distribute-list access-list-name | route-map route-map-name ] | Mandatory By default, the Level-1 leaks its route to the Level-2.

Configure IS-IS ATT-bit

In the Level-1-2 device, the ATT-bit is used to inform other nodes whether this node has the connection to other areas. If yes, the ATT-bit will be set to 1 automatically and other nodes will generate a default route to this node. This increases the service load of this node. To avoid this situation, the ATT-bit can be forcibly set to 0.

Table 5‑14 Configure the IS-IS ATT-bit

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Enter the IS-IS IPv4 address family configuration mode | address-family ipv4 unicast | -
Configure the IS-IS ATT-bit | set-attached-bit { on | off } | Mandatory By default, the ATT-bit is set based on whether the node is connected to other areas.


5.2.5 Configure IS-IS Network Optimization

Configuration Condition

Before configuring the IS-IS adjustment and optimization, first complete the following tasks:

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IS-IS protocol.

Configure IS-IS Interface Priority

The IS-IS chooses a node on the broadcast link as the DIS node. The DIS node sends the CSNP packet periodically to synchronize the link status database on the entire network. The Level-1 and Level-2 select the DIS node respectively. The interface with the highest priority is selected as the DIS node. The node with the large MAC address is selected as the DIS node for the nodes with the same priority.

Table 5‑15Configure the IS-IS interface priority

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the IS-IS interface priority | isis priority priority-value [ level-1 | level-2 ] | Optional By default, the interface priority is 64.

Configure IS-IS Passive Interface

The passive interface does not receive and transmit the IS-IS protocol packet, but still releases the directly connected network routing information of this interface. The IS-IS can reduce the bandwidth and CPU handling time through configuring the passive interface. Based on this configuration, the IS-IS can be specified to only release the directly connected network routing information of the passive interfaces and not release the directly connected network routing information of the non-passive interfaces.

Table 5‑16Configure the IS-IS passive interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Configure the IS-IS passive interface | passive-interface interface-name | Mandatory By default, the IS-IS does not have the passive interface.
Configure the IS-IS only to release the routing information of the passive interface | advertise-passive-only | Optional By default, the directly connected network routing information of the interface enabled with the IS-IS protocol is released.

Configure IS-IS Hello Packet Parameter

1. Configure the Hello packet delivery interval.

The interface enabled with the IS-IS protocol will send the Hello packet to keep the neighboring relationship with the neighboring devices. The smaller delivery interval of the Hello packet is, the faster the network convergence is. However, more bandwidth will be occupied.

Table 5‑17 Configure delivery interval for the Hello packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the Hello packet delivery interval on the interface | isis hello-interval { interval | minimal } [ level-1 | level-2 ] | Optional By default, the delivery interval of the Hello packet is 10s.

2. Configure the number of invalid Hello packets.

The IS-IS calculates the neighbor relationship retention time based on the number of invalid Hello packets and informs the retention time to the neighboring device. If the neighboring device does not receive the Hello packet from this device during this period, the neighbor relationship is invalid and the routing calculation will be recalculated.

Table 5‑18 Configure the number of invalid Hello packets

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the number of invalid Hello packets on the interface | isis hello-multiplier multiplier [ level-1 | level-2 ] | Optional By default, the number of invalid Hello packets is 3.

3. Configure to cancel the Hello packet padding function.

If MTU values on the interface at both sides of the link are inconsistent, as a result, smaller packets can be transmitted but larger packets cannot be transmitted. To avoid such situation, the IS-IS adopts the padding Hello packet to the interface MTU value to make the neighbor relationship cannot be established. However, this method wastes the bandwidth. In actual network, there is no need to configure the padding Hello packet. Only the small Hello packets are transmitted.

Table 5‑19 Configure to cancel the Hello packet padding function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Cancel the Hello packet padding function | no isis hello padding | Mandatory By default, the Hello packet padding function is enabled.

Configure IS-IS LSP Packet Parameter

1. Configure the maximum survival time for the LSP packet.

Each LSP packet has a maximum survival time. When the survival time of the LSP packet reduces to 0, the LSP packet will be deleted from the link status database. The maximum survival time of the LSP packet must be larger than the LSP packet refresh interval.

Table 5‑20Configure the IS-IS LSP packet parameter

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Configure the maximum survival time for the LSP packet | max-lsp-lifetime life-time | Optional By default, the maximum survival time of the LSP is 1200s.

2. Configure the LSP packet refresh interval.

The IS-IS protocol advertises and learns the routing through interacting each LSP packets. The nodes save the received LSP packets in the link status database. Each LSP packet has a maximum survival time and each node needs to refresh its LSP packet periodically to prevent the LSP packet maximum survival time reducing to 0 and keep the LSP packet in the entire area synchronization. Reducing the LSP packet delivery interval can accelerate the network convergence speed, but will occupy more bandwidth.

Table 5‑21 Configure the LSP packet update packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Configure the LSP packet refresh interval | lsp-refresh-interval refresh-interval | Optional By default, the packet refresh interval for the periodical packet delivery is 900s.

3. Configure the LSP packet generation interval.

Periodical refresh will generate new LSP packet. Besides, the interface status changes and network status changes will also trigger new LSP packet generation. To prevent frequently generated LSP packets occupying too much CPU resources, the user can configure the minimum LSP packet generation interval.

Table 5‑22 Configure the LSP packet generation interval

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Configure the LSP packet generation interval | lsp-gen-interval [ level-1 | level-2 ] max-interval [ initial-interval [ secondary-interval ]] | Optional By default, the LSP packet generation interval is 50 ms.

4. Configure the LSP packet delivery interval.

Every generated LSP packet will be delivered on the interface. To avoid frequently generated LSP packet will greatly occupy the interface bandwidth. Each interface is configured with the minimum delivery interval of the LSP packet.

Table 5‑23 Configure the LSP packet delivery interval

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the LSP packet delivery interval | isis lsp-interval min-interval | Optional By default, the delivery interval of the LSP packet is 33 ms.

5. Configure the LSP packet retransmission time.

On the point-to-point link, the IS-IS sends the LSP packet and the then requires the peer end to send the PSNP acknowledgement message. If the IS-IS does not receive the acknowledgement message, the IS-IS will send the LSP packet again. The time waiting the acknowledgement message is the LSP packet retransmission interval. The retransmission interval can be set as required by the user to avoid LSP packet retransmission when the acknowledgement message is not received due to large delay.

Table 5‑24Configure the LSP packet retransmission time

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the LSP packet retransmission time | isis retransmit-interval interval[ level-1 | level-2 ] | Optional By default, the retransmission time is 5s.

6. Configure the LSP MTU value.

The IS-IS protocol packet cannot perform automatic fragmentation. In order not to affecting normal LSP packet spread, the maximum length of the LSP packet in a routing domain cannot exceed the minimum MTU value on the IS-IS interfaces of all devices. Therefore, when the interface MTU values are inconsistent on devices in the routing domain, it is recommended that the maximum length of the LSP packet is set uniformly.

Table 5‑25 Configure the LSP MTU value

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Configure the LSP packet MTU value | lsp-mtu mtu-size[ level-1 | level-2 ] | Optional By default, the MTU value of the LSP packet is 1492 bytes.

Configure IS-IS SNP Packet Parameter

1. Configure the CSNP packet delivery interval.

The selected nodes on the broadcast link need to send the CSNP packet periodically to synchronize the link status database on the entire network. The CSNP packet delivery interval is adjusted based on the actual situation.

Table 5‑26Configure the CSNP packet delivery interval

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the CSNP packet delivery interval | isis csnp-interval interval[ level-1 | level-2 ] | Optional By default, the CSNP packet delivery interval is 10s.

2. Configure the PSNP packet delivery interval

On the broadcast link, the PSNP packet synchronizes the link status database on the entire network. On the point-to-point link, the PSNP packet confirms the received LSP packet. To avoid a large number of PSNP packets being delivered over the interface. A minimum delivery interval is set for the PSNP packet and the user can change the interval dynamically. The PSNP packet delivery interval cannot be set to a too large value. If the packet delivery interval is set to a too large value, the link status database synchronization on the entire network will be affected for the broadcast link, and the LSP packet may be redelivered caused by not timely receiving the acknowledgment message for the point-to-point link.

Table 5‑27 Configure the PSNP packet delivery interval

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the PSNP packet delivery interval | isis psnp-interval min-interval[ level-1 | level-2 ] | Optional By default, the PSNP packet delivery interval is 2s.

Configure IS-IS SPF Calculation Interval

The IS-IS link status database changes will trigger the SPF routing calculation. Frequent SPF calculation will consume a mass of CPU resources and user can configure the SPF calculation interval.

Table 5‑28Configure the IS-IS SPF calculation interval

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Enter the IS-IS IPv4 address family configuration mode | address-family ipv4 unicast | -
Configure the IS-IS SPF calculation interval | spf-interval [ level-1 | level-2 ] maximum-interval [ min-initial-delay [ min-second-delay ]] | Optional

Configure Maximum Number of Areas for IS-IS

Multiple area IP addresses can be configured in an IS-IS process. Multiple area IP addresses are mainly applied in the following two situations that multiple Level-1 areas are combined as a Level-1 area, or a Level-1 area is divided into multiple Level-1 areas.

Table 5‑29Configure the maximum number of areas for the IS-IS

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Configure the maximum number of areas for the IS-IS | max-area-addresses max-number | Optional By default, the maximum number of the area IP addresses is 3.

l This configuration must be consistent in the entire IS-IS Level-1 routing domain. Otherwise, the Level-1 neighbor cannot be established normally. The Level-2 neighbor is not affected.

Configure IS-IS Host Name Mapping

The IS-IS uniquely identifies a intermediate system using the system ID with a fixed length of 6 bytes. When viewing the system information such as the neighbor relationship and link status database, the system ID cannot enable the user to visually associate the system ID with the host name. The IS-IS supports the mapping between the system ID and the host name to enable the user to view the system information more visually and conveniently. The IS-IS host name mapping can be configured in the following two methods:

1. Configure the IS-IS static host name mapping.

The IS-IS static host name mapping is manually established by the user between the system ID and the host name for the remote device .

Table 5‑30 Configure the IS-IS static host name mapping

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Configure the IS-IS static hostname mapping | hostname static system-idhost-name | Mandatory

2. Configure the IS-IS dynamic host name mapping.

The static host name mapping requires the user to configure the system ID and host name mapping of other devices on each device in the network, which has a heavy workload. The dynamic host name mapping only configures the host name for each device, and other devices in the network can learn the host name of the device when the host name advertisement function is enabled.

Table 5‑31 Configure the IS-IS dynamic host name mapping

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Configure the IS-IS dynamic host name mapping | hostname dynamic { host-name| area-tag | recv-only | system-name } | Mandatory By default, only the host names advertized by other devices are learnt.

Configure IS-IS Interface to Be Added to Mesh Group

When the IS-IS interface is not added to the mesh group, the LSP packet received from an interface will be sent out on all the other IS-IS interfaces. This results in great bandwidth waste in a full mesh connected network. To avoid this situation, several IS-IS interfaces can be added to a mesh group. When an interface receives the LSP packet, it only sends the LSP packet out to the interface that is not in the same mesh group with this interface.

Table 5‑32Configure the IS-IS interface to be added to the mesh group

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the IS-IS interface to be added to the mesh group | isis mesh-group { group-number| blocked } | Mandatory By default, the IS-IS interface is not added to the mesh group.

l The isis mesh-group blocked command can be used to configure the interface as the obstructive interface. The obstructive interface will not send the LSP packet actively and only send the LSP packet when receives the LSP request.


5.2.6 Configure IS-IS Network Authentication

Configuration Condition

Before configuring the IS-IS network authentication, first complete the following tasks:

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IS-IS protocol.

Configure IS-IS Neighboring Authentication

When the neighbor relationship authentication is enabled for the IS-IS, the authentication information will be added to the delivered Hello packet and the received Hello packet will be authenticated. If the authentication fails, the neighbor relationship will not be established. This can prevent the neighbor relationship being established with the unreliable devices.

Table 5‑33Configure the IS-IS neighboring authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the Hello packet authentication mode | isis authentication mode { md5 | text } [ level-1 | level-2 ] | Mandatory By default, the authentication function is not enabled.
Configure the Hello packet authentication password | isis authentication key { 0 | 7 } password [ level-1 | level-2 ] | Either By default, the authentication password is not configured. The authentication password can be configured using the password chain. For details about the password chain configuration, refer to the password chain configuration chapter in the configuration manual.
 | isis authentication key-chain key-chain-name [ level-1 | level-2 ]

Configure IS-IS Route Authentication

When the routing information authentication is enabled for the IS-IS, the authentication information will be added to the LSP and SNP packets and the received LSP and SNP packets will be authenticated. If the authentication fails, the packet will be dropped directly. This can prevent the unreliable routing information spreading to the IS-IS network.

Table 5‑34Configure the IS-IS route authentication

Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [area-tag] | -
Configure the authentication mode of the routing information packet | authentication mode { md5 | text } [ level-1 | level-2 ] | Mandatory By default, the authentication function is not enabled.
Configure the authentication password of the routing information packet | authentication key { 0 | 7 } password [ level-1 | level-2 ] | Either By default, the authentication password is not configured. The authentication password can be configured using the password chain. For details about the password chain configuration, refer to the password chain configuration chapter in the configuration manual.
 | authentication key-chain key-chain-name [ level-1 | level-2 ]


5.2.7 Configure IS-IS to coordinate with the BFD

The IS-IS to coordinate with the BFD is configure to fast detect the link faults and enable the backup link for communication. The IS-IS to coordinate with the BFD can be configured in the following two methods: All interfaces enabled with the IS-IS protocol are coordinated with the BFD and the interface is specified to coordinate with the BFD.

For details about the BFD parameter information, refer to the BFD configuration manual.

Configuration Condition

Before configuring the IS-IS to coordinate with the BFD, first complete the following task:

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IS-IS protocol.

Configure IS-IS to Coordinate with BFD

Table 5‑35Configure the IS-IS to coordinate with the BFD

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the interface to enable the BFD link detection function | isis bfd | Mandatory By default, the BFD link detection function is not enabled for the interface.
Return to the global configuration mode | exit | -
Enter the IS-IS configuration mode | router isis [ area-tag ] | -
Configure all IS-IS interfaces to enable the BFD link detection function | bfd all-interfaces | Optional


5.2.8 IS-IS Monitoring and Maintaining

Table 5‑36 The IS-IS monitoring and maintaining

Command | Description
clear isis [ instance -null | area-tag ] statistics [ interface_name ] | Clear the statistics information of the IS-IS protocol operation
clear isis [ instance -null | area-tag ] process | Restart the IS-IS protocol process
show isis [ instance -null | area-tag ] | Display the IS-IS process information
show isis instance { -null | area-tag } bfd-sessions | Display the BFD session information of the IS-IS process
show isis [ instance -null | area-tag ] database [ lsp_id ] [ detail ] [ l1 / l2 ] [ level-1 / level-2 ] [ self ] [ verbose ] | Display the IS-IS link status database information
show isis interface [ interface-name ] [ detail ] | Display the information of the IS-IS protocol interface operation
show isis [ instance –null | area-tag ] ipv4 reach-info | Display the IS-IS IPv4 subnet reachable information
show isis [ instance –null | area-tag ] ipv4 route | Display the IS-IS IPv4 routing information
show isis [ instance –null | area-tag ] ipv4 topology | Display the IS-IS IPv4 topology information
show isis [ instance – null | area-tag ] is-reach-info [ level-1 | level-2 ] | Display the IS-IS neighboring node information
show isis [instance –null | area-tag] mesh-groups | Display the IS-IS mesh group
show isis [ instance –null | area-tag ] neighbors [ interface-name ] [ detail ] | Display the IS-IS neighbor information
show isis [ instance –null | area-tag ] statistics [ interface-name ] | Display the statistics information of the IS-IS protocol operation
show isis router | Display the IS-IS host name information


5.3 IS-IS Typical Configuration Example


5.3.1 Configure IS-IS Basic Function

Network Requirements

l Configure the IS-IS protocol to realize the network interconnection between devices.

l Device1 is the Level-1 router and Device2 is the Level-1-2 router. Device1 and Device2 are in the same area, Area 10. Device3 is the Level-2 router in Area 20. Device2 connects the two areas.

Network Topology

Figure 5–1 Networking of configuring the IS-IS basic functions

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IS-IS and enable the process on the interface.

#Configure the IS-IS process as 100, area number as 10, and type as Level-1 and enable the process on the interface on Device1.

Device1#configure terminal

Device1(config)#router isis 100

Device1(config-isis)#net 10.0000.0000.0001.00

Device1(config-isis)#is-type level-1

Device1(config-isis)#metric-style wide

Device1(config-isis)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip router isis 100

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip router isis 100

Device1(config-if-gigabitethernet1)#exit

#Configure the IS-IS process as 100, area number as 10, and type as Level-1-2 and enable the process on the interface on Device2.

Device2#configure terminal

Device2(config)#router isis 100

Device2(config-isis)#net 10.0000.0000.0002.00

Device2(config-isis)#metric-style wide

Device2(config-isis)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip router isis 100

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip router isis 100

Device2(config-if-gigabitethernet1)#exit

#Configure the IS-IS process as 100, area number as 20, and type as Level-2 and enable the process on the interface on Device3.

Device3#configure terminal

Device3(config)#router isis 100

Device3(config-isis)#net 20.0000.0000.0003.00

Device3(config-isis)#is-type level-2

Device3(config-isis)#metric-style wide

Device3(config-isis)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip router isis 100

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip router isis 100

Device3(config-if-gigabitethernet1)#exit

Step 3:

Check the result.

#View the IS-IS neighboring information of Device1.

Device1#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 1):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L1-LAN 0000.0000.0002 gigabitethernet1 Up 29 sec L1 capable 64 0000.0000.0001.01

#View the IS-IS neighboring information on Device2.

Device2#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 2):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L2-LAN 0000.0000.0003 gigabitethernet1 Up 9 sec L2 capable 64 0000.0000.0003.01

L1-LAN 0000.0000.0001 gigabitethernet0 Up 8 sec L1 capable 64 0000.0000.0001.01

Device2 builds the IS-IS neighbor with Device1 and Device3, respectively.

#View the IS-IS neighboring information of Device3.

Device3#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 1):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L2-LAN 0000.0000.0002 gigabitethernet0 Up 22 sec L2 capable 64 0000.0000.0003.01

#View the routing information of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is 100.1.1.2 to network 0.0.0.0

i 0.0.0.0/0 [115/10] via 100.1.1.2, 17:44:09, gigabitethernet1

C 10.1.1.0/24 is directly connected, 16:56:18, gigabitethernet0

C 100.1.1.0/24 is directly connected, 18:37:57, gigabitethernet1

C 127.0.0.0/8 is directly connected, 284:02:13, lo0

i 200.1.1.0/24 [115/20] via 100.1.1.2, 17:44:09, gigabitethernet1

Device1#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 4):

L1 0.0.0.0/0, flags none, metric 10, from learned, installed

via 100.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

L1 10.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L1 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

L1 200.1.1.0/24, flags none, metric 20, from learned, installed

via 100.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

A default routing is in the routing table of Device1 and the next hop is Device2.

#View the routing information of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

i 10.1.1.0/24 [115/20] via 100.1.1.1, 16:58:26, gigabitethernet0

C 100.1.1.0/24 is directly connected, 18:39:58, gigabitethernet0

C 127.0.0.0/8 is directly connected, 20:16:34, lo0

C 200.1.1.0/24 is directly connected, 18:39:37, gigabitethernet1

i 210.1.1.0/24 [115/20] via 200.1.1.2, 16:57:56, gigabitethernet1

Device2#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 4):

L1 10.1.1.0/24, flags none, metric 20, from learned, installed

via 100.1.1.1, gigabitethernet0, neighbor 0000.0000.0001

L1 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L1 200.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

L2 210.1.1.0/24, flags none, metric 20, from learned, installed

via 200.1.1.2, gigabitethernet1, neighbor 0000.0000.0003

Device2 contains the Level-1 and Level-2 routing.

#View the routing information of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

i 10.1.1.0/24 [115/30] via 200.1.1.1, 16:59:29, gigabitethernet0

i 100.1.1.0/24 [115/20] via 200.1.1.1, 17:47:29, gigabitethernet0

C 127.0.0.0/8 is directly connected, 945:29:12, lo0

C 200.1.1.0/24 is directly connected, 18:40:27, gigabitethernet0

C 210.1.1.0/24 is directly connected, 16:59:04, gigabitethernet1

Device3#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 4):

L2 10.1.1.0/24, flags none, metric 30, from learned, installed

via 200.1.1.1, gigabitethernet0, neighbor 0000.0000.0002

L2 100.1.1.0/24, flags none, metric 20, from learned, installed

via 200.1.1.1, gigabitethernet0, neighbor 0000.0000.0002

L2 200.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L2 210.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

Device3 learns the Level-1 routing and the Level-1 leaks the routing to Level-2 by default.

l The metric type is the narrow metric by default. The wide metric is recommended.

l The IS-IS entity attribute is Level-1-2 by default.


5.3.2 Configure IS-IS DIS Node Selection

Network Requirements

l Specify the device as the DIS node by changing the priority.

l Device1 and Device2 are the Level-1-2 devices, Device3 is the Level-1 device, and Device4 is the Level-2 device. Device1, Device2, Device3, and Device4 are in the same broadcast network and in the same area, Area 10.

Network Topology

Figure 5–2 Networking of configuring the IS-IS DIS selection

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IS-IS and enable the process on the interface.

#Configure the IS-IS process as 100, area number as 10, and type as Level-1-2 and enable the process on the interface on Device1.

Device1#configure terminal

Device1(config)#router isis 100

Device1(config-isis)#net 10.0000.0000.0001.00

Device1(config-isis)#metric-style wide

Device1(config-isis)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip router isis 100

Device1(config-if-gigabitethernet0)#exit

#Configure the IS-IS process as 100, area number as 10, and type as Level-1-2 and enable the process on the interface on Device2.

Device2#configure terminal

Device2(config)#router isis 100

Device2(config-isis)#net 10.0000.0000.0002.00

Device2(config-isis)#metric-style wide

Device2(config-isis)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip router isis 100

Device2(config-if-gigabitethernet0)#exit

#Configure the IS-IS process as 100, area number as 10, and type as Level-1 and enable the process on the interface on Device3.

Device3#configure terminal

Device3(config)#router isis 100

Device3(config-isis)#net 10.0000.0000.0003.00

Device3(config-isis)#is-type level-1

Device3(config-isis)#metric-style wide

Device3(config-isis)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip router isis 100

Device3(config-if-gigabitethernet0)#exit

#Configure the IS-IS process as 100, area number as 20, and type as Level-2 and enable the process on the interface on Device4.

Device4#configure terminal

Device4(config)#router isis 100

Device4(config-isis)#net 20.0000.0000.0004.00

Device4(config-isis)#is-type level-2

Device4(config-isis)#metric-style wide

Device4(config-isis)#exit

Device4(config)#interface gigabitethernet0

Device4(config-if-gigabitethernet0)#ip router isis 100

Device4(config-if-gigabitethernet0)#exit

#View the IS-IS neighboring information of Device1.

Device1#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 4):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L1-LAN 0000.0000.0002 gigabitethernet0 Up 23 sec L1 capable 64 0000.0000.0003.01

L2-LAN 0000.0000.0002 gigabitethernet0 Up 23 sec L2 capable 64 0000.0000.0004.01

L1-LAN 0000.0000.0003 gigabitethernet0 Up 8 sec L1 capable 64 0000.0000.0003.01

L2-LAN 0000.0000.0004 gigabitethernet0 Up 8 sec L2 capable 64 0000.0000.0004.01

The pseudo node of Level-1 is 0000.0000.0003.01 and Device3 is the DIS node of Level-1. The pseudo node of Level-2 is 0000.0000.0004.01 and Device1 is the DIS node of Level-2.

#Run the show isis interface command to view the MAC address of the interface. In the default priority, the DIS node is selected based on the principle that a larger MAC address of the physical interface has a higher priority.

Step 3:

Modify the interface priority.

#Modify the interface priority of Device1.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#isis priority 100

Device1(config-if-gigabitethernet0)#exit

Step 4:

Check the result.

#View the IS-IS neighboring information of Device1.

Device1#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 4):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L1-LAN 0000.0000.0002 gigabitethernet0 Up 24 sec L1 capable 64 0000.0000.0001.01

L2-LAN 0000.0000.0002 gigabitethernet0 Up 23 sec L2 capable 64 0000.0000.0001.01

L1-LAN 0000.0000.0003 gigabitethernet0 Up 20 sec L1 capable 64 0000.0000.0001.01

L2-LAN 0000.0000.0004 gigabitethernet0 Up 24 sec L2 capable 64 0000.0000.0001.01

The pseudo node of Level-1-2 is 0000.0000.0001.01 and Device1 is the DIS node of Levev-1-2.

l The IS-IS interface priority is 64 by default.


5.3.3 Configure IS-IS Inter-layer Route Leakage

Network Requirements

l Configure the inter-layer leakage on the Level-1-2 to leak the routing of Level-2 to Level-1.

l Device1 is the Level-1 router, Device2 is the Level-1-2 router, and Device1 and Device2 are in the same area, Area 10. Device3 is the Level-2 router in Area 20. Device2 connects the two areas.

Network Topology

Figure 5–3 Networking of configuring the IS-IS inter-layer leakage

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IS-IS and enable the process on the interface.

#Configure the IS-IS process as 100, area number as 10, and type as Level-1 and enable the process on the interface on Device1.

Device1#configure terminal

Device1(config)#router isis 100

Device1(config-isis)#net 10.0000.0000.0001.00

Device1(config-isis)#is-type level-1

Device1(config-isis)#metric-style wide

Device1(config-isis)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip router isis 100

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip router isis 100

Device1(config-if-gigabitethernet1)#exit

#Configure the IS-IS process as 100, area number as 10, and type as Level-1-2 and enable the process on the interface on Device2.

Device2#configure terminal

Device2(config)#router isis 100

Device2(config-isis)#net 10.0000.0000.0002.00

Device2(config-isis)#metric-style wide

Device2(config-isis)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip router isis 100

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip router isis 100

Device2(config-if-gigabitethernet1)#exit

#Configure the IS-IS process as 100, area number as 20, and type as Level-2 and enable the process on the interface on Device3.

Device3#configure terminal

Device3(config)#router isis 100

Device3(config-isis)#net 20.0000.0000.0003.00

Device3(config-isis)#is-type level-2

Device3(config-isis)#metric-style wide

Device3(config-isis)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip router isis 100

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip router isis 100

Device3(config-if-gigabitethernet1)#exit

#View the routing information of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is 100.1.1.2 to network 0.0.0.0

i 0.0.0.0/0 [115/10] via 100.1.1.2, 17:44:09, gigabitethernet1

C 10.1.1.0/24 is directly connected, 16:56:18, gigabitethernet0

C 100.1.1.0/24 is directly connected, 18:37:57, gigabitethernet1

C 127.0.0.0/8 is directly connected, 284:02:13, lo0

i 200.1.1.0/24 [115/20] via 100.1.1.2, 17:44:09, gigabitethernet1

Device1#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 4):

L1 0.0.0.0/0, flags none, metric 10, from learned, installed

via 100.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

L1 10.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L1 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

L1 200.1.1.0/24, flags none, metric 20, from learned, installed

via 100.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

Device1#show isis database detail

IS-IS Instance 100 Level-1 Link State Database (Counter 3, LSP-MTU 1492):

LSPID LSP Seq Num LSP Checksum LSP Holdtime Length ATT/P/OL

0000.0000.0001.00-00* 0x0000007E 0xD5DA 1067 71 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 100.1.1.1

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 10.1.1.0/24

Metric: 10 IP-Extended 100.1.1.0/24

0000.0000.0001.01-00* 0x00000073 0xAAAF 471 51 0/0/0

Metric: 0 IS-Extended 0000.0000.0001.00

Metric: 0 IS-Extended 0000.0000.0002.00

0000.0000.0002.00-00 0x00000081 0x5926 887 71 1/0/0

NLPID: IPv4

Area Address: 10

IP Address: 200.1.1.1

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 100.1.1.0/24

Metric: 10 IP-Extended 200.1.1.0/24

A default routing is in the routing table and the next hop is Device2. No Level-2 routing advertised by Device3 is in the routing table.

#View the routing information of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

i 10.1.1.0/24 [115/20] via 100.1.1.1, 16:58:26, gigabitethernet0

C 100.1.1.0/24 is directly connected, 18:39:58, gigabitethernet0

C 127.0.0.0/8 is directly connected, 20:16:34, lo0

C 200.1.1.0/24 is directly connected, 18:39:37, gigabitethernet1

i 210.1.1.0/24 [115/20] via 200.1.1.2, 16:57:56, gigabitethernet1

Device2#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 4):

L1 10.1.1.0/24, flags none, metric 20, from learned, installed

via 100.1.1.1, gigabitethernet0, neighbor 0000.0000.0001

L1 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L1 200.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

L2 210.1.1.0/24, flags none, metric 20, from learned, installed

via 200.1.1.2, gigabitethernet1, neighbor 0000.0000.0003

Device2#show isis database detail

IS-IS Instance 100 Level-1 Link State Database (Counter 3, LSP-MTU 1492):

LSPID LSP Seq Num LSP Checksum LSP Holdtime Length ATT/P/OL

0000.0000.0001.00-00 0x0000007E 0xD5DA 507 71 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 100.1.1.1

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 10.1.1.0/24

Metric: 10 IP-Extended 100.1.1.0/24

0000.0000.0001.01-00 0x00000074 0xA8B0 799 51 0/0/0

Metric: 0 IS-Extended 0000.0000.0001.00

Metric: 0 IS-Extended 0000.0000.0002.00

0000.0000.0002.00-00* 0x00000082 0x5727 1146 71 1/0/0

NLPID: IPv4

Area Address: 10

IP Address: 200.1.1.1

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 100.1.1.0/24

Metric: 10 IP-Extended 200.1.1.0/24

IS-IS Instance 100 Level-2 Link State Database (Counter 3, LSP-MTU 1492):

LSPID LSP Seq Num LSP Checksum LSP Holdtime Length ATT/P/OL

0000.0000.0002.00-00* 0x00000081 0x84C0 1047 79 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 200.1.1.1

Metric: 10 IS-Extended 0000.0000.0003.01

Metric: 20 IP-Extended 10.1.1.0/24

Metric: 10 IP-Extended 100.1.1.0/24

Metric: 10 IP-Extended 200.1.1.0/24

0000.0000.0003.00-00 0x00000315 0x9DC7 543 71 0/0/0

NLPID: IPv4

Area Address: 20

IP Address: 210.1.1.1

Metric: 10 IS-Extended 0000.0000.0003.01

Metric: 10 IP-Extended 200.1.1.0/24

Metric: 10 IP-Extended 210.1.1.0/24

0000.0000.0003.01-00 0x00000070 0xBF97 526 51 0/0/0

Metric: 0 IS-Extended 0000.0000.0002.00

Metric: 0 IS-Extended 0000.0000.0003.00

Device2 contains the Level-1 and Level-2 routing.

#View the routing information of Device3 and Device3 contains the Level-1 routing advertised by Device1.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

i 10.1.1.0/24 [115/30] via 200.1.1.1, 16:59:29, gigabitethernet0

i 100.1.1.0/24 [115/20] via 200.1.1.1, 17:47:29, gigabitethernet0

C 127.0.0.0/8 is directly connected, 945:29:12, lo0

C 200.1.1.0/24 is directly connected, 18:40:27, gigabitethernet0

C 210.1.1.0/24 is directly connected, 16:59:04, gigabitethernet1

Device3#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 4):

L2 10.1.1.0/24, flags none, metric 30, from learned, installed

via 200.1.1.1, gigabitethernet0, neighbor 0000.0000.0002

L2 100.1.1.0/24, flags none, metric 20, from learned, installed

via 200.1.1.1, gigabitethernet0, neighbor 0000.0000.0002

L2 200.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L2 210.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

Device3#show isis database detail

IS-IS Instance 100 Level-2 Link State Database (Counter 3, LSP-MTU 1492):

LSPID LSP Seq Num LSP Checksum LSP Holdtime Length ATT/P/OL

0000.0000.0002.00-00 0x00000081 0x84C0 880 79 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 200.1.1.1

Metric: 10 IS-Extended 0000.0000.0003.01

Metric: 20 IP-Extended 10.1.1.0/24

Metric: 10 IP-Extended 100.1.1.0/24

Metric: 10 IP-Extended 200.1.1.0/24

0000.0000.0003.00-00* 0x00000316 0x9BC8 1197 71 0/0/0

NLPID: IPv4

Area Address: 20

IP Address: 210.1.1.1

Metric: 10 IS-Extended 0000.0000.0003.01

Metric: 10 IP-Extended 200.1.1.0/24

Metric: 10 IP-Extended 210.1.1.0/24

0000.0000.0003.01-00* 0x00000070 0xBF97 359 51 0/0/0

Metric: 0 IS-Extended 0000.0000.0002.00

Metric: 0 IS-Extended 0000.0000.0003.00

Step 3:

Configure the inter-layer leakage.

#Configure the inter-layer leakage for Device2.

Device2(config)#router isis 100

Device2(config-isis)#address-family ipv4 unicast

Device2(config-isis-af)#propagate level-2 into level-1

Device2(config-isis-af)#exit

Device2(config-isis)#exit

Step 4:

Check the result.

#View the routing information of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is 100.1.1.2 to network 0.0.0.0

i 0.0.0.0/0 [115/10] via 100.1.1.2, 17:44:09, gigabitethernet1

C 10.1.1.0/24 is directly connected, 16:56:18, gigabitethernet0

C 100.1.1.0/24 is directly connected, 18:37:57, gigabitethernet1

C 127.0.0.0/8 is directly connected, 284:02:13, lo0

i 200.1.1.0/24 [115/20] via 100.1.1.2, 17:44:09, gigabitethernet1

i 210.1.1.0/24 [115/30] via 100.1.1.2, 00:00:01, gigabitethernet1

Device1#show isis ipv4 route

L1 0.0.0.0/0, flags none, metric 10, from learned, installed

via 100.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

L1 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

L1 200.1.1.0/24, flags none, metric 20, from learned, installed

via 100.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

L1 210.1.1.0/24, flags inter-area, metric 30, from learned, installed

via 100.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

Device1#show isis database detail

IS-IS Instance 100 Level-1 Link State Database (Counter 3, LSP-MTU 1492):

LSPID LSP Seq Num LSP Checksum LSP Holdtime Length ATT/P/OL

0000.0000.0001.00-00* 0x0000007F 0xD3DB 668 71 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 100.1.1.1

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 10.1.1.0/24

Metric: 10 IP-Extended 100.1.1.0/24

0000.0000.0001.01-00* 0x00000075 0xA6B1 995 51 0/0/0

Metric: 0 IS-Extended 0000.0000.0001.00

Metric: 0 IS-Extended 0000.0000.0002.00

0000.0000.0002.00-00 0x00000083 0x4DA6 984 79 1/0/0

NLPID: IPv4

Area Address: 10

IP Address: 200.1.1.1

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 100.1.1.0/24

Metric: 10 IP-Extended 200.1.1.0/24

Metric: 20 IP-Extended ia 210.1.1.0/24

Besides the default routing, Device1 also learns the Level-2 routing advertised by Device3.


5.3.4 Configure IS-IS Routing Redistribution

Network Requirements

l Configure the redistribution to introduce the external routing to the IS-IS, enabling network interconnection between devices.

l Device1 and Device2 are the Level-2 routers. Configure the IS-IS and the Area 10. Configure the OSPF on Device2 and Device3. Redistribute the OSPF routing to the IS-IS through the configuration on Device2.

Network Topology

Figure 5–4 Networking of configuring the IS-IS routing redistribution

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IS-IS and enable the process on the interface.

#Configure the IS-IS process as 100, area number as 10, and type as Level-2 and enable the process on the interface on Device1.

Device1#configure terminal

Device1(config)#router isis 100

Device1(config-isis)#net 10.0000.0000.0001.00

Device1(config-isis)#is-type level-2

Device1(config-isis)#metric-style wide

Device1(config-isis)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip router isis 100

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip router isis 100

Device1(config-if-gigabitethernet1)#exit

#Configure the IS-IS process as 100, area number as 10, and type as Level-1-2 and enable the process on the interface on Device2.

Device2#configure terminal

Device2(config)#router isis 100

Device2(config-isis)#net 10.0000.0000.0002.00

Device2(config-isis)#is-type level-2

Device2(config-isis)#metric-style wide

Device2(config-isis)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip router isis 100

Device2(config-if-gigabitethernet0)#exit

Step 3:

Configure the OSPF.

#Configure Device2.

Device2(config)#router ospf 100

Device2(config-ospf)#network 200.1.1.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 210.1.1.0 0.0.0.255 area 0

Device3(config-ospf)#network 200.1.1.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#View the routing table of Device1. Device1 does not learn the OSPF routing redistributed by Device2.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:58:39, gigabitethernet0

C 100.1.1.0/24 is directly connected, 06:55:35, gigabitethernet1

C 127.0.0.0/8 is directly connected, 603:06:22, lo0

Device1#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 2):

L2 10.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L2 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

Device1#show isis database detail

IS-IS Instance 100 Level-2 Link State Database (Counter 3, LSP-MTU 1492):

LSPID LSP Seq Num LSP Checksum LSP Holdtime Length ATT/P/OL

0000.0000.0001.00-00* 0x00000046 0x489E 1123 71 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 100.1.1.1

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 10.1.1.0/24

Metric: 10 IP-Extended 100.1.1.0/24

0000.0000.0001.01-00* 0x00000045 0x097D 1103 51 0/0/0

Metric: 0 IS-Extended 0000.0000.0001.00

Metric: 0 IS-Extended 0000.0000.0002.00

0000.0000.0002.00-00 0x000000CB 0xEEA6 679 63 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 100.1.1.2

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 100.1.1.0/24

#View the routing table of Device2. Device2 learns the IS-IS and OSPF routing.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

i 10.1.1.0/24 [115/20] via 100.1.1.1, 15:45:37, gigabitethernet0

C 100.1.1.0/24 is directly connected, 22:38:58, gigabitethernet0

C 127.0.0.0/8 is directly connected, 300:03:03, lo0

C 200.1.1.0/24 is directly connected, 22:38:58, gigabitethernet1

O 210.1.1.1/32 [110/2] via 200.1.1.2, 15:43:35, gigabitethernet1

Device2#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 2):

L2 10.1.1.0/24, flags none, metric 20, from learned, installed

via 100.1.1.1, gigabitethernet0, neighbor 0000.0000.0001

L2 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

Device2#show isis database detail

IS-IS Instance 100 Level-2 Link State Database (Counter 3, LSP-MTU 1492):

LSPID LSP Seq Num LSP Checksum LSP Holdtime Length ATT/P/OL

0000.0000.0001.00-00 0x00000046 0x489E 911 71 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 100.1.1.1

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 10.1.1.0/24

Metric: 10 IP-Extended 100.1.1.0/24

0000.0000.0001.01-00 0x00000045 0x097D 892 51 0/0/0

Metric: 0 IS-Extended 0000.0000.0001.00

Metric: 0 IS-Extended 0000.0000.0002.00

0000.0000.0002.00-00* 0x000000CB 0xEEA6 467 63 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 100.1.1.2

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 100.1.1.0/24

Step 4:

Configure the IS-IS to redistribute the OSPF routing..

#Configure the OSPF routing to be redistributed to IS-IS Level-2 on Device2.

Device2(config)#router isis 100

Device2(config-isis)#address-family ipv4 unicast

Device2(config-isis-af)#redistribute ospf 100 level-2

Device2(config-isis-af)#exit

Device2(config-isis)#exit

Step 5:

Check the result.

#View the routing information of Device1. Device1 leans the OSPF routing redistributed by Device2.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 16:47:30, gigabitethernet0

C 100.1.1.0/24 is directly connected, 22:44:27, gigabitethernet1

C 127.0.0.0/8 is directly connected, 618:55:13, lo0

i 200.1.1.0/24 [115/10] via 100.1.1.2, 00:00:05, gigabitethernet1

i 210.1.1.1/32 [115/10] via 100.1.1.2, 00:00:05, gigabitethernet1

Device1#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 4):

L2 10.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L2 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

L2 200.1.1.0/24, flags none, metric 10, from learned, installed

via 100.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

L2 210.1.1.1/32, flags none, metric 10, from learned, installed

via 100.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

Device1#show isis database detail

IS-IS Instance 100 Level-2 Link State Database (Counter 3, LSP-MTU 1492):

LSPID LSP Seq Num LSP Checksum LSP Holdtime Length ATT/P/OL

0000.0000.0001.00-00* 0x00000046 0x489E 626 71 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 100.1.1.1

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 10.1.1.0/24

Metric: 10 IP-Extended 100.1.1.0/24

0000.0000.0001.01-00* 0x00000045 0x097D 606 51 0/0/0

Metric: 0 IS-Extended 0000.0000.0001.00

Metric: 0 IS-Extended 0000.0000.0002.00

0000.0000.0002.00-00 0x000000CD 0xC6E2 1184 80 0/0/0

NLPID: IPv4

Area Address: 10

IP Address: 100.1.1.2

Metric: 10 IS-Extended 0000.0000.0001.01

Metric: 10 IP-Extended 100.1.1.0/24

Metric: 0 IP-Extended 200.1.1.0/24

Metric: 0 IP-Extended 210.1.1.1/32

Device1 learns the redistributed OSPF routing.


5.3.5 Configure IS-IS Neighboring Authentication

Network Requirements

l Enable the authentication on the interface to enable the devices configured with the same password establishing the neighbor relationship.

l Device1 is the Level-1 router, Device2 is the Level-1-2 router, and Device1 and Device2 are in the same area, Area 10. Device3 is the Level-2 router in Area 20. Device2 connects the two areas.

Network Topology

Figure 5–5 Networking of configuring the IS-IS neighbor authentication

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IS-IS and enable the process on the interface.

#Configure the IS-IS process as 100, area number as 10, and type as Level-1 and enable the process on the interface on Device1.

Device1#configure terminal

Device1(config)#router isis 100

Device1(config-isis)#net 10.0000.0000.0001.00

Device1(config-isis)#is-type level-1

Device1(config-isis)#metric-style wide

Device1(config-isis)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip router isis 100

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip router isis 100

Device1(config-if-gigabitethernet1)#exit

#Configure the IS-IS process as 100, area number as 10, and type as Level-1-2 and enable the process on the interface on Device2.

Device2#configure terminal

Device2(config)#router isis 100

Device2(config-isis)#net 10.0000.0000.0002.00

Device2(config-isis)#metric-style wide

Device2(config-isis)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip router isis 100

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip router isis 100

Device2(config-if-gigabitethernet1)#exit

#Configure the IS-IS process as 100, area number as 20, and type as Level-2 and enable the process on the interface on Device3.

Device3#configure terminal

Device3(config)#router isis 100

Device3(config-isis)#net 20.0000.0000.0003.00

Device3(config-isis)#is-type level-2

Device3(config-isis)#metric-style wide

Device3(config-isis)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip router isis 100

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip router isis 100

Device3(config-if-gigabitethernet1)#exit

#View the IS-IS neighboring information of Device1.

Device1#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 1):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L1-LAN 0000.0000.0002 gigabitethernet1 Up 29 sec L1 capable 64 0000.0000.0001.01

#View the IS-IS neighboring information on Device2.

Device2#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 2):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L2-LAN 0000.0000.0003 gigabitethernet1 Up 9 sec L2 capable 64 0000.0000.0003.01

L2-LAN 0000.0000.0001 gigabitethernet0 Up 7 sec L1 capable 64 0000.0000.0001.01

#View the IS-IS neighboring information of Device3.

Device3#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 1):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L2-LAN 0000.0000.0002 gigabitethernet0 Up 24 sec L2 capable 64 0000.0000.0003.01

Step 3:

Configure the authentication.

#Configure the MD5 authentication and password admin on the interface of Device2.

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#isis authentication mode md5

Device2(config-if-gigabitethernet0)#isis authentication key 0 admin

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#isis authentication mode md5

Device2(config-if-gigabitethernet1)#isis authentication key 0 admin

Device2(config-if-gigabitethernet1)#exit

#View the IS-IS neighbor of Device2.

Device2#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 0):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

At this time, Device1 and Device3 are not configured with the authentication. Device2 does not establish the IS-IS neighbor.

#Configure the MD5 authentication and password admin on the gigabitethernet1 interface of Device1.

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#isis authentication mode md5

Device1(config-if-gigabitethernet1)#isis authentication key 0 admin

Device1(config-if-gigabitethernet1)#exit

#Configure the MD5 authentication and password admin on the gigabitethernet0 interface of Device3.

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#isis authentication mode md5

Device3(config-if-gigabitethernet0)#isis authentication key 0 admin

Device3(config-if-gigabitethernet0)#exit

Step 4:

Check the result.

#View the IS-IS neighboring information of Device1.

Device1#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 1):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L1-LAN 0000.0000.0002 gigabitethernet1 Up 29 sec L1 capable 64 0000.0000.0001.01

It can be observed that the IS-IS neighbor is successfully established between Device1 and Device2. It indicates that the authentication succeeds.

#View the IS-IS neighboring information on Device2.

Device2#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 2):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L2-LAN 0000.0000.0003 gigabitethernet1 Up 9 sec L2 capable 64 0000.0000.0003.01

L2-LAN 0000.0000.0001 gigabitethernet0 Up 7 sec L1 capable 64 0000.0000.0001.01

It can be observed that the IS-IS neighbor is successfully established between Device2 and Device1/Device3. It indicates that the authentication succeeds.

#View the IS-IS neighboring information of Device3.

Device3#show isis neighbors

IS-IS Instance 100 Neighbors (Counter 1):

Type System ID Interface State Holdtime Level IETF-NSF Priority Circuit ID

L2-LAN 0000.0000.0002 gigabitethernet0 Up 24 sec L2 capable 64 0000.0000.0003.01

It can be observed that the IS-IS neighbor is successfully established between Device3 and Device2. It indicates that the authentication succeeds.

#View the routing information of Device2. Device2 can normally receives the routing advertised by Device1 and Device3.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

i 10.1.1.0/24 [115/20] via 100.1.1.1, 16:58:26, gigabitethernet0

C 100.1.1.0/24 is directly connected, 18:39:58, gigabitethernet0

C 127.0.0.0/8 is directly connected, 20:16:34, lo0

C 200.1.1.0/24 is directly connected, 18:39:37, gigabitethernet1

i 210.1.1.0/24 [115/20] via 200.1.1.2, 16:57:56, gigabitethernet1

Device2#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 4):

L1 10.1.1.0/24, flags none, metric 20, from learned, installed

via 100.1.1.1, gigabitethernet0, neighbor 0000.0000.0001

L1 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L1 200.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

L2 210.1.1.0/24, flags none, metric 20, from learned, installed

via 200.1.1.2, gigabitethernet1, neighbor 0000.0000.0003


5.3.6 Configure IS-IS to Coordinate with BFD

Network Requirements

l Configure the BFD coordination between devices. When the main line is faulty, services can be quickly switched to the backup line.

l Device1, Device2, and Device3 are the Level-2 routers in the same area, Area 10. Configure the BFD on Device1 and Device3 to initiate a session. When the line between Device1 and Device3 disconnects, Device1 can perform switching quickly and learn the 10.1.1.1/24 routing from Device2.

Network Topology

Figure 5–6 Networking of configuring the IS-IS coordinating with the BFD

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IS-IS and enable the process on the interface.

#Configure the IS-IS process as 100, area number as 10, and type as Level-2 and enable the process on the interface on Device1.

Device1#configure terminal

Device1(config)#router isis 100

Device1(config-isis)#net 10.0000.0000.0001.00

Device1(config-isis)#is-type level-2

Device1(config-isis)#metric-style wide

Device1(config-isis)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip router isis 100

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip router isis 100

Device1(config-if-gigabitethernet1)#exit

#Configure the IS-IS process as 100, area number as 10, and type as Level-2 and enable the process on the interface on Device2.

Device2#configure terminal

Device2(config)#router isis 100

Device2(config-isis)#net 10.0000.0000.0002.00

Device2(config-isis)#is-type level-2

Device2(config-isis)#metric-style wide

Device2(config-isis)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip router isis 100

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip router isis 100

Device2(config-if-gigabitethernet1)#exit

#Configure the IS-IS process as 100, area number as 10, and type as Level-2 and enable the process on the interface on Device3.

Device3#configure terminal

Device3(config)#router isis 100

Device3(config-isis)#net 10.0000.0000.0003.00

Device3(config-isis)#is-type level-2

Device3(config-isis)#metric-style wide

Device3(config-isis)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip router isis 100

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip router isis 100

Device3(config-if-gigabitethernet1)#exit

Device3(config)#interface gigabitethernet2

Device3(config-if-gigabitethernet2)#ip router isis 100

Device3(config-if-gigabitethernet2)#exit

#View the routing information of Device1. Device1 preferentially chooses the routing 10.1.1.0/24 advertised by Device3.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

i 10.1.1.0/24 [115/20] via 100.1.1.2, 00:00:15, gigabitethernet0

C 100.1.1.0/24 is directly connected, 00:09:15, gigabitethernet0

C 127.0.0.0/8 is directly connected, 253:58:17, lo0

C 200.1.1.0/24 is directly connected, 00:11:29, gigabitethernet1

i 210.1.1.0/24 [115/20] via 100.1.1.2, 00:00:15, gigabitethernet0

[115/20] via 200.1.1.2, 00:00:15, gigabitethernet1

Device1#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 4):

L2 10.1.1.0/24, flags none, metric 20, from learned, installed

via 100.1.1.2, gigabitethernet0, neighbor 0000.0000.0003

L2 100.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet0

L2 200.1.1.0/24, flags none, metric 10, from network connected

via 0.0.0.0, gigabitethernet1

L2 210.1.1.0/24, flags none, metric 20, from learned, installed

via 100.1.1.2, gigabitethernet0, neighbor 0000.0000.0003

via 200.1.1.2, gigabitethernet1, neighbor 0000.0000.0002

Step 3:

Configure the BFD.

#Enable the BFD on the interface of Device1.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#isis bfd

Device1(config-if-gigabitethernet0)#exit

#Enable the BFD on the interface of Device3.

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#isis bfd

Device3(config-if-gigabitethernet0)#exit

#View the BFD information of Device1.

Device1#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

100.1.1.2 100.1.1.1 1/1 UP 5000 gigabitethernet0

Step 4:

Check the result.

#When the line between Device1 and Device3 is faulty, the BFD quickly detects the fault and informs the fault to the IS-IS. The ISIS switches the routing to Device2 for communication. View the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-IS-IS

Gateway of last resort is not set

i 10.1.1.0/24 [115/30] via 200.1.1.2, 00:00:14, gigabitethernet1

C 127.0.0.0/8 is directly connected, 112:55:25, lo0

C 200.1.1.0/24 is directly connected, 101:20:08, gigabitethernet1

Device1#show isis ipv4 route

IS-IS Instance 100, VRF Kernel, IPv4 routes table (Counter 2):

L2 10.1.1.0/24, flags none, metric 30, from l earned, installed

via 200.1.1.2, gigabitethernet1, neighbor 0000.0000.0003

L2 200.1.1.0/24, flags none, metric 20, from network connected

via 0.0.0.0, gigabitethernet1

#It can be viewed that the data flow from Device1 to the 10.1.1.0/24 network segment uses the line with Device2 to forward.


6 IRMP


6.1 Overview

The IRMP (Internal Routing Message Protocol), compatible with the Cisco EIGRP, is a dynamic routing protocol based on the distance vector. The IRMP uses the DUAL (Diffusing Update Algorithm) to calculate the route between multiple devices in parallel, ensuring no loop circuit and fast convergence. The IRMP overcomes the low convergence speed of distance vector-based routing protocol. Besides, it does not need the link status routing protocol to run the Dijkstra algorithm and the related databases do not consume huge CPU resources or memory.

The IRMP protocol applies to the medium- and small-size network and supports multiple autonomous systems. The autonomous systems can operate independently without interfering each other.


6.2 IRMP Function Configuration

Table 6‑1 IRMP function list

Configuration Task
Configure the IRMP basic function | Enable the IRMP protocol
Configure the IRMP route generation | Configure the IRMP redistribution
Configure the IRMP route control | Configure the IRMP route summary
 | Configure the IRMP administrative distance
 | Configure the IRMP load balancing
 | Configure the IRMP route filtering
 | Configure the IRMP metric offset
 | Configure the IRMP route metric value
Configure the IRMP network optimization | Configure the IRMP passive interface
 | Configure the IRMP horizontal split
 | Configure the IRMP timer
 | Configure the IRMP static neighbor
Configure the IRMP network authentication | Configure the IRMP authentication


6.2.1 Configure IRMP Basic Function

In the various IRMP configuration tasks, the IRMP protocol must be enabled first to make other function feature configurations valid.

Configuration Condition

Before configuring the IRMP basic function, first complete the following tasks:

l Configure the link layer protocol to ensure the link layer normal communication.

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

Enable IRMP Protocol

Before using the IRMP protocol, first the user must perform the following configurations:

l Establish the IRMP process.

l Configure the IRMP to cover the directly connected network segment.

Table 6‑2 Enable the IRMP protocol

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Establish the IRMP process and enter the IRMP configuration mode | router irmp autonomous-system-number | Mandatory By default, the IRMP process is not enabled.
Configure the IRMP to cover the directly connected network segment | network ip-address [ wildcard-mask ] | Mandatory By default, no directly connected network is covered. If the wildcard mask is not carried, the classful network address is used by default.

l When establishing the IRMP neighbor, the autonomous system numbers must be consistent. Otherwise, the neighbor relationship cannot be established.


6.2.2 Configure IRMP Route Generation

In the IRMP, the network command can be used to cover the directly connected network segment routing. The external routing can be introduced using the redistribution.

Configuration Condition

Before configuring the IRMP route generation, first complete the following tasks:

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IRMP protocol.

Configure the IRMP redistribution

Introduce the routing generated by other protocols to the IRMP through configuring the routing redistribution. The routing of other IRMP processes can also be introduced.

Table 6‑3 Configure the IRMP redistribution

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the IRMP redistribution | redistribute protocol [ process-id ] [ route-map route-map-name / metric bandwidth delay reliability loading mtu ] | Mandatory By default, the external routing is not redistributed.
Configure the default metric value for IRMP redistributing external routing | default-metric bandwidth delay reliability loading mtu | Optional

l When the default-metric command and the redistribute protocol [ process-id ] metric command are configured at the same time, the later command has a higher priority.


6.2.3 Configure IRMP Route Control

Configuration Condition

Before configuring the IRMP route control, first complete the following tasks:

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IRMP protocol.

Configure IRMP Route Summary

Both the IRMP aggregated route and original detailed route exist in the local routing table, but only the aggregated routing is informed to the neighbor. Thus, in the large-size network, the neighboring routing table scale reduces and the network bandwidth consumed by the protocol packets also reduces.

The IRMP supports the automatic summary and interface IP address summary. The metric value of the aggregated route uses the minimum metric value of all the detailed routes.

1. Automatic summary

In this mode, the route is aggregated as the corresponding classful network address by the non-manual configuration. The automatic route mode only aggregates the directly connected network segment route.

Table 6‑4 Configure the IRMP automatic summary

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the IRMP automatic summary | auto-summary | Optional By default, the IRMP automatic summary function is disabled.

2. Interface route summary

The interface route summary needs the user to configure the combination of a pair of destination IP address and mask. This combination aggregates the routes that are covered in this network segment.

Table 6‑5 Configure the IRMP interface route summary

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the IRMP interface IP address summary | ip summary-address irmp autonomous-system-number ip-address mask | Mandatory

l The automatic summary only aggregates the directly connected network segment routes and nay cause all neighbors under the process to reestablish.

l The interface route summary aims at all the IRMP routes delivered from the specified interface and may cause neighbors on the specified interface to reestablish.

l The interface route summary priors to the automatic summary.

l The interface route summary is independent with each other. That is, when the interface route summary 10.1.0.0/16 and 10.0.0.0/8 are configured at the same time, the IRMP will advertise the two summary routes simultaneously.

Configure IRMP Administrative Distance

The administrative distance performs the routing policy for the routing in the same network augment from different protocols. The smaller the administrative distance is, the higher the priority of the routing is. You can change the administrative distance of the IRMP routing to affect the routing policy.

Table 6‑6 Configure the IRMP administrative distance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the IRMP administrative distance | distance irmp internal-routes-distance external-routes-distance | Optional By default, the administrative distance for the IRMP internal route is 90 and for the external route is 170.

l When configuring the IRMP administrative distance, all neighbors under the process may be reestablished.

Configure IRMP Load Balancing

The IRMP supports the equal-cost load balancing and unequal-cost load balancing. When multiple routes with the same metric values to the destination network exist, equal-cost load balancing forms. When multiple routes with the different metric values to the destination network exist, you can run the variance command to change the conversion factor and form the unequal-cost load balancing.

Variance defines a conversion factor, which is used to determine the scope of the unequal-cost load balancing routing. When the metric value of a non-optimal routing is smaller than the metric value of the optimal routing multiplying the variance value, this routing is selected as the unequal-cost load balancing routing.

The maximum-paths command is used to control the maximum number of routings for IRMP load balancing, supporting a maximum of 6 paths for load balancing. When path-number is set to 1, the load function is cancelled. The number of paths for IRMP load balancing includes the number of equal-cost load balancing paths and unequal-cost load balancing paths. The path selected for IRMP load balancing depends on conversion factor variance.

Table 6‑7 Configure the IRMP load balancing

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the IRM conversion factor to form the unequal load balancing | variance number | Optional By default, the conversion factor is 1.
Configure the maximum number of paths for IRMP load balancing | maximum-paths path-number | Optional By default, the maximum number of paths for IRMP load balancing is 4.

Configure IRMP Route Filtering

Control the received or delivered routing through configuring the ACL or prefix list. The inbound and outbound routing filtering can be configured on the interface at the same time.

Table 6‑8 Configure the IRMP route filtering

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the IRMP route filtering | distribute-list { access-list-name | gateway prefix-list-name1 | prefix prefix-list-name2 [ gateway prefix-list-name3 ] } { in | out } [ interface-name ] | Mandatory

l The IRMP routing filtering only supports the standard ACL.

l You can configure the filtering on all interfaces or use the interface-name parameter to specify the interface for configuring filtering. When the preceding two modes are configured at the same time, the configuration is valid when the preceding two filtering rules are set to permit.

Configure IRMP Metric Offset

By default, the IRMP routing adopts the metric value advertised by the neighbor. In some application scenarios, the metric value requires modification. The user can rectify the metric value of a specified routing by configuring the IRMP metric offset.

If the inbound metric offset is configured, the routing metric value is modified, saved in the routing table, and then advertised to the neighbor upon receiving the IRMP routing. If the outbound metric offset is configured, only the metric value advertised to the neighboring routing will be modified and the local metric value remains unchanged.

Table 6‑9 Configure the IRMP metric offset

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the IRMP metric offset | offset-list access-list-name { in | out } offset-value [ interface-name ] | Mandatory

l The IRMP metric offset only supports the standard ACL.

l When configuring the IRMP metric offset, all neighbors under the process may be reestablished.

Configure IRMP Route Metric Value

The IRMP calculates a composite metric value as the rout metric value based on the link features, such as link bandwidth, delay, load, and reliability. The calculation formula is as follows:

Route metric = 256 x ([k1 x (10 [image] /Bandwidth) + k2 x (10 [image] /Bandwidth)/(256 – Load) + k3 x (Delay/10)] x [k5/(Reliability + k4)])

Where, bandwidth is in the unit of kbit/s and delay is in the unit of microsecond. Each k value indicates the weighted value of the corresponding link feature. By default, the RMP uses the link bandwidth and delay as the metric value.

Table 6‑10 Configure the IRMP route metric value

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the IRMP route metric value | metric weights tos k1 k2 k3 k4 k5 | Mandatory Tos indicates the service type, supporting only the type-0 services. By default, k1=k3=1 and k2=k4=k5=0. The K value must be consistent when establishing the neighbor relationship.


6.2.4 Configure IRMP Network Optimization

Configuration Condition

Before configuring the IRMP network optimization, first complete the following tasks:

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IRMP protocol.

Configure IRMP Passive Interface

The dynamic routing protocol adopts the passive interface to effectively reduce the network bandwidth consumed by the routing protocol. In the IRMP protocol, the passive interface is configured, which can suppress the IRMP packet receiving and transmitting on the specified interface. For example, if the gigabitethernet 0 is configured as the passive interface, the IRMP does not receive and transmit the packet on this interface even if the network command is used to cover the network segment that the interface locates at.

Table 6‑11 Configure the IRMP passive interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the IRMP passive interface | passive interface interface-name | Mandatory

Configure IRMP Stub Mode

Configuring the IRMP stub mode can imorove the stability of the IRMP network and reduce the occupied resources. The Stub function is used in the hub and spoke network topology. To enable the Stub function, you only need to configure Stub on the spoke router, but do not need to change the configuration of the hub router. The spoke router specifies the route type to be advertised via the irmp stub command. The hub router does not send the query packets to the Stub neighbor.

Table 6‑12 Configure IRMP Stub

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure IRMP Stub | irmp stub { receive-only } | { connected / summary / redistributed } | Mandatory By default, it is not the stub mode.

l Modifying the Stub configuration results in the re-connection of all neighbors in the process.

Configure IRMP Intelligent Query

Configuring the IRMP intelligent query to control the sending of the query packets can reduce the number of the packets exchanged in the network, reducing the occupied resources. If the intelligent query function is enabled, the device does not send the query packets to the neighbor cancelling the route, so as to reduce the number of the query packets and response packets in the network.

Table 6‑13 Configure IRMP Stub

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the IRMP intelligent query | smart-query infinity-update | Mandatory By default, do not enable the intelligent query.

Configure IRMP Horizontal Split

The IRMP horizontal split indicates that the route learned by the IRMP from a certain interface will not be advertised out from this interface to avoid forming a loop.

Table 6‑14 Configure the IRMP horizontal split

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the IRMP horizontal split | ip split-horizon irmp autonomous-system-number | Optional By default, the horizontal split function is enabled.

Configure IRMP Timer

1. Configure the keep-alive timer for the IRMP neighbor.

The Hello packet of the is used to discover the neighbor and keep it alive by spreading the packet on the network using the periodical and unreliable multicast mode with the multicast address as 224.0.0.10. the default delivery interval for the Hello packet is determined by the network type of the delivery interface. The default delivery interval is 5s on the broadcast and point-to-point interface and is 60s on the NBMA interface.

The hold time indicates the invalid interval of the IRMP neighbor. When a device receives a Hello packet form its neighbor, this packet contains a hold time, which informs the maximum valid time of the neighbor to the device. If the Hello packet is not received from the neighbor when times out, it indicates that the neighbor is not reachable and the neighbor will be removed. By default, the hold time is three times of the hello interval.

Table 6‑15 Configure the keep-alive timer for the IRMP neighbor

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the IRMP hello interval | ip hello-interval irmp autonomous-system hello-time | Optional By default, the hello interval is set to 5s or 60s based on the network type.
Configure the IRMP hold time | ip hold-time irmp autonomous-system-number hold-time | Optional By default, the hold time is three times of the hello interval.

2. Configure the IRMP route timer.

The IRMP uses the DUAL (Diffusing Update Algorithm) to learn the routing. When the DUAL starts, the Active-timer is enabled. If the response of the queried packets is not received when the timer times out, the neighbors without response will be removed from the neighbor list. The route without response I set to Active and the route is considered as unreachable.

When the IRMP receives the neighbor request, if the local route is learnt from other neighbors, the IRMP will not respond immediately. Instead, enable a hold-down timer and then wait for a period. In the period, if the IRMP does not receive the request packet form the neighbor, it responds the packet to avoid forming the loop.

Table 6‑16 Configure the IRMP route timer

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the active-timer timeout | timers active-time minutes | Optional By default, the active-timer timeout is 3 minutes.
Configure the hold down timeout | timers holddown-time seconds | Optional By default, the hold down timeout is 5s.

l When configuring the route timer, all neighbors under the process may be reestablished.

Configure IRMP Static Neighbor

Configure the IRMP static neighbor, where all IRMP packets between neighbors adopt unicast interaction.

To run the IRMP dynamic routing protocol on the NBMA which does not support the broadcast network, such as X.25 and Frame, the static neighbor requires to be configured in pair. Otherwise the neighbor relationship will fail.

Table 6‑17 Configure the IRMP static neighbor

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IRMP configuration mode | router irmp autonomous-system-number | -
Configure the IRMP static neighbor | neighbor neighbor-ip-address interface-name | Mandatory


6.2.5 Configure IRMP Network Authentication

Configuration Condition

Before configuring the IRMP authentication, first complete the following tasks:

l Configure the IP address of the interface to enable the neighboring nodes to be reachable at the network layer.

l Enable the IRMP protocol.

Configure IRMP Authentication

Perform validity check and verification on the IRMP packet by configuring the IRMP authentication to improve the network security. The IRMP only supports the MD5 authentication.

Table 6‑18 Configure the IRMP authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the IRMP authentication function | ip message-digest-key irmp autonomous-system-number key-id md5 { 0 | 7 } password | Mandatory

l When the same Key-id and password are configured on the interfaces at the same time, the IRMP neighboring relationship can be established.


6.2.6 IRMP Monitoring and Maintaining

Table 6‑19 The IRMP monitoring and maintaining

Command | Description
clear ip irmp error | Clear the statistics information of the IRMP error packet
clear ip irmp [ autonomous-system-number ] neighbors [ interface-name ] | Reset the IRMP neighbor
clear ip irmp traffic [ autonomous-system-number ] | Clear the statistics information for receiving and transmitting the IRMP packet
show ip irmp error | Display the statistics information of the IRMP error packet
show ip irmp interface [ autonomous-system-number ] | [ interface-name ] | Display the IRMP interface information
show ip irmp neighbor [ autonomous-system-number | detail | interface-name ] | Display the IRMP neighbor information
show ip irmp topology [autonomous-system-number ] [ active | detail | summary | ip-address mask ] | Display the routing information in the IRMP topology table
show ip irmp traffic [ autonomous-system-number ] | Display the statistics information of receiving and transmitting the IRMP packet


6.3 IRMP Typical Configuration Example


6.3.1 Configure IRMP Basic Function

Network Requirements

l The IRMP operates between Device1 and Device2, establishing the neighbor and interacting the route.

Network Topology

Figure 6–1 Networking of the IRMP basic function

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IRMP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router irmp 100

Device1(config-irmp)#network 1.0.0.0 0.0.0.255

Device1(config-irmp)#network 100.0.0.0 0.0.0.255

Device1(config-irmp)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router irmp 100

Device2(config-irmp)#network 1.0.0.0 0.0.0.255

Device2(config-irmp)#network 200.0.0.0 0.0.0.255

Device2(config-irmp)#exit

Step 3:

Check the result.

#View the IRMP neighbor information of Device1.

Device1#show ip irmp neighbor

IP-IRMP neighbors for process 100 Total neighbor 1

Address Interface Hold(s) Uptime SeqNum Srtt(ms) Rto(s)

1.0.0.2 gigabitethernet1 14 00:00:47 7 0 2

#View the IRMP neighbor information of Device2.

Device2#show ip irmp neighbor

IP-IRMP neighbors for process 100 Total neighbor 1

Address Interface Hold(s) Uptime SeqNum Srtt(ms) Rto(s)

1.0.0.1 gigabitethernet0 11 00:00:43 4 3920 4

It can be viewed that the IRMP neighbor is established between Device1 and Device2I

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet1

P >200.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet1

P >100.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:27:02, gigabitethernet1

E 200.0.0.0/24 [90/3072] via 1.0.0.2, 00:15:07, gigabitethernet1

C 100.0.0.0/24 is directly connected, 00:27:14, gigabitethernet0

C 127.0.0.0/8 is directly connected, 137:46:13, lo0

Device1 learns the routing 200.0.0.0/24 advertised by Device2.

#View the IRMP topology table and routing table of Device2.

Device2#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >200.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet1

P >100.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.1 (3072/2816), gigabitethernet0

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:20:12, gigabitethernet0

C 200.0.0.0/24 is directly connected, 00:19:53, gigabitethernet1

E 100.0.0.0/24 [90/3072] via 1.0.0.1, 00:08:41, gigabitethernet0

C 127.0.0.0/8 is directly connected, 361:04:08, lo0

Device2 learns the routing 100.0.0.0/24 advertised by Device1.


6.3.2 Configure IRMP Redistribution

Network Requirements

l The OSPF neighbor is established between Device3 and Device2 and the interface directly connected routing 200.0.0.0/24 and 210.0.0.0/24 are advertised to Device2.

l The IRMP neighbor is established between Device1 and Device2. When Device2 redistributing the OSPF routing to the IRMP, only the routing 200.0.0.0/24 instead of the routing 210.0.0.0/24 is advertised to Device1 through the routing policy control.

Network Topology

Figure 6–2 Networking of the IRMP route redistribution

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the OSPF.

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 200.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 210.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#View the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 07:39:21, gigabitethernet0

C 2.0.0.0/24 is directly connected, 00:03:36, gigabitethernet1

C 127.0.0.0/8 is directly connected, 57:04:58, lo0

O 200.0.0.0/24 [110/2] via 2.0.0.2, 00:01:10, gigabitethernet1

O 210.0.0.0/24 [110/2] via 2.0.0.2, 00:01:10, gigabitethernet1

In the routing table, it can be viewed that Device2 learns the OSPF routing 200.0.0.0/24 and 210.0.0.0/24 advertised by Device3.

Step 3:

Configure the IRMP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router irmp 100

Device1(config-irmp)#network 1.0.0.0 0.0.0.255

Device1(config-irmp)#exit

#Configure Device2.

Device2(config)#router irmp 100

Device2(config-irmp)#network 1.0.0.0 0.0.0.255

Device2(config-irmp)#exit

#View the IRMP neighbor informatione of Device1.

Device1#show ip irmp neighbor

IP-IRMP neighbors for process 100 Total neighbor 1

Address Interface Hold(s) Uptime SeqNum Srtt(ms) Rto(s)

1.0.0.2 gigabitethernet0 12 00:01:03 1 0 2

The IRMP neighbor is successfully established between Device1 and Device2.

Step 4:

Configure the IRMP to redistribute the OSPF routing and to coordinate with the routing policy.

#Configure the routing policy to match the ACL only permitting the routing 200.0.0.0/24 on Device2 and to coordinate with the routing policy when the IRMP redistributing the OSPF routing.

Device2(config)#ip access-list standard 1

Device2(config-std-nacl)#permit 200.0.0.0 0.0.0.255

Device2(config-std-nacl)#exit

Device2(config)#route-map ospf_to_irmp

Device2(config-route-map)#match ip address 1

Device2(config-route-map)#exit

Device2(config)#router irmp 100

Device2(config-irmp)#redistribute ospf 100 route-map ospf_to_irmp

Device2(config-irmp)#exit

l When configuring the routing policy, both the prefix list and ACL can establish the matching rule. The difference lies in that the prefix list can accurately match the route mask, but the ACL cannot match the route mask.

Step 5:

Check the result.

#View the IRMP topology table of Device2.

Device2#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P 200.0.0.0/24, 1 successors, FD is 2816

via RedisOSPF 100 (2816/0)

It can be viewed that Device2 successfully distributes the OSPF routing to the IRMP.

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >200.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 07:47:01, gigabitethernet0

C 127.0.0.0/8 is directly connected, 07:55:23, lo0

Ex 200.0.0.0/24 [170/3072] via 1.0.0.2, 00:00:06, gigabitethernet0

It can be viewed that Device1 learns the routing 200.0.0.0/24.

l In the actual application, if there are two or more edge routers in the autonomous system, you are advised to not redistribute routes between different routing protocols. If necessary, configure the routing control policies such as filtering and summary on the edge router in the autonomous system to prevent generating routing loop.


6.3.3 Configure IRMP Metric Offset

Network Requirements

l The IRMP protocol operates among Device1, Device2, Device3, and Device4 for interconnection.

l Device1 learns the routing 200.0.0.0/24 from Device2 and Device3 at the same time.

l Configure the routing metric offset at the receiving direction on Device1to enable Device1 to choose the routing advertised by Device2 preferentially.

Network Topology

Figure 6–3 Networking of the IRMP metric offset

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IRMP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router irmp 100

Device1(config-irmp)#network 1.0.0.0 0.0.0.255

Device1(config-irmp)#network 2.0.0.0 0.0.0.255

Device1(config-irmp)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router irmp 100

Device2(config-irmp)#network 1.0.0.0 0.0.0.255

Device2(config-irmp)#network 3.0.0.0 0.0.0.255

Device2(config-irmp)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router irmp 100

Device3(config-irmp)#network 2.0.0.0 0.0.0.255

Device3(config-irmp)#network 4.0.0.0 0.0.0.255

Device3(config-irmp)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router irmp 100

Device4(config-irmp)#network 3.0.0.0 0.0.0.255

Device4(config-irmp)#network 4.0.0.0 0.0.0.255

Device4(config-irmp)#network 200.0.0.0 0.0.0.255

Device4(config-irmp)#exit

#View the IRMP neighbor inofrmation of Device1.

Device1#show ip irmp neighbor

IP-IRMP neighbors for process 100 Total neighbor 2

Address Interface Hold(s) Uptime SeqNum Srtt(ms) Rto(s)

1.0.0.2 gigabitethernet0 11 00:10:37 10 0 2

2.0.0.2 gigabitethernet1 12 00:10:15 9 0 2

#View the IRMP neighbor information of Device4.

Device4#show ip irmp neighbor

IP-IRMP neighbors for process 100 Total neighbor 2

Address Interface Hold(s) Uptime SeqNum Srtt(ms) Rto(s)

3.0.0.1 gigabitethernet1 14 00:11:37 13 0 2

4.0.0.1 gigabitethernet2 12 00:10:45 12 0 2

Device1 successfully establishes the IRMP neighbor with Device2 and Device3, respectively. Device4 successfully establishes the IRMP neighbor with Device2 and Device3, respectively.

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet1

P >3.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >4.0.0.0/24, 1 successors, FD is 3072

*via 2.0.0.2 (3072/512), gigabitethernet1

P >200.0.0.0/24, 2 successors, FD is 3328

*via 2.0.0.2 (3328/3072), gigabitethernet1

*via 1.0.0.2 (3328/3072), gigabitethernet0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 13:16:35, gigabitethernet0

C 2.0.0.0/24 is directly connected, 13:19:24, gigabitethernet1

E 3.0.0.0/24 [90/3072] via 1.0.0.2, 00:03:22, gigabitethernet0

E 4.0.0.0/24 [90/3072] via 2.0.0.2, 00:22:01, gigabitethernet1

C 127.0.0.0/8 is directly connected, 22:27:25, lo0

E 200.0.0.0/24 [90/3328] via 2.0.0.2, 00:21:22, gigabitethernet1

[90/3328] via 1.0.0.2, 00:03:22, gigabitethernet0

There are two load balancing routing to the network segment 200.0.0.0/24 in Device1 routing table. The forwarding paths to the network segment are Device1→Device2→Device4 and Device1→Device3→Device4.

Step 3:

Configure the IRMP metric offset.

#Configure the offset list on Device1. Add metric value 100 to the interface connected to Device3 by the specified routing to enable the total metric value going through Device3 is larger than that going through Device2.

Device1(config)#ip access-list standard 1

Device1(config-std-nacl)#permit 200.0.0.0 0.0.0.255

Device1(config-std-nacl)#exit

Device1(config)#router irmp 100

Device1(config-irmp)#offset-list 1 in 100 gigabitethernet1

Device1(config-irmp)#exit

Step 4:

Check the result.

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet1

P >3.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >4.0.0.0/24, 1 successors, FD is 3072

*via 2.0.0.2 (3072/512), gigabitethernet1

P >200.0.0.0/24, 2 successors, FD is 3328

*via 1.0.0.2 (3328/3072), gigabitethernet0

via 2.0.0.2 (3428/3172), gigabitethernet1

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 13:33:22, gigabitethernet0

C 2.0.0.0/24 is directly connected, 13:36:11, gigabitethernet1

E 3.0.0.0/24 [90/3072] via 1.0.0.2, 00:06:56, gigabitethernet0

E 4.0.0.0/24 [90/3072] via 2.0.0.2, 00:05:43, gigabitethernet1

C 127.0.0.0/8 is directly connected, 22:44:12, lo0

E 200.0.0.0/24 [90/3328] via 1.0.0.2, 00:06:56, gigabitethernet0

After the metric offset is configured, Device1 chooses the routing 200.0.0.0/24 advertised by Device2.

l Configuring the IRMP offset list may cause the neighbor to be reestablished.


6.3.4 Configure IRMP Route Filtering

Network Requirements

l The IRMP operated between Device1 and Device2 for routing interaction.

l Device1 learns two routing 2.0.0.0/24 and 3.0.0.0/24 advertised by Device2 and Device1 only reserves the routing information of 2.0.0.0/24.

Network Topology

Figure 6–4 Networking of the IRMP route filtering

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IRMP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router irmp 100

Device1(config-irmp)#network 1.0.0.0 0.0.0.255

Device1(config-irmp)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router irmp 100

Device2(config-irmp)#network 1.0.0.0 0.0.0.255

Device2(config-irmp)#network 2.0.0.0 0.0.0.255

Device2(config-irmp)#network 3.0.0.0 0.0.0.255

Device2(config-irmp)#exit

#View the IRMP neighbor inofrmation of Device1.

Device1#show ip irmp neighbor

IP-IRMP neighbors for process 100 Total neighbor 1

Address Interface Hold(s) Uptime SeqNum Srtt(ms) Rto(s)

1.0.0.2 gigabitethernet0 11 00:05:00 3 0 2

It can be viewed that the IRMP neighbor is successfully established between Device1 and Device2.

#View the routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >3.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:11:29, gigabitethernet0

E 2.0.0.0/24 [90/3072] via 1.0.0.2, 00:07:43, gigabitethernet0

E 3.0.0.0/24 [90/3072] via 1.0.0.2, 00:07:40, gigabitethernet0

C 127.0.0.0/8 is directly connected, 00:19:50, lo0

Device1 learns the routing 2.0.0.0/24 and 3.0.0.0/24.

Step 3:

Configure the route filtering.

#Configure the ACL rule to only permit the routing 2.0.0.0/24 on Device1 and configure the inbound filtering list to coordinate with the ACL in the IRMP.

Device1(config)#ip access-list standard 1

Device1(config-std-nacl)#permit 2.0.0.0 0.0.0.255

Device1(config-std-nacl)#exit

Device1(config)#router irmp 100

Device1(config-irmp)#distribute-list 1 in

Device1(config-irmp)#exit

l When configuring the route filtering, the prefix list and ACL can establish the matching rule. The difference lies in that the prefix list can accurately match the route mask, but the ACL cannot match the route mask.

Step 4:

Check the result.

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:22:33, gigabitethernet0

E 2.0.0.0/24 [90/3072] via 1.0.0.2, 00:04:18, gigabitethernet0

C 127.0.0.0/8 is directly connected, 00:30:55, lo0

Device1 only learns the routing 2.0.0.0/24, but the routing 3.0.0.0/24 is successfully filtered.

l Configuring the distribute-list command may cause the IRMP neighbor to be reestablished.


6.3.5 Configure IRMP Route Summary

Network Requirements

l The IRMP protocol operates among Device1, Device2, Device3, and Device4 for routing interaction,

l Device1 learns two routing 100.1.0.0/24 and 100.2.0.0/24 from Device. To reduce the routing table scale of Device1, it is required that Device2 only releases the route summary 100.0.0.0/14 to Device1.

Network Topology

Figure 6–5 Networking of the IRMP route summary

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IRMP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router irmp 100

Device1(config-irmp)#network 1.0.0.0 0.0.0.255

Device1(config-irmp)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router irmp 100

Device2(config-irmp)#network 1.0.0.0 0.0.0.255

Device2(config-irmp)#network 2.0.0.0 0.0.0.255

Device2(config-irmp)#network 3.0.0.0 0.0.0.255

Device2(config-irmp)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router irmp 100

Device3(config-irmp)#network 2.0.0.0 0.0.0.255

Device3(config-irmp)#network 100.1.0.0 0.0.0.255

Device3(config-irmp)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router irmp 100

Device4(config-irmp)#network 3.0.0.0 0.0.0.255

Device4(config-irmp)#network 100.2.0.0 0.0.0.255

Device4(config-irmp)#exit

#View the IRMP neighbor inofrmation of Device2.

Device2#show ip irmp neighbor

IP-IRMP neighbors for process 100 Total neighbor 3

Address Interface Hold(s) Uptime SeqNum Srtt(ms) Rto(s)

1.0.0.1 gigabitethernet0 11 00:05:04 4 0 2

2.0.0.2 gigabitethernet0 14 00:04:42 3 16 2

3.0.0.2 gigabitethernet0 11 00:04:00 2 0 2

Device2 successfully establishes the IRMP neighbor with Device1, Device3, and Device4, respectively.

#View the topology table and routing table of Device2.

Device2#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet1

P >3.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet2

P >100.1.0.0/24, 1 successors, FD is 3072

*via 2.0.0.2 (3072/2816), gigabitethernet1

P >100.2.0.0/24, 1 successors, FD is 3072

*via 3.0.0.2 (3072/2816), gigabitethernet2

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 08:12:36, gigabitethernet0

C 2.0.0.0/24 is directly connected, 00:36:51, gigabitethernet1

C 3.0.0.0/24 is directly connected, 00:12:06, gigabitethernet2

E 100.1.0.0/24 [90/3072] via 2.0.0.2, 00:10:03, gigabitethernet1

E 100.2.0.0/24 [90/3072] via 3.0.0.2, 00:00:08, gigabitethernet2

C 127.0.0.0/8 is directly connected, 57:38:13, lo0

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >3.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >100.1.0.0/24, 1 successors, FD is 3328

*via 1.0.0.2 (3328/3072), gigabitethernet0

P >100.2.0.0/24, 1 successors, FD is 3328

*via 1.0.0.2 (3328/3072), gigabitethernet0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 08:09:15, gigabitethernet0

E 2.0.0.0/24 [90/3072] via 1.0.0.2, 00:13:19, gigabitethernet0

E 3.0.0.0/24 [90/3072] via 1.0.0.2, 00:13:17, gigabitethernet0

E 100.1.0.0/24 [90/3328] via 1.0.0.2, 00:12:53, gigabitethernet0

E 100.2.0.0/24 [90/3328] via 1.0.0.2, 00:02:57, gigabitethernet0

C 127.0.0.0/8 is directly connected, 08:17:36, lo0

Both Device1 and Device2 learn routing 100.1.0.0/24 and 100.2.0.0/24.

Step 3:

Configure the IRMP route summary.

#Configure Device2 and configure the IRMP route summary 100.0.0.0/14 on the interface connected to Device1.

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip summary-address irmp 100 100.0.0.0 255.252.0.0

Device2(config-if-gigabitethernet0)#exit

Step 4:

Check the result.

#View the IRMP topology table of Device2.

Device2#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet1

P >3.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet2

P 100.0.0.0/14, 1 successors, FD is 3072

via AddrSumm (3072/0)

P >100.1.0.0/24, 1 successors, FD is 3072

*via 2.0.0.2 (3072/2816), gigabitethernet1

P >100.2.0.0/24, 1 successors, FD is 3072

*via 3.0.0.2 (3072/2816), gigabitethernet2

A route summary 100.0.0.0/14 is generated on Device2.

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >3.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >100.0.0.0/14, 1 successors, FD is 3328

*via 1.0.0.2 (3328/3072), gigabitethernet0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 08:18:49, gigabitethernet0

E 2.0.0.0/24 [90/3072] via 1.0.0.2, 00:04:54, gigabitethernet0

E 3.0.0.0/24 [90/3072] via 1.0.0.2, 00:04:54, gigabitethernet0

E 100.0.0.0/14 [90/3328] via 1.0.0.2, 00:04:54, gigabitethernet0

C 127.0.0.0/8 is directly connected, 08:27:10, lo0

It can be viewed that only the route summary100.0.0.0/14 instead of the corresponding detailed route100.1.0.0/24 and 100.2.0.0/24 exists on Device1.

l Configuring the IRMP route summary in the interface mode may cause the neighbor to be reestablished.


6.3.6 Configure IRMP Load Balancing

Network Requirements

l The IRMP protocol operates among Device1, Device2, Device3, and Device4 for routing interaction,

l Device1 learns the routing 200.0.0.0/24 from Device2 and Device3 at the same time. Modify the bandwidth of interface gigabitethernet1 on Device1 to enable Device1 to preferentially choose the routing 200.0.0.0/24 learned from Device2.

l Device1 is required to transfer data to the network segment200.0.0.0/24 simultaneously on lines Device1→Device2→Device4 and Device1→Device3→Device4.

Network Topology

Figure 6–6 Networking of the IRMP unequal-cost load balancing

Configuration Steps

Step 1: | Configure the IP address of the interfaces. (Omitted)
Step 2: | Configure the IRMP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router irmp 100

Device1(config-irmp)#network 1.0.0.0 0.0.0.255

Device1(config-irmp)#network 2.0.0.0 0.0.0.255

Device1(config-irmp)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router irmp 100

Device2(config-irmp)#network 1.0.0.0 0.0.0.255

Device2(config-irmp)#network 3.0.0.0 0.0.0.255

Device2(config-irmp)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router irmp 100

Device3(config-irmp)#network 2.0.0.0 0.0.0.255

Device3(config-irmp)#network 4.0.0.0 0.0.0.255

Device3(config-irmp)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router irmp 100

Device4(config-irmp)#network 3.0.0.0 0.0.0.255

Device4(config-irmp)#network 4.0.0.0 0.0.0.255

Device4(config-irmp)#network 200.0.0.0 0.0.0.255

Device4(config-irmp)#exit

#View the IRMP neighbor inofrmation of Device1.

Device1#show ip irmp neighbor

IP-IRMP neighbors for process 100 Total neighbor 2

Address Interface Hold(s) Uptime SeqNum Srtt(ms) Rto(s)

1.0.0.2 gigabitethernet0 11 00:10:37 10 0 2

2.0.0.2 gigabitethernet1 12 00:10:15 9 0 2

#View the IRMP neighbor information of Device4.

Device4#show ip irmp neighbor

IP-IRMP neighbors for process 100 Total neighbor 2

Address Interface Hold(s) Uptime SeqNum Srtt(ms) Rto(s)

3.0.0.1 gigabitethernet1 14 00:11:37 13 0 2

4.0.0.1 gigabitethernet2 12 00:10:45 12 0 2

Device1 successfully establishes the IRMP neighbor with Device2 and Device3, respectively. Device4 successfully establishes the IRMP neighbor with Device2 and Device3, respectively.

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet1

P >3.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >4.0.0.0/24, 1 successors, FD is 3072

*via 2.0.0.2 (3072/512), gigabitethernet1

P >200.0.0.0/24, 2 successors, FD is 3328

*via 2.0.0.2 (3328/3072), gigabitethernet1

*via 1.0.0.2 (3328/3072), gigabitethernet0

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 13:16:35, gigabitethernet0

C 2.0.0.0/24 is directly connected, 13:19:24, gigabitethernet1

E 3.0.0.0/24 [90/3072] via 1.0.0.2, 00:03:22, gigabitethernet0

E 4.0.0.0/24 [90/3072] via 2.0.0.2, 00:22:01, gigabitethernet1

C 127.0.0.0/8 is directly connected, 22:27:25, lo0

E 200.0.0.0/24 [90/3328] via 2.0.0.2, 00:21:22, gigabitethernet1

[90/3328] via 1.0.0.2, 00:03:22, gigabitethernet0

There are two load balancing routing to the network segment 200.0.0.0/24 in Device1 routing table. The forwarding paths to the network segment are Device1→Device2→Device4 and Device1→Device3→Device4.

Step 3:

Change the interface delay.

#Change the bandwidth of the interface connected to Device1 and Device3 to 100000 kbps.

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#bandwidth 100000

Device1(config-if-gigabitethernet1)#exit

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 25856

*via Connected (25856/0), gigabitethernet1

P >3.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >4.0.0.0/24, 1 successors, FD is 26112

*via 2.0.0.2 (26112/2816), gigabitethernet1

P >200.0.0.0/24, 2 successors, FD is 3328

*via 1.0.0.2 (3328/3072), gigabitethernet0

via 2.0.0.2 (26368/3072), gigabitethernet1

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 28:44:11, gigabitethernet0

C 2.0.0.0/24 is directly connected, 00:14:05, gigabitethernet1

E 3.0.0.0/24 [90/3072] via 1.0.0.2, 00:10:11, gigabitethernet0

E 4.0.0.0/24 [90/28416] via 2.0.0.2, 00:07:57, gigabitethernet1

C 127.0.0.0/8 is directly connected, 220:26:51, lo0

E 200.0.0.0/24 [90/3328] via 1.0.0.2, 00:10:11, gigabitethernet0

After the metric offset is configured, Device1 preferentially chooses the routing 200.0.0.0/24 advertised by Device2.

Step 4:

Configure the IRMP unequal-cost load balancing.

#Configure Device1 and configure the load balancing conversion factor as 100.

Device1(config)#router irmp 100

Device1(config-irmp)#variance 100

Device1(config-irmp)#exit

For details about the load balancing conversion factor, refer to the load balancing chapter in the IRMP function configuration.

Step 5:

Check the result.

#View the topology table and routing table of Device1.

Device1#show ip irmp topology

IP-IRMP Topology Table for process 100

Codes: P - Passive, A - Active, H - Holddown, D - Hidden

> - FIB route, * - FIB successor

P >1.0.0.0/24, 1 successors, FD is 2816

*via Connected (2816/0), gigabitethernet0

P >2.0.0.0/24, 1 successors, FD is 28160

*via Connected (28160/0), gigabitethernet1

P >3.0.0.0/24, 1 successors, FD is 3072

*via 1.0.0.2 (3072/2816), gigabitethernet0

P >4.0.0.0/24, 1 successors, FD is 28416

*via 2.0.0.2 (28416/2816), gigabitethernet1

P >200.0.0.0/24, 2 successors, FD is 3328

*via 1.0.0.2 (3328/3072), gigabitethernet0

*via 2.0.0.2 (26368/3072), gigabitethernet1

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 28:47:15, gigabitethernet0

C 2.0.0.0/24 is directly connected, 00:17:08, gigabitethernet1

E 3.0.0.0/24 [90/3072] via 1.0.0.2, 00:13:15, gigabitethernet0

E 4.0.0.0/24 [90/28416] via 2.0.0.2, 00:11:00, gigabitethernet1

C 127.0.0.0/8 is directly connected, 220:29:54, lo0

E 200.0.0.0/24 [90/3328] via 1.0.0.2, 00:13:15, gigabitethernet0

[90/26368] via 2.0.0.2, 00:00:12, gigabitethernet1

Routing 200.0.0.0/24 on Device1 forms the unequal-cost load balancing. Data will be transmitted for load balancing on these two paths based on the inverse ratio of the metric value.


7 BGP


7.1 Overview

Border Gateway Protocol (BGP) is a routing protocol that exchanges Network Layer Reachability Information (NLRI) between Autonomous Systems (ASs). Internal Gateway Protocols (IGPs) such as Routing Information Protocol (RIP), Open Shortest Path First (OSPF), and Intermediate System-to-Intermediate System (IS-IS), focus mainly on finding accurate paths, taking network nodes (such as routers, layer-3 switches, multi-NIC hosts) as the routing units. Different from IGPs, External Gateway Protocols (EGPs) focuses mainly on controlling the routing direction, taking AS networks as the routing units.

BGP is used for interconnection between AS networks. It supports routing information exchange between ASs. It is usually used for large-scale network aggregation and network core. Its application layer determines that BGI has the following features when compared with IGP:

l BGP uses the TCP protocol to transmit packets through service port 179. TCP ensures the reliability of transmission, so BGP need not provide an independent transmission control policy for reliable transmission of information.

l BGP updates routes in incremental mode, that is, it informs its neighbors of route changes only when route properties are changed, or a route is added or deleted. This mode greatly decreases network bandwidth that is occupied by BGP in transmitting routes.

l BGP is an AS-based distance vector protocol. It carries AS path properties in routing packets to solve the routing loop problem.

l BGP routes have abundant properties. You can modify the properties by applying a routing policy. In this way, you can control route filtering and selection freely.

l BGP has two neighbor types, Interior Border Gateway Protocol (IBGP) and External Border Gateway Protocol (EBGP). Between different types of neighbors, different route advertisements and routing policies are used.


7.2 BGP Function Configuration

Table 7–1 BGP function list

Configuration Tasks
Configure a BGP neighbor. | Configure an IBGP neighbor.
 | Configure an EBGP neighbor.
 | Configure a BGP passive neighbor.
 | Configure an MP-BGP neighbor.
 | Configure MD5 authentication for BGP neighbors.
Configure BGP route generation. | Configure BGP to advertise local routes.
 | Configuring BGP to redistribute routes.
 | Configure BGP to advertise the default route.
Configure BGP route control. | Configure BGP to advertise aggregated routes.
 | Configure the administrative distance of BGP routes.
 | Configure routing policies in the outgoing direction of a BGP neighbor.
 | Configure a routing policies in the incoming direction of a BGP neighbor.
 | Configure the maximum number of routes that a BGP neighbor receives.
 | Configure the maximum number of BGP load balancing routes.
Configure BGP route properties. | Configure the BGP route weight.
 | Configure the MED property of a BGP route.
 | Configure the Local-Preference property of a BGP route.
 | Configure the AS_PATH property of a BGP route.
 | Configure the NEXT-HOP property of a BGP route.
 | Configure the community property of a BGP route.
Configure BGP network optimization. | Configure the keep-alive time of BGP neighbors.
 | Configure BGP route detection time.
 | Configure quick disconnection of EBGP neighbors.
 | Configure the BGP route suppression function.
 | Configure the BGP neighbor refresh capability.
 | Configure the BGP neighbor soft reset capability.
 | Configure the ORF capability of BGP neighbors.
Configure a large-scale BGP network. | Configure a BGP peer group.
 | Configure a BGP route reflector.
 | Configure a BGP confederation.
Configure BGP GR. | Configure a BGP GR Helper.
Configure BGP to coordinate with BFD. | Configure EBGP to coordinate with BFD.
 | Configure IBGP to coordinate with BFD.


7.2.1 Configure BGP Neighbor

Configuration Condition

Before configuring a BGP neighbor, ensure that:

l The link layer protocol has been configured to ensure normal communication at the link layer.

l The network layer addresses of the interfaces have been configured so that the adjacent network nodes are reachable at the network layer.

Configure an IBGP Neighbor

1. Perform basic configuration.

In configuring an IBGP neighbor, you need to set the AS of the neighbor to be the same as the AS of the local device. You can configure a Router ID for a device. The Router ID is used to uniquely identify a BGP device in setting up a BGP session. If no Router ID is configured for a device, the device selects a Router ID from interface addresses. The rules for selection are as follows:

l Select the biggest IP address from loopback interface IP addresses as the Router ID.

l If no loopback interface is configured with an IP address, select the biggest IP address from the IP addresses of other interfaces as the Router ID.

l Only when an interface is in the UP status can the IP address of the interface be elected as the Router ID.

Table 7–2 Configure an IBGP neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the BGP protocol and enter the BGP configuration mode. | router bgp autonomous-system | Mandatory. By default, BGP is disabled.
Configure a Router ID for the BGP device. | bgp router-id router-id | Optional. By default, the device selects a Router ID from interface addresses. The loopback interface and large IP address have the priorities.
Configure an IBGP neighbor. | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory. By default, no IBGP neighbor is created.
Activate the capability of an IBGP neighbor in transmitting and receiving IPv4 unicast routes. | neighbor { neighbor-address | peer-group-name } activate | Optional. By default, the IBGP neighbor's capability in transmitting and receiving IPv4 unicast routes is activated automatically.
Configure a description for an IBGP neighbor. | neighbor { neighbor-address | peer-group-name } description description-string | Optional. By default, no description is configured for an IBGP neighbor.

2. Configure the source address of a TCP session.

BGP uses the TCP protocol to transmit packets through service port 179. TCP features reliable transmission, ensuring that BGP protocol packets can be properly transmitted to its neighbors.

Table 7–3 Configure the source address of a TCP session

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the BGP protocol and enter the BGP configuration mode. | router bgp autonomous-system | -
Configure an IBGP neighbor. | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory. By default, no IBGP neighbor is created.
Configure the source address of a TCP session of an IBGP neighbor. | neighbor { neighbor-address | peer-group-name } update-source { interface-name | ip-address } | Mandatory. By default, the TCP session automatically selects the address of a routing output interface as the source address.

l If there exist load balancing routes, the source addresses must be configured for TCP sessions of BGP neighbors. If TCP session source addresses are not configured, if the neighbors have different optimal routes, they may use different output interfaces as their source addresses. In this way, BGP sessions may fail to set up within a period of time.

Configure an EBGP Neighbor

1. Perform basic configuration.

In configuring an EBGP neighbor, you need to set the AS of the neighbor to be different from the AS of the local device.

Table 7–4 Configure an EBGP neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enable the BGP protocol and enter the BGP configuration mode. | router bgp autonomous-system | -
Configure an EBGP neighbor. | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory. By default, no EBGP neighbor is created.

2. Configure a non-direct-connect EBGP neighbor

EBGP neighbors are located in different operation networks, and they are usually connected by a direct-connect physical link. Therefore, the default TTL value for the IP packets between EBGP neighbors is 1. In non-direct-connect operation networks, you can use a command to set the TTL value of IP packets so as to set up a BGP connection.

Table 7–5 Configure a non-direct-connect EBGP neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure an EBGP neighbor. | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory. By default, no EBGP neighbor is created.
Configure the source address of a TCP session of an EBGP neighbor. | neighbor { neighbor-address | peer-group-name } update-source { interface-name | ip-address } | Optional. By default, the TCP session automatically selects the address of a routing output interface as the source address.
Allow non-direct-connect EBGP neighbors to set up a connection. | neighbor { neighbor-address | peer-group-name } ebgp-multihop [ ttl-value ] | Mandatory. By default, non-direct-connect devices are not allowed to form EBGP neighbors.

Configure a BGP Passive Neighbor

In some special application environments, the BGP passive neighbor function is in need. After the passive neighbor function is enabled, the BGP does not initiate the TCP connection request for setting up a BGP neighbor relation; instead, it waits for the neighbor's connection request before setting up a neighbor relation. By default, neighbors initiate connection requests to each other. If connections conflict, they select an optimal TCP connection to form a BGP session. Before configuring a BGP passive neighbor, you need to configure a BGP neighbor.

Table 7–6 Configure a BGP passive neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure a BGP neighbor. | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory. By default, no BGP neighbor is created.
Configure a BGP passive neighbor. | neighbor { neighbor-address | peer-group-name } passive | Mandatory. By default, no passive neighbor is activated.

Configure an MP-BGP Neighbor

By default, BGP neighbors are activated in the IPv4 unicast address family, and they have the capability of transmitting and receiving IPv4 unicast routes. Neighbors need to be enabled by using a command in other address families, such as multicast address family, VRF address family, and VPN address family, so that they have the capability of transmitting and receiving the required routes. Before configuring an MP-BGP neighbor, you need to configure a BGP neighbor.

Table 7–7 Configure an MP-BGP neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure a BGP neighbor. | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory. By default, no BGP neighbor is created.
Enter the BGP IPv4 configuration mode. | address-family ipv4 multicast | Mandatory. By default, after entering the BGP configuration mode, the user is in unicast address family mode.
Activate neighbors in BGP IPv4 multicast address family. | neighbor { neighbor-address | peer-group-name } activate | Mandatory. By default, global neighbors are deactivated in multicast address family mode.
Exit the BGP IPv4 configuration mode. | exit-address-family | -
Enter the BGP IPv4 VRF configuration mode. | address-family ipv4 vrf vrf-name | -
Configure neighbors in BGP IPv4 VRF address family mode. | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory. By default, no BGP neighbor is created.
Activate neighbors in IPv4 VRF address family mode. | neighbor { neighbor-address | peer-group-name } activate | Optional. By default, neighbors are activated in BGP IPv4 VRF configuration mode.
Exit the BGP IPv4 VRF configuration mode. | exit-address-family | -
Enter the BGP VPNv4 config mode. | address-family vpnv4 [ unicast ] | -
Activate neighbors in BGP VPNv4 address family mode. | neighbor { neighbor-address | peer-group-name } activate | Mandatory. By default, global neighbors are deactivated in VPN address family mode.
Exit the BGP VPNv4 configuration mode. | exit-address-family | -
Enters the BGP MDT configuration mode. | address-family ipv4 mdt | -
Activate neighbors in BGP MDT address family mode. | neighbor { neighbor-address | peer-group-name } activate | Mandatory. By default, global neighbors are deactivated in MDT address family mode.

l The neighbors that are configured in BGP configuration mode and BGP IPv4 unicast configuration mode are global neighbors, and the neighbors that are configured in BGP IPv4 VRF configuration mode belong only to the VRF address family.

Configure MD5 Authentication for BGP Neighbors

BGP supports configuring MD5 authentication to protect information exchange between neighbors. MD5 authentication is implemented by the TCP protocol. Two neighbors must be configured with the same MD5 authentication password before a TCP connection can be set up; otherwise, if the TCP protocol fails in MD5 authentication, the TCP connection cannot be set up. Before configuring MD5 authentication for BGP neighbors, you need to configure BGP neighbors.

Table 7–8 Configure MD5 authentication for BGP neighbors

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure a BGP neighbor. | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory. By default, no BGP neighbor is created.
Configure MD5 authentication for BGP neighbors. | neighbor { neighbor-address | peer-group-name } password [ 0 | 7 ] password-string | Mandatory. By default, no MD5 authentication is started for BGP neighbors.


7.2.2 Configure BGP Route Generation

Configuration Condition

Before configuring BGP route generation, ensure that:

l BGP is enabled.

l BGP neighbors are configured and a session is set up successfully.

Configure BGP to Advertise Local Routes

BGP can use the network command to introduce the routes of the IP routing table into the BGP routing table. Only when there are routes that match completely the network prefix and mask can the routes be introduced into the BGP routing table and advertised.

In advertising a local route, you can apply a route map for the route, and you can also specify the route as the backdoor route. The backdoor route takes EBGP routes as local BGP routes and uses the administrative distance of local routes. This allows IGP routes to have higher priorities than EBGP routes. At the same time, backdoor routes will not be advertised to EBGP neighbors.

Table 7-9 Configure BGP to advertise local routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to advertise local routes. | network ip-address mask [ route-map rtmap-name [ backdoor ] | backdoor ] | Mandatory. By default, BGP does not advertise local routes.

l The Origin property type of the local routes that are advertised by BGP is IGP.

l If you run the network backdoor command for an EBGP route, the administrative distance of the EBGP route changes to the local route administrative distance. (By default, the EBGP route administrative distance is 20, and the local route administrative distance is 200.) Then, the administrative distance of the EBGP route is smaller than the administrative distance of the default IGP route. In this way, the IGP route is selected with priority, forming a backdoor link between EBGP neighbors.

l The route map applied to the local routes that are advertised by BGP supports match options, including as-path, community, extcommunity, ip address, ip nexthop, and metric, and it supports the set options, including as-path, comm-list, community, extcommunity, ip next-hop, local-preference, metric, origin, and weight.

Configure BGP to Redistribute Routes

BGP is not responsible for route learning. It focuses mainly on managing route properties so as to control the route direction. Therefore, BGP redistributes IGP routes to generate BGP routes and advertise the BGP routes to neighbors. When BGP redistributes IGP routes, it can apply a routing diagram.

Table 7–10 Configure BGP to redistribute routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to redistribute IGP routes. | redistribute { connected | irmp as-number | isis [ area-tag ] [ match isis-level ] | ospf as-number [ match route-sub-type ] | rip | static } [ route-map map-name / metric value ] | Mandatory. By default, BGP does not redistribute IGP routes.

l The Origin property type of the IGP routes that are advertised by BGP is INCOMPLETE.

l The route map applied to other protocol routes that are redistributed by BGP supports match options, including as-path, community, extcommunity, ip address, ip nexthop, and metric, and it supports the set options, including as-path, comm-list, community, extcommunity, ip next-hop, local-preference, metric, origin, and weight.

Configure BGP to Advertise the Default Route

Before BGP advertises a default route to neighbors, the default route needs to be introduced. Two ways of introducing the default routes are available: Running the neighbor default-originate command to generate a BGP default route, and running the default-information originate command to redistribute the default route of another protocol.

The default route that is generated by running the neighbor default-originate command is route 0.0.0.0/0 that is automatically generated by BGP. The default route that is redistributed by running the default-information originate command is route 0.0.0.0/0 of the redistributed protocol introduced by BGP.

Table 7–11 Configure BGP to advertise the default route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to generate the default route. | neighbor { neighbor-address | peer-group-name } default-originate [ route-map rtmap-name ] | Mandatory. By default, BGP does not generate the default route.
Configure the default route of another protocol redistributed by BGP. | default-information originate | Mandatory. By default, BGP does not redistribute the default route of another protocol.

l In configuring BGP to redistribute the default route of another protocol, you need to configure BGP to redistribute routes.

l In configuring BGP to generate a default route, you can apply a route map to the route.

l The route map that is applied to the default route that is generated by BGP supports set options, including as-path, comm-list, community, extcommunity, ip next-hop, local-preference, metric, origin, and weigh.


7.2.3 Configure BGP Route Control

Configuration Condition

Before configuring BGP route control, ensure that:

l BGP is enabled.

l BGP neighbors are configured and a session is set up successfully.

Configure BGP to Advertise Aggregated Routes

In a large-scale BGP network, to decrease the number of routes that are advertised to neighbors or effectively control BGP routing, you can configure a BGP aggregated route.

Table 7–12 Configure BGP to advertise aggregated routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to advertise aggregated routes. | aggregate-address ip-address mask [ as-set / summary-only / route-map rtmap-name ] | Mandatory. By default, BGP does not aggregate routes.

l When configuring BGP to advertise aggregated routes, you can specify the summary-only option so that BGP advertises only aggregated routes. This decreases the number of routes that are advertised.

l You can specify the as-set option to generate aggregation routes with the AS_PATH property.

l You can also apply a route map to the aggregation routes so as to set more abundant properties for the aggregation routes.

Configure the Administrative Distance of BGP Routes

In the IP routing table, each protocol controls the administrative distance of routing. The smaller the administrative distance is, the higher the priority is .BGP affects routing by specifying the administrative distances of specified network segments. The administrative distances of the routes that cover the specified network segments will be modified. Meanwhile, ACL is applied to filter the network segments that are covered by the routes, that is, only the administrative distances of the network segment that are allowed by the ACL can be modified.

The distance bgp command is used to modify the management distances of external, internal, and local BGP routes. The distance command is only used to modify the administrative distances of specified network segments. The distance command has a higher priority than the distance bgpcommand. The network segments that are covered by the distance command use the administrative distance that is specified by the command, while the network segments that are not covered by the distance command use the administrative distance that is specified by the distance bgp command.

Table 7–13 Configure the administrative distance of a BGP route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to modify the default administrative distance. | distance bgp external-distance internal-distance local-distance | Optional. By default, the administrative distance of EBGP routes is 20, the administrative distance of IBGP routes is 200, and the administrative distance of local routes is 200.
Configure the administrative distance of a specified network segment. | distance administrative-distance ip-address mask [ acl-name ]

Configure Routing Policies in the Outgoing Direction of a BGP Neighbor

BGP route advertisement or routing is implemented based on the powerful routing properties. When advertising routes to neighbors, you can apply routing policies to modify route properties or filter some routes. Currently, the routing policies that can be applied in the outgoing direction include:

l distribute-list: Distribution list.

l filter-list: AS_PATH property filtration list.

l prefix-list: IP prefix list.

l route-map: Route map.

Table 7–14 Configure routing policies in the outgoing direction of a BGP neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Apply the distribution list in the outgoing direction. | neighbor { neighbor-address | peer-group-name } distribute-list access-list-name out | You can select multiple options. (However, the distribution list and the IP prefix list cannot be configured at the same time.) By default, no routing policy is configured in the outgoing direction of a BGP neighbor.
Apply the AS_PATH property filtration list in the outgoing direction. | neighbor { neighbor-address | peer-group-name } filter-list aspath-list-name out
Apply the IP prefix list in the outgoing direction. | neighbor { neighbor-address | peer-group-name } prefix-list prefix-list-name out
Apply a route map in the outgoing direction. | neighbor { neighbor-address | peer-group-name } route-map rtmap-name out

l After configuring the routing policy in the outgoing direction of a BGP neighbor, you need to reset the neighbor to validate the settings.

l If you apply a route map in the outgoing direction of a route reflector, this changes only the NEXT-HOP property.

l For how to configure a filtration list, refer to the "Configure AS-PATH" section of the "Routing Policy Tools" chapter.

l In configuring routing policies in the outgoing direction of a BGP neighbor, you can configure multiple policies at the same time. BGP applies routing policies in the sequence of distribute-list, filter-list, prefix-list, and route-map. If a former policy is rejected, the latter policies will not be applied. The routing information can be advertised only after it passes all the configured policies.

l The route map that is applied in the outgoing direction of a BGP route supports match options, including as-path, community, extcommunity, ip address, ip nexthop, and metric, and it supports the set options, including as-path, comm-list, community, extcommunity, ip next-hop, local-preference, metric, origin, and weight.

Configure Routing Policies in the Incoming Direction of a BGP Neighbor

BGP can apply routing policies to filter received routing information or modify route properties. Similar to the policies applied in the outgoing directions, four polices are applied in the incoming directions:

l distribute-list: Distribution list.

l filter-list: AS_PATH property filtration list.

l prefix-list: IP prefix list.

l route-map: Route map.

Table 7–15 Configure Routing Policies in the Incoming Direction of a BGP neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Apply the distribution list in the incoming direction. | neighbor { neighbor-address | peer-group-name } distribute-list access-list-name in | You can select multiple options. (However, the distribution list and the IP prefix list cannot be configured at the same time.) By default, no policy is applied in the incoming direction.
Apply the AS_PATH property filtration list in the incoming direction. | neighbor { neighbor-address | peer-group-name } filter-list aspath-list-name in
Apply the IP prefix list in the incoming direction. | neighbor { neighbor-address | peer-group-name } prefix-list prefix-list-name in
Apply a route map in the incoming direction. | neighbor { neighbor-address | peer-group-name } route-map rtmap-name in

l After configuring the routing policy in the incoming direction of a BGP neighbor, you need to reset the neighbor to validate the settings.

l In configuring routing policies in the incoming direction of a BGP neighbor, you can configure multiple policies at the same time. BGP applies routing policies in the sequence of distribute-list, filter-list, prefix-list, and route-map. If a former policy is rejected, the latter policies will not be applied. A route can be added into the database after it passes all the configured policies.

l The routing policies applied in the incoming direction of a BGP route support match options, including as-path, community, extcommunity, ip address, ip nexthop, and metric, and they support the set options, including as-path, comm-list, community, extcommunity, ip next-hop, local-preference, metric, origin, and weight.

Configure the Maximum Number of Routes that a BGP Receives from a Neighbor

You can limit the number of routes that a BGP receives from a specified neighbor. Once the number of routes the BGP receives from the neighbor reaches a threshold, an alarm is generated or the neighbor is disconnected.

Table 7–16 Configure the maximum number of routes that a BGP Receives from a neighbor

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure the maximum number of routes that a BGP receives from a neighbor. | neighbor { neighbor-address | peer-group-name } maximum-prefix prefix-num [ threshold-value ] [ warning-only ] | Mandatory. By default, the number of routes that a BGP receives from a neighbor is not limited.

l If the warning-only option is not specified, after the number of routes that the BGP receives from the neighbor reaches the maximum number, the BGP session is automatically disconnected.

l If the warning-only option is specified, after the number of routes that the BGP receives from the neighbor reaches the maximum number, a warning message is displayed, but route learning continues.

Configure the Maximum Number of BGP Load Balancing Routes

In a BGP networking environment, if several paths with the same cost are available to reach the same destination, you can configure the number of BGP load balancing routes for load balancing.

Table 7–17 Configure the Maximum number of BGP load balancing routes

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure the maximum number of IBGP load balancing routes. | maximum-paths ibgp number | Mandatory. By default, IBGP does not support load balancing routes.
Configure the maximum number of EBGP load balancing routes. | maximum-paths number | Mandatory. By default, EBGP does not support load balancing routes.

l After the maximum number of EBGP load balancing routes is configured, load balancing takes effect only when EBGP routes are selected with priority.

l In different BGP configuration modes, the commands for configuring the maximum number of load balancing routes are different. For details, refer to the description of maximum-paths in the BGP command manual.


7.2.4 Configure BGP Route Properties

Configuration Condition

Before configuring BGP route properties, ensure that:

l BGP is enabled.

l BGP neighbors are configured and a session is set up successfully.

Configure the BGP Route Weight

In BGP routing, the first rule is to compare the weights of routes. The larger the weight of a route is, the higher the priority it has. The weight of a route is the local property of the device, and it cannot be transferred to other BGP neighbors. The value range of a route weight is 1-65535. By default, the weight of a route that has been learnt from a neighbor is 0, and the weights of all routes that are generated by the local device are all 32768.

Table 7–18 Configure the BGP route weight

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure the weight of a route of a neighbor or peer group. | neighbor { neighbor-address | peer-group-name } weight weight-num | Mandatory. By default, the weight of a route of a neighbor is 0.

Configure the MED Property of a BGP Route

Multi-Exit Discriminator (MED) properties are used to select the optimal route for the traffic that enters an AS. If the other routing conditions are the same and BGP learns several routes with the same destination from different EBGP neighbors, BGP select the route with the minimum MED value as the optimal ingress.

MED sometimes is also called external metric. It is marked as a "metric" in the BGP routing table. BGP advertises the MED properties of the routes that it has learnt from neighbors to IBGP neighbors, but BGP does not advertise the MED properties to EBGP neighbors. Therefore, MED properties are applicable to only adjacent ASs.

1. Configure BGP to allow comparing MEDs of neighbor routes from different ASs.

By default, BGP implements MED route selection only among the routes that are from the same AS. However, you can run the bgp always-compare-med command to let BGP ignore the limitation on the same AS in MED route selection.

Table 7–19 Configure BGP to allow comparing MEDs of neighbor routes from different ASs

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to allow comparing MEDs of neighbor routes from different ASs. | bgp always-compare-med | Mandatory. By default, BGP allows only to compare MEDs of neighbor routes from the same AS.

2. Configure BGP to sort and select MEDs according to AS_PATH groups.

By default, BGP is not enabled to sort and select MEDs according to route AS_PATH groups. To enable the function, run the bgp deterministic-medcommand. In route selection, all routes are organized based on AS_PATHs. In each AS_PATH group, routes are sorted based MED values. The route with the minimum MED value is selected as the optimal route in the group.

Table 7–20 Configure BGP to sort and select MEDs according to AS_PATH groups

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Compare confederation MEDs in BGP route selection. | bgp deterministic-med | Mandatory. By default, confederation MEDs are not compared in BGP route selection.

3. Configure to compare MEDs of routes in the local confederation.

By default, the MED values of EBGP routes from different ASs are not compared. The setting is valid for the EBGP routes of confederations. To enable comparison of MED values of routes of the local confederation, run the bgp bestpath med confed command.

Table 7–21 Configure BGP to compare MEDs of routes in the local confederation

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to compare MED values of routes in the local confederation. | bgp bestpath med confed | Mandatory. By default, the MED values of routes in the local confederations will not be compared.

4. Configure a route map to modify MED properties.

In transmitting and receiving routes, you can apply a route map to modify MED properties.

Table 7–22 Configure a route map to modify MED properties

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configuring a route map to modify MED properties. | neighbor { neighbor-address | peer-group-name } route-map rtmap-name in | out | Mandatory. By default, no route map is applied to any neighbor.

l In configuring a route map to modify an MED property, you can use the set metric command to modify the MED property. For details, refer to Routing Policy Tools-Command Manual-set metric.

l After the neighbor attribute-unchanged command is configured, the MED properties of neighbors cannot be changed by the route map that is applied.

Configure the Local-Preference Property of a BGP Route

Local-Preference properties are transferred only between IBGP neighbors. Local-Preference is used to select the optimal egress of an AS. The route with the maximum Local-Preference will be selected with priority.

The value range of Local-Preference is 0-4294967295. The larger the value is, the higher priority the route has. By default, the Local-Preference value of all the routes that are advertised to IBGP neighbors is 100. You can use the bgp default local-preference command or the route map to modify the Local-Preference property value.

1. Configure BGP to modify the default Local-Preference property.

Table 7–23 Configure BGP to modify the default local-preference property

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure the default value of BGP Local-Preference property. | bgp default local-preference local-value | Optional. By default, the Local-Preference value is 100.

2. Configure the route map to modify the Local-Preference property.

Table 7–24 Configure the route map to modify the local-preference property

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure the route map to modify the Local-Preference property. | neighbor { neighbor-address | peer-group-name } route-map rtmap-name in | out | Mandatory. By default, the route map is not applied to any neighbor.

l In configuring a route map to modify the Local-Preference property, you can use the set local-preference command to modify the Local-Preference property. For details, refer to Routing Policy Tools-Command Manual-set local-preference.

Configure the AS_PATH Property of a BGP Route

1. Configure BGP to ignore AS_PATHs in route selection.

If the other conditions are the same, BGP selects the route with the shortest AS-PATH in route selection. To cancel route selection based on AS_PATHs, run the bgp bestpath as-path ignore command.

Table 7–25 Configure BGP to ignore AS_PATHs in route selection

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to ignore AS_PATHs in route selection. | bgp bestpath as-path ignore | Mandatory. By default, the AS_PATH values are compared in route selection.

2. Configure the number of local ASs that BGP allows to repeat.

To prevent routing loops, BGP checks the AS_PATH properties of the routes that are received from neighbors, and the routes containing the local AS number will be discarded. However, you can run the neighbor allowas-in command to allow the AS_PATH properties of the routes that the BGP receives to contain the local AS number, and you can configure the number of ASs that can be contained.

Table 7–26 Configure the number of local ASs that BGP allows to repeat

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure the number of ASs that are allowed to repeat. | neighbor { neighbor-address | peer-group-name } allowas-in [ as-num ] | Mandatory. By default, the AS_PATH properties of the routes that are received from neighbors do not allow the local AS number.

3. Configure BGP to remove the private AS number when advertising routes to neighbors.

In a large-scale BGP network, the AS_PATH properties of routes contain federation or community property. By default, BGP provides the private AS properties when it advertises routes to neighbors. To mask private network information, run the neighbor remove-private-AS command to remove the private AS number.

Table 7–27 Configure BGP to Remove the Private AS number when advertising routes to neighbors

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to remove the private AS number when advertising routes to neighbors. | neighbor { neighbor-address | peer-group-name } remove-private-AS | Mandatory. By default, when BGP advertise routes to neighbors, it provides the private AS number.

4. Configure to check the validity of the first AS number of an EBGP route.

When BGP advertises a route to EBGP neighbors, it compresses the local AS number to the starting position of the AS_PATH, and the AS that advertises the route first is located at the end. Usually, the first AS of a route that EBGP receives must be the same as the neighbor AS number; otherwise, the route will be discarded.

Table 7–28 Configure to check the validity of the first AS number of an EBGP route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure to check the validity of the first AS number of an EBGP route. | bgp enforce-first-as | Mandatory. By default, BGP does not enable the mechanism for checking the first AS number.

5. Configure a route map to modify AS_PATH properties.

BGP supports configuring a route map to modify AS_PATH properties. You can run the set as-path prepend command to add more routing properties so as to affect neighbor routing. In using the set as-path prepend function, first use the local AS to add AS_PATH. If you use another AS, the AS must be emphasized to prevent the AS from rejecting routes that are advertised to it.

Table 7–29 Configure a Route map to modify AS_PATH properties

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure a route map to modify AS_PATH properties. | neighbor { neighbor-address | peer-group-name } route-map rtmap-name in | out | Mandatory. By default, no route map is applied to any neighbor.

l In configuring a route map to modify an AS_PATH property, you can use the set as-path prepend command to modify the AS_PATH property. For details, refer to Routing Policy Tools-Command Manual-set as-path.

Configure the NEXT-HOP Property of a BGP Route

When BGP advertises routes to IBGP neighbors, it does not change the routing properties (including the NEXT-HOP property). When BGP advertises the routes that are learned from EBGP neighbors to IBGP neighbors, you can run the neighbor next-hop-self command to modify the next-hop property of the routes advertised to BGP neighbors to the local IP address. You can apply a route map to modify the next hop property.

1. Configure BGP to use the local IP address as the next hop of a route.

Table 7–30 Configure BGP to use the local IP address as the next hop of a route

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to use the local IP address as the next hop when advertising routes. | neighbor { neighbor-address | peer-group-name } next-hop-self | Mandatory. By default, the next-hop property of the routes that are advertised to EBGP neighbors is set to the local IP address, and the next-hop property of the routes that are advertised to IBGP neighbors keeps unchanged.

l When BGP is configured to use the local IP address as the next hop of a route, if you run the neighbor update-source command to configure the source address of a TCP session, the source address is used as the next hop address; otherwise, the IP address of the output interface of the advertising device is selected as the local IP address.

2. Configure a route map to modify NEXT-HOP properties.

BGP supports configuring a route map to modify NEXT-HOP properties. You can run the set ip next-hopcommand to modify the next hop property.

Table 7–31 Configure a route map to modify NEXT-HOP properties

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure a route map to modify NEXT-HOP properties. | neighbor { neighbor-address | peer-group-name } route-map rtmap-name in | out | Mandatory. By default, no route map is applied to any neighbor.

l In configuring a route map to modify an NEXT-HOP property, you can use the set ip next-hop command to modify the NEXT-HOP property. For details, refer to Routing Policy Tools-Command Manual-set ip next-hop.

Configure the Community Property of a BGP Route

When BGP advertises routes to neighbors, it can be configured to send the community property. You can apply a route map to a specified neighbor in the incoming and outgoing directions to match the community properties.

Community property is used to identify a group of routes so as to apply a routing policy to the group of routes. Two types of community property are available: standard and extended. The standard community property consist of 4 bytes, providing the properties such as NO_EXPORT, LOCAL_AS, NO_ADVERTISE, and INTERNET. The extended property consist of eight bytes, providing Route Target (RT) and Route Origin (RO) properties.

1. Configure BGP to advertise route community property to neighbors.

The neighbor send-community enables you to advertise standard community property or extended community property or both types of property to neighbors.

Table 7–32 Configure BGP to advertise route community property to neighbors

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP to advertise route community property to neighbors. | neighbor { neighbor-address | peer-group-name } send-community [ both | extended | standard ] | Mandatory. By default, the community property is not advertised to any neighbor.

l After neighbors are activated in VPNv4 address family, standard and extended community properties are automatically advertised to neighbors.

2. Configure a route map to modify the community property.

BGP supports configuring a route map to modify the route community property. You can use the set communtiy to command to modify the community property.

Table 7–33 Configure a route map to modify the community property

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure a route map to modify the BGP route community property | neighbor { neighbor-address | peer-group-name } route-map rtmap-name in | out | Mandatory. By default, no route map is applied to any neighbor.

l In configuring a route map to modify community property, you can use the set community command to modify the community property. For details, refer to Routing Policy Tools-Command Manual-set community.


7.2.5 Configure BGP Network Optimization

Configuration Condition

Before configuring BGP network optimization, ensure that:

l BGP is enabled.

l BGP neighbors are configured and a session is set up successfully.

Configure the Keep-alive Time of BGP Neighbors

After a BGP session is successfully set up, keep-alive messages are sent periodically between the neighbors to maintain the BGP session. If no keep-alive message or Update packet is received from the neighbor within the hold time, the BGP session will be disconnected owing to timeout. The keep-alive time is equal to or smaller than 1/3 of the hold time.

Table 7–34 Configure the keep-alive time of BGP neighbors

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure global BGP keep-alive time and hold time. | timers bgp keepalive-interval holdtime-interval | Optional. By default, the keepalive timer is 60s, the hold timer is 180s, and the session re-connection timer is 120s.
Configure the keepalive time and hold time of a BGP neighbor or peer group. | neighbor { neighbor-address | peer-group-name } timers { keepalive-interval holdtime-interval | connect connect-interval }

l The keepalive time and hold time that are set for a specified neighbor have higher priorities than the global BGP keepalive time and hold time.

l Neighbors negotiate and then take the minimum hold time as the hold of the BGP session between the neighbors.

l If the keepalive time and hold time are both set to 0, the neighbor keepalive/hold function is canceled.

l If the keepalive time is longer than 1/3 of the hold time, the BGP session sends keepalive packets at the interval of 1/3 the hold time.

Configure BGP Route Detection Time

BGP mainly aims at implementing a routing process, with ASs as the routing units. Within an AS, IGP is used for routing. Therefore, BGP routes often rely on IGP routes. If the next hops or output interfaces of IGP routes that BGP relies on change, BGP detects IGP routes periodically to update BGP routes. BGP also update local BGP routes during the detection interval.

Table 7–35 Configure BGP route detection time

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure BGP route detection time. | bgp scan-time time | Optional. By default, the BGP route detection time is 60s.

l If the BGP route detection time is set too small, BGP detect routes frequently, affecting the device performance.

Configure Quick Disconnection of EBGP Neighbors

After a BGP session is successfully set up, Keepalive messages are sent periodically between the neighbors to maintain the BGP session. If no Keepalive message or Update packet is received from the neighbor within the hold time, the BGP session will be disconnected owing to timeout. You can configure direct-connect EBGP neighbors to disconnect a BGP connection immediately after a connecting interface is down, without waiting for BGP keepalive timeout. If the EBGP neighbor quick disconnection function is cancelled, the EBGP session does not respond to an interface down event; instead, the BGP session is disconnected after timeout.

Table 7–36 Configure quick disconnection of EBGP neighbors

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure quick disconnection of EBGP neighbors. | bgp fast-external-failover | Optional. By default, EBGP's quick processing capability in responding to the direct-connect interface down event is enabled.

Configure the BGP Route Suppression Function

Flapping routes in a network may cause instability of the network. You can configure route attenuation to damp this type of routes so as to decrease the effect of flapping routes on the network.

A frequently flapping route will be allocated with a penalty. If the penalty exceeds the suppression threshold, the route will not be advertised to neighbors. The penalty should not be kept beyond the maximum suppression time. If no flapping occurs on the route within the half-life period, the penalty will be halved. If the penalty is lower than the threshold value, the route can be advertised to neighbors again.

l Half-life period: It is the time in which the penalty of a route is halved.

l Reuse threshold: It is the threshold for the route to resume normal use.

l Suppression threshold: It is the threshold for route suppression.

l Maximum suppression time: It is the maximum threshold value for a route penalty.

Table 7–37 Configure the BGP route suppression function

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure the BGP route attenuation period. | bgp dampening [ reach-half-life [ reuse-value suppress-value max-suppress-time [ unreach-half-life ] ] | route-map rtmap-name ] | Mandatory. By default, the route suppression function is disabled. After the function is enabled, the default route suppression half-life period is 15 minutes, the route reuse time is 750 seconds, the minimum route suppression time is 2000 seconds, the maximum route suppression time is 60 minutes, and the route penalty unreachable half-life period is 15 minutes.

l Route flapping not only contains addition and deletion of routes, but also contains route property changes such as next hop and MED property changes.

Configure the BGP Neighbor Refresh Capability

If the routing policy or route selection policy that is applied to a BGP neighbor changes, the routing table needs to be refreshed. One way of refreshing the routing table is to reset the BGP connection so as to reset the BGP session. However, this mode may result in BGP route flapping, affecting normal services. The other way is more graceful, that is, configuring the local BGP device to support the route refresh capability. If a neighbor needs to reset a route, it advertises the Route-Refresh message to the local device. After receiving the Route-Refresh message, it sends the route to the neighbor again. In this way, the routing table is dynamically refreshed without the need of disconnecting the BGP session.

Table 7–38 Configure the BGP Neighbor refresh capability

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Enable the BGP neighbor refresh capability. | neighbor { neighbor-address | peer-group-name } capability route-refresh | Optional. By default, the BGP neighbor refresh capability is enabled.

Configure the BGP Neighbor Soft Reset Capability

If the routing policy or route selection policy that is applied to a BGP neighbor changes, the routing table needs to be refreshed. One way of refreshing the routing table is to reset the BGP connection so as to reset the BGP session. However, this mode may result in BGP route flapping, affecting normal services. Another way is more graceful, that is, configuring the local BGP device to support the route refresh capability. There is still another way, that is, enabling the soft reset capability of the local BGP device. By default, the BGP device reserves the routing information of each neighbor. After enabling its neighbor soft reset capability, it refreshes the neighbor routes that are kept on the local device. At this time, BGP sessions are not disconnected.

Table 7–39 Configure the BGP neighbor soft reset capability

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Enable the BGP neighbor soft reset capability. | neighbor { neighbor-address | peer-group-name } soft-reconfiguration inbound | Mandatory. By default, the neighbor soft reset function is disabled.

Configure the ORF Capability of BGP Neighbors

BGP implements accurate route control through abundant routing properties. It usually applies routing policies in the incoming and outgoing directions. This mode is a local BGP behavior. BGP also supports the Outbound Route Filtering (ORF) capability. It advertises the local ingress policy to its neighbors through Route-refresh packets, and then the neighbors apply the policy when they advertise routes to the local BGP device. This greatly decreases the number of exchanged route refresh packets between BGP neighbors.

To achieve successful negotiation of the ORF capability, ensure that:

l The ORF capability is enabled for both neighbors.

l "ORF send" and "ORF receive" must match. That is, if one end is "ORF send", the other end must be "ORF both" or "ORF receive". If one end is "ORF receive", the other end must be "ORF send" or "ORF both".

l The "ORF send" end must be configured with a prefix list in the incoming direction.

Table 7–40 Configure the ORF capability of BGP neighbors

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Apply a prefix list in the incoming direction of a neighbor. | neighbor { neighbor-address | peer-group-name } prefix-list prefix-list-name in | Mandatory. By default, no prefix list is applied to any BGP neighbor.
Configure a neighbor to support the ORF capability. | neighbor { neighbor-address | peer-group-name } capability orf prefix-list { both | receive | send } | Mandatory. By default, a neighbor does not support the ORF capability.


7.2.6 Configure Large-Scale BGP Network

Configuration Condition

Before configuring a large-scale BGP network, ensure that:

l BGP is enabled.

l BGP neighbors are configured and a session is set up successfully.

Configure a BGP Peer Group

A BGP peer group is a group of BGP neighbors that are configured with the same configuration policy. Any configuration that is performed on a BGP peer group will take effect on all members of the peer group. In this way, by configuring the peer group, you can perform centralized management and maintenance on the neighbors.

Table 7–41 Configure a BGP peer group

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Create a BGP peer group. | neighbor peer-group-name peer-group | Mandatory. By default, no peer group is configured, and a neighbor is not in any peer group.
Add a neighbor into the peer group. | neighbor neighbor-address peer-group peer-group-name

l The configuration on a peer group takes effect on all members of the peer group.

l After a neighbor is added into a peer group, if some configurations of the neighbor are the same as the configurations of the peer group, the configurations of the neighbor are deleted.

l If routing policies are configured in the incoming and outgoing directions of a peer group, after the routing policies are changed, the changes do not take effect on the neighbors that have been added into the peer group. To apply the changed routing policies on the peer group members, you need to reset the peer group.

Configure a BGP Route Reflector

In a large-scale BGP network, it is required that IBGP neighbors are fully connected, that is, each BGP needs to set up connections with all IBGP neighbors. In this way, in a network which contains N BGP neighbors, the number of BGP connections is N*(N-1)/2. The larger the number of connections is, the larger the number of route advertisements is. Configuring a BGP Route Reflector (RR) is a method of reducing the number of network connections. Multiple IBGPs are categorized into a group. In this group, a BGP is specified to act as the RR, while other BGPs act as client, and BGPs that are not in the group act as non-clients. Clients set up peer relations only with the RR while they do not set up peer relations with other BGPs. This reduces the number of mandatory IBGP connections, and the number of connections is N-1.

The following shoes the routing principles of the BGP RR:

l The RR reflects the routes that it learns from non-client IBGP neighbors only to clients.

l The RR reflects the routes that it learns from clients to all clients and non-clients except the clients that initiate the routes.

l The RR reflects the routes that it learns from EBGP neighbors to all clients and non-clients.

Table 7–42 Configure a BGP route reflector

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure an RR cluster ID. | bgp cluster-id { cluster-id-in-ip | cluster-id-in-num } | Mandatory. By default, the route ID is used as the RR cluster ID.
Configure a client as a client of the RR. | neighbor { neighbor-address | peer-group-name } route-reflector-client | Mandatory. By default, no client is specified as a client of the RR.
Configure the route reflection function between BGP neighbors. | bgp client-to-client reflection | Optional. By default, the route reflection function is enabled between RR clients.

l An RR cluster ID is used to identify an RR area. An RR area can contain multiple RRs, and the RRs in the RR area have the same RR cluster ID.

Configure a BGP Confederation

In a large-scale BGP network, it is required that IBGP neighbors are fully connected, that is, each BGP needs to set up connections with all IBGP neighbors. In this way, in a network which contains N BGP neighbors, the number of BGP connections is N*(N-1)/2. The larger the number of connections is, the larger the number of route advertisements is. Configuring BGP confederations is another way of reducing the number of network connections. An AS area is divided into multiple sub-AS areas, and each AS area forms a confederation. IBGP is adopted within a confederation to provide full connections, and sub-AS areas in the confederation are connected through EBGP connections. This effectively reduces the number of BGP connections.

In configuring BGP confederations, you need to assign a confederation ID for each confederation and specify members for the confederation. In the case of route reflection, only the route reflector is required to support route reflection. However, in the case of a confederation, all members in a confederation must support the confederation function.

Table 7–43 Configure a BGP confederation

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Create a BGP confederation ID. | bgp confederation identifier as-number | Mandatory. By default, no AS number is configured for a confederation.
Configure members for the confederation. | bgp confederation peers as-number-list | Mandatory. By default, no sub-AS number is configured for a confederation.

l A confederation ID is used to identify the sub-ASs of the confederation. Confederation members are divided into the sub-ASs.


7.2.7 Configure BGP GR

Graceful Restart (GR) is used in active/standby switchover between devices. During the GR, the routing information of the local device and neighbor devices keep unchanged at the forwarding layer, and data forwarding is not affected. After the switchover is completed and the new device starts to run, the two devices synchronize routing information at the protocol layer and update the forwarding layer so that data forwarding is not interrupted during the device switchover process.

Roles involved in a GR:

l GR Restarter: It is the device that is gracefully restarted.

l GR Helper: It is the device that helps with the GR.

l GR Time: It is the maximum time for GR-Restarters to restart. GR Helper maintains the stability of routes during the period of time.

A dual-controller device can act as a GR Restarter and a GR Helper, while a centralized device can only act as a GR Helper, helping the GR Restarter to complete a GR. When the GR Restarter is in the GR process, the GR Helper maintains the route stability until GR Time timeout. After the GR Helper helps with the GR, it synchronizes route information. During the process, network routes and packet forwarding keep the status before the GR, effectively ensuring the network stability.

The BGP GR relation is set up through OPEN packet negotiation when a connection is set up between neighbors. When the GR Restarter restarts the neighbor, the BGP session will be disconnected, but the routes that are learnt from the neighbor are not deleted. The routes are still normally forwarded in the IP routing table. The routes are labeled with the Stale marks only in the BGP routing table. After the GR is completed, the routes will be refreshed.

The GR Restarter needs to set up a connection with the GR Helper within the maximum allowed time (restart-time); otherwise, the GR Helper with cancel the maintained GR route and cancel the GR process. After the neighbor is re-connected, the GR Helper needs to receive an update packet with the End-Of-RIB mark from the GR Restarter to complete the GR process; otherwise, the GR route that is not updated will be deleted after the maximum hold time (stalepath-time) expires, and then the GR relation is released.

Configuration Condition

Before configuring a BGP GR, ensure that:

l BGP is enabled.

l BGP neighbors are configured and a session is set up successfully.

Configure a BGP GR Helper

Table 7–44 Configure a BGP GR helper

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Enable the BGP GR capability. | bgp graceful-restart [ restart-time time | stalepath-time time ] | Mandatory. By default, the GR capability is disabled for BGP devices. After the GR capability is enabled, the default maximum allowed time for re-setting up a session with the neighbor is 120s, and the maximum hold time of GR routes is 360s.


7.2.8 Configure BGP to Coordinate with BFD

Usually, there are still some intermediate devices between BGP neighbors. When an intermediate device becomes faulty, the BGP session is normal within the hold time, and the link fault cased by the intermediate device cannot be responded to in time. Bidirectional Forwarding Detection (BFD) provides a method for quickly detecting the status of a line between two devices. After BFD is enabled for BGP devices, if a line between two devices becomes faulty, BFD can quickly find the line fault and notifies BGP of the fault. It triggers BGP to quickly disconnect the session and quickly switch over to the backup line, achieving fast switchover of routes.

Configuration Condition

Before configuring BGP to coordinate with BFD, ensure that:

l BGP is enabled.

l BGP neighbors are configured and a session is set up successfully.

Configure EBGP to Coordinate with BFD

The coordination between EBGP and BFD is based on a single-hop BFD session, and BFD session parameters need to be configured in interface mode.

Table 7–45 Configure EBGP to coordinate with BFD

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure EBGP to coordinate with BFD. | neighbor { neighbor-address | peer-group-name } fall-over bfd [single-hop] | Mandatory. By default, the BFD function is disabled for a neighbor.
Exit the BGP configuration mode. | exit | -
Enter the interface configuration mode. | interface interface-name | -
Configure the minimum receive interval of a BFD session. | bfd min-receive-interval milliseconds | Optional. By default, the minimum receive interval of a BFD session is 1000s.
Configure the minimum transmit interval of the BFD session. | bfd min-transmit-interval milliseconds | Optional. By default, the minimum transmit interval of a BFD session is 1000s.
Configure the multiple of BFD session detection timeout. | bfd multiplier number | Optional. By default, the multiple of BFD session detection timeout is 5.

l For the related configuration of BFD, refer to the reliability technology-BFD command manual and BFD configuration manual.

Configure IBGP to Coordinate with BFD

The coordination between IBGP and BFD is based on a multi-hop BFD session, and BFD session parameters need to be configured in BGP mode.

Table 7–46 Configure IBGP to coordinate with BFD

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the BGP configuration mode. | router bgp autonomous-system | -
Configure IBGP to coordinate with BFD. | neighbor { neighbor-address | peer-group-name } fall-over bfd | Mandatory. By default, the BFD function is disabled for a neighbor.
Configure the minimum receive interval of the BFD session. | bfd min-receive-interval milliseconds | Optional. By default, the minimum receive interval of a BFD session is 1000s.
Configure the minimum transmit interval of the BFD session. | bfd min-transmit-interval milliseconds | Optional. By default, the minimum transmit interval of a BFD session is 1000s.
Configure the multiple of BFD session detection timeout. | bfd multiplier number | Optional. By default, the multiple of BFD session detection timeout is 5.


7.2.9 BGP Monitoring and Maintaining

Table 7–47 BGP monitoring and maintaining

Command | Description
clear ip bgp { * | neighbor-address | as-number | peer-group peer-group-name | external } [vrf vrf-name | ipv4 unicast | ipv4 multicast | vpnv4 unicast] |
clear ip bgp [ ipv4 unicast | ipv4 multicast ] dampening [ ip-address | ip-address/mask-length ] | Clears suppressed routes.
clear ip bgp [ ipv4 unicast | ipv4 multicast ] flap-statistics [ ip-address | ip-address/mask-length ] | Clears routing flap statistics.
clear ip bgp { * | neighbor-address | as-number | peer-group peer-group-name | external } [ ipv4 unicast | ipv4 multicast | vpnv4 unicast | vrf vrf-name ] { [ soft ] [ in | out ] } | Soft resets neighbors.
clear ip bgp { * | neighbor-address } in { ecomm | prefix-filter } | Advertises ORF to neighbors.
show ip bgp [ vpnv4 { all | vrf vrf-name | rd route-distinguisher } ] [ ip-address | ip-address/mask-length ] | Display the routing information in the related BGP address family.
show ip bgp attribute-info | Display the BGP common route attributes.
show ip bgp cidr-only | Display all classful network routes of BGP.
show ip bgp community [community-number / aa:nn / exact-match / local-AS / no-advertise / no-export ] | Display the routes that match the specified community property.
show ip bgp community-info | Display all community property information of BGP.
show ip bgp community-list community-list-name | Display the community list that is applied to routes.
show ip bgp [ vpnv4 { all | vrf vrf-name | rd route-distinguisher } ] dampening { dampened-paths | flap-statistics | parameters } | Display the details of route attenuation.
show ip bgp filter-list filter-list-name [ exact-match ] | Display the routes that match the AS_PATH filter list.
show ip bgp inconsistent-as | Display the routes that conflict with AS_PATH.
show ip bgp [ vpnv4 all ] neighbors [ ip-address ] | Display the details of BGP neighbors.
show ip bgp orf ecomm | Display the ORF information of all BGP neighbors.
show ip bgp paths | Display the AS_PATH information of BGP routes.
show ip bgp prefix-list prefix-list-name | Display the routes that match the filter list.
show ip bgp quote-regexp as-path-list-name | Display the routes that match the AS_PATH list.
show ip bgp regexp as-path-list-name | Display the routes that match the AS_PATH list.
show ip bgp route-map rtmap-name | Display the routes that match a route map.
show ip bgp scan | Display the BGP scan information.
show ip bgp [ vpnv4 { all | vrf vrf-name | rd route-distinguisher } ] summary | Display the summary of BGP neighbors.


7.3 BGP Typical Configuration Example


7.3.1 Configure BGP Basic Functions

Network Requirements

l Set up EBGP neighbors between Device1 and Device2, and set up IBGP neighbors between Device2 and Device3.

l Device1 learns the interface direct route 200.0.0.0/24 of Device3, and Device3 learns the interface direct route 100.0.0.0/24 of Device1.

Network Topology

Figure 7‑1 Networking for configuring basic BGP functions

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF so that loopback routes are reachable between devices.

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 10.0.0.1 0.0.0.0 area 0

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 20.0.0.1 0.0.0.0 area 0

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 20.0.0.1/32 [110/2] via 2.0.0.2, 00:27:09, gigabitethernet1

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.0.0.1/32 [110/2] via 2.0.0.1, 00:28:13, gigabitethernet0

According to the queried information, Device2 and Device3 have learnt the routes of the peer loopback interfaces by running OSPF, preparing for setting up IBGP neighbors on the loopback interfaces of Device2 and Device3.

Step 3:

Configure BGP.

#Configure Device1.

Set up a direct-connect EBGP peer relation with Device2. Introduce 100.0.0.0/24 to BGP in network mode.

Device1#configure terminal

Device1(config)#router bgp 200

Device1(config-bgp)#neighbor 1.0.0.2 remote-as 100

Device1(config-bgp)#network 100.0.0.0 255.255.255.0

Device1(config-bgp)#exit

#Configure Device2.

Set up a non-direct-connect IBGP peer relation with Device3 through Loopback0, and set the next hop of the advertised route to the local device, and set up a direct-connect EBGP peer relation with Device1.

Device2(config)#router bgp 100

Device2(config-bgp)#neighbor 20.0.0.1 remote-as 100

Device2(config-bgp)#neighbor 20.0.0.1 update-source loopback0

Device2(config-bgp)#neighbor 1.0.0.1 remote-as 200

Device2(config-bgp)#neighbor 20.0.0.1 next-hop-self

Device2(config-bgp)#exit

#Configure Device3.

Set up a non-direct-connect IBGP peer relation with Device2 through Loopback0. Introduce 200.0.0.0/24 to BGP in network mode.

Device3(config)#router bgp 100

Device3(config-bgp)#neighbor 10.0.0.1 remote-as 100

Device3(config-bgp)#neighbor 10.0.0.1 update-source loopback0

Device3(config-bgp)#network 200.0.0.0 255.255.255.0

Device3(config-bgp)#exit

l To prevent route flapping, IBGP neighbors are set up through the loopback interfaces, and OSPF need to synchronize the routing information of loopback interfaces between IBGP neighbors.

Step 4:

Check the result.

#On Device2, check the BGP neighbor status.

Device2#show ip bgp summary

BGP router identifier 10.0.0.1, local AS number 100

BGP table version is 2

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

1.0.0.1 4 200 3 3 1 0 0 00:00:29 1

20.0.0.1 4 100 5 4 2 0 0 00:02:13 1

According to the numbers (Number of route prefixes received from neighbors) that are displayed in the State/PfxRcd column, BGP neighbors have been successfully set up between Device 2 and Device 1 and Device2 and Device 3.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 200.0.0.0/24 [20/0] via 1.0.0.2, 00:15:52, gigabitethernet1

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 100.0.0.0/24 [20/0] via 1.0.0.1, 00:14:11, gigabitethernet0

B 200.0.0.0/24 [200/0] via 20.0.0.1, 00:17:12, gigabitethernet1

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 100.0.0.0/24 [200/0] via 10.0.0.1, 00:14:50, gigabitethernet0

Device1 has learnt the interface direct route 200.0.0.0/24 of Device3, and Device3 has learnt the interface direct route 100.0.0.0/24 of Device1.


7.3.2 Configure BGP to Redistribute Routes

Network Requirements

l Set up OSPF neighbors between Device3 and Device2, and advertise interface direct-connect route 200.0.0.0/24 to Device2.

l Set up EBGP neighbors between Device1 and Device2, and redistribute the OSPF route that Device2 learns to BGP and advertise the route to Device1.

Network Topology

Figure 7‑2 Networking for configuring BGP to redistribute routes

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF so that loopback routes are reachable between devices.

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 200.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#Query the routing table of Device2.

Device2#show ip route ospf

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 200.0.0.0/24 [110/2] via 2.0.0.2, 00:01:45, gigabitethernet1

According to the routing table, Device2 has learnt the OSPF route 200.0.0.0/24 that has been advertised by Device1.

Step 3:

Configure BGP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router bgp 200

Device1(config-bgp)#neighbor 1.0.0.2 remote-as 100

Device1(config-bgp)#exit

#Configure Device2.

Device2(config)#router bgp 100

Device2(config-bgp)#neighbor 1.0.0.1 remote-as 200

Device2(config-bgp)#exit

#On Device2, check the BGP neighbor status.

Device2#show ip bgp summary

BGP router identifier 2.0.0.1, local AS number 200

BGP table version is 2

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

1.0.0.1 4 100 2 2 2 0 0 00:00:42 0

BGP neighbors have been successfully set up between Device2 and Device1.

Step 4:

Configure BGP to redistribute the OSPF route.

#Configure Device2.

Device2(config)#router bgp 100

Device2(config-bgp)#redistribute ospf 100

Device2(config-bgp)#exit

Step 5:

Check the result.

#Query the BGP routing table of Device2.

Device2#show ip bgp

BGP table version is 6, local router ID is 2.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[O]*> 2.0.0.0/24 0.0.0.0 1 32768 ?

[O]*> 200.0.0.0/24 2.0.0.2 2 32768 ?

According to the queried information, OSPF routes have been successfully redistributed to BGP.

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 2.0.0.0/24 [20/1] via 1.0.0.2, 00:06:14, gigabitethernet0

B 200.0.0.0/24 [20/2] via 1.0.0.2, 00:06:14, gigabitethernet0

According to the queried information, Device1 has successfully learnt routes 2.0.0.0/24 and 200.0.0.0/24.

l In an actual application, if there are two or more AS boundary routers, it is recommended that you do not redistribute routes between different routing protocols. If route redistribution must be configured, you are required to configure route control policies such as route filtering and filtration summary on the AS boundary routers to prevent routing loops.


7.3.3 Configure BGP Community Properties

Network Requirements

l Set up EBGP neighbors between Device1 and Device2.

l Device1 introduces two direct-connect routes 100.0.0.0/24 and 200.0.0.0/24 to BGP in network mode, and set different community properties for two routes that are advertised to Device2.

l When Device2 receives routes from Device1, it applies community properties in the incoming direction of a neighbor to filter route 100.0.0.0/24 and allow route 200.0.0.0/24.

Network Topology

Figure 7‑3 Networking for configuring BGP community properties

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure BGP.

#Configure Device1.

Device1#configure terminal

Device1(config)#router bgp 100

Device1(config-bgp)#neighbor 2.0.0.2 remote-as 200

Device1(config-bgp)#network 100.0.0.0 255.255.255.0

Device1(config-bgp)#network 200.0.0.0 255.255.255.0

Device1(config-bgp)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router bgp 200

Device2(config-bgp)#neighbor 2.0.0.1 remote-as 100

Device2(config-bgp)#exit

#On Device1, check the BGP neighbor status.

Device1#show ip bgp summary

BGP router identifier 200.0.0.1, local AS number 100

BGP table version is 1

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

2.0.0.2 4 200 2 3 1 0 0 00:00:04 0

BGP neighbors have been successfully set up between Device1 and Device2.

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 100.0.0.0/24 [20/0] via 2.0.0.1, 00:07:47, gigabitethernet0

B 200.0.0.0/24 [20/0] via 2.0.0.1, 00:07:47, gigabitethernet0

According to the queried information, Device2 has successfully learnt routes 100.0.0.0/24 and 200.0.0.0/24.

Step 3:

Configure the ACL and routing policy, and set BGP community properties.

#Configure Device1.

Device1(config)#ip access-list standard 1

Device1(config-std-nacl)#permit 100.0.0.0 0.0.0.255

Device1(config-std-nacl)#exit

Device1(config)#ip access-list standard 2

Device1(config-std-nacl)#permit 200.0.0.0 0.0.0.255

Device1(config-std-nacl)#exit

Device1(config)#route-map CommunitySet 10

Device1(config-route-map)#match ip address 1

Device1(config-route-map)#set community 100:1

Device1(config-route-map)#exit

Device1(config)#route-map CommunitySet 20

Device1(config-route-map)#match ip address 2

Device1(config-route-map)#set community 100:2

Device1(config-route-map)#exit

Set different community properties for routes 100.0.0.0/24 and 200.0.0.0/24 respectively by configuring an ACL and routing policy.

Step 4:

Configure a routing policy for BGP.

#Configure Device1.

Device1(config)#router bgp 100

Device1(config-bgp)#neighbor 2.0.0.2 route-map CommunitySet out

Device1(config-bgp)#neighbor 2.0.0.2 send-community

Device1(config-bgp)#exit

#Query the BGP routing table of Device2.

Device2#show ip bgp 100.0.0.0

BGP routing table entry for 100.0.0.0/24

Paths: (1 available, best #1, table Default-IP-Routing-Table)

Not advertised to any peer

100

2.0.0.1 (metric 10) from 2.0.0.1 (10.0.0.1)

Origin IGP, metric 0, localpref 100, valid, external, best

Community: 100:1

Last update: 00:01:06 ago

Device2#show ip bgp 200.0.0.0

BGP routing table entry for 200.0.0.0/24

Paths: (1 available, best #1, table Default-IP-Routing-Table)

Not advertised to any peer

100

2.0.0.1 (metric 10) from 2.0.0.1 (10.0.0.1)

Origin IGP, metric 0, localpref 100, valid, external, best

Community: 100:2

Last update: 00:01:10 ago

According to the BGP routing table of Device2, the community property of route 100.0.0.0/24 is set to 100:1, and the community properties of route 200.0.0.0/24 is set to 100:2.

Step 5:

Configure BGP route filtration.

#Configure Device2.

Device2(config)#ip community-list 1 permit 100:2

Device2(config)#route-map communityfilter

Device2(config-route-map)#match community 1

Device2(config-route-map)#exit

Device2(config)#router bgp 200

Device2(config-bgp)#neighbor 2.0.0.1 route-map communityfilter in

Device2(config-bgp)#exit

Step 6:

Check the result.

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 200.0.0.0/24 [20/0] via 2.0.0.1, 00:00:53, gigabitethernet0

According to the BGP routing table of Device2, route 100.0.0.0/24 has been filtered in the incoming direction, and route 200.0.0.0/24 has been allowed.

l After a routing policy is configured on the peer, the BGP must be reset to make the configuration take effect.

l You must configure the send-community command to advertise the community property to the peer.


7.3.4 Configure BGP Route Reflector

Network Requirements

l Set up EBGP neighbors between Device3 and Device4, and configure Device4 to advertise route 100.0.0.0/24.

l Set up IBGP neighbors between Device2 and Device3 and between Device2 and Device1 respectively. On Device2, configure Route Reflectors (RRs), and configure Device1 and Device3 as clients, so that Device1 can learn route 100.0.0.0/24 that is advertised by Device4.

Network Topology

Figure 7‑4 Networking for configuring a BGP route reflector

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF so that loopback routes are reachable between devices.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.0.0.1 0.0.0.0 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 20.0.0.1 0.0.0.0 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device2#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 30.0.0.1 0.0.0.0 area 0

Device3(config-ospf)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 2.0.0.0/24 [110/2] via 1.0.0.2, 01:12:00, gigabitethernet0

O 20.0.0.1/32 [110/2] via 1.0.0.2, 01:11:47, gigabitethernet0

O 30.0.0.1/32 [110/3] via 1.0.0.2, 01:07:47, gigabitethernet0

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.0.0.1/32 [110/2] via 1.0.0.1, 01:13:02, gigabitethernet0

O 30.0.0.1/32 [110/2] via 2.0.0.2, 01:08:58, gigabitethernet1

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 1.0.0.0/24 [110/2] via 2.0.0.1, 01:10:04, gigabitethernet1

O 10.0.0.1/32 [110/3] via 2.0.0.1, 01:10:04, gigabitethernet1

O 20.0.0.1/32 [110/2] via 2.0.0.1, 01:10:04, gigabitethernet1

According to the routing table, Device1, Device2, and Device3 have learnt the routes of the loopback interfaces of each other.

Step 3:

Configure BGP.

#Configure Device1.

Device1(config)#router bgp 100

Device1(config-bgp)#neighbor 20.0.0.1 remote-as 100

Device1(config-bgp)#neighbor 20.0.0.1 update-source loopback0

Device1(config-bgp)#exit

#Configure Device2.

Device2(config)#router bgp 100

Device2(config-bgp)#neighbor 30.0.0.1 remote-as 100

Device2(config-bgp)#neighbor 30.0.0.1 update-source loopback0

Device2(config-bgp)#neighbor 10.0.0.1 remote-as 100

Device2(config-bgp)#neighbor 10.0.0.1 update-source loopback0

Device2(config-bgp)#exit

#Configure Device3.

Device3(config)#router bgp 100

Device3(config-bgp)#neighbor 3.0.0.2 remote-as 200

Device3(config-bgp)#neighbor 20.0.0.1 remote-as 100

Device3(config-bgp)#neighbor 20.0.0.1 update-source loopback0

Device3(config-bgp)#neighbor 20.0.0.1 next-hop-self

Device3(config-bgp)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router bgp 200

Device4(config-bgp)#neighbor 3.0.0.1 remote-as 100

Device4(config-bgp)#network 100.0.0.0 255.255.255.0

Device4(config-bgp)#exit

#On Device2, check the BGP neighbor status.

Device2#show ip bgp summary

BGP router identifier 20.0.0.1, local AS number 100

BGP table version is 1

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

10.0.0.1 4 100 8 8 1 0 0 00:03:01 0

30.0.0.1 4 100 9 9 1 0 0 00:02:41 1

#On Device4, check the BGP neighbor status.

Device4#show ip bgp summary

BGP router identifier 100.0.0.1, local AS number 200

BGP table version is 1

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

3.0.0.1 4 100 19 19 1 0 0 00:05:40 0

According to the queried information, BGP neighbors have been set up between the devices.

#Query the BGP routing table of Device3.

Device3#show ip bgp

BGP table version is 2, local router ID is 30.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 100.0.0.0/24 3.0.0.2 0 0 200 i

#Query the BGP routing table of Device2.

Device2#show ip bgp

BGP table version is 768, local router ID is 20.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*>i100.0.0.0/24 30.0.0.1 0 100 0 200 i

#Query the BGP routing table of Device1.

Device1#show ip bgp

BGP table version is 2, local router ID is 10.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

According to the routing table, Device2 and Device3 have learnt route 100.0.0.0/24, and Device2 has not advertised the route to Device1.

Step 4:

Configure a BGP route reflector.

#Configure Device2.

Device2(config)#router bgp 100

Device2(config-bgp)#neighbor 10.0.0.1 route-reflector-client

Device2(config-bgp)#neighbor 30.0.0.1 route-reflector-client
Device2(config-bgp)#exit

On Device2, Device1 and Device3 have been configured as the RR clients.

Step 5:

Check the result.

#Query the routing table of Device1.

Device1#show ip bgp

BGP table version is 2, local router ID is 10.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*>i100.0.0.0/24 30.0.0.1 0 100 0 200 i

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 100.0.0.0/24 [200/0] via 30.0.0.1, 00:01:40, gigabitethernet0

On BGP of Device2, Device1 and Device3 have been configured as the RR clients, and Device2 has successfully reflects route 100.0.0.0/24 to RR client Device1.

l If you configure a peer as a RR client, the device and the neighbors of the peer will be reset.


7.3.5 Configure BGP Route Summary

Network Requirements

l Set up OSPF neighbors between Device1 and Device3, and configure Device3 to advertise routes 100.1.0.0/24 and 100.2.0.0/24 to Device1.

l Set up EBGP neighbors between Device1 and Device2.

l On Device1, aggregate routes 100.1.0.0/24 and 100.2.0.0/24 into route 100.0.0.0/14 and advertise the aggregated route to Device2.

Network Topology

Figure 7‑5 Networking for configuring BGP route summary

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF so that loopback routes are reachable between devices.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 100.1.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 100.2.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 100.1.0.0/24 [110/2] via 2.0.0.2, 00:00:24, gigabitethernet1

O 100.2.0.0/24 [110/2] via 2.0.0.2, 00:00:24, gigabitethernet1

According to the routing table, Device1 has learnt routes 100.1.0.0/24 and 100.2.0.0/24 advertised by Device3.

Step 3:

Configure BGP.

#Configure Device1.

Device1(config)#router bgp 100

Device1(config-bgp)#neighbor 1.0.0.2 remote-as 200

Device1(config-bgp)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router bgp 200

Device2(config-bgp)#neighbor 1.0.0.1 remote-as 100

Device2(config-bgp)#exit

#On Device1, check the BGP neighbor status.

Device1#show ip bgp summary

BGP router identifier 1.0.0.1, local AS number 100

BGP table version is 2

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

1.0.0.2 4 200 2 2 2 0 0 00:00:42 0

BGP neighbors have been successfully set up between Device1 and Device2.

Step 4:

Configure BGP route summary.

Two solutions are available to satisfy network requirements.

Solution 1: Configure an aggregated static route that is targeted at null0 to introduce the aggregated static route to BGP.

#Configure Device1.

Device1(config)#ip route 100.0.0.0 255.252.0.0 null0

Device1(config)#router bgp 100

Device1(config-bgp)#network 100.0.0.0 255.252.0.0

Device1(config-bgp)#exit

Check the result.

#Query the BGP routing table of Device1.

Device1#show ip bgp

BGP table version is 2, local router ID is 10.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 100.0.0.0/14 0.0.0.0 32768 i

The aggregated route 100.0.0.0/14 has been generated in the BGP routing table of Device1.

#Query the routing table of Device2.

Device2#show ip bgp

BGP table version is 3, local router ID is 20.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 100.0.0.0/14 1.0.0.1 0 0 100 i

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 100.0.0.0/14 [20/0] via 1.0.0.1, 01:39:30, gigabitethernet0

Device2 has successfully learnt the aggregated route 100.0.0.0/14 that has been advertised by Device3.

Solution 2: First introduce common routes into BGP, and then run the aggregate-address command to aggregate the routes.

#Configure Device1.

Device1(config)#router bgp 100

Device1(config-bgp)#redistribute ospf 100

Device1(config-bgp)#aggregate-address 100.0.0.0 255.252.0.0 summary-only

Device1(config-bgp)#exit

Check the result.

#Query the BGP routing table of Device1.

Device1#show ip bgp

BGP table version is 2, local router ID is 10.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 100.0.0.0/14 0.0.0.0 32768 i

[B]s> 100.1.0.0/24 2.0.0.2 2 32768 i

[B]s> 100.2.0.0/24 2.0.0.2 2 32768 i

The aggregated route 100.0.0.0/14 has been generated in the BGP routing table of Device1.

#Query the routing table of Device2.

Device2#show ip bgp

BGP table version is 3, local router ID is 20.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 100.0.0.0/14 1.0.0.1 0 0 100 i

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 100.0.0.0/14 [20/0] via 1.0.0.1, 01:39:30, gigabitethernet0

Device2 has successfully learnt the aggregated route 100.0.0.0/14 that has been advertised by Device3.

l When the aggregate-address command is used to aggregate routes, if the extended command is configured, the device advertises only the aggregated route; otherwise, both common routes and aggregated routes are advertised.


7.3.6 Configure the BGP Route Selection Priority

Network Requirements

l Set up IBGP neighbors between Device1 and Device2 and between Device1 and Device3, and set up EBGP neighbors between Device4 and Device2 and between Device4 and Device3.

l Device1 advertises two routes 55.0.0.0/24 and 65.0.0.0/24 to Device4, and Device4 advertises two routes 75.0.0.0/24 and 85.0.0.0/24 to Device1.

l Modify the Local-preference property of routes on Device2 and Device3 so that Device1 selects route 75.0.0.0/24 advertised by Device2 and route 85.0.0.0/24 advertised by Device3 with priority.

l Modify the MED property of routes on Device2 and Device3 so that Device4 selects route 55.0.0.0/24 advertised by Device2 and route 65.0.0.0/24 advertised by Device3 with priority.

Network Topology

Figure 7‑6 Networking for configuring the BGP route selection priority

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF so that loopback routes are reachable between devices.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.0.0.1 0.0.0.0 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 20.0.0.1 0.0.0.0 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 30.0.0.1 0.0.0.0 area 0

Device3(config-ospf)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 20.0.0.1/32 [110/2] via 1.0.0.2, 00:03:15, gigabitethernet0

O 30.0.0.1/32 [110/2] via 2.0.0.2, 00:01:40, gigabitethernet1

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 2.0.0.0/24 [110/2] via 1.0.0.1, 00:03:54, gigabitethernet0

O 10.0.0.1/32 [110/2] via 1.0.0.1, 00:03:54, gigabitethernet0

O 30.0.0.1/32 [110/3] via 1.0.0.1, 00:02:14, gigabitethernet0

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 1.0.0.0/24 [110/2] via 2.0.0.1, 00:02:35, gigabitethernet0

O 10.0.0.1/32 [110/2] via 2.0.0.1, 00:02:35, gigabitethernet0

O 20.0.0.1/32 [110/3] via 2.0.0.1, 00:02:35, gigabitethernet0

According to the routing table, Device1, Device2, and Device3 have learnt the routes of the loopback interfaces of each other.

Step 3:

Configure BGP.

#Configure Device1.

Device1(config)#router bgp 100

Device1(config-bgp)#neighbor 20.0.0.1 remote-as 100

Device1(config-bgp)#neighbor 20.0.0.1 update-source loopback0

Device1(config-bgp)#neighbor 30.0.0.1 remote-as 100

Device1(config-bgp)#neighbor 30.0.0.1 update-source loopback0

Device1(config-bgp)#network 55.0.0.0 255.255.255.0

Device1(config-bgp)#network 65.0.0.0 255.255.255.0

Device1(config-bgp)#exit

#Configure Device2.

Device2(config)#router bgp 100

Device2(config-bgp)#neighbor 10.0.0.1 remote-as 100

Device2(config-bgp)#neighbor 10.0.0.1 update-source loopback0

Device2(config-bgp)#neighbor 10.0.0.1 next-hop-self

Device2(config-bgp)#neighbor 3.0.0.1 remote-as 200

Device2(config-bgp)#exit

#Configure Device3.

Device3(config)#router bgp 100

Device3(config-bgp)#neighbor 10.0.0.1 remote-as 100

Device3(config-bgp)#neighbor 10.0.0.1 update-source loopback0

Device3(config-bgp)#neighbor 10.0.0.1 next-hop-self

Device3(config-bgp)#neighbor 4.0.0.1 remote-as 200

Device3(config-bgp)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router bgp 200

Device4(config-bgp)#neighbor 3.0.0.2 remote-as 100

Device4(config-bgp)#neighbor 4.0.0.2 remote-as 100

Device4(config-bgp)#network 75.0.0.0 255.255.255.0

Device4(config-bgp)#network 85.0.0.0 255.255.255.0

Device4(config-bgp)#exit

#On Device1, check the BGP neighbor status.

Device1#show ip bgp summary

BGP router identifier 10.0.0.1, local AS number 100

BGP table version is 2

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

20.0.0.1 4 100 11 11 2 0 0 00:07:40 2

30.0.0.1 4 100 7 7 2 0 0 00:03:59 2

#On Device4, check the BGP neighbor status.

Device4#show ip bgp summary

BGP router identifier 85.0.0.1, local AS number 200

BGP table version is 2

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

3.0.0.2 4 100 5 6 2 0 0 00:02:24 2

4.0.0.2 4 100 6 5 2 0 0 00:02:24 2

IBGP neighbors have been set up between Device1 and Device2 and between Device2 and Device3, and EBGP neighbors have been set up between Device4 and Device2 and between Device4 and Device3.

#Query the routing table of Device1.

Device1#show ip bgp

BGP table version is 2, local router ID is 10.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 55.0.0.0/24 0.0.0.0 0 32768 i

[B]*> 65.0.0.0/24 0.0.0.0 0 32768 i

[B]* i75.0.0.0/24 30.0.0.1 0 100 0 200 i

[B]*>i 20.0.0.1 0 100 0 200 i

[B]* i85.0.0.0/24 30.0.0.1 0 100 0 200 i

[B]*>i 20.0.0.1 0 100 0 200 i

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 75.0.0.0/24 [200/0] via 20.0.0.1, 01:13:17, gigabitethernet0

B 85.0.0.0/24 [200/0] via 20.0.0.1, 01:13:17, gigabitethernet0

According to the routing table, both route 75.0.0.0/24 and route 85.0.0.0/24 of Device1 select Device2 as the next-hop device.

#Query the routing table of Device4.

Device4#show ip bgp

BGP table version is 2, local router ID is 85.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]* 55.0.0.0/24 3.0.0.2 0 0 100 i

[B]*> 4.0.0.2 0 0 100 i

[B]* 65.0.0.0/24 3.0.0.2 0 0 100 i

[B]*> 4.0.0.2 0 0 100 i

[B]*> 75.0.0.0/24 0.0.0.0 0 32768 i

[B]*> 85.0.0.0/24 0.0.0.0 0 32768 i

Device4#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 55.0.0.0/24 [20/0] via 4.0.0.2, 01:25:19, gigabitethernet1

B 65.0.0.0/24 [20/0] via 4.0.0.2, 01:25:19, gigabitethernet1

According to the routing table, both route 55.0.0.0/24 and route 65.0.0.0/24 of Device4 select Device3 as the next-hop device.

Step 4:

Configure an ACL and routing policy to set local-preference and metric.

#Configure Device2.

Device2(config)#ip access-list standard 1

Device2(config-std-nacl)#permit 75.0.0.0 0.0.0.255

Device2(config-std-nacl)#exit

Device2(config)#ip access-list standard 2

Device2(config-std-nacl)#permit 65.0.0.0 0.0.0.255

Device2(config-std-nacl)#exit

Device2(config)#route-map SetPriority1 10

Device2(config-route-map)#match ip address 1

Device2(config-route-map)#set local-preference 110

Device2(config-route-map)#exi

Device2(config)#route-map SetPriority1 20

Device2(config-route-map)#exit

Device2(config)#route-map SetPriority2 10

Device2(config-route-map)#match ip address 2

Device2(config-route-map)#set metric 100

Device2(config-route-map)#exit

Device2(config)#route-map SetPriority2 20

Device2(config-route-map)#exit

On Device2, configure a routing policy to set local-preference of route 75.0.0.0/24 to 110, and set metric of route 65.0.0.0/24 to 100.

#Configure Device3.

Device3(config)#ip access-list standard 1

Device3(config-std-nacl)#permit 85.0.0.0 0.0.0.255

Device3(config-std-nacl)#exit

Device3(config)#ip access-list standard 2

Device3(config-std-nacl)#permit 55.0.0.0 0.0.0.255

Device3(config-std-nacl)#exit

Device3(config)#route-map SetPriority1 10

Device3(config-route-map)#match ip address 1

Device3(config-route-map)#set local-preference 110

Device3(config-route-map)#exit

Device3(config)#route-map SetPriority1 20

Device3(config-route-map)#exit

Device3(config)#route-map SetPriority2 10

Device3(config-route-map)#match ip address 2

Device3(config-route-map)#set metric 100

Device3(config-route-map)#exit

Device3(config)#route-map SetPriority2 20

Device3(config-route-map)#exit

On Device3, configure a routing policy to set local-preference of route 85.0.0.0/24 to 110, and set metric of route 55.0.0.0/24 to 100.

l In configuring a routing policy, you can create a filtration rule based on a prefix list or ACL. The prefix list can precisely match routing masks while the ACL cannot match routing masks.

Step 5:

Configure a routing policy for BGP.

#Configure Device2.

Device2(config)#router bgp 100

Device2(config-bgp)#neighbor 10.0.0.1 route-map SetPriority1 out

Device2(config-bgp)#neighbor 3.0.0.1 route-map SetPriority2 out

Device2(config-bgp)#exit

On Device2, configure the outgoing direction of neighbor 10.0.0.1 to modify local-preference of route 75.0.0.0/24, and configure the outgoing direction of neighbor 3.0.0.1 to modify metric of route 65.0.0.0/24.

#Configure Device3.

Device3(config)#router bgp 100

Device3(config-bgp)#neighbor 10.0.0.1 route-map SetPriority1 out

Device3(config-bgp)#neighbor 4.0.0.1 route-map SetPriority2 out

Device3(config-bgp)#exit

On Device3, configure the outgoing direction of neighbor 10.0.0.1 to modify local-preference of route 85.0.0.0/24, and configure the outgoing direction of neighbor 4.0.0.1 to modify metric of route 55.0.0.0/24.

After a routing policy is configured on the peer, the BGP must be reset to make the configuration take effect.

Step 6:

Check the result.

#Query the routing table of Device1.

Device1#show ip bgp

BGP table version is 5, local router ID is 10.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 55.0.0.0/24 0.0.0.0 0 32768 i

[B]*> 65.0.0.0/24 0.0.0.0 0 32768 i

[B]* i75.0.0.0/24 30.0.0.1 0 100 0 200 i

[B]*>i 20.0.0.1 0 110 0 200 i

[B]*>i85.0.0.0/24 30.0.0.1 0 110 0 200 i

[B]* i 20.0.0.1 0 100 0 200 i

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 75.0.0.0/24 [200/0] via 20.0.0.1, 00:01:34, gigabitethernet0

B 85.0.0.0/24 [200/0] via 30.0.0.1, 00:00:51, gigabitethernet1

According to the routing table, local-preference of routes 75.0.0.0/24 and 85.0.0.0/24 is modified successfully, and Device1 select route 75.0.0.0/24 that is advertised by Device2 and route 85.0.0.0/24 that is advertised by Device3 with priority.

#Query the routing table of Device4.

Device4#show ip bgp

BGP table version is 4, local router ID is 85.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]* 55.0.0.0/24 4.0.0.2 100 0 100 i

[B]*> 3.0.0.2 0 0 100 i

[B]*> 65.0.0.0/24 4.0.0.2 0 0 100 i

[B]* 3.0.0.2 100 0 100 i

[B]*> 75.0.0.0/24 0.0.0.0 0 32768 i

[B]*> 85.0.0.0/24 0.0.0.0 0 32768 i

Device4#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 55.0.0.0/24 [20/0] via 3.0.0.2, 00:15:02, gigabitethernet0

B 65.0.0.0/24 [20/0] via 4.0.0.2, 00:14:55, gigabitethernet1

According to the routing table, metric of routes 55.0.0.0/24 and 65.0.0.0/24 is modified successfully, and Device4 select route 55.0.0.0/24 that is advertised by Device2 and route 65.0.0.0/24 that is advertised by Device3 with priority.

l A routing policy can be used in the outgoing direction of route advertisement, and it can also be used in the incoming direction of route receiving.


7.3.7 Configure BGP Confederation

Network Requirements

l Device2, Device3, Device4, and Device5 are in the same BGP AS 200. To reduce the number of IBGP full connections, they are divided into two different ASs in one BGP confederation.

l Set up EBGP neighbors between Device1 and Device2, and advertise route 100.0.0.0/24 to AS 200.

Network Topology

Figure 7‑7 Networking for configuring a BGP confederation

Device | Interface | IP Address | Device | Interface | IP Address
Device1 | Gi0 | 1.0.0.1/24 | Device4 | Gi0 | 3.0.0.1/24
 | Gi1 | 100.0.0.1/24 |  | Gi0 | 4.0.0.2/24
Device2 | Gi0 | 1.0.0.2/24 |  | Gi0 | 5.0.0.1/24
 | Gi1 | 2.0.0.2/24 |  | Loopback0 | 40.0.0.1/32
 | Gi2 | 3.0.0.2/24 | Device5 | Gi0 | 5.0.0.2/24
 | Loopback0 | 20.0.0.1/32 |  |  |
Device3 | Gi0 | 2.0.0.1/24 |  |  |
 | Gi1 | 4.0.0.1/24 |  |  |
 | Loopback0 | 30.0.0.1/32 |  |  |

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF so that loopback routes are reachable between devices.

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 20.0.0.1 0.0.0.0 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 30.0.0.1 0.0.0.0 area 0

Device3(config-ospf)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router ospf 100

Device4(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device4(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

Device4(config-ospf)#network 5.0.0.0 0.0.0.255 area 0

Device4(config-ospf)#network 40.0.0.1 0.0.0.0 area 0

Device4(config-ospf)#exit

#Configure Device5.

Device5#configure terminal

Device5(config)#router ospf 100

Device5(config-ospf)#network 5.0.0.0 0.0.0.255 area 0

Device5(config-ospf)#exit

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 4.0.0.0/24 [110/2] via 2.0.0.1, 00:02:42, gigabitethernet1

[110/2] via 3.0.0.1, 00:02:11, gigabitethernet2

O 30.0.0.1/32 [110/2] via 2.0.0.1, 00:02:32, gigabitethernet1

O 40.0.0.1/32 [110/2] via 3.0.0.1, 00:02:05, gigabitethernet2

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 3.0.0.0/24 [110/2] via 2.0.0.2, 00:03:24, gigabitethernet0

[110/2] via 4.0.0.2, 00:02:38, gigabitethernet1

O 20.0.0.1/32 [110/2] via 2.0.0.2, 00:03:24, gigabitethernet0

O 40.0.0.1/32 [110/2] via 4.0.0.2, 00:02:38, gigabitethernet1

#Query the routing table of Device4.

Device4#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 2.0.0.0/24 [110/2] via 3.0.0.2, 00:03:42, gigabitethernet0

[110/2] via 4.0.0.1, 00:03:42, gigabitethernet1

O 20.0.0.1/32 [110/2] via 3.0.0.2, 00:03:42, gigabitethernet0

O 30.0.0.1/32 [110/2] via 4.0.0.1, 00:03:42, gigabitethernet1

#Query the routing table of Device5.

Device5#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 2.0.0.0/24 [110/3] via 5.0.0.1, 00:00:03, gigabitethernet0

O 3.0.0.0/24 [110/2] via 5.0.0.1, 00:00:03, gigabitethernet0

O 4.0.0.0/24 [110/2] via 5.0.0.1, 00:00:03, gigabitethernet0

O 20.0.0.1/32 [110/3] via 5.0.0.1, 00:00:03, gigabitethernet0

O 30.0.0.1/32 [110/3] via 5.0.0.1, 00:00:03, gigabitethernet0

O 40.0.0.1/32 [110/2] via 5.0.0.1, 00:00:03, gigabitethernet0

According to the routing table, Device2, Device3, and Device4 have learnt the routes of the loopback interfaces of each other.

Step 3:

Configure BGP connections in a confederation.

Configure IBGP connections in a confederation.

#Configure Device2.

Device2(config)#router bgp 65100

Device2(config-bgp)#neighbor 30.0.0.1 remote-as 65100

Device2(config-bgp)#neighbor 30.0.0.1 update-source loopback0

Device2(config-bgp)#neighbor 40.0.0.1 remote-as 65100

Device2(config-bgp)#neighbor 40.0.0.1 update-source loopback0

Device2(config-bgp)#neighbor 30.0.0.1 next-hop-self

Device2(config-bgp)#neighbor 40.0.0.1 next-hop-self

Device2(config-bgp)#exit

#Configure Device3.

Device3(config)#router bgp 65100

Device3(config-bgp)#neighbor 20.0.0.1 remote-as 65100

Device3(config-bgp)#neighbor 20.0.0.1 update-source loopback0

Device3(config-bgp)#neighbor 40.0.0.1 remote-as 65100

Device3(config-bgp)#neighbor 40.0.0.1 update-source loopback0

Device3(config-bgp)#exit

#Configure Device4.

Device4(config)#router bgp 65100

Device4(config-bgp)#neighbor 20.0.0.1 remote-as 65100

Device4(config-bgp)#neighbor 20.0.0.1 update-source loopback0

Device4(config-bgp)#neighbor 30.0.0.1 remote-as 65100

Device4(config-bgp)#neighbor 30.0.0.1 update-source loopback0

Device4(config-bgp)#exit

Configure EBGP connections in a confederation.

#Configure Device4.

Device4(config)#router bgp 65100

Device4(config-bgp)#neighbor 5.0.0.2 remote-as 65200

Device4(config-bgp)#exit

#Configure Device5.

Device5(config)#router bgp 65200

Device5(config-bgp)#neighbor 5.0.0.1 remote-as 65100

Device5(config-bgp)#exit

#On Device4, check the BGP neighbor status.

Device4#show ip bgp summary

BGP router identifier 40.0.0.1, local AS number 65100

BGP table version is 2

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

5.0.0.2 4 65200 15 15 2 0 0 00:09:40 0

20.0.0.1 4 65100 9 9 2 0 0 00:07:49 0

30.0.0.1 4 65100 7 7 2 0 0 00:05:39 0

IBGP neighbors have been set up between Device4 and Device2 and between Device4 and Device3, and EBGP neighbors have been set up between Device4 and Device5.

Step 4:

Configure a BGP confederation.

#Configure Device1.

Configure an EBGP peer. The AS number of the peer is confederation ID 200.

Device1#configure terminal

Device1(config)#router bgp 100

Device1(config-bgp)#neighbor 1.0.0.2 remote-as 200

Device1(config-bgp)#network 100.0.0.0 255.255.255.0

Device1(config-bgp)#exit

#Configure Device2.

Configure the BGP confederation ID to 200, and configure an EBGP peer. The peer AS number is 100.

Device2(config)#router bgp 65100

Device2(config-bgp)#bgp confederation identifier 200

Device2(config-bgp)#neighbor 1.0.0.1 remote-as 100

Device2(config-bgp)#exit

#Configure Device3.

Configure the BGP confederation ID to 200.

Device3(config)#router bgp 65100

Device3(config-bgp)#bgp confederation identifier 200

Device3(config-bgp)#exit

#Configure Device4.

Configure the BGP confederation ID to 200, and configure the confederation to contain area 65100.

Device4#configure terminal

Device4(config)#router bgp 65100

Device4(config-bgp)#bgp confederation identifier 200

Device4(config-bgp)#bgp confederation peers 65200

Device4(config-bgp)#exit

#Configure Device5.

Configure the BGP confederation ID to 200, and configure the confederation to contain area 65200.

Device5(config)#router bgp 65200

Device5(config-bgp)#bgp confederation identifier 200

Device5(config-bgp)#bgp confederation peers 65100

Device5(config-bgp)#exit

Step 5:

Check the result.

#On Device1, check the BGP neighbor status.

Device1#show ip bgp summary

BGP router identifier 100.0.0.1, local AS number 100

BGP table version is 2

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

1.0.0.2 4 200 6 6 2 0 0 00:02:20 0

EBGP neighbors have been successfully set up between Device1 and Device2.

#On Device5, query the route information.

Device5#show ip bgp

BGP table version is 49, local router ID is 5.0.0.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 100.0.0.0/24 20.0.0.1 0 100 0 (65100) 100 i

Device5#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 100.0.0.0/24 [200/0] via 20.0.0.1, 00:00:38, gigabitethernet0

Device5 has successfully learnt route 100.0.0.0/24, and the next-hop property of the route keeps unchanged while the route is transmitted in the confederation. Device2, Device3, Device4, and Device5 belong to the same confederation, and full connections are not required. Device5 obtains external route information through Device4.


7.3.8 Configure BGP to Coordinate with BFD

Network Requirements

l Set up EBGP neighbors between Device1 and Device2 and between Device1 and Device3, and set up IBGP neighbors between Device2 and Device3.

l Device1 learns EBGP route 3.0.0.0/24 both from Device2 and Device3, and Device1 selects to forward data to the network segment 3.0.0.0/24 through Device2.

l On Device1 and Device2, configure EBGP to coordinate with BFD. When the line between Device1 and Device2 becomes faulty, BFD can quickly detect the fault and notify BGP of the fault. Then Device1 selects to forward data to network segment 3.0.0.0/24 through Device3.

Network Topology

Figure 7‑8 Networking for configuring BGP to coordinate with BFD

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF so that loopback routes are reachable between devices.

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 20.0.0.1 0.0.0.0 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 30.0.0.1 0.0.0.0 area 0

Device3(config-ospf)#exit

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 30.0.0.1/32 [110/2] via 3.0.0.2, 00:02:26, gigabitethernet1

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 20.0.0.1/32 [110/2] via 3.0.0.1, 00:03:38, gigabitethernet1

According to the routing table, Device2 and Device3 have learnt the routes of the loopback interfaces of each other.

Step 3:

Configure an ACL and routing policy to set metric of a route.

#Configure Device1.

Device1#configure terminal

Device1(config)#ip access-list standard 1

Device1(config-std-nacl)#permit 3.0.0.0 0.0.0.255

Device1(config-std-nacl)#exit

Device1(config)#route-map SetMetric

Device1(config-route-map)#match ip address 1

Device1(config-route-map)#set metric 50

Device1(config-route-map)#exit

The routing policy that is configured on Device1 sets the metric of route 3.0.0.0/24 to 50.

Step 4

Configure BGP, and configure Device1 with a routing policy.

#Configure Device1.

Device1(config)#router bgp 100

Device1(config-bgp)#neighbor 1.0.0.2 remote-as 200

Device1(config-bgp)#neighbor 2.0.0.2 remote-as 200

Device1(config-bgp)#neighbor 2.0.0.2 route-map SetMetric in

Device1(config-bgp)#exit

#Configure Device2.

Device2(config)#router bgp 200

Device2(config-bgp)#neighbor 1.0.0.1 remote-as 100

Device2(config-bgp)#neighbor 30.0.0.1 remote-as 200

Device2(config-bgp)#neighbor 30.0.0.1 update-source loopback0

Device2(config-bgp)#network 3.0.0.0 255.255.255.0

Device2(config-bgp)#exit

#Configure Device3.

Device3(config)#router bgp 200

Device3(config-bgp)#neighbor 2.0.0.1 remote-as 100

Device3(config-bgp)#neighbor 20.0.0.1 remote-as 200

Device3(config-bgp)#neighbor 20.0.0.1 update-source loopback0

Device3(config-bgp)#network 3.0.0.0 255.255.255.0

Device3(config-bgp)#exit

After a routing policy is configured on the peer, the BGP must be reset to make the configuration take effect.

#On Device1, check the BGP neighbor status.

Device1#show ip bgp summary

BGP router identifier 2.0.0.1, local AS number 100

BGP table version is 2

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

1.0.0.2 4 200 2 2 2 0 0 00:01:32 1

2.0.0.2 4 200 2 2 2 0 0 00:01:43 1

#On Device2, check the BGP neighbor status.

Device2#show ip bgp summary

BGP router identifier 20.0.0.1, local AS number 200

BGP table version is 2

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

1.0.0.1 4 100 2 2 2 0 0 00:02:52 0

30.0.0.1 4 200 3 3 2 0 0 00:02:45 1

BGP neighbors between Device1, Device2, and Device3 have been set up successfully.

#Query the routing table of Device1.

Device1#show ip bgp

BGP table version is 3, local router ID is 1.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]* 3.0.0.0/24 2.0.0.2 50 0 200 i

[B]*> 1.0.0.2 0 0 200 i

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 3.0.0.0/24 [20/0] via 1.0.0.2, 00:07:19, gigabitethernet0

According to the routing table, route 3.0.0.0/24 of Device1 selects Device2 as the next-hop device.

Step 5:

Configure BGP to coordinate with BFD.

#Configure Device1.

Device1(config)#router bgp 100

Device1(config-bgp)#neighbor 1.0.0.2 fall-over bfd

Device1(config-bgp)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#bfd min-receive-interval 500

Device1(config-if-gigabitethernet0)#bfd min-transmit-interval 500

Device1(config-if-gigabitethernet0)#bfd multiplier 4

Device1(config-if-gigabitethernet0)#exit

#Configure Device2.

Device2(config)#router bgp 200

Device2(config-bgp)#neighbor 1.0.0.1 fall-over bfd

Device2(config-bgp)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#bfd min-receive-interval 500

Device2(config-if-gigabitethernet00)#bfd min-transmit-interval 500

Device2(config-if-gigabitethernet0)#bfd multiplier 4

Device2(config-if-gigabitethernet0)#exit

BFD is enabled between EBGP neighbors Device1 and Device2, and the minimum transmit interval, minimum receive interval, and detection timeout multiple of the BFD control packets have been modified.

Step 6:

Check the result.

#On Device1, query the BFD session status.

Device1#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

1.0.0.1 1.0.0.2 2/2 UP 2000 gigabitethernet0

On Device1, the BFD status is up, and the holddown time is negotiated to be 2000ms.

#If the line between Device1 and Device2 becomes faulty, the route can quickly switch over to the backup line.

#Query the routing table of Device1.

Device1#show ip bgp

BGP table version is 6, local router ID is 1.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 3.0.0.0/24 2.0.0.2 50 0 200 i

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 3.0.0.0/24 [20/50] via 2.0.0.2, 00:00:05, gigabitethernet1

The next hop of route 3.0.0.0/24 is Device3.


8 PBR


8.1 Overview

The PBR (policy-based routing) is a routing mechanism for fotwarding the packets based on the policy. When forwarding the data packet, the packet can be matched based on the packet information, such as source address, destination address, and the length. For the packets that match the rules, the related operation (that is, setting the outbound interface and next hop of the packets) is performed according to the specified policy. In this way, forwarding control of the packets is implemented.

Traditional routing forwards packets only based on the destination addresses. Compared with the traditional routing, the PBR is more flexible. It is an effective supplement to and enhancement of the traditional routing mechanism.


8.2 PBR Function Configuration

Table 8‑1 PBR function list

Configuration Task
Configure the PBR | Match the standard ACL
 | Match the extended ACL
 | Match the packet length
 | Set the packet TOS field
 | Set the packet DF field
 | Set the packet priority field
 | Set the next hop address for sending the packet
 | Set the default next hop address for sending the packet
 | Set the packet outbound interface
 | Set the default packet outbound interface
Configure the interface PBR | Enable the interface PBR
 | Enable the interface PBR cache
Configure the local PBR | Enable the local PBR


8.2.1 Configure PBR

Before configuring other PBR configuration tasks, first complete the PBR to enable PBR function features to be valid.

Configuration Condition

None

Match Standard ACL

After configuring the route map to match the standard ACL and PBR to associate the route map, packet matching is achieved.

Table 8‑2 Configure to match the standard ACL

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the standard ACL | ip access-list standard { access-list-number | access-list-name } | Mandatory By default, the standard ACL is not configured.
Configure the ACL permitting rule | [ sequence ] permit { any | source-addr source-wildcard | host source-addr } [ time-range time-range-name ] | Optional Configure the permitting rules the basis for analyzing and handling the packet.
Exit the IP standard ACL configuration mode | exit | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Specify the route map to match the standard ACL | match ip address { access-list-number | access-list-name } | Mandatory By default, the standard ACL is not specified for the route map.

Match Extended ACL

After configuring the route map to match the extended ACL and PBR to associate the route map, packet matching is achieved.

Table 8‑3 Configure to match the extended ACL

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the extended ACL | ip access-list extended { access-list-number | access-list-name } | Mandatory By default, the extended ACL is not configured.
Configure the ACL permitting rule | [ sequence ] permit protocol { any | source-addr source-wildcard | host source-addr } [ operator source-port ] { any | destination-addr destination-wildcard | host destination-addr } [ icmp-type ] [ icmp-code ] [ igmp-type ] [ operator destination-port ] [ ack / fin / established / psh / rst / syn / urg ] [ precedence precedence ] [ tos tos ] [ dscp dscp ] [ fragments ] [ time-range time-range-name ] | Optional Configure the permitting rules the basis for analyzing and handling the packet.
Exit the IP extended ACL configuration mode | exit | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Specify the route map to match the standard ACL | match ip address { access-list-number | access-list-name } | Mandatory By default, the extended ACL is not specified for the route map.

Match Packet Length

After configuring the route map to match the packet length and PBR to associate the route map, packet matching is achieved.

Table 8‑4 Configure to match the packet length

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Specify the route map to match the packet length | match length min-pkt-length max-pkt-length | Mandatory By default, the packet length is not specified for the route map.

l After the PBR is specified to match the packet length, enabling the interface PBR will make the cache invalid.

Set Packet TOS Field

After configuring the route map to set the packet TOS field and PBR to associate the route map, packet TOS field is modified.

Table 8‑5 Set the packet TOS field

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Set the packet TOS field | set ip tos { tos-value | max-reliability | max-throughput | min-delay | min-monetary-cost | normal } | Mandatory By default, the packet TOS field is not specified for the route map.

Set Packet DF Field

After configuring the route map to set the packet DF field and PBR to associate the route map, packet DF field is modified.

Table 8‑6 Set the packet DF field

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Set the packet DF field | set ip df bit-value | Mandatory By default, the packet DF field is not specified for the route map.

Set Packet Priority Field

After configuring the route map to set the packet priority field and PBR to associate the route map, packet priority field is modified.

Table 8‑7 Set the packet priority field

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Set the packet priority field | set ip precedence { precedence-number | precedence-type } | Mandatory By default, the packet priority field is not specified for the route map.

Set Next Hop Address for Sending Packets

After configuring the next hop address for sending packets and PBR to associate the route map, the next hop address for sending packets is set.

Table 8‑8 Set the next hop address for sending packets

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Set the next hop address for sending the packet | set ip next-hop ip-address | Mandatory By default, the next hop address for sending packets is not specified for the route map.

l When setting the next hop address for sending the packet, the routing of the next hop address must be valid.

Set Default Next Hop Address for Sending Packets

After configuring the default next hop address for sending packets and PBR to associate the route map, the default next hop address for sending packets is controlled.

Table 8‑9 Set the default next hop address for sending packets

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Set the default next hop address for sending the packet | set ip default next-hop ip-address | Mandatory By default, the default next hop address for sending packets is not specified for the route map.

l When setting the default next hop address for sending the packet, the routing of the next hop address must be valid.

l When the packet has searched the matching routing in the routing table, the default next hop address set by the PBR will not be used again.

Set Packet Sending Interface

After configuring packet interface and PBR to associate the route map, the packet sending interface is controlled.

Table 8‑10 Set the packet sending interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Set the packet sending interface | set interface interface-name | Mandatory By default, the packet sending interface is not specified for the route map.

l When setting the packet sending interface, the interface must be enabled and valid address must be available.

Set Default Interface for Sending Packets

After configuring the default packet sending interface and PBR to associate the route map, the default interface for packet sending is controlled.

Table 8‑11 Set the default interface for sending the packets

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the route map | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory By default, the route map is not created.
Set the default interface for sending packets | set default interface interface-name | Mandatory By default, the default interface for sending packets is not specified for the route map.

l When setting the packet sending interface, the interface must be enabled and valid address must be available.

l When the packet has searched the matching routing in the routing table, the default interface for sending packets set by the PBR will not be used again.

l The PBR must be set in the following sequence: set the packet outbound interface > set the packet next hop address > set the default interface for sending packets > set the default next hop address for sending packets.


8.2.2 Configure Interface PBR

Configure the interface PBR to control the forwarding packets.

Configuration Condition

l Configure the PBR.

Enable Interface PBR

Enable the interface PBR to control the packets received from the interface.

Table 8‑12 Enable the interface PBR

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the interface PBR | ip policy route-map route-map-name | Mandatory By default, the PBR is not enabled for the interface.

Enable Interface PBR Cache

After enabling the interface PBR cache, the system adopts the high-speed cache mode to save the PBR control entries. This improves the forwarding speed when there is few message flow.

Table 8‑13 Enable the interface PBR cache

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the interface PBR cache | ip route-cache policy | Mandatory By default, the PBR cache is not enabled for the interface.


8.2.3 Configure Local PBR

Configure the local PBR to control the locally generated packets.

Configuration Condition

l Configure the PBR.

Enable Local PBR

Enable the local PBR to control the locally generated packets.

Table 8‑14 Enable the local PBR

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the local PBR | ip local policy route-map route-map-name | Mandatory By default, the local PBR is not enabled.


8.2.4 PBR Monitoring and Maintaining

Table 8‑15 The PBR monitoring and maintaining

Command | Description
show ip local policy | Display the local PBR configuration information
show ip policy [ { { interface-name | local } configuration } | statistics ] | Display PBR configuration and statistics information


8.3 PBR Typical Configuration Example


8.3.1 Configure PBR Basic Function

Network Requirements

l Configure the default routing on Device1. By default, the packet sent from Device1 is forwarded via Device2.

l Configure the PBR on Device1 to enable PC to visit the network 10.1.0.0/24 via Device2 and visit network 10.1.1.0/24 via Device3.

Network Topology

Figure 8–1 Networking of configuring the PBR basic function

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure the static route.

#Configure the default route on Device1 and the next hop as Device2.

Device1#configure terminal

Device1(config)#ip route 0.0.0.0 0.0.0.0 2.0.0.2

#Configure two static routes on Device2 with the destination address as the network that the PC locates in and the network that Device4 connects to.

Device2#configure terminal

Device2(config)#ip route 1.0.0.0 255.255.255.0 2.0.0.1

Device2(config)#ip route 10.1.0.0 255.255.254.0 4.0.0.1

#Configure two static routes on Device3 with the destination address as the network that the PC locates in and the network that Device4 connects to.

Device3#configure terminal

Device3(config)#ip route 1.0.0.0 255.255.255.0 3.0.0.1

Device3(config)#ip route 10.1.0.0 255.255.254.0 5.0.0.1

#Configure the static route on Device4 withe the destination address as the network that the interfaces of Device1 locate in.

Device4#configure terminal

Device4(config)#ip route 2.0.0.0 255.255.255.0 4.0.0.2

Device4(config)#ip route 3.0.0.0 255.255.255.0 5.0.0.2

Device4(config)#ip route 1.0.0.0 255.255.255.0 5.0.0.2

Device4(config)#ip route 1.0.0.0 255.255.255.0 4.0.0.2

#View the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 2.0.0.2 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 2.0.0.2, 02:20:47, gigabitethernet1

C 1.0.0.0/24 is directly connected, 02:44:40, gigabitethernet0

C 2.0.0.0/24 is directly connected, 02:44:33, gigabitethernet1

C 3.0.0.0/24 is directly connected, 02:44:22, gigabitethernet2

C 127.0.0.0/8 is directly connected, 2402:50:36, lo0

Step 3:

Configure the ACL and route-map.

#Configure the extended ACL on Device1 to match the packet with the source address as 1.0.0.2 and destination address as 10.1.1.1.

Device1(config)#ip access-list extended 1001

Device1(config-ext-nacl)#permit ip host 1.0.0.2 host 10.1.1.1

Device1(config-ext-nacl)#exit

#Configure route-map on Device1 to match the ACL and set the next hop for forwarding the packet as 3.0.0.2.

Device1(config)#route-map 1

Device1(config-route-map)#match ip address 1001

Device1(config-route-map)#set ip next-hop 3.0.0.2

Device1(config-route-map)#exit

l The packets are matched flexibly based on the introduced ACL rule. The packet can be matched based on the packet information such as source IP address, destination IP address, source port, destination port, protocol, and TCP identification information.

Step 4:

Configure the PBR

#Configure the PBR on gigabitethernet0 of Device1.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip policy route-map 1

Device1(config-if-gigabitethernet0)#exit

l The PBR must be configured on the inbound interface for the packet.

Step 5:

Check the result.

#View the route to the destination network 10.1.0.0/24 through Traceroute on PC.

[root@PC]# traceroute 10.1.0.1

traceroute to 10.1.0.1 (10.1.0.1), 30 hops max, 60 byte packets

1 1.0.0.1 (1.0.0.1) 0.464 ms 0.244 ms 0.211 ms

2 2.0.0.2 (2.0.0.2) 0.730 ms 1.025 ms 1.614 ms

3 4.0.0.1 (4.0.0.1) 0.978 ms !N 1.116 ms !N 0.749 ms !N

It can be viewed that the packet sent out by PC reaches the network 10.1.0.0/24 via Device1, Device2, and Device4.

# View the route to the destination network 10.1.1.0/24 through Traceroute on PC.

[root@PC]# traceroute 10.1.1.1

traceroute to 10.1.1.1 (10.1.1.1), 30 hops max, 60 byte packets

1 1.0.0.1 (1.0.0.1) 0.366 ms 0.586 ms 0.506 ms

2 3.0.0.2 (3.0.0.2) 1.024 ms 5.646 ms 5.576 ms

3 5.0.0.1 (5.0.0.1) 5.692 ms !N 8.489 ms !N 5.653 ms !N

It can be viewed that the packet sent out by PC reaches the network 10.1.1.0/24 via Device1, Device3, and Device4.


9 PBR Tools


9.1 Overview

A routing policy can change properties or reachability of a route so as to change the routing information or change the paths that the data flow passes. A routing policy is mainly applied in the following aspects:

l Sets route properties: Sets the required route properties for the routes that match the routing policy.

l Controls route advertisement: When a routing protocol advertises route, it advertises only the routes that meet the requirements.

l Controls route receiving: When a routing protocol, it receives only the routes that meet the requirements so as to control the number of routes and improves the network security.

l Controls route redistribution: When a routing protocol redistributes external routes, it introduces only the routes that meet the requirements. A routing policy tool can also be used to set some properties for the external routes that are introduced.

Key-chain is a password management tool. It provides authentication passwords for the routing protocol to authentication protocol packets.


9.2 Configure PBR Tools

Table 9‑1 Routing policy tool list

Configuration Tasks
Configure a prefix list. | Configure a prefix list.
Configure an AS-PATH list. | Configure an AS-PATH list.
Configure a Community-list. | Configure a Community-list.
Configure an Extcommunity-list. | Configure an Extcommunity-list.
Configure a route map. | Create a route map.
 | Configure the match clauses of a route map.
 | Configure the set clauses of a route map.
Configure a key chain. | Configure a key chain.


9.2.1 Configure Prefix List

Configuration Condition

None

Configure a Prefix List

The prefix list filters routes based on prefixes. The ACL is first designed to filter data packets and then used to filter routes while the prefix list is designed to filter routes. Through some route filtering functions of the ACL and prefix list are the same, the prefix list is more flexible than the ACL.

A prefix list is identified by a prefix list name. Each prefix list contains multiple entries, and each entry can specify a matching range independently. Each entry has a serial number, indicating the sequence in which the prefix list implements matching checks.

The entries of a prefix list are in the OR relation. When a route tries to match a prefix list, it checks the entries in the sequence of small to large. Once the route matches an entry, it passes the filtration of the prefix list, and the next entry will no longer be checked.

Table 9‑2 Configure a prefix list

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure an IPv4 prefix list. | ip prefix-list prefix-list-name [ seq seq-value ] { deny | permit } network / length [ ge ge-value ] [ le le-value ] | Mandatory. By default, no IPv4 prefix list is configured.

l The value range is 0<=length<ge-value<=le-value<=32, where "ge" means equal to or larger than, and "le" means equal to or smaller than. If ip prefix-list test permit 192.168.0.0/16 ge 18 le 24 is configured, it indicates that routes with the address 192.168.0.0 and mask length of 18 to 24 (including 18 and 24) are allowed to pass.

l If network/length is set to 0.0.0.0/0, it means to match the default route. If 0.0.0.0/0 le 32 is configured, it means to match all routes.

l If an implicit expression is contained at the end of an IPv4 prefix list, it means to deny all entries: deny 0.0.0.0/0 le 32. If you want to deny some routes by configuring a deny statement, it is recommended that you add a permit 0.0.0.0/0 le 32 statement to allow other IPv4 routes to pass.


9.2.2 Configure AS-PATH List

Configuration Condition

None

Configure an AS-PATH List

An AS-PATH list is a tool for filtration based on AS numbers. It is used for BGP route filtration. The AS path property of a BGP route records all ASs that the route passes. When BGP advertises a route to a network outside the local AS, it adds the local AS number to the AS path property to record the AS paths that the route passes.

An AS-PATH list contains multiple entries, and the entries are in the OR relation. When a route tries to match an AS-PATH list, it checks the entries following the sequence of configuration. Once the route matches an entry, it passes the filtration of the AS-PATH list.

Table 9‑3 Configure an AS-PATH list

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure an AS-PATH list. | ip as-path access-list path-list-number { permit | deny } regular-expression | Mandatory. By default, no AS-PATH list is configured.

An AS-PATH list uses a regular expression to specify a collection of AS properties that meet the requirement. A regular expression consists of some common characters and some metacharacters. Common characters includes upper- and lower-case characters and numbers while metacharacters have special meanings, as shown in the following table.

Table 9‑4 Meanings of metacharacters in a regular expression

Symbol | Meaning
. | Matches any single character.
* | Matches a sequence which consists of 0 or more bits in the mode.
+ | Matches a sequence which consists of 1 or more bits in the mode.
? | Matches a sequence which consists of 0 or 1 bit in the mode.
^ | Matches the start of the inputted character string.
$ | Matches the end of the inputted character string.
_ | Matches commas, brackets, start and end of the inputted character string, and blank spaces.
[] | Matches single characters in a certain range.
- | Separates the end point of a range.


9.2.3 Configure Community-List

Configuration Condition

None

Configure a Community-List

A Community-list is used to filter community properties of routes. Usually, a route consists of two parts: prefix and routing properties. Routing properties are different for different routing protocols. The IGP protocol usually provides simple properties such as metric, but the BGP protocol provides complex properties such as community property. A Community-list is used for filtration.

Filtration on a Community-list acts on the route on which the community property is configured. That is, if the filtration result is deny, the route instead of the community property is filtered.

Two types of Community-lists are available: standard Community-list and extended Community-list. A standard Community-list filters BGP routes based on the local-AS, internet, no-advertise, no-export properties. An extended Community-list filters BGP routes with community properties based on a regular expression.

A Community-list can be used for a routing protocol with community properties. However, you need to bind the Community-list with a route map, and then apply the route map to the routing protocol.

A Community-list contains multiple entries, and the entries are in the OR relation. When a route tries to match a Community-list, it checks the entries following the sequence of configuration. Once the route matches an entry of the community list, it passes the filtration of the community list. For the use of a regular expression in configuring an extended Community-list, refer to "Configure an AS-PATH List".

Table 9‑5 Configure a community-list

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a standard Community-list. | ip community-list { community-list-number | standard community-list-name } { permit | deny } [ community-number / aa:nn / local-AS / internet / no-advertise / no-export ] | Mandatory. By default, no standard Community-list is configured.
Configure an extended Community-list. | ip community-list { community-list-number | expanded community-list-name } { permit | deny } regular-expression | Mandatory. By default, no extended Community-list is configured.


9.2.4 Configure Extcommunity-List

Configuration Condition

None

Configure an Extcommunity-List

An extended community list (Extcommunity-list) filters BGP routes based on the extended community properties. The quality and usage method of an extended community list (Extcommunity-list) are the same as a standard community list. The major difference is that extended community properties are mainly used in a Multi Protocol Label Switching (MPLS) Layer 3 Virtual Private Network (L3VPN), so an Extcommunity list is also mainly used in an MPLS L3VPN.

Two types of Extcommunity-lists are available: standard Extcommunity-list and extended Extcommunity-list. The standard Extcommunity-list filters BGP routes based on Router Target and Site or Origin properties. An extended Extcommunity-list filters BGP routes with community properties based on a regular expression.

An Extcommunity-list contains multiple entries, and the entries are in the OR relation. When a route tries to match an Extcommunity-list, it checks the entries following the sequence of configuration. Once the route matches an entry, it passes the filtration of the Extcommunity-list. For the use of a regular expression in configuring an extended Extcommunity-list, refer to "Configure an AS-PATH List".

Table 9‑6 Configure an extcommunity-list

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a standard Extcommunity-list. | ip extcommunity-list { extcommunity-list-number | standard extcommunity-list-name} { permit | deny } [ rt extcommunity-number / soo extcommunity-number ] | Mandatory. By default, no standard Extcommunity-list is configured.
Configure an extended Extcommunity list. | ip extcommunity-list { extcommunity-list-number | expanded extcommunity-list-name } { permit | deny } regular-expression | Mandatory. By default, no extended Extcommunity-list is configured.


9.2.5 Configure Route Map

A route map is a tool for matching routes and setting route properties. A route map consists of multiple statements, and each statement consists of some match clauses and set clauses. The match clauses define the matching rules of the statement, and the set clauses define the follow-up actions after a route match the match clauses. The match clauses are in the OR relation, that is, a route must match all match clauses of the statement.

The route map statements are in the OR relation. When a route tries to match a route map, it checks the entries in the sequence of small to large. Once a route matches a statement, it matches the route map, and the next statement will no longer be checked. If a route fails to match a statement, it fails to match the route map.

Configuration Condition

Before configuring a route map, ensure that:

l The ACL, prefix list, AS-PATH, and Community-list or Extcommunity-list that are required for configuring a route map have been configured.

Create a Route Map

In creating a route map, you can specify the match mode of the statements of the route map. Two match modes are available: permit and deny.

The permit mode sets the matching mode of the statements of the route map to permit, that is, if a route matches all match clauses of the statement, the route is allowed to pass, and then the set clauses of the statement are executed. If a route fails to match the match clauses of the statement, it starts to match the next statement of the route map.

The deny mode sets the matching mode of the statements of the route map to deny, that is, when a route matches all match clauses of a statement, the route is denied, and the route will not match the next statement of the route map. In deny mode, set clauses will not be executed.

Table 9‑7 Create a route map

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Create a route map. | route-map map-name [ { permit | deny } [ seq-number ] ] | Mandatory. By default, no route map is created.

l If you run the route-map command to create a route map, if you configure only the route map name but do not configure the match mode and statement serial number, a statement whose match mode is permit and serial number is 10 is automatically created.

l If a route map is applied to the routing protocol but the route map has not been configured, all objects will fail to match.

Configure the Match Clauses of a Route Map

The match clauses of a route map statement are in the OR relation, that is, a route must match all match clauses before it is allowed to pass.

Table 9‑8 Configure the match clause of a route map

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the route map configuration mode. | route-map map-name [ { permit | deny } [ seq-number ] ] | -
Specify the AS-PATH list that the route map matches. | match as-path path-list-number | Optional. By default, no AS-PATH list that the route map matches is specified.
Specify the BGP Community-list that the route map matches. | match community community-list-number / community-list-name [ exact-match ] | Optional. By default, no BGP Community-list that the route map matches is specified.
Specify the BGP Extcommunity-list that the route map matches. | match extcommunity ext community-list-number / ext community-list-name | Optional. By default, no BGP Extcommunity-list that the route map matches is specified.
Specify the interface that the route map matches. | match interface interface-names | Optional. By default, no interface that the route map matches is specified.
Specify the route prefix that the route map matches. | match ip address { access-list-number | access-list-name | prefix-list prefix-list-name } | Optional. By default, no route prefix that the route map matches is specified.
Specify the next-hop address that the route map matches. | match ip next-hop { access-list-name | prefix-list prefix-list-name } | Optional. By default, no next-hop address that the route map matches is specified.
Specify the source route address that the route map matches. | match ip route-source { access-list-name | prefix-list prefix-list-name } | Optional. By default, no source route address that the route map matches is specified.
Specify the packet length scope that the route map matches. | match length min-pkt-length max-pkt-length | Optional. By default, no packet length scope that the route map matches is specified.
Specify the route metric value that the route map matches. | match metric metric-value | Optional. By default, no route metric value that the route map matches is specified.
Specify the routing type that the route map matches. | match route-type { external / interarea / internal / level-1 / level-2 / nssa-external / type-1 / type-2 } | Optional. By default, no routing type that the route map matches is specified.
Specify the tag value that the route map matches. | match tag tag-value | Optional. By default, no tag value that the route map matches is specified.

l If a route map is not configured with match clauses, all objects can match the route map successfully.

l When the ACL and prefix list that are associated with the match clauses do not exist, no object can match the route map.

Configure the Set Clauses of a Route Map

When the route map match mode is permit, if a route matches all match clauses, the set operations will be executed. If the match mode is deny, the set operations will not be performed.

Table 9‑9 Configure the set clauses of a route map

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Enter the route map configuration mode. | route-map map-name [ { permit | deny } [ seq-number ] ] | -
Set the AS path property of a BGP route. | set as-path prepend as-path-number | Optional. By default, the AS path property of the BGP route is not configured.
Configure the community property of the BGP route. | set communtiy { community-number | additive | local-AS | internet | no-advertise | no-export | none } | Optional. By default, the community property of the BGP route is not configured.
Delete the Community-list of the BGP route. | set comm-list { community-list-number / community-list-name } delete | Optional. By default, the community property of the BGP route is not deleted.
Set BGP route attenuation parameters. | set dampening half-life start-reusing start-suppress max-duration | Optional. By default, BGP route attenuation parameters are not set.
Set the default outbound interface for forwarding the packet. | set default interface interface-name | Optional. By default, the default outbound interface for forwarding the packet is not configured.
Set Extcommunity properties of the MPLS L3VPN route. | set extcommunity { rt | soo } extcommunity | Optional. By default, the Extcommunity properties of MPLS L3VPN are not configured.
Set the outbound interface for forwarding the packet. | set interface interface-name | Optional. By default, the outbound interface for forwarding the packet is not configured.
Set the default next hop or the route next hop for forwarding IP packets. | set ip default next-hop ip-address | Optional. By default, the default next hop or the route next hop for forwarding IP packets is not configured.
Set the IP packet fragmentation identification | set ip df bit-value | Optional. By default, the IP packet fragmentation identification is not configured.
Set the forwarding next hop or the route next hop for the IP packet | set ip next-hop ip-address | Optional. By default, the forwarding next hop or the route next hop for the IP packet is not configured.
Set the IP packet priority | set ip precedence { precedence-number | precedence-type} | Optional. By default, the IP packet priority is not configured.
Set the service type field TOS bit for the IP packet | set ip tos { tos-value | max-reliability | max-throughput | min-delay | min-monetary-cost | normal } | Optional. By default, the service type field TOS bit for the IP packet is not configured.
Set the IS-IS redistribution route type | set level { level-1 | level-1-2 | level-2 } | Optional. By default, the IS-IS redistribution route type is not configured.
Set the local priority of BGP route. | set local-preference value | Optional. By default, the local priority is not configured for the BGP route.
Set the metric value of the route. | set metric { metric | +metric | -metric | bandwidth delay reliable loading mtu } | Optional. By default, the metric value of the route is not configured.
Set the metric type of the route. | set metric-type { external | internal | type-1 | type-2 } | Optional. By default, the metric type of the route is not configured.
Configure the Origin property of the BGP route. | set origin { egp as-number | igp | incomplete } | Optional. By default, the Origin property of the BGP route is not configured.
Set the tag option field of external routes. | set tag tag-value | Optional. By default, the tag option field of external routes is not configured.
Set the weight of the BGP route. | set weight weight-value | Optional. By default, the weight of the BGP route is not configured.


9.2.6 Configure Key Chain

Configuration Condition

None

Configure a Key Chain

Key chain is a password management tool. It provides authentication passwords for the routing protocol to authentication protocol packets. A key chain provides different passwords for transmitting and receiving packets, and it provides different passwords for different Key IDs. Meanwhile, a key chain can automatically switch passwords according to the validity duration of keys, that is, it uses different keys in different periods of time. This greatly enhances the password security.

You can configure multiple Key IDs for a key chain. When a protocol uses the key chain for authentication, it obtains the Key ID according to the following rules:

l The minimum valid transmit passwords of the Key IDs are obtained as the transmit passwords.

l Among the Key IDs that are larger than the specified key IDs of the protocol, obtain the minimum valid receive passwords of the Key IDs as the receive passwords.

l If a Key ID is contained in the received protocol packets, a search for the valid receive passwords are performed based on the Key ID. Otherwise, the minimum valid receive passwords of the Key IDs in the local key chain is used as the receive password.

Table 9‑10 Configure a key chain

Step | Command | Description
Enter the global configuration mode. | configure terminal | -
Configure a key chain. | key chain keychain-name | Mandatory. By default, the key chain is not configured.
Configure a Key ID. | key key-id | Mandatory. By default, the key ID is not configured.
Configure a password. | key-string [ 0 | 7 ] password | Mandatory. By default, no password is configured. A blank space is also regarded as a password character. Pay attention to this while configuring a password.
Configure the valid duration in which a key acts as the receive password. | accept-lifetime time-start { time-end | duration second | infinite } | Mandatory. By default, the receive password is always valid.
Configure the valid duration in which a key acts as the transmit password. | send-lifetime time-start { time-end | duration second | infinite } | Mandatory. By default, the transmit password is always valid.


9.2.7 Routing Policy Monitoring and Maintaining

Table 9‑11 Routing policy monitoring and maintaining

Command | Description
clear ip prefix-list [ prefix-list-name network/length ] | Clears the prefix list statistics.
show ip prefix-list [ prefix-list-name [ network/lenghter [ first-match | longer ] | seq sep_value ] | detail [ prefix-list-name ] | orf-prefix | summary [ prefix-list-name ] | Display the information about a prefix list.
show ip as-path-access-list [ list-name ] | Display the information about an AS-PATH list.
show ip community-list [ community-list-number | community-list-name] | Display the information about a Community list.
show ip extcommunity-list [ extcommunity-list-number | extcommunity-list-name ] | Display the information about an Extcommunity list.
show route-map [ route-map-name ] | Display the information about a route map.
show key chain [ keychain-name ] | Display the information about a key chain.


9.3 PBT Tool Typical Configuration Example


9.3.1 Configure Routing Policy for Configuring Route Redistribution

Network Requirements

l Run OSPF between Device1 and Device2, and run RIP between Device2 and Device3.

l On Device2, configure OSPF to redistribute RIP routes, and associate a routing policy to modify route properties. It is required that the tag property of route 100.1.1.0/24 is changed to 5, the metric value of route v is changed to 50, and the property of route 120.1.1.0/24 keeps unchanged.

Network Topology

Figure 9‑1 Configuring a routing policy for configuring route redistribution

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 172.1.1.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 172.1.1.0 0.0.0.255 area 0

Device2(config-ospf)#exit

Step 3:

Configure RIP.

#Configure Device2.

Device2(config)#router rip

Device2(config-rip)#version 2

Device2(config-rip)#network 171.1.1.0

Device2(config-rip)#exit

#Configure Device3.

Device3(config)#configure terminal

Device3(config)#router rip

Device3(config-rip)#version 2

Device3(config-rip)#network 171.1.1.0

Device3(config-rip)#network 100.1.1.0

Device3(config-rip)#network 110.1.1.0

Device3(config-rip)#network 120.1.1.0

Device3(config-rip)#exit

Step 4:

Configure OSPF to redistribute RIP routes.

#Configure Device2.

Device2(config)#router ospf 100

Device2(config-ospf)#redistribute rip

Device2(config-ospf)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

OE 100.1.1.0/24 [150/20] via 172.1.1.2, 02:22:08, gigabitethernet0

OE 110.1.1.0/24 [150/20] via 172.1.1.2, 00:49:57, gigabitethernet0

OE 120.1.1.0/24 [150/20] via 172.1.1.2, 02:22:08, gigabitethernet0

OE 171.1.1.0/24 [150/20] via 172.1.1.2, 02:22:41, gigabitethernet0

According to the routing table of Device1, the RIP routes 100.1.1.0/24, 110.1.1.0/24, and 120.1.1.0/24 are redistributed to the OSPF process and successfully advertised to Device1.

Step 5:

Configure an ACL and routing policy.

#Configure Device2.

Configure an ACL to allow routes 100.1.1.0/24, 110.1.1.0/24, and 120.1.1.0/24 to pass.

Device2(config)#ip access-list standard 1

Device2(config-std-nacl)#permit 100.1.1.0 0.0.0.255

Device2(config-std-nacl)#exit

Device2(config)#ip access-list standard 2

Device2(config-std-nacl)#permit 110.1.1.0 0.0.0.255

Device2(config-std-nacl)#exit

Device2(config)#ip access-list standard 3

Device2(config-std-nacl)#permit 120.1.1.0 0.0.0.255

Device2(config-std-nacl)#exit

Configure routing policy rip_to_ospf. Set the tag property of the routes that match ACL 1, set the metric property of the routes that match ACL2, and do not change the routing properties of the routes that match ACL 3.

Device2(config)#route-map rip_to_ospf 10

Device2(config-route-map)#match ip address 1

Device2(config-route-map)#set tag 5

Device2(config-route-map)#exit

Device2(config)#route-map rip_to_ospf 20

Device2(config-route-map)#match ip address 2

Device2(config-route-map)#set metric 50

Device2(config-route-map)#exit

Device2(config)#route-map rip_to_ospf 30

Device2(config-route-map)#match ip address 3

Device2(config-route-map)#exit

l In configuring a routing policy, you can create a matching rule based on a prefix list or ACL. The prefix list can precisely match routing masks while the ACL cannot match routing masks.

Step 6:

Configure OSPF to redistribute RIP routes and associate a routing policy.

#Configure Device2.

Device2(config)#router ospf 100

Device2(config-ospf)#redistribute rip route-map rip_to_ospf

Device2(config-ospf)#exit

Step 7:

Check the result.

#Check the OSPF database of Device1.

Device1#show ip ospf database external

OSPF Router with ID (172.1.1.1) (Process ID 100)

AS External Link States

LS age: 1183

Options: 0x22 (-|-|DC|-|-|-|E|-)

LS Type: AS-external-LSA

Link State ID: 100.1.1.0 (External Network Number)

Advertising Router: 172.1.1.2

LS Seq Number: 80000006

Checksum: 0xbcc0

Length: 36

Network Mask: /24

Metric Type: 2 (Larger than any link state path)

TOS: 0

Metric: 20

Forward Address: 0.0.0.0

External Route Tag: 5

LS age: 1233

Options: 0x22 (-|-|DC|-|-|-|E|-)

LS Type: AS-external-LSA

Link State ID: 110.1.1.0 (External Network Number)

Advertising Router: 172.1.1.2

LS Seq Number: 80000006

Checksum: 0x0d4d

Length: 36

Network Mask: /24

Metric Type: 2 (Larger than any link state path)

TOS: 0

Metric: 50

Forward Address: 0.0.0.0

External Route Tag: 0

LS age: 1113

Options: 0x22 (-|-|DC|-|-|-|E|-)

LS Type: AS-external-LSA

Link State ID: 120.1.1.0 (External Network Number)

Advertising Router: 172.1.1.2

LS Seq Number: 80000005

Checksum: 0x5f10

Length: 36

Network Mask: /24

Metric Type: 2 (Larger than any link state path)

TOS: 0

Metric: 20

Forward Address: 0.0.0.0

External Route Tag: 0

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

OE 100.1.1.0/24 [150/20] via 172.1.1.2, 02:30:28, gigabitethernet0

OE 110.1.1.0/24 [150/50] via 172.1.1.2, 00:58:17, gigabitethernet0

OE 120.1.1.0/24 [150/20] via 172.1.1.2, 02:30:28, gigabitethernet0

According to the OSPF database and routing table of Device1, the tag of route 100.1.1.0/24 is 5, the metric of route 110.1.1.0/24 is 50, and the routing properties of route 120.1.1.0/24 are not changed.

l In redistributing external routes, the routes of the direct connect interfaces that are covered by the RIP process will also be redistributed into the target protocol.


9.3.2 Configure Routing Policy for BGP

Network Requirements

l Run IGP protocol ISPF and set up IBGP neighbors between Device1 and Device2 and between Device1 and Device3, and set up EBGP neighbors between Device4 and Device2 and between Device4 and Device3.

l Configure a routing policy on Device2 and Device3 so that the data of Device1 reaches network segment 100.1.1.0/24 through Device2, reaches network segment 110.1.1.0/24 through Device3, reaches network segment 120.1.1.0/24 through Device2, and reaches network segment 130.1.1.0/24 through Device3.

Network Topology

Figure 9‑2 Configuring a routing policy for BGP

Configuration Steps

Step 1: | Configure the IP addresses of the interfaces. (Omitted)
Step 2: | Configure OSPF so that loopback routes are reachable between devices.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 38.1.1.1 0.0.0.0 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 39.1.1.1 0.0.0.0 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 40.1.1.1 0.0.0.0 area 0

Device3(config-ospf)#exit

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 39.1.1.1/32 [110/2] via 1.0.0.2, 19:11:33, gigabitethernet0

O 40.1.1.1/32 [110/2] via 2.0.0.2, 18:56:32, gigabitethernet1

#Query the routing table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 2.0.0.0/24 [110/2] via 1.0.0.1, 19:19:10, gigabitethernet0

O 38.1.1.1/32 [110/2] via 1.0.0.1, 19:09:43, gigabitethernet0

O 40.1.1.1/32 [110/3] via 1.0.0.1, 18:56:49, gigabitethernet0

#Query the routing table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 1.0.0.0/24 [110/2] via 2.0.0.1, 19:17:33, gigabitethernet0

O 38.1.1.1/32 [110/2] via 2.0.0.1, 19:09:59, gigabitethernet0

O 39.1.1.1/32 [110/3] via 2.0.0.1, 19:12:06, gigabitethernet0

After the configuration is completed, Device1 can set up OSPF neighbors respectively with Device2 and Device3 and the devices can learn the Loopback routes of the peer end.

Step 3:

Configure BGP.

#Configure Device1.

Configure Device1 to set up IBGP neighbors respectively with Device2 and Device3 through Loopback interfaces and advertises routes 120.1.1.0/24 and 130.1.1.0/24 to the BGP routing table.

Device1(config)#router bgp 100

Device1(config-bgp)#neighbor 39.1.1.1 remote-as 100

Device1(config-bgp)#neighbor 39.1.1.1 update-source loopback0

Device1(config-bgp)#neighbor 40.1.1.1 remote-as 100

Device1(config-bgp)#neighbor 40.1.1.1 update-source loopback0

Device1(config-bgp)#network 120.1.1.0 255.255.255.0

Device1(config-bgp)#network 130.1.1.0 255.255.255.0

Device1(config-bgp)#exit

#Configure Device2.

Device2(config)#router bgp 100

Device2(config-bgp)#neighbor 38.1.1.1 remote-as 100

Device2(config-bgp)#neighbor 38.1.1.1 update-source loopback0

Device2(config-bgp)#neighbor 38.1.1.1 next-hop-self

Device2(config-bgp)#neighbor 3.0.0.2 remote-as 200

Device2(config-bgp)#exit

#Configure Device3.

Device3(config)#router bgp 100

Device3(config-bgp)#neighbor 38.1.1.1 remote-as 100

Device3(config-bgp)#neighbor 38.1.1.1 update-source loopback0

Device3(config-bgp)#neighbor 38.1.1.1 next-hop-self

Device3(config-bgp)#neighbor 4.0.0.2 remote-as 200

Device3(config-bgp)#exit

#Configure Device4.

Configure Device4 to set up EBGP neighbors respectively with Device2 and Device3 and advertise routes 100.1.1.0/24 and 110.1.1.0/24 to the BGP routing table.

Device4#configure terminal

Device4(config)#router bgp 200

Device4(config-bgp)#neighbor 3.0.0.1 remote-as 100

Device4(config-bgp)#neighbor 4.0.0.1 remote-as 100

Device4(config-bgp)#network 100.1.1.0 255.255.255.0

Device4(config-bgp)#network 110.1.1.0 255.255.255.0

Device4(config-bgp)#exit

#Query the BGP routing information of Device1.

Device1#show ip bgp

BGP table version is 2, local router ID is 38.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*>i100.1.1.0/24 39.1.1.1 0 100 0 200 i

[B]* i 40.1.1.1 0 100 0 200 i

[B]*>i110.1.1.0/24 39.1.1.1 0 100 0 200 i

[B]* i 40.1.1.1 0 100 0 200 i

[B]*> 120.1.1.0/24 0.0.0.0 0 32768 i

[B]*> 130.1.1.0/24 0.0.0.0 0 32768 i

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 100.1.1.0/24 [200/0] via 39.1.1.1, 19:03:19, gigabitethernet0

B 110.1.1.0/24 [200/0] via 39.1.1.1, 19:03:19, gigabitethernet0

According to the BGP routing table of Device1, data that are targeted at network segments 100.1.1.0/24 and 110.1.1.0/24 have two valid routes respectively. Because the router ID of Device2 is smaller, so the BGP data that are targeted at network segments 100.1.1.0/24 and 110.1.1.0/24 choose to pass Device2 by default.

#Query the BGP routing information of Device4.

Device4#show ip bgp

BGP table version is 3, local router ID is 110.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 100.1.1.0/24 0.0.0.0 0 32768 i

[B]*> 110.1.1.0/24 0.0.0.0 0 32768 i

[B]* 120.1.1.0/24 4.0.0.1 0 0 100 i

[B]*> 3.0.0.1 0 0 100 i

[B]* 130.1.1.0/24 4.0.0.1 0 0 100 i

[B]*> 3.0.0.1 0 0 100 i

#Query the routing table of Device4.

Device4#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 120.1.1.0/24 [20/0] via 3.0.0.1, 19:25:05, gigabitethernet1

B 130.1.1.0/24 [20/0] via 3.0.0.1, 19:25:05, gigabitethernet1

According to the BGP routing table of Device4, the data that are targeted at network segments 120.1.1.0/24 and 130.1.1.0/24 have two valid routes. Because Device4 first sets up a neighbor relation with Device2, it takes longer time for Device2 to learn the two routes, so BGP data that are targeted at the network segments 120.1.1.0/24 and 130.1.1.0/24 choose to pass Device2 by default.

Step 4:

Configure a prefix list and routing policy.

#Configure Device2.

Configure a prefix list to allow routes 100.1.1.0/24 and 130.1.1.0/24 to pass.

Device2(config)#ip prefix-list 1 permit 100.1.1.0/24

Device2(config)#ip prefix-list 2 permit 130.1.1.0/24

Configure the routing policy lp so that the prefix list 1 of Device2 allows setting local-preference for routes.

Device2(config)#route-map lp 10

Device2(config-route-map)#match ip address prefix-list 1

Device2(config-route-map)#set local-preference 200

Device2(config-route-map)#exit

Device2(config)#route-map lp 20

Device2(config-route-map)#exit

Configure the routing policy med so that the prefix list 2 of Device2 allows setting the MED property for routes.

Device2(config)#route-map med 10

Device2(config-route-map)#match ip address prefix-list 2

Device2(config-route-map)#set metric 10

Device2(config-route-map)#exit

Device2(config)#route-map med 20

Device2(config-route-map)#exit

#Configure Device3.

Configure a prefix list to allow routes 110.1.1.0/24 and 120.1.1.0/24 to pass.

Device3(config)#ip prefix-list 1 permit 110.1.1.0/24

Device3(config)#ip prefix-list 2 permit 120.1.1.0/24

Configure the routing policy lp so that the prefix list 1 of Device3 allows setting local-preference for routes.

Device3(config)#route-map lp 10

Device3(config-route-map)#match ip address prefix-list 1

Device3(config-route-map)#set local-preference 200

Device3(config-route-map)#exit

Device3(config)#route-map lp 20

Device3(config-route-map)#exit

Configure the routing policy med so that the prefix list 2 of Device3 allows setting the MED property for routes.

Device3(config)#route-map med 10

Device3(config-route-map)# match ip address prefix-list 2

Device3(config-route-map)#set metric 10

Device3(config-route-map)#exit

Device3(config)#route-map med 20

Device3(config-route-map)#exit

l In configuring a routing policy, you can create a matching rule based on a prefix list or ACL. The prefix list can precisely match routing masks while the ACL cannot match routing masks.

Step 5:

Configure a routing policy for BGP.

#Configure Device2.

Apply the routing policy lp to the outgoing routes of neighbor 38.1.1.1 and apply the routing policy med to the outgoing routes of neighbor 3.0.0.2.

Device2(config)#router bgp 100

Device2(config-bgp)#neighbor 38.1.1.1 route-map lp out

Device2(config-bgp)#neighbor 3.0.0.2 route-map med out

Device2(config-bgp)#exit

#Configure Device3.

Apply the routing policy lp to the outgoing routes of neighbor 38.1.1.1 and apply the routing policy med to the outgoing routes of neighbor 4.0.0.2.

Device3(config)#router bgp 100

Device3(config-bgp)#neighbor 38.1.1.1 route-map lp out

Device3(config-bgp)#neighbor 4.0.0.2 route-map med out

Device3(config-bgp)#exit

Step 6:

Check the result.

#Query the BGP routing information of Device1.

Device1#show ip bgp

BGP table version is 9, local router ID is 38.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]* i100.1.1.0/24 40.1.1.1 0 100 0 200 i

[B]*>i 39.1.1.1 0 200 0 200 i

[B]*>i110.1.1.0/24 40.1.1.1 0 200 0 200 i

[B]* i 39.1.1.1 0 100 0 200 i

[B]*> 120.1.1.0/24 0.0.0.0 0 32768 i

[B]*> 130.1.1.0/24 0.0.0.0 0 32768 i

#Query the routing table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 100.1.1.0/24 [200/0] via 39.1.1.1, 02:58:12, gigabitethernet0

B 110.1.1.0/24 [200/0] via 40.1.1.1, 02:58:10, gigabitethernet1

According to the BGP routing table of Device1, route 100.1.1.0/24 has two next hops, 40.1.1.1 and 39.1.1.1. The local-preference of the route with the next hop 39.1.1.1 has been changed to 200 so that the data that are targeted at the network segment 100.1.1.0/24 choose to pass Device2 with priority. Route 110.1.1.0/24 also has two next hops, 40.1.1.1 and 39.1.1.1. The local-preference of the route with the next hop 40.1.1.1 has been changed to 200 so that the data that are targeted at the network segment 110.1.1.0/24 choose to pass Device3 with priority.

#Query the BGP routing information of Device4.

Device4#show ip bgp

BGP table version is 9, local router ID is 110.1.1.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 100.1.1.0/24 0.0.0.0 0 32768 i

[B]*> 110.1.1.0/24 0.0.0.0 0 32768 i

[B]* 120.1.1.0/24 4.0.0.1 10 0 100 i

[B]*> 3.0.0.1 0 0 100 i

[B]*> 130.1.1.0/24 4.0.0.1 0 0 100 i

[B]* 3.0.0.1 10 0 100 i

#Query the routing table of Device4.

Device4#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 120.1.1.0/24 [20/0] via 3.0.0.1, 03:05:39, gigabitethernet1

B 130.1.1.0/24 [20/0] via 4.0.0.1, 03:05:37, gigabitethernet2

According to the BGP routing table of Device4, route 120.1.1.0/24 has two next hops, 4.0.0.1 and 3.0.0.1. The metric of the route with the next hop 4.0.0.1 has been changed to 10 so that the data that are targeted at the network segment 120.1.1.0/24 choose to pass Device2 with priority. Route 130.1.1.0/24 also has two next hops, 4.0.0.1 and 3.0.0.1. The metric of the route with the next hop 3.0.0.1 has been changed to 10 so that the data that are targeted at the network segment 130.1.1.0/24 choose to pass Device3 with priority.

l If a routing policy is applied to a BGP peer or peer group, it can be applied in the receiving or advertisement direction of the BGP peer or peer group, and the settings take effect after BGP is reset.


1 IPv4 Multicast Basics


1.1 Overview

IPv4 multicast basics is the basis of running the IP multicast protocol and the common part of all multicast protocols. No matter which multicast route protocol runs, we first need to enable the IP multicast forwarding function so that the device can forward the multicast service packets.


1.2 Basic Function Configuration of IPv4 Multicast

Table 1‑1 Basic function configuration list of IPv4 multicast

Configuration Task
Enable IP multicast forwarding | Enable the IP multicast forwarding
 | Enable the IP multicast fast forwarding
Configure IP multicast forwarding rule | Configure the multicast forwarding management edge
 | Configure the regular detection of the multicast forwarding
 | Configure the multicast route table limitation
 | Configure the multicast interface TTL threshold


1.2.1 Enable IP Multicast Forwarding

IP multicast forwarding is the basic module of the multicast forwarding. The device can forward the IP multicast service packets only after enabling the IP multicast forwarding function. Both the general IP multicast forwarding and IP multicast fast forwarding are controlled by whether to enable the IP multicast forwarding.

IP multicast fast forwarding is one IPv4 fast multicast forwarding technology designed to improve the forwarding performance of the service packets. It completes the route selection and service processing for a time, so as to reduce the resource consumption caused by the switching between the internal tasks of the system and the packet cache management. At last, improve the data forwarding performance of the whole system.

Configuration Condition

Before configuring the IP multicast forwarding function, first complete the following task:

l Configure the IP address of the interface, making the neighboring node network layer reachable;

l Configure any unicast routing protocol, making the routes in the domain reachable;

l Configure any multicast routing protocol.

Enable IP Multicast Forwarding

The device can forward the IP multicast service packets only after enabling the IP multicast forwarding function.

Table 1‑2 Enable IP multicast forwarding

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable IP multicast forwarding | ip multicast-routing [ vrf vrf-name ] | Mandatory By default, the IP multicast forwarding is not enabled.

Enable IP Multicast Fast Forwarding

Enabling the IP multicast fast forwarding function can improve the multicast service forwarding capability of the device.

Table 1‑3 Enable the IP multicast fast forwarding

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the IP multicast fast forwarding | ip mroute-cache | Mandatory By default, the IP multicast fast forwarding is enabled.


1.2.2 Configure IP Multicast Forwarding Rule

Configuration Condition

Before configuring the IP multicast forwarding rule, first complete the following task:

l Configure interface IP address, making the neighboring node network layer reachable;

l Configure any unicast routing protocol, making the routes in the domain reachable;

l Enable IP multicast forwarding;

l Configure any multicast route protocol.

Configure Multicast Forwarding Management Edge

The multicast forwarding management edge mainly realizes the filtering for the multicast packets. After configuring the management edge, the device can filter the multicast service packets and only the multicast service permitted by ACL can pass.

Table 1‑4 Configure multicast forwarding management edge

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure multicast forwarding management edge | ip multicast boundary { access-list-number | access-list-name } | Mandatory By default, the multicast forwarding management edge is not configured.

Configure Regular Detection of Multicast Forwarding

After configuring the regular detection of the multicast forwarding and if the number of the specified forwarded multicast service packets in the unit time is smaller than the configured minimum number, print the alarm information.

Table 1‑4 Configure the regular detection of the multicast forwarding

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the regular detection of the multicast forwarding | ip multicast heartbeat group-ip-address source-ip-address minimum-packets interval-value [ vrf vrf-name ] | Mandatory By default, do not perform the regular detection of the multicast forwarding.

Configure Multicast Route Table Limitation

Configure the maximum quantity limitation of the multicast route table. After exceeding the maximum quantity limitation of the multicast route table, do not create new multicast route table any more.

Table 1‑5 Configure the multicast route table limitation

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the multicast route table limitation | ip multicast route-limit number-value [ vrf vrf-name ] | Optional By default, the maximum number of the multicast route table is 1024.

Configure TTL Threshold of Multicast Interface

After configuring the TTL threshold of the multicast ingress interface, only the multicast service packet whose TTL is larger than the threshold can be accepted, while the multicast packet whose TTL is smaller than or equal to the threshold is dropped.

After configuring the TTL threshold of the multicast egress interface, only the multicast service packet whose TTL minus 1 is still larger than the threshold can be forwarded, while the multicast packet whose TTL is smaller than or equal to the threshold is dropped.

Table 1‑6 Configure the TTL threshold of the multicast interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the TTL threshold of the multicast ingress interface | ip multicast in-threshold number-value | Optional By default, the TTL threshold of the multicast ingress interface is 0.
Configure the TTL threshold of the multicast egress interface | ip multicast out-threshold number-value | Optional By default, the TTL threshold of the multicast egress interface is 0.


1.2.3 Monitoring and Maintaining of IPv4 Multicast Basics

Table 1‑8 Monitoring and maintaining of IPv4 multicast basics

Command | Description
clear ip mcache [ source source-ip-addres s ] [ group group-ip-address ] [ all | vrf vrf-name ] | Clear the multicast route entry
show ip mcache [ source source-ip-address ] [ group group-ip-address ] [ vrf vrf-name ] | Display the multicast route table information
show ip mroute-cache [ source source-ip-address ] [ group group-ip-address ] [ all | vrf vrf-name ] | Display the multicast fast forwarding table information
show ip mvif [ vrf vrf-name ] | Display the multicast virtual interface information


2 IGMP


2.1 Overview

IGMP (Internet Group Management Protocol) is the protocol for managing the IP multicast members in the TCP/IP protocol stack, used to set up and maintain the multicast group member relation between the IP host and the direct neighboring multicast device.

IGMP has three versions. Currently, the widely-used is IGMPv2. IGMPv2 has three kinds of packets: query packet, group member relation report packet, and group member leave packet.

Query packet includes the general query packet and the specified group query packet. The device gets to know which members there are in the direct-connected network via the general query packets and whether there are the members of one specified group in the direct-connected network via the specified group query packets.

Group member relation report: When the host wants to add into one multicast group, the host immediately sends the group member relation report to the desired multicast group. When the host receives one query packet, it also sends the group member relation report.

Group member leave packet: When the host leaves one multicast group, send one group member leave report. When the device receives the group member leave packet, send the specified group query to confirm whether one specified group has members.


2.2 IGMP Function Configuration

Table 2–1 IGMP function configuration list

Configuration Task
Configure IGMP basic functions | Enable the IGMP protocol
 | Configure the IGMP version
 | Configure static group adding
 | Configure multicast group filter
 | Configure SSM multicast group filter
Adjust and optimize the IGMP network | Configure the query interval of the general group
 | Configure the robustness factor
 | Configure the maximum response time
 | Configure the specified group query
 | Configure the other querier timeout
 | Configure the fast leave
Configure the IGMP SSM mapping | Configure the IGMP SSM mapping
Configure the IGMP proxy | Configure the IGMP proxy


2.2.1 Configure IGMP Basic Functions

Configuration Condition

Before configuring the IGMP basic functions, first complete the following task:

l Configure the interface network layer address, making the neighboring node network layer reachable

Enable IGMP Protocol

Table 2–2 Enable the IGMP protocol

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enable the IP multicast forwarding | ip multicast-routing | Mandatory By default, the IP multicast forwarding is disabled.
Enter interface configuration mode | interface interface-name | -
Enable the IGMP protocol | ip pim sparse-mode | Mandatory By default, IGMP is disabled. When the interface enables the multicast route protocol, automatically enable IGMP. Only after enabling IGMP, all IGMP configurations can take effect.

Configure IGMP Version

Table 2–3 Configure the IGMP version

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the IGMP version | ip igmp version version-number | Mandatory By default, the IGMP version is 2.

l Because the packet structure and kind of different versions of IGMP protocols are different, it is suggested to configure the same version of IGMP for all devices on the same subnet.

Configure Static Group Adding

After configuring one static group or source group in the interface, the device regards that the interface has the receiver of the multicast group or source group.

Table 2–4 Configure static group adding

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the static group adding | ip igmp static-group group-ip-address [ source-ip-address ] | Mandatory By default, the interface is not added to any multicast group or source group in the static mode.

Configure Multicast Group Filter

The interface configured with the IGMP multicast group filter filters the group member relation report in the segment according to the ACL rules and only the group member relation report permitted by ACL is processed and the un-permitted is directly dropped. For the existing but not permitted by ACL multicast group, immediately delete the multicast group information.

Table 2–5 Configure multicast group filter

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the IGMP multicast group filter | ip igmp access-group { access-list-number | access-list-name } | Mandatory By default, the multicast group filter is not configured.

l ip igmp access-group Command only supports the standard ACL.

Configure SSM Multicast Group Filter

After configuring the range of the source groups received by IGMP, filter the received source group member relation report to limit the source group range the interface serves. For the groups belonging to the PIM-SSM range, only the IGMPv3 non (IS_EX, TO_EX) member relation report permitted by the access list (S, G ) can be accepted.

Table 2–6 Configure the SSM multicast group filter

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the SSM multicast group filter | ip igmp ssm-access-group { access-list-number | access-list-name } | Mandatory By default, do not filter to limit the SSM group members.

l ip igmp ssm-access-group can take effect only when the interface enables IGMPv3.

l ip igmp ssm-access-group takes effect only for the source groups in the PIM SSM range.

l ip igmp ssm-access-group only supports the extended ACL.


2.2.2 Adjust and Optimize IGMP Network

Configuration Condition

Before adjusting and optimizing the IGMP network, first complete the following task:

l Configure interface network layer address, making the neighboring node network layer reachable

l Enable the IGMP protocol

Configure Query Interval of General Group

IGMP querier periodically sends the general group query packets to maintain the group member relation. You can modify the interval of sending the IGMP general group query packets according to the actuality of the network.

Table 2–7 Configure the query interval of the general group

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the query interval of the general group | ip igmp query-interval interval-value | Optional By default, the interval of sending the IGMP general group query packets is 125s.

l The genera query intervals of the devices on the same segment should try to keep consistent.

l The general group query interval should be larger than the maximum response time. Otherwise, the configuration cannot succeed.

Configure Robustness Factor

Table 2–8 Configure robustness factor

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the robustness factor | ip igmp robustness-variable variable-value | Optional By default, the robustness factor of the IGMP querier is 2.

l After configuring the robustness factor, the following parameters also change with the robustness parameters:

l Group member timeout = Robustness factor * general group query time + maximum response time;

l Other querier timeout = Robustness factor * general group query time + maximum response time/2;

l The larger the robustness factor, the larger the IGMP group member timeout and other querier timeout. Set the value according to the actuality of the network.

Configure Maximum Response Time

The general group query packet sent by the IGMPv2 querier contains the maximum response time field and the receiver sends the group member relation report within the maximum response interval. If the receiver does not send the group member relation report within the maximum response time, the device regards that the subnet does not have the receiver of the multicast group and deletes the multicast group information immediately.

Table 2–9 Configure the maximum response time

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the maximum response time | ip igmp query-max-response-time seconds | Optional By default, the maximum response time of the IGMP general group query is 10s.

Configure Specified Group Query

After the IGMP querier receives the leave packet of one multicast group, send the specified group query packet to query the multicast group on the segment. The sending times of the packet depends on “Specified group query times”.This is to know whether the subnet has the members of the multicast group. If not receiving the member relation report of the multicast group after waiting for “maximum response time”, delete the information of the multicast group.

Table 2–10 Configure the specified group query

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the query interval of the specified group | ip igmp last-member-query-interval interval-value | Optional By default, the interval of sending the specified group query packets is 1s.
Configure the query times of the specified group | ip igmp last-member-query-count count-value | Optional By default, the times of sending the specified group query packets is 2.

l ip igmp last-member-query-interval and ip igmp last-member-query-count are invalid in IGMPv1, because the IGMPv1 host does not send leave packets when leaving one multicast group.

Configure Other Querier Timeout

The device with the smallest address in one subnet is elected as the querier and the other devices are called non-querier. On the non-queriers, set one timeout as the timer of “other querier timeout” (the other queriers have timer) for the querier. When the non-querier receives the query packet of the querier, refresh the timer. When the timer times out, it indicates that the current IGMP querier becomes invalid and you need to re-elect the querier.

Table 2–11 Configure the other querier timeout

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the other querier timeout | ip igmp query-timeout seconds | Optional By default, the other querier timeout is 255s.

l If the configure other querier timeout is smaller than the query interval, the querier in the network may change repeatedly.

Configure Fast Leave

The end segment in the network only connects to one host, which performs the switching action of the multicast group frequently. To reduce the leave delay, you can configure the fast leave of the multicast group on the device.

After configuring the fast leave, the device receives the leave packet of one multicast group and checks whether the multicast group belongs to the fast leave range. If yes, the device does not send the specified group query packet to the segment any more and deletes the information of the multicast group immediately.

Table 2–12 Configure the fast leave

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the multicast group range of the fast leave | ip igmp immediate-leave group-list { access-list-number | access-list-name } | Mandatory By default, do not permit the fast leave of the multicast group, applicable to IGMPv2.
Configure the source group range of the fast leave | ip igmp sg-immediate-leave sg-list { access-list-number | access-list-name } | Mandatory By default, do not permit the fast leave of the source group, applicable to IGMPv3.


2.2.3 Configure IGMP SSM Mapping

Configuration Conditions

Before configuring the IGMP SSM mapping, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable;

l Enable the IGMP protocol.

Configure IGMP SSM Mapping

To provide the PIM-SSM service for the receiver not supporting IGMPv3 in the PIM-SSM network, we can configure the IGMP SSM Mapping function on the device.

The user can configure the IGMP SSM Mapping rule according to the demand of the network receiver. The group member relation report permitted by the rule is converted to the IGMPv3 non-member (IS_EX, TO_EX) relation report, and the multicast source address is the source address specified by the IGMP SSM mapping rule.

Table 2‑13 Configure the IGMP SSM mapping

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the IGMP SSM Mapping | ip igmp ssm-map enable [ vrf vrf-name ] | Mandatory By default, do not enable the IGMP SSM Mapping.
Configure the IGMP SSM Mapping rule | ip igmp ssm-map static { access-list-number | access-list-name } source-ip-address [ vrf vrf-name ] | Mandatory By default, there is no IGMP SSM Mapping rule.

l The ip igmp ssm-map staticcommand only supports the standard ACL.


2.2.4 Configure IGMP Proxy

Configuration Conditions

Before configuring the IGMP proxy, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable;

l Enable the IGMP protocol.

Configure IGMP Proxy

IGMP proxy is the extension for the existing IGMP function. IGMP proxy function configures one interface of the device as the upstream interface of the IGMP proxy and the other interfaces as the downstream interfaces of the IGMP proxy. The upstream interface of the IGMP proxy serves as the IGMP host. IGMP proxy integrates the IGMP members learned by the downstream interface to form the IGMP proxy member database and the upstream interface of the IGMP proxy sends the IGMP report to the upstream IGMP querier according to the member status in the proxy member database.

Table 2‑14 Configure the IGMP proxy

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the IGMP proxy | ip igmp proxying | Mandatory By default, do not enable the IGMP proxy.


2.2.5 IGMP Monitoring and Maintaining

Table 2–15 IGMP monitoring and maintaining

Command | Description
clear ip igmpstat | Clear the statistics information of the IGMP protocol packets
clear ip igmp group [ group-ip-address ] [ interface-name ] [ vrf vrf-name ] | Clear the IGMP multicast group information
clear ip igmp proxy statistic [ vrf vrf-name ] | Clear the IGMP proxy statistics information
clear ip igmp statistic interface interface-name [ vrf vrf-name ] | Clear the IGMP packet statistics information on the interface
show ip igmp groups [ [ static ] | [ interface-name ] [ group-ip-address ] [ detail ] ] [ vrf vrf-name ] | Display the IGMP multicast group information
show ip igmp interface [ interface-name ] [ vrf vrf-name ] | Display the interface IGMP information
show ip igmp proxy { group | statistic } [ vrf vrf-name ] | Display the IGMP proxy information
show ip igmp statistic interface interface-name [ vrf vrf-name ] | Display the statistics information of the IGMP packets
show ip igmp ssm-map [ vrf vrf-name ] | Display the IGMP SSM Mapping information


2.3 IGMP Typical Configuration Example


2.3.1 Configure IGMP Basic Functions

Network Requirements

l The whole network runs the PIM-SM protocol.

l Device1, Device2, and Receiver are in the same LAN and Device1 is the querier.

l Receiver is one receiver of Device1 and Device2 stub network.

l Run IGMPv2 between Device1, Device2 and stub network.

Network Topology

Figure 2‑1 Networking of configuring IGMP basic functions

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the interface.

#Configure Device1.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device1(config)#configure terminal

Device1(config)#ip multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim sparse-mode

Device1(config-if-gigabitethernet1)#exit

#Configure Device2.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device2(config)#configure terminal

Device2(config)#ip multicast-routing

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim sparse-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim sparse-mode

Device2(config-if-gigabitethernet1)#exit

Step3:

Check the result.

#View the IGMP version information and querier election result of Device1 interface gigabitethernet1.

Device1#show ip igmp interface gigabitethernet 1

Interface gigabitethernet1 (Index 50331921)

IGMP Active, Querier (4.0.0.1)

Default version 2

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 4.0.0.1

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

#View the IGMP version information and querier election result of Device2 interface gigabitethernet1.

Device2#show ip igmp interface gigabitethernet 1

Interface gigabitethernet 1 (Index 50331921)

IGMP Active, Non-Querier (4.0.0.1, Expires: 00:02:15)

Default version 2

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 4.0.0.2

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds configged, and 10 seconds is adopted

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

# Receiver sends the IGMPv2 member report packet to add to multicast group 225.1.1.1.

#View the multicast member table of Device1.

Device1#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet1 00:21:02 00:03:47 4.0.0.100 stopped

#View the multicast member table of Device2.

Device2#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet1 00:21:02 00:03:47 4.0.0.100 stopped

l After configuring the multicast protocol on the interface, automatically enable the IGMP function and run the IGMPv2 by default. You can configure the running IGMP version of the interface via the command ip igmp version.

l When multiple devices run IGMP in one LAN, elect the IGMP querier and the one with the smallest address is elected as the IGMP querier of the LAN.


2.3.2 Configure IGMP Static Adding

Network Requirements

l The whole network runs the PIM-SM protocol.

l Receiver is one receiver of the Device stub network.

l Run IGMPv2 between Device and the stub network.

l Device interface gigabitethernet1 adds to multicast group 225.1.1.1 statically.

Network Topology

Figure 2‑2 Networking of configuring IGMP static adding

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the interface.

#Configure Device.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device(config)#configure terminal

Device(config)#ip multicast-routing

Device(config)#interface gigabitethernet0

Device(config-if-gigabitethernet0)#ip pim sparse-mode

Device(config-if-gigabitethernet0)#exit

Device(config)#interface gigabitethernet1

Device(config-if-gigabitethernet1)#ip pim sparse-mode

Device(config-if-gigabitethernet1)#exit

#View the IGMP information of Device interface gigabitethernet1.

Device#show ip igmp interface gigabitethernet 1

Interface gigabitethernet1 (Index 50331921)

IGMP Active, Querier (3.0.0.1)

Default version 2

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 3.0.0.1

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

Step 3:

Device interface gigabitethernet 1 adds to multicast group 225.1.1.1 statically.

#Configure Device.

Device interface gigabitethernet 1 adds to multicast group 225.1.1.1 statically.

Device(config)#interface gigabitethernet1

Device(config-if-gigabitethernet1)#ip igmp static-group 225.1.1.1

Device(config-if-gigabitethernet1)#exit

Step 4:

Check the result.

#Source sends the multicast packet with multicast group 225.1.1.1.

#View the multicast member table of Device.

Device#show ip igmp groups

IGMP Static Group Membership

Total 1 static groups

Group Address Source Address Interface

225.1.1.1 0.0.0.0 gigabitethernet1

#View the PIM-SM multicast route table of Device.

Device#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 1 (*,G) entry

Total 1 (S,G) entry

Total 1 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(*, 225.1.1.1)

Up time: 00:08:12

RP: 0.0.0.0

RPF nbr: 0.0.0.0

RPF idx: None

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet1

Joined interface list:

Asserted interface list:

(192.168.1.1, 225.1.1.1)

Up time: 00:07:24

KAT time: 00:02:22

RPF nbr: 0.0.0.0

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

COULD REGISTER

Upstream State: JOINED

Local interface list:

Joined interface list:

register_vif0

Asserted interface list:

Outgoing interface list:

register_vif0

gigabitethernet1

Packet count 8646421

(192.168.1.1, 225.1.1.1, rpt)

Up time: 00:07:24

RP: 0.0.0.0

Flags:

RPT JOIN DESIRED

RPF SGRPT XG EQUAL

Upstream State: NOT PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

gigabitethernet1

#Receiver can receive the multicast packet with multicast group 225.1.1.1 sent by Source.


2.3.3 Configure IGMP SSM Mapping

Network Requirements

l The whole network runs the PIM-SM protocol.

l Receiver1, Receiver2, Receiver3, and Device2 are all in one LAN.

l Run IGMPv3 between Device2 and the stub network.

l Use the IGMP SSM mapping on Device2 so that Receiver2 and Receiver3 can only receive the multicast service packets sent by Source1.

Network Topology

Figure 2-3 Networking of configuring the IGMP SSM mapping

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Enable the unicast routing OSPF so that all network devices in the network can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 192.168.1.0 0.0.0.255 area 0

Device1(config-ospf)#network 192.168.2.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#View the route table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 2.0.0.0/24 is directly connected, 00:16:05, gigabitethernet0

C 3.0.0.0/24 is directly connected, 00:06:36, gigabitethernet1

O 192.168.1.0/24 [110/2] via 2.0.0.1, 00:15:17, gigabitethernet0

O 192.168.2.0/24 [110/2] via 2.0.0.1, 00:00:51, gigabitethernet0

l The viewing method of Device1 is the same as that of Device2, so the viewing process is omitted.

Step 3:

Enable the multicast forwarding globally, configure PIM-SSM globally and the multicast group range of the SSM service is 232.0.0.0/8. On the interfaces, enable the multicast protocol PIM-SM. The interface gigabitethernet1 of Device2 runs IGMPv3.

#Configure Device1.

Enable the multicast forwarding globally, configure the PIM-SSM globally and enable the multicast protocol PIM-SM on the interface.

Device1(config)#ip multicast-routing

Device1(config)#ip pim ssm default

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim sparse-mode

Device1(config-if-gigabitethernet1)#exit

Device1(config)#interface gigabitethernet2

Device1(config-if-gigabitethernet2)#ip pim sparse-mode

Device1(config-if-gigabitethernet2)#exit

#Configure Device2.

Enable the multicast forwarding globally, configure the PIM-SSM globally, and enable the multicast protocol PIM-SM on the interface. The interface gigabitethernet1 runs IGMPv3.

Device2(config)#ip multicast-routing

Device2(config)#ip pim ssm default

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim sparse-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim sparse-mode

Device2(config-if-gigabitethernet1)#ip igmp version 3

Device2(config-if-gigabitethernet1)#exit

#View the IGMP information of the interface gigabitethernet1 on Device2.

Device2#show ip igmp interface gigabitethernet1

Interface gigabitethernet1 (Index 50331921)

IGMP Enabled, Active, Querier (3.0.0.1)

Configured for version 3

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 3.0.0.1

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

Step 4:

Enable the IGMP SSM mapping on Device2 and configure the IGMP SSM mapping rule so that Receiver2 and Receiver3 can only receive the multicast service packets sent by Source1.

#Configure Device2.

Enable the IGMP SSM mapping, configure the multicast group range of the IGMP SSM as 232.0.0.0~232.0.0.255, and the multicast source address is 192.168.1.1.

Device2(config)#ip access-list standard 1

Device2(config-std-nacl)#permit 232.0.0.0 0.0.0.255

Device2(config-std-nacl)#exit

Device2(config)#ip igmp ssm-map enable

Device2(config)#ip igmp ssm-map static 1 192.168.1.1

#View the IGMP SSM mapping rule of Device2.

Device2#show ip igmp ssm-map

IGMP SSM-MAP Information : enable

acl-name source-addr

--------------------------

1 192.168.1.1

Step 5:

Check the result.

# Receiver1 sends the IGMPv3 member report packet of the specified source group to add to the multicast group 232.1.1.1 and the specified multicast source is 192.168.2.1; Receiver2 sends the IGMPv2 member report packet to add to the multicast group 232.1.1.2; Receiver3 sends the IGMPv1 member report packet to add to multicast group 232.1.1.3.

#Source1 and Source2 both send the multicast service packets with multicast groups 232.1.1.1, 232.1.1.2, and 232.1.1.3.

#View the multicast member table.

Device2#show ip igmp groups

IGMP Connected Group Membership

Total 3 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

232.1.1.1 gigabitethernet1 01:28:45 stopped 3.0.0.2 stopped stopped

232.1.1.2 gigabitethernet1 01:29:01 stopped 3.0.0.3 stopped stopped

232.1.1.3 gigabitethernet1 01:29:16 stopped 3.0.0.4 stopped stopped

Device2#show ip igmp groups detail

Interface: gigabitethernet1

Group: 232.1.1.1

Uptime: 01:30:44

Group mode: Include

Last reporter: 3.0.0.2

TIB-A Count: 1

TIB-B Count: 0

Group source list: (R - Remote, M - SSM Mapping)

Source Address Uptime v3 Exp M Exp Fwd Flags

192.168.2.1 01:30:44 00:03:39 stopped Yes R

Interface: gigabitethernet1

Group: 232.1.1.2

Uptime: 01:31:00

Group mode: Include

Last reporter: 3.0.0.3

TIB-A Count: 1

TIB-B Count: 0

Group source list: (R - Remote, M - SSM Mapping)

Source Address Uptime v3 Exp M Exp Fwd Flags

192.168.1.1 01:31:00 stopped 00:03:38 Yes M

Interface: gigabitethernet1

Group: 232.1.1.3

Uptime: 01:31:15

Group mode: Include

Last reporter: 3.0.0.4

TIB-A Count: 1

TIB-B Count: 0

Group source list: (R - Remote, M - SSM Mapping)

Source Address Uptime v3 Exp M Exp Fwd Flags

192.168.1.1 01:31:15 stopped 00:03:42 Yes M

#View the PIM-SM multicast route table of Device2.

Device2#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 0 (*,G) entry

Total 3 (S,G) entries

Total 0 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(192.168.2.1, 232.1.1.1)

Up time: 01:32:51

KAT time: 00:03:24

RPF nbr: 2.0.0.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet1

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 19868613

(192.168.1.1, 232.1.1.2)

Up time: 01:33:07

KAT time: 00:03:24

RPF nbr: 2.0.0.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet1

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 19873645

(192.168.1.1, 232.1.1.3)

Up time: 01:33:22

KAT time: 00:03:24

RPF nbr: 2.0.0.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet1

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 19873645

# Receiver1 can only receive the multicast service packets sent by Source2; Receiver2 and Receiver3 can only receive the multicast service packets sent by Source1.

l The viewing method of Device1 is the same as that of Device2, so the viewing process is omitted.

l IGMP SSM mapping needs to be used with PIM-SSM; the multicast group range in the IGMP SSM mapping rule should belong to the PIM-SSM multicast group range. IGMP SSM mapping mainly runs IGMPv1 or IGMPv2 and cannot be upgraded to the receiver host of IGMPv3 to provide the supporting for the SSM model.

l The IGMP SSM mapping is invalid for the IGMPv3 member report packet.


2.3.4 Configure IGMP Multicast Group Filter

Network Requirements

l The whole network runs the PIM-SM protocol.

l Receiver is one receiver of the Device stub network.

l Run IGMPv2 between Device and the stub network.

l Device interface vlan3 filters the multicast group; the range of the multicast groups Receiver is permitted to add is 225.1.1.0-225.1.1.255.

Network Topology

Figure 2‑4 Networking of configuring IGMP multicast group filter

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the interface.

#Configure Device.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device(config)#configure terminal

Device(config)#ip multicast-routing

Device(config)#interface gigabitethernet0

Device(config-if-gigabitethernet0)#ip pim sparse-mode

Device(config-if-gigabitethernet0)#exit

Device(config)#interface gigabitethernet1

Device(config-if-gigabitethernet1)#ip pim sparse-mode

Device(config-if-gigabitethernet1)#exit

#View the IGMP information of Device interface gigabitethernet1.

Device#show ip igmp interface gigabitethernet 1

Interface gigabitethernet1 (Index 50331921)

IGMP Enabled, Active, Querier (3.0.0.1)

Default version 2

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 3.0.0.1

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

Step 3:

Configure the multicast group filter on Device interface gigabitethernet1.

#Configure Device.

Configure the multicast group filter on Device interface gigabitethernet1; the range of the multicast groups Receiver is permitted to add is 225.1.1.0-225.1.1.255.

Device(config)#ip access-list standard 1

Device(config-std-nacl)#permit 225.1.1.0 0.0.0.255

Device(config-std-nacl)#exit

Device(config)#interface gigabitethernet1

Device(config-if-gigabitethernet1)#ip igmp access-group 1

Device(config-if-gigabitethernet1)#exit

Step4:

Check the result.

#Receiver sends the IGMPv2 member report packet to add to multicast group 225.1.1.1 and 226.1.1.1.

#Source sends the multicast packets with multicast group 225.1.1.1 and 226.1.1.1.

#View the multicast member table of Device.

Device#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet1 03:14:59 00:03:05 3.0.0.2 stopped

#View the PIM-SM multicast route table of Device.

Device#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 1 (*,G) entry

Total 2 (S,G) entries

Total 2 (S,G,rpt) entries

Total 0 FCR entry

Up timer/Expiry timer

(*, 225.1.1.1)

Up time: 00:00:56

RP: 0.0.0.0

RPF nbr: 0.0.0.0

RPF idx: None

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet1

Joined interface list:

Asserted interface list:

(192.168.1.1, 225.1.1.1)

Up time: 00:00:15

KAT time: 00:03:15

RPF nbr: 0.0.0.0

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

COULD REGISTER

Upstream State: JOINED

Local interface list:

Joined interface list:

register_vif0

Asserted interface list:

Outgoing interface list:

register_vif0

gigabitethernet1

Packet count 1

(192.168.1.1, 225.1.1.1, rpt)

Up time: 00:00:15

RP: 0.0.0.0

Flags:

RPT JOIN DESIRED

RPF SGRPT XG EQUAL

Upstream State: NOT PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

gigabitethernet1

(192.168.1.1, 226.1.1.1)

Up time: 00:00:15

KAT time: 00:03:15

RPF nbr: 0.0.0.0

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

COULD REGISTER

Upstream State: JOINED

Local interface list:

Joined interface list:

register_vif0

Asserted interface list:

Outgoing interface list:

register_vif0

Packet count 1

(192.168.1.1, 226.1.1.1, rpt)

Up time: 00:00:15

RP: 0.0.0.0

Flags:

RPF SGRPT XG EQUAL

Upstream State: RPT NOT JOINED

Local interface list:

Pruned interface list:

Outgoing interface list:

#Receiver can only receive the multicast service packets with multicast group 225.1.1.1 sent by Source.

l To filter based on multicast source group, use the command ip igmp ssm-access-group to realize. When using the command, it is required that the device runs PIM-SSM and the interface runs IGMPv3.


2.3.5 Configure IGMP Proxying

Network Requirements

l Device1 runs the PIM-SM protocol.

l Receiver is one receiver of the Device2 stub network.

l Run IGMPv2 between Device2 and the stub network.

l Device2 is the IGMP Proxying device; the IGMP member report packet of Receiver is sent to Device1 via the IGMP Proxying interface of Device2, so as to forward the multicast service packets.

Network Topology

Figure 2-4 Networking of configuring IGMP proxying

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Enable the unicast routing protocol OSPF so that let all network devices in the network can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#View the route table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:40:53, gigabitethernet0

C 2.0.0.0/24 is directly connected, 00:04:58, gigabitethernet1

O 10.0.0.0/24 [110/2] via 1.0.0.1, 00:02:59, gigabitethernet0

l The viewing method of Device1 is the same as that of Device2, so the viewing process is omitted.

Step 3:

Enable the multicast forwarding globally and enable the multicast protocol PIM-SM on the interface.

#Configure Device1.

Enable the multicast forwarding globally and enable the multicast protocol PIM-SM on the interface.

Device1(config)#ip multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim sparse-mode

Device1(config-if-gigabitethernet1)#exit

#Configure Device2.

Enable the multicast forwarding globally and enable the passive mode of the multicast protocol PIM-SM on the interface.

Device2(config)#ip multicast-routing

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim sparse-mode passive

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim sparse-mode passive

Device2(config-if-gigabitethernet1)#exit

#View the IGMP information of the interface gigabitethernet1 on Device2.

Device2#show ip igmp interface gigabitethernet 1

Interface gigabitethernet1 (Index 5)

IGMP Active, Querier (2.0.0.1)

Default version 2

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 2.0.0.1

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

#View the PIM-SM neighbor information of Device2.

Device2#show ip pim neighbor

PIM Neighbor Table:

PIM VRF Name: Default

Total 0 Neighbor entry

l The viewing method of Device1 is the same as that of Device2, so the viewing process is omitted.

l After configuring the multicast protocol on the interface, automatically enable the IGMP function; after enabling the passive mode of the multicast protocol PIM-SM or PIM-DM on the interface, the interface can receive and send the IGMP protocol packets normally, and but cannot receive or send the PIM-SM or PIM-DM protocol packets.

Step 4:

Configure IGMP Proxying.

#Configure Device2.

Configure IGMP Proxying on gigabitethernet0 of Device2.

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip igmp proxying

Device2(config-if-gigabitethernet0)#exit

Step 5:

Check the result.

#Receiver sends the IGMPv2 member report packet to add to the multicast group 225.1.1.1.

#Source sends the multicast service packets with the multicast group 225.1.1.1.

#View the multicast member table on Device2.

Device2#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet1 00:00:02 00:04:18 2.0.0.2 stopped

#View the IGMP Proxying multicast member table of Device2.

Device2#show ip igmp proxy group

IGMP Proxy Information:

Upstream Interface: gigabitethernet0

Upstream Interface Compatible Mode: IGMPv2

IGMP Proxy Group Membership:

Total 1 Group Memberships

--------------------------------

225.1.1.1

#View the IGMP Proxying statistics information of Device2.

Device2#show ip igmp proxy statistic

IGMP Proxy Report Statistic:

IGMPv1 Group Member Report Count: 0

IGMPv2 Group Member Report Count: 3

IGMPv2 Leave Group Report Count: 0

#View the multicast member table on Device1.

Device1#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet1 00:00:02 00:04:18 1.0.0.2 stopped

We can see that there is the information of multicast group 225.1.1.1 in the multicast member table of Device1, indicating that the IGMP member report packet of Receiver is send to Device1 via the IGMP Proxying interface of Device2.

# Receiver can receive the multicast service packet of multicast group 225.1.1.1 sent by Source.


3 PIM-DM


3.1 Overview

PIM-DM (Protocol Independent Multicast-Dense Mode) is applicable when the group members are relatively concentrated and the range is small, or the network bandwidth resource is sufficient.

PIM-DM does not depend on the specified unicast route protocol for the RPF check.

PIM-DM adopts the “Push” to transmit the multicast packets. When the multicast source starts to send the multicast packets, suppose that all subnets in the multicast domain have the multicast receivers, so the multicast packets are pushed to all nodes in the network. PIM-DM forwards and prunes the multicast without the receiver. When the node of the pruned multicast forwarding branch node has the receiver of the multicast source, PIM-DM uses the graft mechanism to actively restore the forwarding of the multicast data.

PIM-DM uses the status refresh mechanism to refresh the downstream status regularly so that the pruned branch does not time out.


3.2 PIM-DM Function Configuration

Table 3‑1 PIM-DM function configuration list

Configuration Task
Configure PIM-DM basic functions | Configure the PIM-DM protocol
Configure the PIM-DM neighbor | Configure the period of sending the HELLO packets
 | Configure PIM-DM neighbor keepalive time
 | Configure PIM-DM neighbor filter
Configure the status refresh parameters | Configure PIM-DM status refresh interval


3.2.1 Configure PIM-DM Basic Functions

Configuration Condition

Before configuring PIM-DM, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, realizing the intra-domain route reachable

Configure PIM-DM Protocol

Table 3‑2 Configure the PIM-DM protocol

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enable the IP multicast forwarding | ip multicast-routing | Mandatory By default, do not enable the IP multicast forwarding.
Enter interface configuration mode | interface interface-name | -
Enable the PIM-DM protocol. | ip pim dense-mode | Either By default, PIM-DM is disabled on the interface.
 | ip pim dense-mode passive

l After enabling the PIM-DM function, all PIM-DM configurations can take effect.


3.2.2 Configure PIM-DM Neighbor

Configuration Condition

Before configuring the PIM-DM neighbor, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, realizing intra-domain route reachable

l Enable the PIM-DM protocol

Configure Sending Period of HELLO Packets

The interface enabled with the PIM-DM protocol periodically sends the Hello packets to set up and maintain the PIM-DM neighbor.

Table 3‑3 Configure the period of sending HELLO packets

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the period of sending the Hello packets | ip pim dense-mode hello-interval interval-value | Optional By default, the period of sending the Hello packets is 30s.

Configure PIM-DM Neighbor Keepalive Time

When the interface receives the Hello packets of one neighbor, record the holdtime carried in the Hello packet as the keepalive time of the neighbor. If not receiving the Hello packet of the neighbor within the keepalive time, it is regarded that the neighbor becomes invalid.

Table 3‑4 Configure PIM-DM neighbor keepalive time

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the keepalive time of the PIM-DM neighbor | ip pim dense-mode hello-holdtime holdtime-value | Optional By default, the keepalive time of the PIM-DM neighbor is 105s.

Configure PIM-DM Neighbor Filter

To save the system resources, you can use the neighbor filter function to set up the neighbor selectively, so as to save the resources of the device.

Table 3‑5Configure the PIM-DM neighbor filter

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the PIM-DM neighbor filter | ip pim dense-mode neighbor-filter { access-list-number | access-list-name } | Optional By default, do not enable the PIM-DM neighbor filter function.


3.2.3 Configure Status Refresh Parameters

Configuration Condition

Before configuring the PIM-DM status refresh parameters, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, realizing intra-domain route reachable

l Enable the PIM-DM protocol

Configure PIM-DM Status Refresh Interval

To prevent the pruned branches from timing out, the devices directly connected to the multicast source periodically send the (S, G) status refresh packet. The packet is forwarded along the initial forwarding path of the PIM-DM hop by hop, so as to refresh the pruning timer status of all devices on the pruned branches.

Table 3‑6 Configure the PIM-DM status refresh interval

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the PIM-DM status refresh interval | ip pim dense-mode state-refresh origination-interval interval-value | Optional By default, the PIM-DM status refresh interval is 60s.


3.2.4 PIM-DM Monitoring and Maintaining

Table 3‑7 PIM-DM monitoring and maintaining

Command | Description
clear ip pim dense-mode mroute [ group-address source-address ] [ vrf vrf-name ] | Clear the PIM-DM multicast route information.
show ip pim dense-mode interface [ detail ] [ vrf vrf-name ] | Display the PIM-DM interface information
show ip pim dense-mode neighbor [ detail ] [ vrf vrf-name ] | Display the PIM-DM neighbor information
show ip pim dense-mode nexthop [ source-ip-address ] [ vrf vrf-name ] | Display the unicast next-hop information from PIM-DM to source
show ip pim dense-mode mroute [ [ group group-ip-address [ source source-ip-address ] ] | [ source source-ip-address group group-ip-address ] ] [ vrf vrf-name ] | Display the route table information of the PIM-DM protocol


3.3 PIM-DM Typical Configuration Example


3.3.1 Configure PIM-DM Basic Functions

Network Requirements

l The whole network enables the PIM-DM protocol.

l Receiver is one receiver of the Device2 stub network.

l Run IGMPv2 between Device2 and the stub network.

Network Topology

Figure 3-1 Networking of configuring the PIM-DM basic functions

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Enable the unicast route protocol OSPF so that all devices in the network can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 192.168.1.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#View the route table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:49:46, gigabitethernet0

C 2.0.0.0/24 is directly connected, 01:06:17, gigabitethernet1

O 192.168.1.0/24 [110/2] via 1.0.0.1, 00:01:19, gigabitethernet0

l The method of viewing the route table of Device1 is the same as that of Device2.

Step 3:

Globally enable the multicast forwarding and enable the multicast protocol PIM-DM on the interface.

#Configure Device1.

Globally enable the multicast forwarding and enable the multicast protocol PIM-DM on the interface.

Device1(config)#ip multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim dense-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim dense-mode

Device1(config-if-gigabitethernet1)#exit

#Configure Device2.

Globally enable the multicast forwarding and enable the multicast protocol PIM-DM on the interface.

Device2(config)#ip multicast-routing

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim dense-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim dense-mode

Device2(config-if-gigabitethernet1)#exit

#View the information of the interface enabled with the PIM-DM protocol on Device2 and the PIM-DM neighbor information.

Device2#show ip pim dense-mode interface

Total 2 Interface entries

Total 0 External Interface entry

Total 0 Sparse-Dense Mode Interface entry

Address Interface VIF Ver/ Nbr VIF

Index Mode Count Flag

1.0.0.2 gigabitethernet0 0 v2/D 1 UP

2.0.0.1 gigabitethernet1 1 v2/D 0 UP

Device2#show ip pim dense-mode neighbor

PIM Dense-mode Neighbor Table:

PIM Dense-mode VRF Name: Default

Total 1 Neighbor entries

Neighbor-Address Interface Uptime/Expires Ver

1.0.0.1 gigabitethernet0 00:10:42/00:01:36 v2

#View the IGMP information of interface gigabitethernet1 of Device2.

Device2#show ip igmp interface gigabitethernet1

Interface gigabitethernet1 (Index 4)

IGMP Active, Querier (2.0.0.1)

Default version 2

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 2.0.0.1

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

l The method of viewing the Device1 information is the same as that of Device2.

l After configuring the multicast protocol on the interface, automatically enable the IGMP function and run IGMPv2 by default. You can configure the running IGMP version on the interface by executing the ip igmp version command.

Step 4:

Check the result.

#Receiver sends the IGMPv2 member report packet to add to multicast group 225.1.1.1.

#Source sends the multicast packets with multicast group 225.1.1.1.

#View the multicast member table of Device2.

Device2#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet1 00:15:07 00:02:09 2.0.0.2 stopped

#View the PIM-DM multicast route table of Device2.

Device2#show ip pim dense-mode mroute

PIM-DM Multicast Routing Table

Total 1 mroute entry

(192.168.1.1, 225.1.1.1)

Expire in: 00:03:24

RPF Neighbor: 1.0.0.1, Nexthop: 1.0.0.1, gigabitethernet0

Upstream IF: gigabitethernet0

Upstream State: Forwarding

Assert State: Loser

Downstream IF List:

gigabitethernet1, in 'olist':

Downstream State: NoInfo

Assert State: NoInfo

#Receiver can receive the multicast packets with the multicast group 225.1.1.1 sent by Source.

l The method of viewing the Device1 information is the same as that of Device2.


4 PIM-SM


4.1 Overview

PIM-SM (Protocol Independent Multicast, Sparse Mode) is applicable when the group members are relatively dispersive and their range is relatively broad or the network bandwidth resource is relatively limited.

PIM-SM does not depend on any particular unicast route protocol. The device announces the multicast information to all PIM-SM routers by actively sending the packets to request to set up multicast distributing tree (MDT) and set RP (Rendezvous Point) and BSR (Bootstrap Router). When the receiver adds to one multicast group, the receiving end DR (Designated Router) sends the PIM adding packet to RP, constructing the sharing tree-RPT with RP as root, while the source DR registers the multicast source to RP, constructing the source tree with the multicast source as root. The multicast service packets are transmitted to the receiver along the source tree and sharing tree; the receiving end DR sends the PIM adding packet to the multicast source. At last, switch from RPT to source-based SPT (Shortest-path Tree), so as to reduce the network delay.

PIM SSM is short for Protocol Independent Multicast ---- Source Specific Multicast. PIM-SSM is the subset of the PIM-SM protocol and should run on the basis of PIM-SM. The PIM-SSM protocol set the IPv4 address 232.0.0.0-232.255.255.255 to be reserved for SSM. PIM-SSM should work with IGMPv3, because IGMPv3 can send the IGMP membership report packet of the specified source and group.


4.2 PIM-SM Function Configuration

Table 4–1 PIM-SM function configuration list

Configuration Task
Configure the PIM-SM basic functions | Enable the PIM-SM protocol
Configure the PIM-SM aggregation router | Configure C-RP
 | Configure static RP
Configure the PIM-SM bootstrap router | Configure C-BSR
 | Configure the BSR edge
Configure PIM-SM multicast source registration | Configure the RP reachability check
 | Configure the sending rate of the register packets
 | Configure sending rate of the register stop packets
 | Configure the source address of the register packet
 | Configure register packet filter
Configure PIM-SM neighbor parameters | Configure the period of sending the Hello packets
 | Configure the keepalive time of the neighbor
 | Configure the neighbor filter
 | Configure the DR priority
Configure PIM-SM SPT switching | Configure the SPT switching condition
Configure PIM-SSM | Configure PIM-SSM
Configure the PIM adaptive basic function | Configure the PIM adaptive basic function


4.2.1 Configure PIM-SM Basic Functions

Configuration Conditions

Before configuring PIM-SM, first complete the following task:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

Enable PIM-SM Protocol

Table 4–2 Enable the PIM-SM protocol

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enable the IP multicast forwarding | ip multicast-routing [ vrf vrf-name ] | Mandatory By default, the IP multicast forwarding is not enabled.
Enter interface configuration mode | interface interface-name | -
Enable the PIM-SM protocol | ip pim sparse-mode | Either By default, PIM-SM is disabled on the interface.
 | ip pim sparse-mode passive

l After enabling the PIM-SM protocol, automatically enable the IGMP protocol.

l After enabling the PIM-SM function, all PIM-SM configurations can take effect.


4.2.2 Configure PIM-SM Aggregation Router

Configuration Condition

Before configuring RP, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

l Enable the PIM-SM protocol

Configure C-RP

RP is generated by the C-RO election. After BSR is elected, all C-RPs (Candidate-Rendezvous Point) regularly unicast the C-RP packet to BSR. BSR integrates the C-RP information and transmits the information to all devices in the PIM-SM domain via the bootstrap packet.

Table 4–3 Configure C-RP

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure C-RP | ip pim rp-candidate interface-name [ [ priority-value [ interval-value [ group-list { access-list-number | access-list-name } ] ] ] | [ group-list { access-list-number | access-list-name } ] ] [ vrf vrf-name ] | Mandatory By default, there is no C-RP.

l RP election rules:

l For the group range of the C-RP service, perform the longest matching of the mask.

l If the longest matching of the mask has multiple C-RPs, compare the C-RP priority. The smaller the value, the high the priority. The one with highest priority wins.

l If there are multiple C-RPs with highest priority, perform the HASH calculation for the C-RP address and group. The one with the largest HASH value wins.

l If there are multiple RPs with the largest HASH, the C-RP with the largest IP address wins.

Configure Static RP

For the simple PIM-SM network, it is suggested to use the static RP. If using the static RP, do not need to perform the BSR configuration, eliminating the frequent interacting between RP and BSR, so as to save the network bandwidth.

Table 4–4 Configure static RP

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the static RP | ip pim rp-address ip-address [ access-list-name | access-list-number ] [ override ] [ vrf vrf-name ] | Mandatory By default, there is no static RP.

l All devices in the same PIM-SM domain should be configured with the same static RP.


4.2.3 Configure PIM-SM Bootstrap Router

Configuration Conditions

Before configuring BSR, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

l Enable the PIM-SM protocol

Configure C-BSR

In one PIM-SM domain, there should be the unique BSR. Multiple C-BSRs (Candidate-Bootstrap Router) elects to generate the unique BSR via the bootstrap packet.

Table 4–5 Configure C-BSR

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure C-BSR | ip pim bsr-candidate interface_name [ hash-mask-length [ priority-value ] ] [ vrf vrf-name ] | Mandatory By default, there is no C-BSR.

l BSR election rules:

l Compare the priorities. The larger the value, the higher the priority. The one with highest priority wins.

l If the priority is the same, the one with the largest IP address wins.

Configure BSR Border

BSR is responsible for collecting the C-RP information and transmits the information to all devices in the PIM-SM domain via the bootstrap packet. The BSR range is the range of the multicast domain. The bootstrap packet cannot pass the interface configured with the BSR border. The devices out of the multicast domain range cannot take part in the forwarding of the multicast service packet in the multicast domain, so as to realize the dividing of the multicast domain.

Table 4–6 Configure the BSR border

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the BSR border | ip pim bsr-border | Mandatory By default, there is no multicast border.


4.2.4 Configure PIM-SM Multicast Source Register

Configuration Condition

Before configuring the multicast source register, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

l Enable the PIM-SM protocol

Configure RP Reachability Check

Before source DR sends the register packet to RP, first perform the RP reachability check. If finding that the RP route is not reachable, do not register to RP, so as to reduce the cost of the DR.

Table 4–7 Configure the RP reachability check

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the RP reachability check | ip pim register-rp-reachability [ vrf vrf-name ] | Mandatory By default, before performing the PIM register, do not check the RP reachability.

l To reduce the cost of the source DR, it is suggested to configure the command on the source DRs of all PIM-SMs.

Configure Sending Rate of Register Packets

When the source DR receives the multicast packet, encapsulate the multicast packet to the register packet and send to RP for source register until the registration is complete..

When the source DR does not complete the multicast source register and the multicast flow is large, generate lots of register packets, which increase the load of the RP device. Even RP cannot work normally. Source DR does not need to transmit all register packets of one flow to RP, so configuring the rate of sending the register packets at the source DR not only can reach the purpose of source registration, but also can reduce the RP load.

Table 4–8 Configure the rate of sending the register packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the rate of sending the register packet | ip pim register-rate-limit rate-limit-value [ vrf vrf-name ] | Mandatory By default, do not limit the rate of sending the register packet.

l To reduce the RP load, it is suggested to configure the rate of sending the source resgiter packets on all source DRs.

Configure Sending Rate of Register Stop Packets

After RP receives the register packet of the source DR, send the register stop packet to the source DR to complete the registration. When the RP receives lots of register packets, it is necessary to reply all register packets (send register stop packet). In fact, there are lots of repeated packets in the register stop packets. You can limit the rate of sending the register stop packet on RP to reduce the cost of RP.

Table 4–9 Configure the rate of sending the register stop packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the rate of sending the register stop packet | ip pim register-stop-rate-limit rate-limit-value [ vrf vrf-name ] | Mandatory By default, do not limit the rate of sending the register stop packet.

l To improve the robustness of the whole PIM-SM network, it is suggested to limit the rate of the source register stop packet on all RPs.

Configure Source Address of Register Packet

When the source DR performs the source register, the source address of the register packet uses the IP address of the register interface automatically registered by the system. The command can specify the source address of the register packet as the IP address of one interface on the device to meet some special demand of the network.

Table 4–10 Configure the source address of the register packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the source address of the register packet | ip pim register-source interface interface-name [ vrf vrf-name ] | Mandatory By default, use IP address of the register interface automatically registered by the system as the source address of the register packet.

Configure Register Packet Filter

To prevent the source register attack, you can use ACL on RP to perform the multicast source filter for the register packet. Only the multicast source permitted by ACL can register successfully on RP.

Table 4–11 Configure the register packet filter

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the register packet filter | ip pim accept-register list { access-list-number | access-list-name } [ vrf vrf-name ] | Mandatory By default, do not filter the register packet.


4.2.5 Configure PIM-SM Neighbor Parameters

Configuration Condition

Before configuring the PIM-SM neighbor parameters, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

l Enable the PIM-SM protocol

Configure Sending Period of Hello Packets

The interface enabled with the PIM protocol periodically sends the Hello packets to set up and maintain the PIM neighbor.

Table 4–12 Configure the period of sending the Hello packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the period of sending the Hello packet | ip pim hello-interval interval-value | Optional By default, the period of sending the Hello packet is 30s.

Configure Neighbor Keepalive Time

When the interface receives the Hello packets of one neighbor, record the holdtime carried in the Hello packet as the keepalive time of the neighbor. If not receiving the Hello packet of the neighbor within the keepalive time, it is regarded that the neighbor becomes invalid.

Table 4–13 Configure PIM-SM neighbor keepalive time

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure PIM-SM neighbor keepalive time | ip pim hello-holdtime holdtime-value | Optional By default, the keepalive time of the PIM-SM neighbor is 105s.

Configure Neighbor Filter

If there are many PIM neighbors in one subnet, you can use the neighbor filter function to set up the neighbor selectively, so as to save the resources of the device.

Table 4–14 Configure the neighbor filter

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the neighbor filter | ip pim neighbor-filter { access-list-number | access-list-name } | Mandatory By default, do not enable the neighbor filter function.

Configure DR Priority

DR plays one important role in the PIM-SM network, so selecting the appropriate DR is important. You can select the appropriate device as DR by configuring the DR priority.

One PIM-SM subnet only permits one DR. According to the function, DR can be divided to source DR and receiving DR.

The main function of the source DR is to perform the source register to RP.

The main function of the receiving DR is to add to RP and set up the switching of RPT and SPT.

Table 4–15 Configure the DR priority

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter interface configuration mode | interface interface-name | -
Configure the DR priority | ip pim dr-priority priority-value | Optional By default, the DR priority is 1.

l DR election rules:

l Compare the priorities. The larger the value, the higher the priority. The one with highest priority wins.

l If the priority is the same, the one with the largest IP address wins.


4.2.6 Configure PIM-SM SPT Switching

Configuration Condition

Before configuring SPT, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

l Enable the PIM-SM protocol

Configure SPT Switching Condition

The receiving end DR does not know the address of the multicast source, so it can only add to RP to form RPT. The source DR performs the source register to RP and form the source tree between source DR and RP. At first, the direction of the multicast flow is from multicast source to RP and then from RP to the receiver. When the receiving end DR receives the first multicast packet, it performs adding to multicast source, forms SPT, and performs the pruning for RPT. This is called SPT switching.

The command is to configure the SPT switching condition at the receiving end DR.

Table 4–16 Configure the SPT switching condition

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the SPT switching condition | ip pim spt-threshold { infinity | threshold [ group-list{access-list-number | access-list-name } ] [ vrf vrf-name ] | Mandatory By default, all multicast groups perform the SPT switching.

l Do not configure SPT never-switching on RP. Otherwise, it may result in the failure of the multicast forwarding.


4.2.7 Configure PIM-SSM

PIM-SSM is one subset of PIM-SM. In PIM-SSM, do not need RP, BSR or RPT, and there is no SPT switching, but the receiving end DR directly adds to multicast source and sets up the shortest path tree (SPT) with source as root.

Configuration Condition

Before configuring PIM-SSM, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

l Enable the PIM-SM protocol on all interfaces that need multicast route forwarding

Configure PIM-SSM

Table 4–17 Configure PIM-SSM

Step

Command

Description

Enter global configuration mode

configure terminal

-

Configure PIM-SSM

ip pim ssm { default | range { access-list-number | access-list-name } }
[ vrf vrf-name ]

Mandatory

By default, the SSM function is disabled.

l When using PIM-SSM, the receiving end should enable IGMPv3.

l When the receiver cannot be upgraded to IGMPv3, you can use the IGMP SSM Mapping function to cooperate with PIM-SSM.

l Ensure that the SSM multicast group address ranges configured on all devices in the domain are consistent. Otherwise, it may result in the abnormality of PIM-SS.


4.2.8 Configure PIM Adaptive Basic Function

Configuration Condition

Before configuring PIM-SDM, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

Configure PIM Adaptive Basic Function

Table 4–18 Configure the PIM adaptive basic function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enable the IP multicast forwarding | ip multicast-routing [ vrf vrf-name ] | Mandatory By default, the IP multicast forwarding is disabled.
Enter interface configuration mode | interface interface-name | -
Configure the PIM adaptive basic function | ip pim sparse-dense-mode | Either By default, the PIM adaptive basic function is disabled.
 | ip pim sparse-dense-mode passive

l After enabling the PIM adaptive function on the interface, automatically enable the PIM-SM, PIM-DM, and IGMP protocols.


4.2.9 PIM-SM Monitoring and Maintaining

Table 4–19 PIM-SM monitoring and maintaining

Command | Description
clear ip pim bsr rp-set [ vrf vrf-name ] | Clear the RP set information of PIM-SM
clear ip pim mroute [ group-address [ source-address ] ] [ vrf vrf-name ] | Clear the multicast route information of PIM-SM
clear ip pim stat [ [ interface interface-name | [ all_interface ] ] | [ vrf vrf-name ] ] | Clear the statics information of the PIM-SM protocol packets
show ip pim bsr-router [ vrf vrf-name ] | Display the PIM-SM bootstrap route information
show ip pim interface [ interface-name detail | detail ] [ vrf vrf-name ] | Display the PIM-SM interface information
show ip pim local-members interface-name [ vrf vrf-name ] | Display the PIM-SM local group member information
show ip pim mroute [ active | proxy | ssm [ active ] | group group-ip-address [ source source-ip-address | active ] | source source-ip-address ] [ vrf vrf-name ] | Display the PIM-SM multicast route table information
show ip pim neighbor [ detail ] [ vrf vrf-name ] | Display the PIM-SM neighbor information
show ip pim nexthop [ ip-address ] [ vrf vrf-name ] | Display the PIM-SM next-hop router information
show ip pim rp mapping [ vrf vrf-name ] | Display the PIM-SM RP information
show ip pim rp-hash group-address [ vrf vrf-name ] | Display the RP information of the multicast group mapping
show ip pim statistics [ vrf vrf-name ] | Display the statistics information of the PIM-SM protocol packets


4.3 PIM-SM Typical Configuration Example


4.3.1 Configure PIM-SM Basic Functions

Network Requirements

l The whole network runs the PIM-SM protocol.

l Receiver1 and Receiver2 are the two receivers of Device3 stub network.

l Device1 and Device2 are C-BSR and C-RP.

l Run IGMPv2 between Device3 and the stub network.

Network Topology

Figure 4-1 Networking of configuring PIM-SM basic functions

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Enable the unicast route protocol OSPF so that all devices in the network can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 192.168.1.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#View the route table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 2.0.0.0/24 is directly connected, 44:48:47, gigabitethernet0

O 3.0.0.0/24 [110/2] via 2.0.0.1, 24:31:14, gigabitethernet0

[110/2] via 4.0.0.1, 24:31:04, gigabitethernet1

C 4.0.0.0/24 is directly connected, 35:36:57, gigabitethernet1

C 5.0.0.0/24 is directly connected, 24:09:18, gigabitethernet2

O 192.168.1.0/24 [110/2] via 2.0.0.1, 00:30:55, gigabitethernet0

l The viewing method of Device1 and device2 is the same as that of Device3, so the viewing process is omitted.

Step 3:

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the interface.

#Configure Device1.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device1(config)#ip multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim sparse-mode

Device1(config-if-gigabitethernet1)#exit

Device1(config)#interface gigabitethernet2

Device1(config-if-gigabitethernet2)#ip pim sparse-mode

Device1(config-if-gigabitethernet2)#exit

#Configure Device2.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device2(config)#ip multicast-routing

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim sparse-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim sparse-mode

Device2(config-if-gigabitethernet1)#exit

#Configure Device3.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device3(config)#ip multicast-routing

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip pim sparse-mode

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip pim sparse-mode

Device3(config-if-gigabitethernet1)#exit

Device3(config)#interface gigabitethernet2

Device3(config-if-gigabitethernet2)#ip pim sparse-mode

Device3(config-if-gigabitethernet2)#exit

#View the information of the interface enabled with the PIM-SM protocol on Device3 and the PIM-SM neighbor information.

Device3#show ip pim interface

PIM Interface Table:

PIM VRF Name: Default

Total 4 Interface entries

Total 0 External Interface entry

Total 0 Sparse-Dense Mode Interface entry

Address Interface VIF Ver/ VIF Nbr DR DR BSR CISCO Neighbor

Index Mode Flag Count Pri Border Neighbor Filter

2.0.0.2 register_vif0 1 v2/S UP

2.0.0.2 gigabitethernet0 0 v2/S UP 1 2 2.0.0.2 FALSE FALSE

4.0.0.2 gigabitethernet1 2 v2/S UP 0 1 4.0.0.2 FALSE FALSE

5.0.0.1 gigabitethernet2 3 v2/S UP 0 1 5.0.0.1 FALSE FALSE

Device3#show ip pim neighbor

PIM Neighbor Table:

PIM VRF Name: Default

Total 2 Neighbor entries

Neighbor Interface Uptime/Expires Ver DR

Address

2.0.0.1 gigabitethernet0 01:12:00/00:01:39 v2 1 /

4.0.0.1 gigabitethernet1 01:13:19/00:01:35 v2 1 /

#View the IGMP information of interface gigabitethernet2 of Device3.

Device3#show ip igmp interface gigabitethernet2

Interface gigabitethernet2 (Index 50332250)

IGMP Active, Querier (5.0.0.1)

Default version 2

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 5.0.0.1

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

l The viewing methods of Device1 and Device2 are the same as that of Device3, so the viewing process is omitted.

l After configuring the multicast protocol on the interface, automatically enable the IGMP function and run IGMPv2 by default. You can configure the running IGMP version on the interface by executing the ip igmp version command.

Step 4:

Configure C-BSR and C-RP.

#Configure Device1.

Configure interface gigabitethernet1 of Device1 as C-BSR and C-RP; the priority of C-BSR is 200; the multicast group range of the C-RP service is 230.0.0.0/8.

Device1(config)#ip pim bsr-candidate gigabitethernet1 10 200

Device1(config)#ip access-list standard 1

Device1(config-std-nacl)#permit 230.0.0.0 0.255.255.255

Device1(config-std-nacl)#exit

Device1(config)#ip pim rp-candidate gigabitethernet1 group-list 1

#Configure Device2.

Configure interface gigabitethernet0 of Device2 as C-BSR and C-RP; the priority of C-BSR is 0; the multicast group range of the C-RP service of Device2 is 230.0.0.0/4.

Device2(config)#ip pim bsr-candidate gigabitethernet0

Device2(config)#ip pim rp-candidate gigabitethernet0

#View the BSR and RP information of Device3.

Device3#show ip pim bsr-router

PIMv2 Bootstrap information

PIM VRF Name: Default

BSR address: 2.0.0.1

BSR Priority: 200

Hash mask length: 10

Up time: 01:03:30

Expiry time: 00:01:46

Role: Non-candidate BSR

State: Accept Preferred

Device3#show ip pim rp mapping

PIM Group-to-RP Mappings Table:

PIM VRF Name: Default

Total 2 RP set entries

Total 2 RP entries

Group(s): 224.0.0.0/4

RP count: 1

RP: 3.0.0.2

Info source: 2.0.0.1, via bootstrap, priority 192

Up time: 01:03:29

Expiry time: 00:02:02

Group(s): 230.0.0.0/8

RP count: 1

RP: 2.0.0.1

Info source: 2.0.0.1, via bootstrap, priority 192

Up time: 01:15:50

Expiry time: 00:02:02

l The viewing method of Device1 and device2 is the same as that of Device3, so the viewing process is omitted.

l When configuring multiple C-BSRs in one multicast domain, first elect BSR according to the priority and the C-BSR with the largest priority is elected as BSR. When the priorities of C-BSRs are the same, the C-BSR with the largest ip address is elected as BSR.

l When configuring multiple C-RPs in one multicast domain and the service multicast group ranges are the same, calculate the RP of the multicast group G according to the hash algorithm.

l In the multicast domain, you can configure RP via the command ip pim rp-address, but it is required that the static RP addresses configured on all devices in the multicast domain keep consistent.

Step 5:

Check the result.

# Receiver1 and Receiver2 send the IGMPv2 member report packet to add to multicast group 225.1.1.1, 230.1.1.1 respectively.

#Source sends the multicast packets with multicast group 225.1.1.1, 230.1.1.1.

#View the multicast member table of Device3.

Device3#show ip igmp groups

IGMP Connected Group Membership

Total 2 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet2 00:56:48 00:02:39 5.0.0.2 stopped

230.1.1.1 gigabitethernet2 00:56:48 00:02:46 5.0.0.3 stopped

#View the RP of multicast group 225.1.1.1,230.1.1.1 on Device3.

Device3#show ip pim rp-hash 225.1.1.1

PIM VRF Name: Default

RP: 3.0.0.2

Info source: 2.0.0.1, via bootstrap

Device3#show ip pim rp-hash 230.1.1.1

PIM VRF Name: Default

RP: 2.0.0.1

Info source: 2.0.0.1, via bootstrap

We can see that the valid RP of the multicast group 225.1.1.1 is 3.0.0.2 and the valid RP of the multicast group is 2.0.0.1.

#View the PIM-SM multicast route table of Device3.

Device3#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 2 (*,G) entries

Total 2 (S,G) entries

Total 2 (S,G,rpt) entries

Total 0 FCR entry

Up timer/Expiry timer

(*, 225.1.1.1)

Up time: 00:36:21

RP: 3.0.0.2

RPF nbr: 4.0.0.1

RPF idx: gigabitethernet1

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet2

Joined interface list:

Asserted interface list:

(192.168.1.1, 225.1.1.1)

Up time: 00:36:02

KAT time: 00:03:11

RPF nbr: 2.0.0.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet2

Packet count 2517423

(192.168.1.1, 225.1.1.1, rpt)

Up time: 00:36:02

RP: 3.0.0.2

Flags:

RPT JOIN DESIRED

PRUNE DESIRED

RPF SGRPT XG EQUAL

Upstream State: PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

gigabitethernet2

(*, 230.1.1.1)

Up time: 00:36:21

RP: 2.0.0.1

RPF nbr: 2.0.0.1

RPF idx: gigabitethernet0

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet2

Joined interface list:

Asserted interface list:

(192.168.1.1, 230.1.1.1)

Up time: 00:36:02

KAT time: 00:03:11

RPF nbr: 2.0.0.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet2

Packet count 2517712

(192.168.1.1, 230.1.1.1, rpt)

Up time: 00:36:02

RP: 2.0.0.1

Flags:

RPT JOIN DESIRED

RPF SGRPT XG EQUAL

Upstream State: NOT PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

#Receiver1 can only receive the multicast service packet with multicast group 225.1.1.1 sent by Source. Receiver2 can only receive the multicast service packet with multicast group 230.1.1.1 sent by Source.

l The viewing method of Device1 and Device2 is the same as that of Device3, so the viewing process is omitted.

l By default, the device enables the SPT switching.


4.3.2 Configure PIM-SSM

Network Requirements

l The whole network runs the PIM-SSM protocol.

l Receiver is one receiver of Device3 stub network.

l Run IGMPv3 between Device3 and the stub network.

Network Topology

Figure 4-2 Networking of configuring PIM-SSM

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Enable the unicast route protocol OSPF so that all devices in the network can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 192.168.1.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#View the route table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 2.0.0.0/24 is directly connected, 44:48:47, gigabitethernet0

O 3.0.0.0/24 [110/2] via 2.0.0.1, 24:31:14, gigabitethernet1

[110/2] via 4.0.0.1, 24:31:04, gigabitethernet1

C 4.0.0.0/24 is directly connected, 35:36:57, gigabitethernet1

C 5.0.0.0/24 is directly connected, 24:09:18, gigabitethernet2

O 192.168.1.0/24 [110/2] via 2.0.0.1, 00:30:55, gigabitethernet0

l The viewing method of Device1 and device2 is the same as that of Device3, so the viewing process is omitted.

Step 3:

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the interface.

#Configure Device1.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device1(config)#ip multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim sparse-mode

Device1(config-if-gigabitethernet1)#exit

Device1(config)#interface gigabitethernet2

Device1(config-if-gigabitethernet2)#ip pim sparse-mode

Device1(config-if-gigabitethernet2)#exit

#Configure Device2.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device2(config)#ip multicast-routing

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim sparse-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim sparse-mode

Device2(config-if-gigabitethernet1)#exit

#Configure Device3.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device3(config)#ip multicast-routing

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip pim sparse-mode

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip pim sparse-mode

Device3(config-if-gigabitethernet1)#exit

Device3(config)#interface gigabitethernet2

Device3(config-if-gigabitethernet2)#ip pim sparse-mode

Device3(config-if-gigabitethernet2)#exit

#View the information of the interface enabled with the PIM-SM protocol on Device3 and the PIM-SM neighbor information.

Device3#show ip pim interface

PIM Interface Table:

PIM VRF Name: Default

Total 4 Interface entries

Total 0 External Interface entry

Total 0 Sparse-Dense Mode Interface entry

Address Interface VIF Ver/ VIF Nbr DR DR BSR CISCO Neighbor

Index Mode Flag Count Pri Border Neighbor Filter

2.0.0.2 register_vif0 1 v2/S UP

2.0.0.2 gigabitethernet0 3 v2/S UP 1 1 2.0.0.2 FALSE FALSE

4.0.0.2 gigabitethernet1 0 v2/S UP 0 1 4.0.0.2 FALSE FALSE

5.0.0.1 gigabitethernet2 2 v2/S UP 1 1 5.0.0.1 FALSE FALSE

Device3#show ip pim neighbor

PIM Neighbor Table:

PIM VRF Name: Default

Total 2 Neighbor entries

Neighbor Interface Uptime/Expires Ver DR

Address

2.0.0.1 gigabitethernet0 01:12:00/00:01:39 v2 1 /

4.0.0.1 gigabitethernet1 01:13:19/00:01:35 v2 1 /

l The viewing method of Device1 and device2 is the same as that of Device3, so the viewing process is omitted.

Step 4:

Configure PIM-SSM on all devices; the multicast group range of the SSM service is 232.0.0.0/8. gigabitethernet2 of Device3 runs IGMPv3.

#Configure Device1.

Device1(config)#ip pim ssm default

#Configure Device2.

Device2(config)#ip pim ssm default

#Configure Device3.

Device3(config)#ip pim ssm default

Device3(config)#interface gigabitethernet2

Device3(config-if-gigabitethernet2)#ip igmp version 3

Device3(config-if-gigabitethernet2)#exit

#View the IGMP information of interface gigabitethernet2 of Device3.

Device3#show ip igmp interface gigabitethernet2

Interface gigabitethernet2 (Index 50332250)

IGMP Enabled, Active, Querier (5.0.0.1)

Configured for version 3

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 5.0.0.1

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

Step 5:

Check the result.

#Receiver sends the IMGPv3 member relation report of the specified source group to add to multicast group 232.1.1.1; the specified multicast source is 192.168.1.1

#Source sends the multicast packets with multicast group 232.1.1.1.

#View the multicast member table of Device3.

Device3#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

232.1.1.1 gigabitethernet2 00:11:14 stopped 5.0.0.2 stopped stopped

Device3#show ip igmp groups detail

Interface: gigabitethernet2

Group: 232.1.1.1

Uptime: 00:11:20

Group mode: Include

Last reporter: 5.0.0.2

TIB-A Count: 1

TIB-B Count: 0

Group source list: (R - Remote, M - SSM Mapping)

Source Address Uptime v3 Exp M Exp Fwd Flags

192.168.1.1 00:11:20 00:03:28 stopped Yes R

#View the PIM-SM multicast route table of Device3.

Device3#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 0 (*,G) entry

Total 1 (S,G) entry

Total 0 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(192.168.1.1, 232.1.1.1)

Up time: 12:59:27

KAT time: 00:03:20

RPF nbr: 2.0.0.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet2

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet2

Packet count 109783214

#Receiver can only receive the multicast service packet with multicast group 232.1.1.1 sent by Source.

l The viewing method of Device1 and device2 is the same as that of Device3, so the viewing process is omitted.

l The default multicast group range of PIM-SSM is 232.0.0.0/8. You can modify the multicast group range of the 232.0.0.0/8 service via the command ip pim ssm range.

l For the multicast group G meeting the SSM condition, the multicast route table does not generate the (*,G) entry, but just generate the (S,G) entry.


4.3.3 Configure PIM-SM Multicast Forwarding Control

Network Requirements

l The whole network runs the PIM-SM protocol.

l Receiver is one receiver of Device3 stub network.

l Device2 is C-BSR and C-RP.

l On Device2 and Device3, control for the multicast source, making Receiver only receive the multicast service packet sent by Source1.

l Run IGMPv2 between Device3 and the stub network.

Network Topology

Figure 4-3 Networking of configuring PIM-SM multicast forwarding control

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Enable the unicast route protocol OSPF so that all devices in the network can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.0.0.0 0.0.255.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#View the route table of Device3.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 2.0.0.0/24 is directly connected, 45:51:07, gigabitethernet0

O 3.0.0.0/24 [110/2] via 2.0.0.1, 25:33:34, gigabitethernet0

[110/2] via 4.0.0.1, 25:33:24, gigabitethernet1

C 4.0.0.0/24 is directly connected, 36:39:17, gigabitethernet1

C 5.0.0.0/24 is directly connected, 25:11:38, gigabitethernet2

O 10.0.0.0/24 [110/2] via 2.0.0.1, 00:06:32, gigabitethernet0

O 10.0.1.0/24 [110/2] via 2.0.0.1, 00:06:32, gigabitethernet0

O 10.0.2.0/24 [110/2] via 2.0.0.1, 00:06:32, gigabitethernet0

O 10.0.3.0/24 [110/2] via 2.0.0.1, 00:06:32, gigabitethernet0

l The viewing method of Device1 and device2 is the same as that of Device3, so the viewing process is omitted.

Step 3:

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the interface.

#Configure Device1.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device1(config)#ip multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim sparse-mode

Device1(config-if-gigabitethernet1)#exit

Device1(config)#interface gigabitethernet2

Device1(config-if-gigabitethernet2)#ip pim sparse-mode

Device1(config-if-gigabitethernet2)#exit

Device1(config)#interface gigabitethernet0/0

Device1(config-if-gigabitethernet0/0)#ip pim sparse-mode

Device1(config-if-gigabitethernet0/0)#exit

Device1(config)#interface gigabitethernet0/1

Device1(config-if-gigabitethernet0/1)#ip pim sparse-mode

Device1(config-if-gigabitethernet0/1)#exit

Device1(config)#interface gigabitethernet0/2

Device1(config-if-gigabitethernet0/2)#ip pim sparse-mode

Device1(config-if-gigabitethernet0/2)#exit

#Configure Device2.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device2(config)#ip multicast-routing

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim sparse-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim sparse-mode

Device2(config-if-gigabitethernet1)#exit

#Configure Device3.

Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the related interfaces.

Device3(config)#ip multicast-routing

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip pim sparse-mode

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip pim sparse-mode

Device3(config-if-gigabitethernet1)#exit

Device3(config)#interface gigabitethernet2

Device3(config-if-gigabitethernet2)#ip pim sparse-mode

Device3(config-if-gigabitethernet2)#exit

#View the information of the interface enabled with the PIM-SM protocol on Device3 and the PIM-SM neighbor information.

Device3#show ip pim interface

PIM Interface Table:

PIM VRF Name: Default

Total 4 Interface entries

Total 0 External Interface entry

Total 0 Sparse-Dense Mode Interface entry

Address Interface VIF Ver/ VIF Nbr DR DR BSR CISCO Neighbor

Index Mode Flag Count Priority Border Neighbor Filter

4.0.0.2 register_vif0 1 v2/S UP

2.0.0.2 gigabitethernet0 2 v2/S UP 1 2 2.0.0.2 FALSE FALSE

4.0.0.2 gigabitethernet1 0 v2/S UP 1 1 4.0.0.2 FALSE FALSE

5.0.0.1 gigabitethernet2 3 v2/S UP 0 1 5.0.0.1 FALSE FALSE

Device3#show ip pim neighbor

PIM Neighbor Table:

PIM VRF Name: Default

Total 2 Neighbor entries

Neighbor Interface Uptime/Expires Ver DR

Address Priority/Mode

2.0.0.1 gigabitethernet0 00:50:29/00:01:19 v2 1 /

4.0.0.1 gigabitethernet1 00:57:58/00:01:33 v2 1 /

l The viewing method of Device1 and device2 is the same as that of Device3, so the viewing process is omitted.

Step 4:

Configure C-BSR and C-RP.

#Configure Device2.

Configure gigabitethernet0 of Device2 as the C-BSR and C-RP of the whole network and the multicast group range of the C-RP service is 224.0.0.0/4.

Device2(config)#ip pim bsr-candidate gigabitethernet0

Device2(config)#ip pim rp-candidate gigabitethernet0

#View the BSR and RP information of Device3.

Device3#show ip pim bsr-router

PIMv2 Bootstrap information

PIM VRF Name: Default

BSR address: 3.0.0.2

BSR Priority: 0

Hash mask length: 10

Up time: 00:10:37

Expiry time: 00:01:33

Role: Non-candidate BSR

State: Accept Preferred

Device3#show ip pim rp mapping

PIM Group-to-RP Mappings Table:

PIM VRF Name: Default

Total 1 RP set entry

Total 1 RP entry

Group(s): 224.0.0.0/4

RP count: 1

RP: 3.0.0.2

Info source: 3.0.0.2, via bootstrap, priority 192

Up time: 03:59:59

Expiry time: 00:01:49

l The viewing method of Device1 and device2 is the same as that of Device3, so the viewing process is omitted.

Step 5:

On Device2 and Device3, control for the multicast source, making Receiver only receive the multicast service packet sent by Source1

#On Device2, configure the accepted register message access list, filtering the register message of Source4.

Device2(config)#ip access-list standard 1

Device2(config-std-nacl)#deny 10.0.3.0 0.0.0.255

Device2(config-std-nacl)#permit any

Device2(config-std-nacl)#exit

Device2(config)#ip pim accept-register list 1

#On interface gigabitethernet0 and gigabitethernet1 of Device3, configure the ingress acl, filtering the multicast service packets of Source3.

Device3(config)#ip access-list extended 1001

Device3(config-ext-nacl)#deny ip 10.0.2.0 0.0.0.255 224.0.0.0 31.255.255.255

Device3(config-ext-nacl)#permit igmp any any

Device3(config-ext-nacl)#permit pim any any

Device3(config-ext-nacl)#permit ospf any any

Device3(config-ext-nacl)#permit ip any any

Device3(config-ext-nacl)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip access-group 1001 in

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip access-group 1001 in

Device3(config-if-gigabitethernet1)#exit

#On interface gigabitethernet2 of Device3, configure the ingress acl, filtering the multicast service packets of Source2.

Device3(config)#ip access-list extended 1002

Device3(config-ext-nacl)#deny ip 10.0.1.0 0.0.0.255 224.0.0.0 31.255.255.255

Device3(config-ext-nacl)#permit igmp any any

Device3(config-ext-nacl)#permit pim any any

Device3(config-ext-nacl)#permit ip any any

Device3(config-ext-nacl)#exit

Device3(config)#interface gigabitethernet2

Device3(config-if-gigabitethernet2)#ip access-group 1002 out

Device3(config-if-gigabitethernet2)#exit

Step 6:

Check the result.

#Receiver sends the IMGPv2 member relation report to add to multicast group 225.1.1.1.

# Source1, Source2, Source3, and Source4 all send the multicast packets of multicast group 225.1.1.1.

#View the multicast member table of Device3.

Device3#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet2 00:00:38 00:03:45 5.0.0.2 stopped

#View the PIM-SM multicast route table of Device3.

Device3#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 1 (*,G) entry

Total 2 (S,G) entries

Total 2 (S,G,rpt) entries

Total 0 FCR entry

Up timer/Expiry timer

(*, 225.1.1.1)

Up time: 00:07:55

RP: 3.0.0.2

RPF nbr: 4.0.0.1

RPF idx: gigabitethernet1

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet2

Joined interface list:

Asserted interface list:

(10.0.0.1, 225.1.1.1)

Up time: 00:07:49

KAT time: 00:03:17

RPF nbr: 2.0.0.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet2

Packet count 268411

(10.0.0.1, 225.1.1.1, rpt)

Up time: 00:07:49

RP: 3.0.0.2

Flags:

RPT JOIN DESIRED

PRUNE DESIRED

RPF SGRPT XG EQUAL

Upstream State: PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

gigabitethernet2

(10.0.1.1, 225.1.1.1)

Up time: 00:07:49

KAT time: 00:03:17

RPF nbr: 2.0.0.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet2

Packet count 268237

(10.0.1.1, 225.1.1.1, rpt)

Up time: 00:07:49

RP: 3.0.0.2

Flags:

RPT JOIN DESIRED

PRUNE DESIRED

RPF SGRPT XG EQUAL

Upstream State: PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

gigabitethernet2

l The viewing method of Device1 and device2 is the same as that of Device3, so the viewing process is omitted.

#View the matching of ACL on Device2.

Device2#show ip access-list 1

ip access-list standard 1

10 deny 10.0.3.0 0.0.0.255 32 matches

20 permit any 2767 matches

#View the matching of ACL on Device3.

Device3#show ip access-list 1001

ip access-list extended 1001

10 deny ip 10.0.2.0 0.0.0.255 224.0.0.0 31.255.255.255 671545 matches

20 permit igmp any any 19 matches

30 permit pim any any 119 matches

40 permit ospf any any 252 matches

50 permit ip any any 1343339 matches

Device3#show ip access-list 1002

ip access-list extended 1002

10 deny ip 10.0.1.0 0.0.0.255 224.0.0.0 31.255.255.255 672358 matches

20 permit igmp any any 10 matches

30 permit pim any any 40 matches

40 permit ip any any 672532 matches

#Receive end can only receive the multicast service packets sent by Source1.

l When performing the multicast source control, you’d better first configure the multicast source control and then on-demand multicast source, because by default, after receiving the multicast service packet, the receiving end DR performs the SPT switching. If first on-demanding multicast source and then performing the multicast forwarding control, the multicast forwarding control does not take function. To prevent the multicast forwarding control from not taking function, you can configure not permitting SPT switching on the receiving end DR.


4.3.4 Configure PIM Adaptive Function

Network Requirements

l On all interfaces of Device1 and Device2, enable the PIM adaptive function.

l Device1 is C-BSR and C-RP; the multicast group range of the C-RP service is 225.0.0.0/8.

l Run IGMPv2 between Device2 and the stub network.

l Receiver is one receiver of Device2 stub network.

Network Topology

Figure 4-4 Networking of configuring PIM adaptive function

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Enable the unicast route protocol OSPF so that all devices in the network can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 192.168.1.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#View the route table of Device2.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 15:00:16, gigabitethernet0

C 2.0.0.0/24 is directly connected, 01:09:58, gigabitethernet1

192.168.1.0/24 [110/2] via 1.0.0.1, 00:18:44, gigabitethernet0

l The viewing method of Device1 is the same as that of Device2, so the viewing process is omitted.

Step 3:

Globally enable the multicast forwarding; enable the PIM adaptive function on the interface.

#Configure Device1.

Globally enable the multicast forwarding; enable the PIM adaptive function on the related interfaces.

Device1(config)#ip multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim sparse-dense-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim sparse-dense-mode

Device1(config-if-gigabitethernet1)#exit

#Configure Device2.

Globally enable the multicast forwarding; enable the PIM adaptive function on the related interfaces.

Device2(config)#ip multicast-routing

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim sparse-dense-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim sparse-dense-mode

Device2(config-if-gigabitethernet1)#exit

l After enabling the PIM adaptive function on the interface, automatically enable the PIM-SM and PIM-DM protocols.

#View the information of the interface enabled with the PIM-SM protocol on Device2 and the PIM-SM neighbor information.

Device2#show ip pim interface

PIM Interface Table:

PIM VRF Name: Default

Total 3 Interface entries

Total 0 External Interface entry

Total 3 Sparse-Dense Mode Interface entries

Address Interface VIF Ver/ VIF Nbr DR DR BSR CISCO Neighbor

Index Mode Flag Count Priority Border Neighbor Filter

2.0.0.1 register_vif0 1 v2/S UP

1.0.0.2 gigabitethernet0 2 v2/S UP 1 1 1.0.0.2 FALSE FALSE

2.0.0.1 gigabitethernet1 0 v2/S UP 0 1 2.0.0.1 FALSE FALSE

Device2#show ip pim neighbor

PIM Neighbor Table:

PIM VRF Name: Default

Total 1 Neighbor entry

Neighbor Interface Uptime/Expires Ver DR

Address Priority/Mode

1.0.0.1 gigabitethernet0 00:12:31/00:01:44 v2 N /

#We can see that the PIM-SM neighbor is set up between Device2 and Device1 successfully.

#View the information of the interface enabled with the PIM-DM protocol on Device2 and the PIM-DM neighbor information.

Device2#show ip pim dense-mode interface

Total 2 Interface entries

Total 0 External Interface entry

Total 2 Sparse-Dense Mode Interface entries

Address Interface VIF Ver/ Nbr VIF

Index Mode Count Flag

1.0.0.2 gigabitethernet0 2 v2/D 1 UP

2.0.0.1 gigabitethernet1 0 v2/D 0 UP

Device2#show ip pim dense-mode neighbor

PIM Dense-mode Neighbor Table:

PIM Dense-mode VRF Name: Default

Total 1 Neighbor entries

Neighbor-Address Interface Uptime/Expires Ver

1.0.0.1 gigabitethernet0 00:12:39/00:01:35 v2

#We can see that the PIM-DM neighbor is set up between Device2 and Device1 successfully.

#View the IGMP information of the interface gigabitethernet1 on Device2.

Device2#show ip igmp interface gigabitethernet 1

Interface gigabitethernet1 (Index 5)

IGMP Active, Querier (2.0.0.1)

Default version 2

IP router alert option in IGMP V2 msgs: EXCLUDE

Internet address is 2.0.0.1

IGMP query interval is 125 seconds

IGMP querier timeout is 255 seconds

IGMP max query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

IGMP robustness variable is 2

Step 4:

Configure C-BSR and C-RP.

#Configure Device1.

Configure interface gigabitethernet0 of Device1 as C-BSR and C-RP and the multicast group range of the C-RP service is 225.0.0.0/8.

Device1(config)#ip pim bsr-candidate gigabitethernet0

Device1(config)#ip access-list standard 1

Device1(config-std-nacl)#permit 225.0.0.0 0.255.255.255

Device1(config-std-nacl)#exit

Device1(config)#ip pim rp-candidate gigabitethernet0 group-list 1

#View the BSR and RP information of Device2.

Device2#show ip pim bsr-router

PIMv2 Bootstrap information

PIM VRF Name: Default

BSR address: 192.168.1.254

BSR Priority: 0

Hash mask length: 10

Up time: 00:00:48

Expiry time: 00:01:30

Role: Non-candidate BSR

State: Accept Preferred

Device2#show ip pim rp mapping

PIM Group-to-RP Mappings Table:

PIM VRF Name: Default

Total 1 RP set entry

Total 1 RP entry

Group(s): 225.0.0.0/8

RP count: 1

RP: 192.168.1.254

Info source: 192.168.1.254, via bootstrap, priority 192

Up time: 00:00:42

Expiry time: 00:01:48

#We can see that there is the BSR and RP information on Device2 and the multicast group range of the RP service is 225.0.0.0/8.

Step 5:

Check the result.

#Receiver sends the IMGPv2 member relation report to add to multicast group 225.1.1.1, 226.1.1.1.

# Source sends the multicast packets with multicast group 225.1.1.1 and 226.1.1.1.

#View the multicast member table of Device2.

Device2#show ip igmp groups

IGMP Connected Group Membership

Total 2 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet1 02:28:52 00:02:26 2.0.0.2 stopped

226.1.1.1 gigabitethernet1 02:26:57 00:02:24 2.0.0.2 stopped

#View the PIM-SM multicast route table of Device1.

Device1#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 1 (*,G) entry

Total 1 (S,G) entry

Total 1 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(*, 225.1.1.1)

Up time: 02:23:32

RP: 192.168.1.254

RPF nbr: 0.0.0.0

RPF idx: None

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

gigabitethernet1 02:23:32/00:03:00

Asserted interface list:

(192.168.1.1, 225.1.1.1)

Up time: 00:02:25

KAT time: 00:03:00

RPF nbr: 0.0.0.0

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

gigabitethernet1 00:02:25/00:03:05

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 4324131

(192.168.1.1, 225.1.1.1, rpt)

Up time: 00:02:25

RP: 192.168.1.254

Flags:

RPT JOIN DESIRED

RPF SGRPT XG EQUAL

Upstream State: NOT PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

gigabitethernet1

#View the PIM-DM multicast route table of Device1.

Device1#show ip pim dense-mode mroute

PIM-DM Multicast Routing Table

Total 1 mroute entry

(192.168.1.1, 226.1.1.1)

Expire in: 00:02:46

Source directly connected on gigabitethernet0

State-Refresh Originator State: Originator

Upstream IF: gigabitethernet0

Upstream State: Forwarding

Assert State: NoInfo

Downstream IF List:

gigabitethernet1, in 'olist':

Downstream State: NoInfo

Assert State: NoInfo

#Receiver can receive the multicast service packets with multicast group 225.1.1.1. 226.1.1.1 sent by Source, and the multicast service packet with multicast group 225.1.1.1 uses PIM-SM to communicate; the multicast service packet with multicast group 226.1.1.1 uses PIM-DM to communicate.

l The viewing method of Device2 is the same as that of Device1, so the viewing process is omitted.


5 MVPN


5.1 Overview

With the promotion of the BGP/MPLS VPN service, the user puts forward the requirement of developing the multicast service in the VPN (Virtual Private Network) network and MVPN (Multicast Virtual Private Network) comes into being.

Similar to the unicast VPN, MVPN realizes the access and isolation of different MVPN users via the VRF mechanism. The MVPN users belonging to the same multicast domain can perform the multicast communication and the users of different multicast domains are isolated from each other.

The typical application environment: In the SP (Service Provider) network, run the PIM multicast routing protocol and run MVPN on the PE (Provider Edge). In the C (Client) network, also run the PIM multicast routing protocol. Each multicast domain sets up the Default MDT (Default Multicast Distribution Tree) in the SP network. The MVPN users of the same multicast domain are all added to one default MDT. The MVPN user receives the multicast data packets of the other MVPN users in the multicast domain via it.

There is one drawback to use Default MDT. Even PE does not have receiver, it also receives the multicast data packets sent by other PEs to Default MDT and then drop the packets. This causes the waste for the SP network bandwidth. To solve the problem, we can use the mode of setting up the Data MDT (Data Multicast Distribution Tree). The PE connected to the MVPN multicast source creates Data MDT according to the configuration rule to transmit the multicast data packets. Only the PEs with the receivers can be added to the corresponding Data MDT.

PE uses the address of Default MDT or Data MDT to encapsulate the multicast data packets of C network to the multicast data packet of the SP network and forward to the other PEs via the multicast distribution tree of the SP network. When PE has the receiver, de-capsulate the received multicast data packet and forward via the multicast distribution tree of the C network.


5.2 MVPN Function Configuration

Table 5‑1 MVPN function configuration list

Configuration Task
Configure the MVPN basic functions | Configure the default multicast distribution tree.
 | Configure the data multicast distribution tree.
Configure the RPF proxy | Configure the RPF proxy
Configure BGP MDT | Configure the BGP MDT address stack


5.2.1 Configure MVPN Basic Functions

Configuration Conditions

Before configuring MVPN, first complete the following task:

l Configure MPLS L3VPN so that the users of the same VPN can perform the unicast communication normally;

l Configure the PIM-SM (or SSM) globally and in VPN;

l Enable the IP multicast route forwarding globally and in VPN.

Configure Default MDT

After configuring Default MDT, the system automatically generates MTI and adds to Default MDT Group automatically.

Table 5‑2 Configure the default MDT

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the VRF instance configuration mode | ip vrf vrf-name | -
Configure the default multicast distribution tree | mdt default group-ip-address | Mandatory By default, do not configure the default MDT.

l Default MDTs of the same VPN in one network needs to be configured as one multicast group.

Configure Data MDT

Set the switching threshold on the PE of the multicast source. When the PE finds that the forwarding rate of the multicast service packets reaches the threshold, create one MDT and only the PE of the receiver of the corresponding multicast group can be added to the new tree. After the switching is complete, the multicast service packets are not forwarded in Default MDT, but forwarded along Data MDT. This can prevent all multicast data from being forwarded along Default MDT, because not all PEs have the receivers of the multicast data.

Table 5‑3 Configure the data MDT

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the VRF instance configuration mode | ip vrf vrf-name | -
Configure the MDT | mdt data group-ip-address wildcard-mask [ threshold traffic-rate ] [ list { access-list-number | access-list-name } ] | Mandatory By default, do not configure the data MDT.


5.2.2 Configure RPF Proxy

Configuration Condition

Before configuring the RPF proxy, first complete the following tasks:

l Configure MPLS L3VPN so that the users of the same VPN can perform the unicast communication normally;

l Configure the PIM-SM (or SSM) globally and in VPN;

l Enable the IP multicast route forwarding globally and in VPN;

l Configure MDT Default in VPN.

Configure RPF Proxy

In the common MVPN environment, we need to specify the source IP and the next-hop address to the source IP in the PIM add packet sent by the PE device. In the Options-B across-domain scheme, do not perform the switching of the internal route between the autonomous domains, which will result in the failure of the RPF check of the P device for the PIM add packet from the PE device. To solve the problem, bring in the RPF proxy. After the PE device is configured with the RPF proxy, the PIM add packet sent by the PE device to the P device will contain the information of the RPF proxy. After the P device receives the PIM add packet containing the proxy message and finds that there is no route to the multicast source, query the next hop to the specified IP (in the autonomous domain, ASBR sets up the interface IP of the BGP neighbor with the peer ASBR) address in the proxy information to perform the RPF check.

Table 5‑4 Configure the RPF proxy

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the RPF proxy | ip multicast rpf proxy rd vector vrf vrf-name | Mandatory By default, does not enable the RD vector proxy function of the multicast RPF.


5.2.3 Configure BGP MDT Address Stack

Configuration Condition

Before configuring the BGP MDT address stack, first complete the following tasks:

l Configure MPLS L3VPN so that the users of the same VPN can perform the unicast communication normally;

l Configure the PIM-SM (or SSM) globally and in VPN;

l Enable the IP multicast route forwarding globally and in VPN;

l Configure MDT Default in VPN.

Configure BGP MDT Address Stack

Configure the BGP MDT address stack so that the BGP MDT route information can carry the local MTI address, Default MDT address and Data MDT address to advertise to the peer PE, so as to set up the source tree with the local MTI interface address as the source.

Table 5‑5 Configure the BGP MDT address stack

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Configure the BGP neighbor | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory By default, do not create any BGP neighbor.
Configure the source address of the neighbor TCP session | neighbor { neighbor-address | peer-group-name } update-source { interface-name | ip-address } | Mandatory By default, the source address automatically adopts the egress interface of the packet as the source address via the route selection.
Enter the BGP MDT address stack | address-family ipv4 mdt | -
Activate the capability of the BGP neighbor receiving and sending the MDT route | neighbor { neighbor-address | peer-group-name } activate | Mandatory By default, do not activate the capability of the BGP neighbor receiving and sending the MDT route.


5.2.4 MVPN Monitoring and Maintaining

Table 5‑6 MVPN monitoring and maintaining

Command | Description
show ip bgp ipv4 mdt { all [ summary | ip-address ] ] } | vrf vrf-name [ ip-address ] | rd route-distinguisher [ ip-address ] } | Display the BGP MDT route information
show ip pim mdt | Display the MDT information
show ip pim mdt bgp | Display the received BGP MDT SAFI information
show ip pim mdt receive vrf vrf-name | Display the received Data MDT information in VRF
show ip pim mdt send vrf vrf-name | Display the sent Data MDT information in VRF
show ip pim mroute proxy [ vrf vrf-name ] | Display the multicast RPF proxy information


5.3 MVPN Typical Configuration Example


5.3.1 MVPN Typical Configuration in Single AS

Network Requirements

l Configure VPN instance 1 and configure the multicast Default MDT and Data MDT.

l Set up the MPLS L3VPN environment in the domain; enable the MPLS and BGP process on the PE; enable MPLS on the P;

l To enable the multicast enabling on all devices, we need to enable multicast enabling globally and in VPN instance 1 on the PE;

l Connect PE to the CE interface and add to VPN instance 1; enable the multicast protocol in the global interfaces and the interfaces of VPN instance 1;

l Configure the RP and BSR globally and in VPN instance 1;

l Send the multicast service packets at the Source and receive the multicast service packets at the Receiver, completing the multicast forwarding.

Network Topology

Figure 5-1 Networking of configuring MVPN in a single AS

Device | Interface | IP address | Device | Interface | IP address
CE1 | Gi0 | 10.1.1.1/24 | P | Loopback0 | 172.0.0.3/32
 | Gi1 | 10.1.2.1/24 | PE2 | Gi0 | 192.168.2.2/24
PE1 | Gi0 | 10.1.2.2/24 |  | Gi1 | 10.2.1.1/24
 | Gi1 | 192.168.1.1/24 |  | Loopback0 | 172.0.0.2/32
 | Loopback0 | 172.0.0.1/32 | CE2 | Gi0 | 10.2.1.2/24
P | Gi0 | 192.168.1.2/24 |  | Gi1 | 10.2.2.1/24
 | Gi1 | 192.168.2.1/24 |  |  |

Configuration Steps

Step 1: | Configure the IP addresses of all device interfaces. (omitted)
Step 2: | Configure the VPN instance on the PE.

#Configure PE1.

PE1#config terminal

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

#Configure PE2.

PE2#config terminal

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 100:1

PE2(config-vrf)#route-target export 100:1

PE2(config-vrf)#route-target import 100:1

PE2(config-vrf)#exit

Step 3:

Configure the VPN instance and IP address of the interface.

Take PE1 as an example:

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#ip vrf forwarding 1

PE1(config-if-gigabitethernet0)#ip address 10.1.2.2 255.255.255.0

PE1(config-if-gigabitethernet0)#exit

l The configuration methods of VPN instance 1 interfaces of PE2 are similar;

l When configuring the interfaces of VPN instance 1 on the PE, first configure the interface to belong to VPF and then configure the IP address.

Step 4:

Configure the backbone network IGP protocol to realize the unicast intercommunication of the backbone network.

#Configure OSPF on PE1.

PE1(config)#router ospf 200

PE1(config-ospf)#network 172.0.0.1 0.0.0.0 area 0

PE1(config-ospf)#network 192.168.1.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#Configure OSPF on PE2.

PE2(config)#router ospf 200

PE2(config-ospf)#network 172.0.0.2 0.0.0.0 area 0

PE2(config-ospf)#network 192.168.2.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#Configure OSPF on the P.

P#config terminal

P(config)#router ospf 100

P(config-ospf)#network 172.0.0.3 0.0.0.0 area 0

P(config-ospf)#network 192.168.1.0 0.0.0.255 area 0

P(config-ospf)#network 192.168.2.0 0.0.0.255 area 0

P(config-ospf)#exit

#View the global route table of the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 127.0.0.0/8 is directly connected, 386:48:06, lo0

C 192.168.1.0/24 is directly connected, 45:24:54, gigabitethernet1

O 192.168.2.0/24 [110/2] via 192.168.1.2, 45:23:57, gigabitethernet1

C 172.0.0.1/32 is directly connected, 147:17:37, loopback0

O 172.0.0.2/32 [110/3] via 192.168.1.2, 45:23:57, gigabitethernet1

O 172.0.0.3/32 [110/2] via 192.168.1.2, 24:07:47, gigabitethernet1

We can see that there are the loopback interface routes of PE2 and P in the route table of PE1.

l The checking method on PE2 and P is the same as that on PE1.

Step 5:

Enable MPLS IP and MPLS LDP.

#Enable the global MPLS IP and MPLS LDP on PE1; enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 172.0.0.1

PE1(config-ldp)#transport-address 172.0.0.1

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#mpls ip

PE1(config-if-gigabitethernet1)#mpls ldp

PE1(config-if-gigabitethernet1)#exit

#Enable the global MPLS IP and MPLS LDP on PE2; enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 172.0.0.2

PE2(config-ldp)#transport-address 172.0.0.2

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

#Enable the global MPLS IP and MPLS LDP on P; enable MPLS IP and MPLS LDP on the interface.

P(config)#mpls ip

P(config)#mpls ldp

P(config-ldp)#router-id 172.0.0.3

P(config-ldp)#transport-address 172.0.0.3

P(config-ldp)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#mpls ip

P(config-if-gigabitethernet0)#mpls ldp

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#mpls ip

P(config-if-gigabitethernet1)#mpls ldp

P(config-if-gigabitethernet1)#exit

#View the LDP session information on the device.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

172.0.0.3 Multicast Active OPERATIONAL 00:02:34

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

We can see that PE1 and P set up the LDP session successfully.

l The checking method on PE2 and P is the same as that on PE1.

Step 6:

Configure the IGP protocol in the VPN instance.

#Configure OSPF in the VPN instance on PE1.

PE1(config)#router ospf 100 vrf 1

PE1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#Configure OSPF in the VPN instance on PE2.

PE2(config)#router ospf 100 vrf 1

PE2(config-ospf)#network 10.2.1.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#Configure OSPF on CE1 and advertise the private network route.

CE1#config terminal

CE1(config)#router ospf 100

CE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

CE1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

CE1(config-ospf)#exit

#Configure OSPF on CE2 and advertise the private network route.

CE2#config terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 10.2.1.0 0.0.0.255 area 0

CE2(config-ospf)#network 10.2.2.0 0.0.0.255 area 0

CE2(config-ospf)#exit

Step 7:

Configure MP-IBGP, use the loopback interface as the peer address and perform the route re-distribution with the IGP protocol in the VPN instance.

#Configure MP-IBGP on PE1 and enable the VPNV4 address stack; perform the route re-distribution with the IGP protocol in the VPN instance.

PE1(config)#router bgp 100

PE1(config-bgp)#neighbor 172.0.0.2 remote-as 100

PE1(config-bgp)#neighbor 172.0.0.2 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 172.0.0.2 activate

PE1(config-bgp-af)#neighbor 172.0.0.2 send-community both

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute ospf 100

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 100 vrf 1

PE1(config-ospf)#redistribute bgp 100

PE1(config-ospf)#exit

#Configure MP-IBGP on PE2 and enable the VPNV4 address stack; perform the route re-distribution with the IGP protocol in the VPN instance.

PE2(config)#router bgp 100

PE2(config-bgp)#neighbor 172.0.0.1 remote-as 100

PE2(config-bgp)#neighbor 172.0.0.1 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 172.0.0.1 activate

PE2(config-bgp-af)#neighbor 172.0.0.1 send-community both

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 100

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 100 vrf 1

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

#View the BGP neighbor information on the PE.

Take PE1 as an example.

PE1#show ip bgp vpnv4 all summary

BGP router identifier 172.0.0.1, local AS number 100

BGP table version is 6

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

172.0.0.2 4 100 40 41 5 0 0 00:32:01 2

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as numbers (the number of the route prefixes received from the neighbor), indicating that PE1 and PE2 set up the BGP neighbor successfully.

#View the BGP VPNV4 route table and VPN route table on the PE.

Take PE1 as an example.

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 22, local router ID is 172.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[O]*> 10.1.1.0/24 10.1.2.1 2 32768 ?

[O]*> 10.1.2.0/24 0.0.0.0 1 32768 ?

[B]*>i10.2.1.0/24 172.0.0.2 1 100 0 ?

[B]*>i10.2.2.0/24 172.0.0.2 2 100 0 ?

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.1.1.0/24 [110/2] via 10.1.2.1, 46:02:56, gigabitethernet0

C 10.1.2.0/24 is directly connected, 148:00:45, gigabitethernet0

B 10.2.1.0/24 [200/1] via 172.0.0.2, 22:50:24, gigabitethernet1

B 10.2.2.0/24 [200/2] via 172.0.0.2, 22:50:24, gigabitethernet1

We can see that the BGP VPNV4 route table and VPN route table of PE1 both have the routes to CE2.

l The checking method on PE2 is the same as that on PE1.

#Check the route intercommunication.

CE1#ping 10.2.2.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 10.2.2.1 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

We can see that CE1 can ping the route of CE2 successfully.

Step 8:

Configure the backbone network and VPN instance multicast; configure BSR and RP.

#Enable the global multicast enabling on PE1 and multicast enabling in the VPN instance; enable the multicast protocol globally and on the VPN instance interface.

PE1(config)#ip multicast-routing

PE1(config)#ip multicast-routing vrf 1

PE1(config)#interface loopback0

PE1(config-if-loopback0)#ip pim sparse-mode

PE1(config-if-loopback0)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#ip pim sparse-mode

PE1(config-if-gigabitethernet0)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#ip pim sparse-mode

PE1(config-if-gigabitethernet1)#exit

#Enable the global multicast enabling on PE2 and multicast enabling in the VPN instance; enable the multicast protocol globally and on the VPN instance interface.

PE2(config)#ip multicast-routing

PE2(config)#ip multicast-routing vrf 1

PE2(config)#interface loopback0

PE2(config-if-loopback0)#ip pim sparse-mode

PE2(config-if-loopback0)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#ip pim sparse-mode

PE2(config-if-gigabitethernet0)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#ip pim sparse-mode

PE2(config-if-gigabitethernet1)#exit

#Enable the global multicast enabling on the P; enable the multicast protocol on the global interfaces and configure the global RP and BSR.

P(config)#ip multicast-routing

P(config)#interface loopback0

P(config-if-loopback0)#ip pim sparse-mode

P(config-if-loopback0)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#ip pim sparse-mode

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#ip pim sparse-mode

P(config-if-gigabitethernet1)#exit

P(config)#ip pim bsr-candidate loopback0

P(config)#ip pim rp-candidate loopback0

#Enable the multicast enabling on CE1 and enable the multicast protocol on the interface.

CE1(config)#ip multicast-routing

CE1(config)#interface gigabitethernet0

CE1(config-if-gigabitethernet0)#ip pim sparse-mode

CE1(config-if-gigabitethernet0)#exit

CE1(config)#interface gigabitethernet1

CE1(config-if-gigabitethernet1)#ip pim sparse-mode

CE1(config-if-gigabitethernet1)#exit

#Enable the multicast enabling on CE2; enable the multicast protocol on the interface; configure the RP and BSR of the VPN instance.

CE2(config)#ip multicast-routing

CE2(config)#interface gigabitethernet0

CE2(config-if-gigabitethernet0)#ip pim sparse-mode

CE2(config-if-gigabitethernet0)#exit

CE2(config)#interface gigabitethernet1

CE2(config-if-gigabitethernet1)#ip pim sparse-mode

CE2(config-if-gigabitethernet1)#exit

CE2(config)#ip pim bsr-candidate gigabitethernet0

CE2(config)#ip pim rp-candidate gigabitethernet0

Step 9:

Configure Default MDT and Data MDT; after the configuration is complete, send the multicast service packets of multicast group 225.0.0.1 and 225.0.0.2 on the Source and make Receiver to add to the multicast group 225.0.0.1 and 225.0.0.2.

#Configure Default MDT and Data MDT on PE1.

PE1(config)#ip vrf 1

PE1(config-vrf)#mdt default 239.1.1.1

PE1(config-vrf)#mdt data 238.1.1.0 0.0.0.255

PE1(config-vrf)#exit

#Configure Default MDT and Data MDT on PE2.

PE2(config)#ip vrf 1

PE2(config-vrf)#mdt default 239.1.1.1

PE2(config-vrf)#mdt data 238.1.1.0 0.0.0.255

PE2(config-vrf)#exit

Step 10:

Check the result.

#View the multicast interface and MTI interface information of the VPN instance on the PE.

Take PE1 as an example.

PE1#show ip pim interface vrf 1

PIM Interface Table:

PIM VRF Name: 1

Total 3 Interface entries

Total 1 External Interface entry

Total 0 Sparse-Dense Mode Interface entry

Address Interface VIF Ver/ VIF Nbr DR DR BSR CISCO Neighbor

Index Mode Flag Count Priority Border Neighbor Filter

10.1.2.2 register_vif0 1 v2/S UP

10.1.2.2 gigabitethernet0 0 v2/S UP 1 1 10.1.2.2 FALSE FALSE

172.0.0.1 tunnel1023 2 v2/S UP 1 1 172.0.0.2 FALSE FALSE

We can see that there is the MTI interface information in the multicast interface of the VPN instance of PE1 and the MTI interface automatically gets the IP address. The address is the same as the IP address of the Loopback interface specified when configuring the BGP peer.

#View the neighbor information in the VPN instance on PE1.

Take PE1 as an example.

PE1#show ip pim neighbor vrf 1

PIM Neighbor Table:

PIM VRF Name: 1

Total 2 Neighbor entries

Neighbor Interface Uptime/Expires Ver DR

Address Priority/Mode

10.1.2.1 gigabitethernet0 6d05h58m/00:01:36 v2 1 /

172.0.0.2 tunnel1023 00:01:28/00:01:17 v2 1 / DR

We can see that the MTI interface neighbor of PE1 is set up; we can see the MTI interface information of PE2 in the neighbor list.

l tunnel 1023 is the MTI interface of MVPN. The MTI interface is one interface of connecting VPN to the backbone multicast domain. It can be regarded as one channel connecting the VPN and the global. Each VPN creates one tunnel interface. When BGP enables the VPN address stack and Update-Source, Default MDT is configured in the VPN and there is multicast interface, the interface is generated automatically.

#View the Default MDT information on the PE.

Take PE1 as an example.

PE1#show ip pim mdt

Total 1 MDT Groups

MDT Group Interface Source VRF

239.1.1.1 tunnel1023 loopback0 1

We can see that the MTI interface is added to Default MDT multicast group.

l The checking method on PE2 is the same as that on PE1.

#At the Source, send the multicast service packets of multicast group 225.0.0.1 and 225.0.0.2; at the Receiver, send the IGMP member report packets of multicast group 225.0.0.1 and 225.0.0.2; when there is multicast traffic, view the Group in the backbone network on PE2.

PE2#show ip igmp groups

IGMP Static Group Membership

Total 6 static groups

Group Address Source Address Interface

239.1.1.1 0.0.0.0 loopback0

239.1.1.1 172.0.0.1 loopback0

238.1.1.0 0.0.0.0 loopback0

238.1.1.0 172.0.0.1 loopback0

238.1.1.1 0.0.0.0 loopback0

238.1.1.1 172.0.0.1 loopback0

We can see that the loopback port is automatically added to Default MDT multicast group. When there is multicast traffic, we can see that the loopback port of PE2 is automatically added to Data MDT multicast group and the backbone network is switched from Default MDT to Data-MDT.

#View the Data MDT switching information on the PE.

PE1#show ip pim mdt send vrf 1

MDT-data send list for VRF: 1

Total 2 MDT-data Groups

(source, group) MDT-data group ref_count

(10.1.1.2, 225.0.0.2) 238.1.1.1 1

(10.1.1.2, 225.0.0.1) 238.1.1.0 1

PE2#show ip pim mdt receive vrf 1

Joined MDT-data [group : source] for VRF: 1

Total 2 MDT-data Groups

[238.1.1.0 : 172.0.0.1]

[238.1.1.1 : 172.0.0.1]

We can see that PE1 sends the Data MDT switching information and PE2 also receives the Data MDT switching information of PE1 successfully.


5.3.2 Across-AS MVPN Typical Configuration

Network Requirements

l Configure VPN instance 1 on the PE and configure the multicast Default MDT and Data MDT.

l Set up the OptionB across-domain MPLS L3VPN environment; enable the MPLS and BGP process on the PE and ASBR;

l To enable the multicast enabling on all devices, we need to enable multicast enabling globally and in VPN instance 1 on the PE;

l Connect PE to the CE interface and add to VPN instance 1; enable the multicast protocol in the global interfaces and the interfaces of VPN instance 1;

l Enable SSM on the devices except for the CE devices, associate all multicast group addresses, and configure the RP and BSR of VPN instance 1 on the CE;

l Send the multicast service packets at the Source and receive the multicast service packets at the Receiver, completing the multicast forwarding.

Network Topology

Figure 5-2 Networking of configuring MVPN across-AS

Device | Interface | IP address | Device | Interface | IP address
CE1 | Gi0 | 10.1.2.1/24 | ASBR1 | Loopback0 | 172.0.0.2/32
 | Gi1 | 10.1.1.2/24 | ASBR2 | Gi0 | 192.168.3.2/24
PE1 | Gi0 | 10.1.1.1/24 |  | Gi1 | 100.1.1.1/24
 | Gi1 | 192.168.1.1/24 |  | Loopback0 | 172.0.0.3/32
 | Loopback0 | 172.0.0.1/32 | PE2 | Gi0 | 100.1.1.2/24
P | Gi0 | 192.168.1.2/24 |  | Gi1 | 11.1.1.1/24
 | Gi1 | 192.168.2.1/24 |  | Loopback0 | 172.0.0.4/32
 | Loopback0 | 172.0.0.5/32 | CE2 | Gi0 | 11.1.1.2/24
ASBR1 | Gi0 | 192.168.2.2/24 |  | Gi1 | 11.1.2.1/24
 | Gi1 | 192.168.3.1/24 |  |  |

Configuration Steps

Step 1: | Configure the IP addresses of all device interfaces. (omitted)
Step 2: | Create the VPN instance on the PE.

#Configure PE1.

PE1#config terminal

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

#Configure PE2.

PE1#config terminal

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

Step 3:

Configure the belonging VPN instance and IP address of the interface.

l When configuring the interface of VPN instance 1 on the PE, first configure the interface to belong to VPF and then configure the IP address.

Take PE1 as an example.

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#ip vrf forwarding 1

PE1(config-if-gigabitethernet0)#ip address 10.1.1.1 255.255.255.0

PE1(config-if-gigabitethernet0)#exit

l The checking method on PE2 is the same as that on PE1.

Step 4:

Configure the backbone network and OSPF in the VPN instance.

#Configure the OSPF on PE1 globally and in the VPN instance.

PE1(config)#router ospf 100

PE1(config-ospf)#network 192.168.1.0 0.0.0.255 area 0

PE1(config-ospf)#network 172.0.0.1 0.0.0.0 area 0

PE1(config-ospf)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#Configure the OSPF globally on the P.

P#config terminal

P(config)#router ospf 100

P(config-ospf)#network 192.168.1.0 0.0.0.255 area 0

P(config-ospf)#network 172.0.0.5 0.0.0.0 area 0

P(config-ospf)#network 192.168.2.0 0.0.0.255 area 0

P(config-ospf)#exit

#Configure the OSPF globally on the ASBR1.

ASBR1#config terminal

ASBR1(config)#router ospf 100

ASBR1(config-ospf)#network 192.168.2.0 0.0.0.255 area 0

ASBR1(config-ospf)#network 172.0.0.2 0.0.0.255 area 0

ASBR1(config-ospf)#exit

#Configure the OSPF globally on the ASBR2.

ASBR2#config terminal

ASBR2(config)#router ospf 100

ASBR2(config-ospf)#network 100.1.1.0 0.0.0.255 area 0

ASBR2(config-ospf)#network 172.0.0.3 0.0.0.255 area 0

ASBR2(config-ospf)#exit

#Configure the OSPF globally on PE2 and in the VPN instance.

PE2(config)#router ospf 100

PE2(config-ospf)#network 100.1.1.0 0.0.0.255 area 0

PE2(config-ospf)#network 172.0.0.4 0.0.0.0 area 0

PE2(config-ospf)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#network 11.1.1.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#Configure the OSPF globally on the CE1.

CE1#config terminal

CE1(config)#router ospf 100

CE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

CE1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

CE1(config-ospf)#exit

# Configure the OSPF globally on the CE2.

CE2#config terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 11.1.1.0 0.0.0.255 area 0

CE2(config-ospf)#network 11.1.2.0 0.0.0.255 area 0

CE2(config-ospf)#exit

#View the global route table on the device.

Take PE2 as an example.

PE2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 100.1.1.0/24 is directly connected, 06:38:51, gigabitethernet0

C 127.0.0.0/8 is directly connected, 513:34:42, lo0

O 172.0.0.3/32 [110/2] via 100.1.1.1, 04:31:09, gigabitethernet0

C 172.0.0.4/32 is directly connected, 83:48:24, loopback0

We can see that there is the information of the route to the ASBR2 loopback port in the global route table of PE2.

l The checking method on PE1 and ASBR is the same as that on PE2.

Step 5:

Enable MPLS IP and MPLS LDP.

#Enable the global MPLS IP and MPLS LDP on the PE1; enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 172.0.0.1

PE1(config-ldp)#transport-address 172.0.0.1

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#mpls ip

PE1(config-if-gigabitethernet1)#mpls ldp

PE1(config-if-gigabitethernet1)#exit

#Enable the global MPLS IP and MPLS LDP on the P; enable MPLS IP and MPLS LDP on the interface.

P(config)#mpls ip

P(config)#mpls ldp

P(config-ldp)#router-id 172.0.0.5

P(config-ldp)#transport-address 172.0.0.5

P(config-ldp)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#mpls ip

P(config-if-gigabitethernet0)#mpls ldp

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#mpls ip

P(config-if-gigabitethernet1)#mpls ldp

P(config-if-gigabitethernet1)#exit

#Enable the global MPLS IP and MPLS LDP on the ASBR1; enable MPLS IP and MPLS LDP on the interface.

ASBR1(config)#mpls ip

ASBR1(config)#mpls ldp

ASBR1(config-ldp)#router-id 172.0.0.2

ASBR1(config-ldp)#transport-address 172.0.0.2

ASBR1(config-ldp)#exit

ASBR1(config)#interface gigabitethernet0

ASBR1(config-if-gigabitethernet0)#mpls ip

ASBR1(config-if-gigabitethernet0)#mpls ldp

ASBR1(config-if-gigabitethernet0)#exit

ASBR1(config)#interface gigabitethernet1

ASBR1(config-if-gigabitethernet1)#mpls ip

ASBR1(config-if-gigabitethernet1)#exit

#Enable the global MPLS IP and MPLS LDP on the ASBR2; enable MPLS IP and MPLS LDP on the interface.

ASBR2(config)#mpls ip

ASBR2(config)#mpls ldp

ASBR2(config-ldp)#router-id 172.0.0.3

ASBR2(config-ldp)#transport-address 172.0.0.3

ASBR2(config-ldp)#exit

ASBR2(config)#interface gigabitethernet0

ASBR2(config-if-gigabitethernet0)#mpls ip

ASBR2(config-if-gigabitethernet0)#exit

ASBR2(config)#interface gigabitethernet1

ASBR2(config-if-gigabitethernet1)#mpls ip

ASBR2(config-if-gigabitethernet1)#mpls ldp

ASBR2(config-if-gigabitethernet1)#exit

#Enable the global MPLS IP and MPLS LDP on the PE2; enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 172.0.0.4

PE2(config-ldp)#transport-address 172.0.0.4

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

#View the LDP session information on the device.

Take P as an example.

P#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

172.0.0.1 Multicast Active OPERATIONAL 00:02:58

172.0.0.2 Multicast Active OPERATIONAL 00:02:48

Statistics for ldp sessions:

Multicast sessions: 2

Targeted sessions: 0

We can see that P sets up the LDP session with PE1 and ASBR1 successfully.

l The checking method on ASBR and PE is the same as that on the P device.

Step 6:

Configure MP-IBGP between PE and ASBR, use the loopback interface as the peer address, configure MP-EBGP between ASBRs, and perform the route re-distribution with the IGP protocol in the VPN instance.

#Configure MP-IBGP on PE1, enable the VPNV4 address stack and MDT address stack, and perform the route re-distribution with the IGP protocol in the VPN instance.

PE1(config)#router bgp 200

PE1(config-bgp)#neighbor 172.0.0.2 remote-as 200

PE1(config-bgp)#neighbor 172.0.0.2 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 172.0.0.2 activate

PE1(config-bgp-af)#neighbor 172.0.0.2 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 mdt

PE1(config-bgp-af)#neighbor 172.0.0.2 activate

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute ospf 200

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#redistribute bgp 200

PE1(config-ospf)#exit

#Configure MP-IBGP with PE1 on ASBR1, configure MP-EBGP between ASBR1 and ASBR2, and enable VPNV4 address stack and MDT address stack.

ASBR1(config)#router bgp 200

ASBR1(config-bgp)#neighbor 172.0.0.1 remote-as 200

ASBR1(config-bgp)#neighbor 172.0.0.1 update-source loopback0

ASBR1(config-bgp)#neighbor 192.168.3.2 remote-as 100

ASBR1(config-bgp)#address-family vpnv4

ASBR1(config-bgp-af)#neighbor 172.0.0.1 activate

ASBR1(config-bgp-af)#neighbor 172.0.0.1 next-hop-self

ASBR1(config-bgp-af)#neighbor 172.0.0.1 send-community extended

ASBR1(config-bgp-af)#neighbor 192.168.3.2 activate

ASBR1(config-bgp-af)#neighbor 192.168.3.2 send-community extended

ASBR1(config-bgp-af)#exit-address-family

ASBR1(config-bgp)#address-family ipv4 mdt

ASBR1(config-bgp-af)#neighbor 172.0.0.1 activate

ASBR1(config-bgp-af)#neighbor 172.0.0.1 next-hop-self

ASBR1(config-bgp-af)#neighbor 192.168.3.2 activate

ASBR1(config-bgp-af)#exit-address-family

ASBR1(config-bgp)#exit

#Configure MP-IBGP with PE2 on ASBR2, configure MP-EBGP between ASBR2 and ASBR1, and enable VPNV4 address stack and MDT address stack.

ASBR2(config)#router bgp 100

ASBR2(config-bgp)#neighbor 172.0.0.4 remote-as 100

ASBR2(config-bgp)#neighbor 172.0.0.4 update-source loopback0

ASBR2(config-bgp)#neighbor 192.168.3.1 remote-as 200

ASBR2(config-bgp)#address-family vpnv4

ASBR2(config-bgp-af)#neighbor 172.0.0.4 activate

ASBR2(config-bgp-af)#neighbor 172.0.0.4 next-hop-self

ASBR2(config-bgp-af)#neighbor 172.0.0.4 send-community extended

ASBR2(config-bgp-af)#neighbor 192.168.3.1 activate

ASBR2(config-bgp-af)#neighbor 192.168.3.1 send-community extended

ASBR2(config-bgp-af)#exit-address-family

ASBR2(config-bgp)#address-family ipv4 mdt

ASBR2(config-bgp-af)#neighbor 172.0.0.4 activate

ASBR2(config-bgp-af)#neighbor 172.0.0.4 next-hop-self

ASBR2(config-bgp-af)#neighbor 192.168.3.1 activate

ASBR2(config-bgp-af)#exit-address-family

ASBR2(config-bgp)#exit

#Configure MP-IBGP on PE2, enable the VPNV4 address stack and MDT address stack, and perform the route re-distribution with the IGP protocol in the VPN instance.

PE2(config)#router bgp 100

PE2(config-bgp)#neighbor 172.0.0.3 remote-as 100

PE2(config-bgp)#neighbor 172.0.0.3 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 172.0.0.3 activate

PE2(config-bgp-af)#neighbor 172.0.0.3 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 mdt

PE2(config-bgp-af)#neighbor 172.0.0.3 activate

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 200

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

#View the BGP neighbor information on the device.

Take ASBR1 as an example.

ASBR1#show ip bgp vpnv4 all summary

BGP router identifier 172.0.0.2, local AS number 200

BGP table version is 1

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

172.0.0.1 4 200 2 2 1 0 0 00:00:14 2

192.168.3.2 4 100 7 8 1 0 0 00:05:28 2

Total number of neighbors 2

#The content of the State/PfxRcd list is displayed as numbers (the number of the route prefixes received from the neighbor), indicating that ASBR1 sets up the BGP neighbor with PE1 and ASBR2 successfully.

#View the BGP VPNV4 route table on the BGP device.

Take ASBR1 as an example.

ASBR1#show ip bgp vpnv4 all

BGP table version is 7, local router ID is 172.0.0.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1

[B]*>i10.1.1.0/24 172.0.0.1 1 100 0 ?

[B]*>i10.1.2.0/24 172.0.0.1 2 100 0 ?

[B]*> 11.1.1.0/24 192.168.3.2 0 0 100 ?

[B]*> 11.1.2.0/24 192.168.3.2 0 0 100 ?

We can see that there is the route to the local CE1 and the peer CE2 in the BGP VPNV4 of ASBR1.

l The checking method on PE and ASBR2 is the same as that on ASBR1.

Step 7:

Configure the backbone network PIM domain to adopt the SSM mode; the VPN instance configures the multicast routing protocol PIM-SM; configure BSR and RP.

#Enable the multicasting enabling globally and of the VPN instance on PE1, the RPF proxy function in VPN and the global SSM; configure the multicast protocol on the interface.

PE1(config)#ip multicast-routing

PE1(config)#ip multicast-routing vrf 1

PE1(config)#ip multicast rpf proxy rd vector vrf 1

PE1(config)#interface loopback 0

PE1(config-if-loopback0)#ip pim sparse-mode

PE1(config-if-loopback0)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#ip pim sparse-mode

PE1(config-if-gigabitethernet0)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#ip pim sparse-mode

PE1(config-if-gigabitethernet1)#exit

PE1(config)#ip pim ssm default

#Enable the global multicast enabling and SSM function on the P; configure the multicast protocol on the interface.

P(config)#ip multicast-routing

P(config)#interface loopback 0

P(config-if-loopback0)#ip pim sparse-mode

P(config-if-loopback0)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#ip pim sparse-mode

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#ip pim sparse-mode

P(config-if-gigabitethernet1)#exit

P(config)#ip pim ssm default

#Enable the global multicast enabling and SSM function on ASBR1; configure the multicast protocol on the interface.

ASBR1(config)#ip multicast-routing

ASBR1(config)#interface loopback 0

ASBR1(config-if-loopback0)#ip pim sparse-mode

ASBR1(config-if-loopback0)#exit

ASBR1(config)#interface gigabitethernet0

ASBR1(config-if-gigabitethernet0)#ip pim sparse-mode

ASBR1(config-if-gigabitethernet0)#exit

ASBR1(config)#interface gigabitethernet1

ASBR1(config-if-gigabitethernet1)#ip pim sparse-mode

ASBR1(config-if-gigabitethernet1)#exit

ASBR1(config)#ip pim ssm default

#Enable the global multicast enabling and SSM function on ASBR2; configure the multicast protocol on the interface.

ASBR2(config)#ip multicast-routing

ASBR2(config)#interface loopback 0

ASBR2(config-if-loopback0)#ip pim sparse-mode

ASBR2(config-if-loopback0)#exit

ASBR2(config)#interface gigabitethernet0

ASBR2(config-if-gigabitethernet0)#ip pim sparse-mode

ASBR2(config-if-gigabitethernet0)#exit

ASBR2(config)#interface gigabitethernet1

ASBR2(config-if-gigabitethernet1)#ip pim sparse-mode

ASBR2(config-if-gigabitethernet1)#exit

ASBR2(config)#ip pim ssm default

#Enable the multicasting enabling globally and of the VPN instance on PE2, the RPF proxy function in VPN and the global SSM; configure the multicast protocol on the interface.

PE2(config)#ip multicast-routing

PE2(config)#ip multicast-routing vrf 1

PE2(config)#ip multicast rpf proxy rd vector vrf 1

PE2(config)#interface loopback 0

PE2(config-if-loopback0)#ip pim sparse-mode

PE2(config-if-loopback0)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#ip pim sparse-mode

PE2(config-if-gigabitethernet0)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#ip pim sparse-mode

PE2(config-if-gigabitethernet1)#exit

PE2(config)#ip pim ssm default

#Enable the global multicast enabling on CE1; configure the RP and BSR in the VPN instance; configure the multicast protocol on the interface.

CE1(config)#ip multicast-routing

CE1(config)#interface gigabitethernet0

CE1(config-if-gigabitethernet0)#ip pim sparse-mode

CE1(config-if-gigabitethernet0)#exit

CE1(config)#interface gigabitethernet1

CE1(config-if-gigabitethernet1)#ip pim sparse-mode

CE1(config-if-gigabitethernet1)#exit

CE1(config)#ip pim bsr-candidate gigabitethernet1

CE1(config)#ip pim rp-candidate gigabitethernet1

#Enable the global multicast enabling on CE2; configure the multicast protocol on the interface.

CE2(config)#ip multicast-routing

CE2(config)#interface gigabitethernet0

CE2(config-if-gigabitethernet0)#ip pim sparse-mode

CE2(config-if-gigabitethernet0)#exit

CE2(config)#interface gigabitethernet1

CE2(config-if-gigabitethernet1)#ip pim sparse-mode

CE2(config-if-gigabitethernet1)#exit

l Here, use the default range of SSM 232.0.0.0/8; the SSM range can use ip pim ssm range to change. The SSM range should contain Default MDT and Data MDT.

#View the global multicast interface information of the device in the backbone network.

Take PE1 as an example.

PE1#show ip pim interface

PIM Interface Table:

PIM VRF Name: Default

Total 3 Interface entries

Total 0 External Interface entry

Total 0 Sparse-Dense Mode Interface entry

Address Interface VIF Ver/ VIF Nbr DR DR BSR CISCO Neighbor

Index Mode Flag Count Priority Border Neighbor Filter

172.0.0.1 register_vif0 1 v2/S UP

192.168.1.1 gigabitethernet1 2 v2/S UP 1 1 192.168.1.2 FALSE FALSE

172.0.0.1 loopback0 0 v2/S UP 0 1 172.0.0.1 FALSE FALSE

We can see that there is the loopback port and Gi1 in the global multicast interface information of PE1.

#View the global multicast neighbor information of the device in the backbone network.

Take PE1 as an example.

PE1#show ip pim neighbor

PIM Neighbor Table:

PIM VRF Name: Default

Total 1 Neighbor entry

Neighbor Interface Uptime/Expires Ver DR

Address Priority/Mode

192.168.1.2 gigabitethernet1 2d00h06m/00:01:36 v2 1 / DR

We can see that there is the interface address information of P in the global multicast neighbor information of PE1.

l The checking method on PE2 and ASBR is the same as that of PE1.

#View the RP and BSR information in the multicast VPN on the device.

Take PE1 and CE2 as an example.

PE1#show ip pim rp mapping vrf 1

PIM Group-to-RP Mappings Table:

PIM VRF Name: 1

Total 1 RP set entry

Total 1 RP entry

Group(s): 224.0.0.0/4

RP count: 1

RP: 10.1.1.2

Info source: 10.1.1.2, via bootstrap, priority 192

Up time: 00:07:51

Expiry time: 00:00:39

PE1#show ip pim bsr-router vrf 1

PIMv2 Bootstrap information

PIM VRF Name: 1

BSR address: 10.1.1.2

BSR Priority: 0

Hash mask length: 10

Up time: 00:08:47

Expiry time: 00:00:14

Role: Non-candidate BSR

State: Accept Preferred

CE2#show ip pim rp mapping

PIM Group-to-RP Mappings Table:

PIM VRF Name: Default

Total 1 RP set entry

Total 1 RP entry

Group(s): 224.0.0.0/4

RP count: 1

RP: 10.1.1.2

Info source: 10.1.1.2, via bootstrap, priority 192

Up time: 00:09:29

Expiry time: 00:02:01

CE2#show ip pim bsr-router

PIMv2 Bootstrap information

PIM VRF Name: Default

BSR address: 10.1.1.2

BSR Priority: 0

Hash mask length: 10

Up time: 00:10:18

Expiry time: 00:01:43

Role: Non-candidate BSR

State: Accept Preferred

We can see that there is the BSR and RP information in the VPN of PE1 and the global of CE2.

l The checking method on PE2 and CE1 is the same as that on PE1 and CE2.

Step 8:

Configure Default MDT and Data MDT.

#Configure Default MDT and Data MDT on PE1.

PE1(config)#ip vrf 1

PE1(config-vrf)#mdt default 232.0.0.1

PE1(config-vrf)#mdt data 232.1.1.0 0.0.0.255

PE1(config-vrf)#exit

#Configure Default MDT and Data MDT on PE2.

PE1(config)#ip vrf 1

PE1(config-vrf)#mdt default 232.0.0.1

PE1(config-vrf)#mdt data 232.1.1.0 0.0.0.255

PE1(config-vrf)#exit

Step 9:

Check the result.

#View the BGP MDT route table on the device enabled with the BGP MDT address stack.

Take PE1 as an example.

PE1#show ip bgp ipv4 mdt all

BGP table version is 2, local router ID is 172.0.0.1

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1

[?]*> 172.0.0.1/32 0.0.0.0 0 ?

[B]*>i172.0.0.4/32 172.0.0.2 0 100 0 100 ?

We can see that there is the information of the route to the MTI interface of PE2 in the BGP MDT route table of PE1.

#View the MTI interface information on the PE.

Take PE1 as an example.

PE1#show ip pim interface vrf 1

PIM Interface Table:

PIM VRF Name: 1

Total 3 Interface entries

Total 1 External Interface entry

Total 0 Sparse-Dense Mode Interface entry

Address Interface VIF Ver/ VIF Nbr DR DR BSR CISCO Neighbor

Index Mode Flag Count Priority Border Neighbor Filter

10.1.1.1 register_vif0 1 v2/S UP

10.1.1.1 gigabitethernet0 0 v2/S UP 1 1 10.1.1.2 FALSE FALSE

172.0.0.1 tunnel1023 2 v2/S UP 1 1 172.0.0.4 FALSE FALSE

We can see that the multicast interface of the VPN instance of PE1 has tunnel1023 and the MTI interface automatically gets the IP address. The address is the same as the IP address of the loopback interface specified when configuring the BGP peer.

#View the multicast neighbor information in the VPN instance on the PE.

Take PE1 as an example.

PE1#show ip pim neighbor vrf 1

PIM Neighbor Table:

PIM VRF Name: 1

Total 2 Neighbor entries

Neighbor Interface Uptime/Expires Ver DR

Address Priority/Mode

10.1.1.2 gigabitethernet0 6d05h58m/00:01:36 v2 1 / DR

172.0.0.4 tunnel1023 00:01:28/00:01:17 v2 1 / DR

We can see that the MTI neighbor of PE1 is set up and there is the information of the MTI interface of PE2 in the neighbor list.

l tunnel 1023 is the MTI interface of MVPN. The MTI interface is one interface of connecting VPN to the backbone multicast domain. It can be regarded as one channel connecting the VPN and the global. Each VPN creates one tunnel interface. When BGP enables the VPN address stack and Update-Source, Default MDT is configured in the VPN and there is multicast interface, the interface is generated automatically.

#View the Default MDT information on the PE.

Take PE1 as an example.

PE1#show ip pim mdt

Total 1 MDT Groups

MDT Group Interface Source VRF

232.0.0.1 tunnel1023 loopback0 1

We can see that the MTI interface of PE1 is added to the Default MDT multicast group.

#View the global multicast route table on the device.

Take PE1 as an example.

PE1#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 0 (*,G) entry

Total 4 (S,G) entries

Total 0 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(172.0.0.1, 232.1.1.0)

Up time: 00:15:37

KAT time: 00:02:52

RPF nbr: 0.0.0.0

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

gigabitethernet1 00:15:37/00:02:53

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 743987

(172.0.0.1, 232.1.1.1)

Up time: 00:15:37

KAT time: 00:02:52

RPF nbr: 0.0.0.0

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

gigabitethernet1 00:15:37/00:02:53

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 743847

(172.0.0.1, 232.0.0.1)

Up time: 00:41:16

KAT time: 00:02:52

RPF nbr: 0.0.0.0

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

gigabitethernet1 00:39:20/00:03:07

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 39840

(172.0.0.4, 232.0.0.1)

Up time: 00:39:07

KAT time: 00:02:52

RPF nbr: 192.168.1.2 Vector: 172.0.0.2

RPF idx: gigabitethernet1

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

loopback0

Joined interface list:

Asserted interface list:

Outgoing interface list:

loopback0

Packet count 144

The used by the backbone network is PIM-SSM, so we can see that there is no the (*, G) entry in the multicast route table of the PE1 backbone network and the RPF proxy takes effect. On PE1, we can see that the RPF neighbor 172.0.0.2 of the source address 172.0.0.4 is replaced to 192.168.1.2, so as to complete the setup of the across-domain Default MDT.

l The checking method of PE2 is the same as that of PE1.

#At the Source, send the multicast service packets of multicast group 225.0.0.1 and 225.0.0.2; at the Receiver, send the IGMP member report packets of multicast group 225.0.0.1 and 225.0.0.2; when there is multicast traffic, view the Group in the backbone network on PE2.

PE2#show ip igmp groups

IGMP Static Group Membership

Total 6 static groups

Group Address Source Address Interface

232.1.1.0 0.0.0.0 loopback0

232.1.1.0 172.0.0.1 loopback0

232.1.1.1 0.0.0.0 loopback0

232.1.1.1 172.0.0.1 loopback0

232.0.0.1 0.0.0.0 loopback0

232.0.0.1 172.0.0.1 loopback0

We can see that the loopback port of PE2 is automatically added to Default MDT multicast group. When there is multicast traffic, the loopback port of PE2 is automatically added to Data MDT multicast group and the backbone network is switched from Default Mdt to Data-MDT.

#View the Data-MDT switching information on the PE.

PE1#show ip pim mdt send vrf 1

MDT-data send list for VRF: 1

Total 2 MDT-data Groups

(source, group) MDT-data group ref_count

(10.1.2.2, 225.0.0.2) 232.1.1.1 1

(10.1.2.2, 225.0.0.1) 232.1.1.0 1

PE2#show ip pim mdt receive vrf 1

Joined MDT-data [group : source] for VRF: 1

Total 2 MDT-data Groups

[232.1.1.0 : 172.0.0.1]

[232.1.1.1 : 172.0.0.1]

We can see that PE1 sends the switching information of Data MDT and PE2 also receives the Data MDT switching information of PE1 successfully.


6 MSDP


6.1 Overview

RP in the PIM-SM network only knows the multicast source information in the multicast domain, but in the actual application, the whole network is divided to multiple multicast domains. In the case, the RP in the domain cannot know the multicast source information out of the domain and the receiver cannot receive the multicast packets of other domains.

MSDP (Multicast Source Discovery Protocol) provides one multicast cross-domain solution. The MSDP mechanism transmits the multicast source information of the multicast domain to the RP of another multicast domain, and the RP in the other multicast domain can initiate adding to the multicast source of the multicast domain and set up the multicast distributing tree, so as to realize the cross-domain transmission of the multicast packets.


6.2 MSDP Function Configuration

Table 6‑1 MSDP function configuration list

Configuration Task
Configure the MSDP basic functions | Configure the MSDP peer
 | Disable the MSDP peer
Configure the MSDP peer connection | Configure the default MSDP peer
 | Configure the MSDP mesh group
Configure the SA packet | Configure the SA request packet
 | Configure the SA packet filter policy


6.2.1 Configure MSDP Peer

Set up the MSDP peer connection via the MSDP peer between the multicast domains, forming one “MSDP interconnection map”. When the MSDP peer of one domain perceives the new multicast source, encapsulate the new multicast source information in the SA (Source-Active) packet and send to all remote peers setting up the MSDP peer connection. After MSDP peer receives the SA packet, the SA packet passing the RPF (Reverse Path Forwarding) is forwarded. With the relay between the MSDP peers, you can transmit the SA message sent by one RP to all the other RPs, realizing the sharing of the multicast source information between the multicast domains.

Use the TCP as the transmission protocol between the MSDP peers. Use the reliability of TCP to ensure that the MSDP protocol packets can be transmitted to the remote peer correctly.

Configuration Condition

Before configuring MSDP, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

l Configure the PIM-SM protocol, realizing the intra-domain multicast

Configure MSDP Peer

Set up the MSDP peer connection between the local device and the specified remote device. At the remote device, you also should specify the local device as the MSDP peer so that the peer connection can be set up successfully. After the peer connection is set up successfully, the peers interact the MSDP protocol packets via the connection.

Table 6‑2 Configure the MSDP peer

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the MSDP peer | ip msdp [ vrf vrf-name ] peer peer-ip-address [ connect-source interface-name ] [ remote-as as-number-value ] | Mandatory By default, the MSDP peer is not configured.

l When configuring the first MSDP peer, automatically enable the MSDP protocol.

Disable MSDP Peer

The administrator can disable the specified MSDP peer connection via the command according to the network demand. After disabling the MSDP peer connection, stop interacting the MSDP protocol packets between the MSDP peers.

Table 6‑3 Disable the MSDP peer

Step | Command | Description
Enter global configuration mode | configure terminal | -
Disable the MSDP peer | ip msdp [ vrf vrf-name ] shutdown peer-ip-address | Mandatory By default, do not disable the MSDP peer.


6.2.2 Configure MSDP Peer Connection

After the device receives the SA packet, perform the RPF check. The packets passing the check are forwarded to the other peers that set up the peer connection. The packets not passing the RPF check are dropped.

The default peer, mesh group can omit specifying the RPF check of the SA packet between the peers.

Configuration Condition

Before configuring MSDP, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

l Configure the PIM-SM protocol, realizing the intra-domain multicast

l Configure the MSDP peer

Configure Default MSDP Peer

When specifying the default MSDP peer, you can configure the RP range. When receiving the SA packet sent by the default peer and if the RP in the packet belongs to the permitted range, do not perform the RPF check. Otherwise, still perform the RPF check for the RP in the packet.

Table 6‑4 Configure the default MSDP peer

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the default MSDP peer | ip msdp [ vrf vrf-name ] default-peer peer-ip-address [ prefix-list prefix-list-name ] | Mandatory By default, the MSDP default peer is not configured.

Configure MSDP Mesh Group

When receiving the SA packet from the peer in the group, the device directly passes the RPF check and does not forward the SA packet to the other peers in the group, but just forwards to the peers out of the group. This can reduce the load of the device and avoid the repeated forwarding, so as to save the network bandwidth.

Table 6‑5 Configure the MSDP mesh group

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the MSDP mesh group | ip msdp [ vrf vrf-name ] mesh-group mesh-group-name peer-ip-address | Mandatory By default, no peer is added to the mesh group.


6.2.3 Configure SA Packet

Configuration Condition

Before configuring MSDP, first complete the following tasks:

l Configure the network layer address of the interface, making the neighboring node network layer reachable

l Configure any unicast route protocol, reaching the intra-domain route reachable

l Configure the PIM-SM protocol, realizing the intra-domain multicast

l Configure the MSDP peer

Configure SA Request Packet

After configuring the SA request packet on the device, the device immediately sends the SA request packet to MSDP peer when receiving the new multicast group adding packet, so as to reduce the adding delay of the multicast group.

Some RP does not hope to be known by the receivers of the un-recognized other multicast domain. You can configure the filter policy of the SA request packet on all peers of the multicast domain to which the RP belongs. Only answer the SA request packet of the peers permitted by the policy.

Table 6‑6 Configure the SA request packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure sending the SA request packet | ip msdp [ vrf vrf-name ] sa-request peer-ip-address | Mandatory By default, when receiving the new multicast group adding packet, the device does not send the SA request packet to the MSDP peer, but waits for the SA packet of the next period.
Configure the filter policy of the received SA request packet | ip msdp [ vrf vrf-name ] filter-sa-request peer-ip-address [ list access-list-number | access-list-name ] | Mandatory By default, do not filter the SA request packet.

l ip msdp filter-sa-request only supports the standard ACL.

Configure SA Packet Filter Policy

Usually, the MSDP peer accepts the SA packets from all peers that pass the RPF check and forward to all the peers out of the mesh group. The user can configure the filter policy of the SA packet on the peer as desired, controlling the SA packets from or sent to the specified peer. When receiving or forwarding the SA packet, the device filters the multicast source group and RP of the SA packet.

Table 6‑7 Configure the filter policy of the SA packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the filter policy of the SA packet | ip msdp [ vrf vrf-name ] sa-filter { in | out } peer-ip-address [ list { access-list-name | access-list-number } ] [ rp-list { access-list-name | access-list-number } ] | Mandatory By default, do not filter the SA packet.

l The list parameter of ip msdp sa-filter only supports the extended ACL.

l The rp-list parameter of ip msdp sa-filter only supports the standard ACL.


6.2.4 MSDP Monitoring and Maintaining

Table 6‑8 MSDP Monitoring and Maintaining

Command | Description
clear ip msdp [ vrf vrf-name ] peer [ peer-ip-address ] | Clear the MSDP peer information
clear ip msdp [ vrf vrf-name ] sa-cache [ group-ip-address ] | Clear the SA cache information
clear ip msdp [ vrf vrf-name ] statistics [ peer-ip-address ] | Clear the statistics information of the MSDP peers
show ip msdp [ vrf vrf-name ] count [ as-number-value ] | Display the SA information received by MSDP from the AS domain
show ip msdp [ vrf vrf-name ] peer [ peer-ip-address [ accepted-SAs | advertised-SAs ] ] | Display the MSDP peer information
show ip msdp [ vrf vrf-name ] rpf [ peer-ip-address ] | Display the MSDP next-hop route information
show ip msdp [ vrf vrf-name ] sa-cache [ group-ip-address [ source-ip-address ] ] [ as-number-value ] | Display the MSDP SA cache information
show ip msdp [ vrf vrf-name ] summary | Display the summery information of the MSDP peer


6.3 MSDP Typical Configuration Example


6.3.1 Configure Inter-PIM-SM Domain Multicast

Network Requirements

l The whole network includes two AS: AS100 and AS200. Run the BGP protocol between Ass and use MBGP to interact the multicast route; in AS, run the OSPF protocol to interact the route.

l Multicast domain PIM-SM1 is located in AS100; multicast domain PIM-SM2 is located in AS200. Source is one multicast source of PIM-SM1. Receiver is one receiver of PIM-SM2.

l Loopback0 of Device2 is C-BSR and C-RP of PIM-SM1. Loopback0 of Device3 is C-BSR and C-RP of PIM-SM2.

l Between Device2 and Device3, set up the MSDP peer connection, so as to realize the cross-domain forwarding of the multicast service packet, so that Receiver can receive the multicast service packet sent by Source.

Network Topology

Figure 6-1 Networking of configuring the inter-PIM-SM domain multicast

Device | Interface | IP address | Device | Interface | IP address
Device1 | Gi0 | 10.1.1.1/24 | Device3 | Gi0 | 10.1.3.2/24
 | Gi1 | 10.1.2.1/24 |  | Gi1 | 10.1.4.1/24
Device2 | Gi0 | 10.1.2.2/24 |  | Loopback0 | 22.22.22.22/32
 | Gi1 | 10.1.3.1/24 | Device4 | Gi0 | 10.1.4.2/24
 | Loopback0 | 11.11.11.11/32 |  | Gi1 | 10.1.5.1/24
Source | - | 10.1.1.2/24 |  |  |

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Configure OSPF so that all devices in the AS domain can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

Device2(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

Device3(config-ospf)#network 22.22.22.22 0.0.0.0 area 0

Device3(config-ospf)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router ospf 100

Device4(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

Device4(config-ospf)#network 10.1.5.0 0.0.0.255 area 0

Device4(config-ospf)#exit

#View the route table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:05:44, gigabitethernet0

C 10.1.2.0/24 is directly connected, 22:24:35, gigabitethernet1

O 11.11.11.11/32 [110/2] via 10.1.2.2, 01:21:25, gigabitethernet1

#View the route table of Device4.

Device4#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.4.0/24 is directly connected, 22:41:14, gigabitethernet0

C 10.1.5.0/24 is directly connected, 00:08:11, gigabitethernet1

O 22.22.22.22/32 [110/2] via 10.1.4.1, 01:23:33, gigabitethernet0

You can see that Device1 and Device4 only learn the routes of the belonging AS domain.

l The viewing method of Device2 and Device3 is the same as that of Device1, Device4, so the viewing process is omitted.

Step 3:

Globally enable the multicast forwarding, enable the multicast protocol PIM-SM on the interface, and configure C-BSR and C-RP.

#Configure Device1.

Globally enable the multicast forwarding, and enable the multicast protocol PIM-SM on the interfaces.

Device1(config)#ip multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim sparse-mode

Device1(config-if-gigabitethernet1)#exit

#Configure Device2.

Globally enable the multicast forwarding, enable the multicast protocol PIM-SM on the interface, and configure Loopback0 as C-BSR and C-RP; the multicast group range of the C-RP service is 224.0.0.0/4.

Device2(config)#ip multicast-routing

Device2(config)#interface loopback 0

Device2(config-if-loopback0)#ip pim sparse-mode

Device2(config-if-loopback0)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim sparse-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim sparse-mode

Device2(config-if-gigabitethernet1)#exit

Device2(config)#ip pim bsr-candidate loopback0

Device2(config)#ip pim rp-candidate loopback0

#Configure Device3.

Globally enable the multicast forwarding, enable the multicast protocol PIM-SM on the interface, and configure Loopback0 as C-BSR and C-RP; the multicast group range of the C-RP service is 224.0.0.0/4.

Device3(config)#ip multicast-routing

Device3(config)#interface loopback 0

Device3(config-if-loopback0)#ip pim sparse-mode

Device3(config-if-loopback0)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip pim sparse-mode

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip pim sparse-mode

Device3(config-if-gigabitethernet1)#exit

Device3(config)#ip pim bsr-candidate loopback0

Device3(config)#ip pim rp-candidate loopback0

#Configure Device4.

Globally enable the multicast forwarding, and enable the multicast protocol PIM-SM on the interfaces.

Device4(config)#ip multicast-routing

Device4(config)#interface gigabitethernet0

Device4(config-if-gigabitethernet0)#ip pim sparse-mode

Device4(config-if-gigabitethernet0)#exit

Device4(config)#interface gigabitethernet1

Device4(config-if-gigabitethernet1)#ip pim sparse-mode

Device4(config-if-gigabitethernet1)#exit

#View the information of the interface enabled with the PIM-SM protocol on Device4 and the PIM-SM neighbor information.

Device4#show ip pim interface

PIM Interface Table:

PIM VRF Name: Default

Total 3 Interface entries

Total 0 External Interface entry

Total 0 Sparse-Dense Mode Interface entry

Address Interface VIF Ver/ VIF Nbr DR DR BSR CISCO Neighbor

Index Mode Flag Count Pri Border Neighbor Filter

10.1.4.2 register_vif0 1 v2/S UP

10.1.4.2 gigabitethernet0 0 v2/S UP 1 1 10.1.4.2 FALSE FALSE

10.1.5.1 gigabitethernet1 2 v2/S UP 0 1 10.1.5.1 FALSE FALSE

Device4#show ip pim neighbor

PIM Neighbor Table:

PIM VRF Name: Default

Total 1 Neighbor entry

Neighbor Interface Uptime/Expires Ver DR

Address Priority/Mode

10.1.4.1 gigabitethernet0 23:03:12/00:01:20 v2 1 /

l The viewing method of Device1, Device2, Device3 is the same as that of Device4, so the viewing process is omitted.

#View the BSR and RP information of Device4.

Device4#show ip pim bsr-router

PIMv2 Bootstrap information

PIM VRF Name: Default

BSR address: 22.22.22.22

BSR Priority: 0

Hash mask length: 10

Up time: 01:57:44

Expiry time: 00:01:28

Role: Non-candidate BSR

State: Accept Preferred

Device4#show ip pim rp mapping

PIM Group-to-RP Mappings Table:

PIM VRF Name: Default

Total 1 RP set entry

Total 1 RP entry

Group(s): 224.0.0.0/4

RP count: 1

RP: 22.22.22.22

Info source: 22.22.22.22, via bootstrap, priority 192

Up time: 01:57:45

Expiry time: 00:01:47

#View the BSR and RP information of Device1.

Device1#show ip pim bsr-router

PIMv2 Bootstrap information

PIM VRF Name: Default

BSR address: 11.11.11.11

BSR Priority: 0

Hash mask length: 10

Up time: 02:00:24

Expiry time: 00:01:44

Role: Non-candidate BSR

State: Accept Preferred

Device1#show ip pim rp mapping

PIM Group-to-RP Mappings Table:

PIM VRF Name: Default

Total 1 RP set entry

Total 1 RP entry

Group(s): 224.0.0.0/4

RP count: 1

RP: 11.11.11.11

Info source: 11.11.11.11, via bootstrap, priority 192

Up time: 02:00:30

Expiry time: 00:01:58

You can see that there is only the BSR and RP information of the belonging multicast domain on Device4, Device1.

l The viewing method of Device2 and Device3 is the same as that of Device1, Device4, so the viewing process is omitted.

Step 4:

Configure MP-EBGP. Set up the direct-connected EBGP peer between Device2 and Device3 and use the MBGP to interact the multicast route.

#Configure Device2.

Configure setting up the direct-connected EBGP peer with Device3, enable Multicast address stack and advertise the multicast route.

Device2(config)#router bgp 100

Device2(config-bgp)#neighbor 10.1.3.2 remote-as 200

Device2(config-bgp)#address-family ipv4 multicast

Device2(config-bgp-af)#network 10.1.1.0 255.255.255.0

Device2(config-bgp-af)#network 11.11.11.11 255.255.255.255

Device2(config-bgp-af)#neighbor 10.1.3.2 activate

Device2(config-bgp-af)#exit-address-family

Device2(config-bgp)#exit

#Configure Device3.

Configure setting up the direct-connected EBGP peer with Device2, enable Multicast address stack and advertise the multicast route.

Device3(config)#router bgp 200

Device3(config-bgp)#neighbor 10.1.3.1 remote-as 100

Device3(config-bgp)#address-family ipv4 multicast

Device3(config-bgp-af)#network 10.1.5.0 255.255.255.0

Device3(config-bgp-af)#network 22.22.22.22 255.255.255.255

Device3(config-bgp-af)#neighbor 10.1.3.1 activate

Device3(config-bgp-af)#exit-address-family

Device3(config-bgp)#exit

#View the BGP neighbor status of Device3.

Device3#show ip bgp summary

BGP router identifier 22.22.22.22, local AS number 200

BGP table version is 2

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

10.1.3.1 4 100 114 111 2 0 0 01:35:00 0

Total number of neighbors 1

According to the number displayed in the State/PfxRcd list (the number of the unicast route prefixes received from the neighbor), we can see that the BGP neighbor is set up between Device3 and Device2 successfully.

#View the BGP Multicast route table of Device3.

Device3#show bgp ipv4 multicast

BGP table version is 9, local router ID is 22.22.22.22

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 10.1.1.0/24 10.1.3.1 2 0 100 i

[B]*> 10.1.5.0/24 10.1.4.2 2 32768 i

[B]*> 11.11.11.11/32 10.1.3.1 0 0 100 i

[B]*> 22.22.22.22/32 0.0.0.0 0 32768 i

You can see that Device3 learns the Source and RP routes of the multicast domain PIM-SM1 and the next hop is MSDP peer 10.1.3.1.

l The viewing method of Device2 is the same as that of Device3, so the viewing process is omitted.

Step 5:

Configure MSDP.

#Configure Device2.

Configure setting up the direct-connected EBGP peer with Device3; enable the function of actively sending the SA request packet to the specified peer; configure using the RFC3618 rule to perform the RPF check for the MSDP packet.

Device2(config)#ip msdp peer 10.1.3.2 remote-as 200

Device2(config)#ip msdp sa-request 10.1.3.2

Device2(config)#ip msdp rpf rfc3618

#Configure Device3.

Configure setting up the direct-connected EBGP peer with Device2; enable the function of actively sending the SA request packet to the specified peer; configure using the RFC3618 rule to perform the RPF check for the MSDP packet.

Device3(config)#ip msdp peer 10.1.3.1 remote-as 100

Device3(config)#ip msdp sa-request 10.1.3.1

Device3(config)#ip msdp rpf rfc3618

#View the MSDP peer connection status and details of Device3.

Device3#show ip msdp summary

MSDP Peer Status Summary

Total 1 Peer entry

Peer Address AS State Reset Uptime/Downtime

10.1.3.1 100 Up 0 02:21:18

Device3#show ip msdp peer

MSDP Peer Table:

Total 1 Peer entry

MSDP Peer 10.1.3.1, AS 100 (configured AS)

Connection status:

State: Established, Resets: 0, Connection source: none configured

Uptime(Downtime): 02:50:00, Message sent/received: 136/161

Connection and counters cleared 02:13:25 ago

Local Address of connection: 10.1.3.2

Remote Address of connection: 10.1.3.1

Local Port: 639, Remote Port: 1179

SA-Requests:

Input filter: none

Sending SA-Requests to peer: enabled

SA:

Input filter: none

Message counters:

RPF Failure count: 0

SA Messages in/out: 47/0

SA Requests in/out: 0/3

SA Responses in/out: 3/0

Data Packets in/out: 0/0

You can see that the MSDP peer connection is set up successfully between Device3 and Device2.

l The viewing method of Device2 is the same as that of Device3, so the viewing process is omitted.

Step 6:

Check the result.

#Receiver sends the IGMPv2 member report packet to add to multicast group 225.1.1.1; Source sends the multicast service packet with multicast group 225.1.1.1.

#View the multicast member table on Device4.

Device4#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet1 00:05:11 00:02:38 10.1.5.2 stopped

#View the MSDP SA cache information of Device2.

Device2#show ip msdp sa-cache

MSDP Source-Active Cache - 1 entries

(10.1.1.2, 225.1.1.1), RP 11.11.11.11, Originated, 00:11:45/00:05:39

You can see that Device2 generates and caches the SA packet. The multicast source address in the SA packet is 10.1.1.2; the multicast group address is 225.1.1.1; the RP address is 11.11.11.11.

#View the MSDP SA cache information and RPF check table of Device3.

Device3#show ip msdp sa-cache

MSDP Source-Active Cache - 1 entries

(10.1.1.2, 225.1.1.1), RP 11.11.11.11, Recv From Peer 10.1.3.1, 00:08:39/00:05:21

Device3#show ip msdp rpf

Destination Nexthop Nexthop Nexthop Metric Pref

Address Address From RefCnt

10.1.3.1 0.0.0.0 0.0.0.0 1 10 0

11.11.11.11 10.1.3.1 10.1.3.1 1 0 20

You can see that Device3 receives and caches the SA packet. The SA packet is from the peer 10.1.3.1. The multicast source address in the packet is 10.1.1.2; the multicast group address is 225.1.1.1; the RP address is 11.11.11.11; the next hop of on the best path from Device3 to source end RP (11.11.11.11) is 10.1.3.1.

#View the PIM-SM multicast route table of Device3.

Device3#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 1 (*,G) entry

Total 1 (S,G) entry

Total 1 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(*, 225.1.1.1)

Up time: 00:13:57

RP: 22.22.22.22

RPF nbr: 0.0.0.0

RPF idx: None

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

gigabitethernet1 00:13:57/00:02:33

Asserted interface list:

(10.1.1.2, 225.1.1.1)

Up time: 00:13:57

KAT time: 00:03:28

RPF nbr: 10.1.3.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 6906038

(10.1.1.2, 225.1.1.1, rpt)

Up time: 00:13:57

RP: 22.22.22.22

Flags:

RPT JOIN DESIRED

PRUNE DESIRED

RPF SGRPT XG EQUAL

Upstream State: PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

gigabitethernet1

#Receiver can receive the multicast service packet with multicast group 225.1.1.1 sent by Source.

l The viewing method of Device2 is the same as that of Device3, so the viewing process is omitted.


6.3.2 Configure Anycast RP

Network Requirements

l The whole PIM multicast domain runs the PIM-SM protocol.

l Loopback0 interface of Device3 is C-BSR. Loopback1 interfaces of Device2 and Device4 are C-RP and the IP addresses are the same.

l Use the IP address of Loopback0 between Device2 and Device4 to set up the MSDP peer connection.

l In the domain, configure multiple RPs with the same address; non-RP device selects the nearest RP used to manage the multicast source and receiver. The RPs exchange the multicast source information via MSDP so that the multicast service of the whole multicast domain can be interacted. If one RP fails, its managed areas are shared by other RPs.

Network Topology

Figure 6-2 Networking of configuring Anycast RP

Device | Interface | IP address | Device | Interface | IP address
Device1 | Gi0 | 10.1.1.1/24 | Device3 | Loopback0 | 44.44.44.44/32
 | Gi1 | 10.1.2.1/24 | Device4 | Gi0 | 10.1.4.2/24
Device2 | Gi0 | 10.1.2.2/24 |  | Gi1 | 10.1.5.1/24
 | Gi1 | 10.1.3.1/24 |  | Loopback0 | 22.22.22.22/32
 | Loopback0 | 11.11.11.11/32 |  | Loopback1 | 55.55.55.55/32
 | Loopback1 | 55.55.55.55/32 | Device5 | Gi0 | 10.1.5.2/24
Device3 | Gi0 | 10.1.3.2/24 |  | Gi1 | 10.1.6.1/24
 | Gi1 | 10.1.4.1/24 | Source | - | 10.1.1.2/24

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Configure OSPF so that all devices in the network can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

Device2(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

Device2(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

Device2(config-ospf)#network 55.55.55.55 0.0.0.0 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

Device3(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

Device3(config-ospf)#network 44.44.44.44 0.0.0.0 area 0

Device3(config-ospf)#exit

#Configure Device4.

Device4#configure terminal

Device4(config)#router ospf 100

Device4(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

Device4(config-ospf)#network 10.1.5.0 0.0.0.255 area 0

Device4(config-ospf)#network 22.22.22.22 0.0.0.0 area 0

Device4(config-ospf)#network 55.55.55.55 0.0.0.0 area 0

Device4(config-ospf)#exit

#Configure Device5.

Device5#configure terminal

Device5(config)#router ospf 100

Device5(config-ospf)#network 10.1.5.0 0.0.0.255 area 0

Device5(config-ospf)#network 10.1.6.0 0.0.0.255 area 0

Device5(config-ospf)#exit

#View the route table of Device5.

Device5#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 10.1.1.0/24 [110/5] via 10.1.5.1, 04:04:37, gigabitethernet0

O 10.1.2.0/24 [110/4] via 10.1.5.1, 04:05:13, gigabitethernet0

O 10.1.3.0/24 [110/3] via 10.1.5.1, 04:17:36, gigabitethernet0

O 10.1.4.0/24 [110/2] via 10.1.5.1, 18:19:08, gigabitethernet0

C 10.1.5.0/24 is directly connected, 18:22:13, gigabitethernet0

C 10.1.6.0/24 is directly connected, 04:32:51, gigabitethernet1

O 11.11.11.11/32 [110/4] via 10.1.5.1, 04:17:36, gigabitethernet0

O 22.22.22.22/32 [110/2] via 10.1.5.1, 03:56:25, gigabitethernet0

O 44.44.44.44/32 [110/3] via 10.1.5.1, 04:13:23, gigabitethernet0

O 55.55.55.55/32 [110/2] via 10.1.5.1, 04:17:36, gigabitethernet0

#We can see that Device5 leans the routes of multicast source, BSR and RP.

l The viewing method of Device1, Device2, Device3, and Device4 is the same as that of Device5, so the viewing process is omitted.

Step 4:

Globally enable the multicast forwarding, enable the multicast protocol PIM-SM on the interface, and configure C-BSR and C-RP.

#Configure Device1.

Globally enable the multicast forwarding, and enable the multicast protocol PIM-SM on the interface.

Device1(config)#ip multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ip pim sparse-mode

Device1(config-if-gigabitethernet1)#exit

#Configure Device2.

Globally enable the multicast forwarding, enable the multicast protocol PIM-SM on the interface, and configure Loopback1 as C-RP; the multicast group range of the C-RP service is 224.0.0.0/4.

Device2(config)#ip multicast-routing

Device2(config)#interface loopback0

Device2(config-if-loopback0)#ip pim sparse-mode

Device2(config-if-loopback0)#exit

Device2(config)#interface loopback1

Device2(config-if-loopback1)#ip pim sparse-mode

Device2(config-if-loopback1)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ip pim sparse-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ip pim sparse-mode

Device2(config-if-gigabitethernet1)#exit

Device2(config)#ip pim rp-candidate loopback1

#Configure Device3.

Globally enable the multicast forwarding, enable the multicast protocol PIM-SM on the interface, and configure Loopback0 as C-BSR.

Device3(config)#ip multicast-routing

Device3(config)#interface loopback0

Device3(config-if-loopback0)#ip pim sparse-mode

Device3(config-if-loopback0)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip pim sparse-mode

Device3(config-if-gigabitethernet0)#exit

Device3(config)#interface gigabitethernet1

Device3(config-if-gigabitethernet1)#ip pim sparse-mode

Device3(config-if-gigabitethernet1)#exit

Device3(config)#ip pim bsr-candidate loopback0

#Configure Device4.

Globally enable the multicast forwarding, enable the multicast protocol PIM-SM on the interface, and configure Loopback1 as C-RP; the multicast group range of the C-RP service is 224.0.0.0/4.

Device4(config)#ip multicast-routing

Device4(config)#interface loopback0

Device4(config-if-loopback0)#ip pim sparse-mode

Device4(config-if-loopback0)#exit

Device4(config)#interface loopback1

Device4(config-if-loopback1)#ip pim sparse-mode

Device4(config-if-loopback1)#exit

Device4(config)#interface gigabitethernet0

Device4(config-if-gigabitethernet0)#ip pim sparse-mode

Device4(config-if-gigabitethernet0)#exit

Device4(config)#interface gigabitethernet1

Device4(config-if-gigabitethernet1)#ip pim sparse-mode

Device4(config-if-gigabitethernet1)#exit

Device4(config)#ip pim rp-candidate loopback1

#Configure Device5. Globally enable the multicast forwarding and enable the multicast protocol PIM-SM on the interface.

Device5(config)#ip multicast-routing

Device5(config)#interface gigabitethernet0

Device5(config-if-gigabitethernet0)#ip pim sparse-mode

Device5(config-if-gigabitethernet0)#exit

Device5(config)#interface gigabitethernet1

Device5(config-if-gigabitethernet1)#ip pim sparse-mode

Device5(config-if-gigabitethernet1)#exit

#View the information of the interface enabled with the PIM-SM protocol on Device5 and the PIM-SM neighbor information.

Device5#show ip pim interface

PIM Interface Table:

PIM VRF Name: Default

Total 3 Interface entries

Total 0 External Interface entry

Total 0 Sparse-Dense Mode Interface entry

Address Interface VIF Ver/ VIF Nbr DR DR BSR CISCO Neighbor

Index Mode Flag Count Pri Border Neighbor Filter

10.1.5.2 register_vif0 1 v2/S UP

10.1.5.2 gigabitethernet0 0 v2/S UP 1 1 10.1.5.2 FALSE FALSE

10.1.6.1 gigabitethernet1 2 v2/S UP 0 1 10.1.6.1 FALSE FALSE

Device5#show ip pim neighbor

PIM Neighbor Table:

PIM VRF Name: Default

Total 1 Neighbor entry

Neighbor Interface Uptime/Expires Ver DR

Address Priority/Mode

10.1.5.1 gigabitethernet0 18:37:22/00:01:45 v2 1 /

#View the BSR and RP information of Device5.

Device5#show ip pim bsr-router

PIMv2 Bootstrap information

PIM VRF Name: Default

BSR address: 44.44.44.44

BSR Priority: 0

Hash mask length: 10

Up time: 04:36:44

Expiry time: 00:01:35

Role: Non-candidate BSR

State: Accept Preferred

Device5#show ip pim rp mapping

PIM Group-to-RP Mappings Table:

PIM VRF Name: Default

Total 1 RP set entry

Total 1 RP entry

Group(s): 224.0.0.0/4

RP count: 1

RP: 55.55.55.55

Info source: 44.44.44.44, via bootstrap, priority 192

Up time: 04:36:44

Expiry time: 00:01:53

l The viewing method of Device1, Device2, Device3, Device4 is the same as that of Device5, so the viewing process is omitted.

Step 4:

Configure MSDP.

#Configure Device2.

Configure setting up the non-direct-connected MSDP peer connection via Loopback0 with Loopback0 of Device4; enable the function of actively sending the SA request packet to the specified peer; configure the RP address in the SA packet as the IP address of Loopback0; configure using the RFC3618 rule to perform the RPF check for the MSDP packet.

Device2(config)#ip msdp peer 22.22.22.22 connect-source loopback0

Device2(config)#ip msdp sa-request 22.22.22.22

Device2(config)#ip msdp originator-id loopback0

Device2(config)#ip msdp rpf rfc3618

#Configure Device4.

Configure setting up the non-direct-connected MSDP peer connection via Loopback0 with Loopback0 of Device2; enable the function of actively sending the SA request packet to the specified peer; configure the RP address in the SA packet as the IP address of Loopback0; configure using the RFC3618 rule to perform the RPF check for the MSDP packet.

Device4(config)#ip msdp peer 11.11.11.11 connect-source loopback0

Device4(config)#ip msdp sa-request 11.11.11.11

Device4(config)#ip msdp originator-id loopback0

Device4(config)#ip msdp rpf rfc3618

#View the MSDP peer connection status and details of Device4.

Device4#show ip msdp summary

MSDP Peer Status Summary

Total 1 Peer entry

Peer Address AS State Reset Uptime/Downtime

11.11.11.11 ? Up 0 05:49:35

Device4#show ip msdp peer

MSDP Peer Table:

Total 1 Peer entry

MSDP Peer 11.11.11.11, AS ?

Connection status:

State: Established, Resets: 0, Connection source: loopback0

Uptime(Downtime): 05:49:39, Message sent/received: 352/528

Connection and counters cleared 05:53:24 ago

Local Address of connection: 22.22.22.22

Remote Address of connection: 11.11.11.11

Local Port: 639, Remote Port: 1053

SA-Requests:

Input filter: none

Sending SA-Requests to peer: enabled

SA:

Input filter: none

Message counters:

RPF Failure count: 3

SA Messages in/out: 348/0

SA Requests in/out: 0/3

SA Responses in/out: 2/0

Data Packets in/out: 0/0

You can see that Device4 and Device2 set up the MSDP peer connection successfully.

l The viewing method of Device2 is the same as that of Device4, so the viewing process is omitted.

Step 5:

Check the result.

# Source sends the multicast service packet with multicast group 225.1.1.1.

#View the MSDP SA cache information of Device2.

Device2#show ip msdp sa-cache

MSDP Source-Active Cache - 1 entries

(10.1.1.2, 225.1.1.1), RP 55.55.55.55, Originated, 00:03:34/00:05:43

You can see that Device2 generates and caches the SA packet. The multicast source address in the SA packet is 10.1.1.2; the multicast group address is 225.1.1.1; the RP address is 55.55.55.55.

#View the MSDP SA cache information and RPF check table of Device4.

Device4#show ip msdp sa-cache

MSDP Source-Active Cache - 1 entries

(10.1.1.2, 225.1.1.1), RP 11.11.11.11, Recv From Peer 11.11.11.11, 00:07:02/00:05:58

Device4#show ip msdp rpf

Destination Nexthop Nexthop Nexthop Metric Pref

Address Address From RefCnt

10.1.4.1 0.0.0.0 0.0.0.0 1 10 0

11.11.11.11 10.1.4.1 55.55.55.55 3 3 110

55.55.55.55 0.0.0.0 0.0.0.0 2 1 0

You can see that Device4 receives and caches the SA packet. The SA packet is from the peer 11.11.11.11. The multicast source address in the packet is 10.1.1.2; the multicast group address is 225.1.1.1; the RP address is 11.11.11.11.

l If ip msdp originator-id is configured on the source RP and when it sends the SA packet to MSDP peer, it replaces the RP address in the packet with the IP address of the specified interface.

#View the PIM-SM multicast route table of Device2.

Device2#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 0 (*,G) entry

Total 1 (S,G) entry

Total 1 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(10.1.1.2, 225.1.1.1)

Up time: 00:01:14

KAT time: 00:03:23

RPF nbr: 10.1.2.1

RPF idx: gigabitethernet0

SPT bit: FALSE

Flags:

Upstream State: NOT JOINED

Local interface list:

Joined interface list:

Asserted interface list:

Outgoing interface list:

Packet count 0

(10.1.1.2, 225.1.1.1, rpt)

Up time: 00:01:14

RP: 55.55.55.55

Flags:

RPF SGRPT XG EQUAL

Upstream State: RPT NOT JOINED

Local interface list:

Pruned interface list:

Outgoing interface list:

#View the PIM-SM multicast route table of Device4.

Device4#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 0 (*,G) entry

Total 0 (S,G) entry

Total 0 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

You can see that there is (10.1.1.2, 225.1.1.1) entry on Device2 and no (10.1.1.2, 225.1.1.1) entry on Device4. It indicates that Source initiates the PIM-SM register to the nearest RP, that is, Device2.

#Receiver sends the IGMPv2 member report packet to add to multicast group 225.1.1.1.

#View the multicast member table on Device5.

Device5#show ip igmp groups

IGMP Connected Group Membership

Total 1 groups

Group Address Interface Uptime Expires Last Reporter V1 Expires V2 Expires

225.1.1.1 gigabitethernet1 00:00:12 00:04:12 10.1.6.2 stopped

#View the PIM-SM multicast route table of Device2.

Device2#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 0 (*,G) entry

Total 1 (S,G) entry

Total 1 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(10.1.1.2, 225.1.1.1)

Up time: 00:19:01

KAT time: 00:03:14

RPF nbr: 10.1.2.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

gigabitethernet1 00:02:56/00:02:34

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 1136269

(10.1.1.2, 225.1.1.1, rpt)

Up time: 00:19:01

RP: 55.55.55.55

Flags:

RPF SGRPT XG EQUAL

Upstream State: RPT NOT JOINED

#View the PIM-SM multicast route table of Device4.

Device4#show ip pim mroute

IP Multicast Routing Table:

PIM VRF Name: Default

Total 0 (*,*,RP) entry

Total 1 (*,G) entry

Total 1 (S,G) entry

Total 1 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(*, 225.1.1.1)

Up time: 00:05:54

RP: 55.55.55.55

RPF nbr: 0.0.0.0

RPF idx: None

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

gigabitethernet1 00:05:54/00:02:36

Asserted interface list:

(10.1.1.2, 225.1.1.1)

Up time: 00:05:54

KAT time: 00:03:22

RPF nbr: 10.1.4.1

RPF idx: gigabitethernet0

SPT bit: TRUE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

Joined interface list:

gigabitethernet1 00:05:54/00:02:37

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 2172581

(10.1.1.2, 225.1.1.1, rpt)

Up time: 00:05:54

RP: 55.55.55.55

Flags:

RPT JOIN DESIRED

PRUNE DESIRED

RPF SGRPT XG EQUAL

Upstream State: PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

gigabitethernet1

You can see that there is (*,225.1.1.1) entry on Device4 and no (*,225.1.1.1) entry on Device2. It indicates that Source initiates the PIM-SM adding to the nearest RP, that is, Device4.

#Receiver can receive the multicast service packet with multicast group 225.1.1.1 sent by Source.


7 MLD


7.1 Overview

MLD is short for Multicast Listener Discovery Protocol, used to set up and maintain the multicast group member relation between the IPv6 host and its dirst neighboring multicast device.

MLD router uses the local address of the IPv6 unicast link as the source address to send the MLD packet. MLD uses ICMPv6 (Internet Control Message Protocol for IPv6) packet type. All MLD packets are limited on the local link, and the hops are 1.

MLD has two versions: MLDv1n corresponds to IGMPv2, and MLDv2 corresponds to IGMPv3.

The packet types of the IGMP protocol adopting the IP protocol number 2 are different. The MLD protocol adopts the ICMPv6 (IP protocol number is 58) packet type, including MLD query packet (type value is 130), MLDv1 report packet (type value is 131), MLDv1 leave packet (type value is 132), and MLDv2 report packet (type value is 143). The MLD protocol and IGMP protocol have different packet formats, but have the same protocol actions.


7.2 MLD Function Configuration

Table 7‑1 MLD function configuration list

Configuration tasks
Configure the MLD basic functions | Enable the MLD protocol in the interface
Adjust and optimize the MLD network | Configure the query interval of the general group
 | Configure the robustness factor
 | Configure the maximum response time
 | Configure the specified group query
 | Configure the fast leave
Configure the MLD SSM mapping | Configure the MLD SSM mapping


7.2.1 Configure MLD Basic Functions

Configuration Condition

Before configuring the MLD basic functions, first complete the following task:

l Enable the interface IPv6

l Enable the interface MLD

Enable the MLD Protocol

Table 7‑2 Enable the MLD protocol

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enable the IPv6 multicast forwarding | ipv6 multicast-routing [ vrf vrf-name ] | Mandatory By default, the IPv6 multicast forwarding is disabled.
Enter the interface configuration mode | interface interface-name | -
Enable the MLD protocol | ipv6 mld enable | Mandatory By default, do not enable MLD. After enabling MLD, all MLD configurations can take effect.

Configure the MLD Version

Table 7‑3 Configure the MLD version

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the MLD version | ipv6 mld version version-number | Mandatory By default, the MLD version is 2.

l Because the packet structure and kind of different versions of MLD protocols are different, it is suggested to configure the same version of IGMP for all devices on the same subnet.

Configure Static Group Adding

After configuring one static group or source group in the interface, the device regards that the interface has the receiver of the multicast group or source group.

Table 7‑4 Configure static group adding

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the static group adding | ipv6 mld static-group group-ipv6-address [ source-ipv6-address ] | Mandatory By default, the interface is not added to any multicast group or source group in the static mode.

Configure Multicast Group Filter

The interface configured with the MLD multicast group filter filters the group member relation report in the segment according to the ACL rules and only the group member relation report permitted by ACL is processed and the un-permitted is directly dropped. For the existing but not permitted by ACL multicast group, immediately delete the multicast group information.

Table 7‑5 Configure multicast group filter

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the IGMP multicast group filter | ipv6 mld access-group { access-list-number | access-list-name } | Mandatory By default, the multicast group filter is not configured.

l The ipv6 mld access-group command only supports the standard ACL.


7.2.2 Adjust and Optimize the MLD Network

Configuration Condition

Before adjusting and optimizing the MLD network, first complete the following tasks:

l Enable the IPv6 protocol

l Enable the MLD protocol on the interface

Configure Query Interval of General Group

MLD querier periodically sends the general group query packets to maintain the group member relation. You can modify the interval of sending the MLD general group query packets according to the actuality of the network.

Table 7‑6 Configure the query interval of the general group

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the query interval of the general group | ipv6 mld query-interval interval-value | Optional By default, the interval of sending the MLD general group query packets is 125s.

l The genera query intervals of the devices on the same segment should try to keep consistent.

l The general group query interval should be larger than the maximum response time. Otherwise, the configuration cannot succeed.

Configure Robustness Factor

The robustness factor is used to prevent the packet loss.

Table 7‑7 Configure the robustness factor

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the robustness factor | ipv6 mld robustness-variable variable-value | Optional By default, the robustness factor of the MLD querier is 2.

l After configuring the robustness factor, the following parameters also change with the robustness parameters:

1. Group member timeout = Robustness factor * general group query time + maximum response time;

2. Other querier timeout = Robustness factor * general group query time + maximum response time/2;

3. The larger the robustness factor, the larger the MLD group member timeout and other querier timeout. Set the value according to the actuality of the network.

Configure Maximum Response Time

The general group query packet sent by the querier contains the maximum response time field and the receiver sends the group member relation report within the maximum response interval. If the receiver does not send the group member relation report within the maximum response time, the device regards that the subnet does not have the receiver of the multicast group and deletes the multicast group information immediately.

Table 7‑8 Configure the maximum response time

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the maximum response time | ipv6 mld query-max-response-time seconds | Optional By default, the maximum response time of the MLD general group query is 10s.

Configure Specified Group Query

After the MLD querier receives the leave packet of one multicast group, send the specified group query packet to query the multicast group on the segment. The sending times of the packet depends on “Specified group query times”. This is to know whether the subnet has the members of the multicast group. If not receiving the member relation report of the multicast group after waiting for “maximum response time”, delete the information of the multicast group.

Table 7‑9 Configure the specified group query

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the query interval of the specified group | ipv6 mld last-member-query-interval interval-value | Optional By default, the interval of sending the specified group query packets is 1s.
Configure the query times of the specified group | ipv6 mld last-member-query-count count-value | Optional By default, the times of sending the specified group query packets is 2.

Configure Fast Leave

The end segment in the network only connects to one host, which performs the switching action of the multicast group frequently. To reduce the leave delay, you can configure the fast leave of the multicast group on the device.

After configuring the fast leave, the device receives the leave packet of one multicast group and checks whether the multicast group belongs to the fast leave range. If yes, the device does not send the specified group query packet to the segment any more and deletes the information of the multicast group immediately.

Table 7‑10 Configure the fast leave

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the source group range of the fast leave | ipv6 mld immediate-leave group-list { access-list-number | access-list-name } | Mandatory By default, do not permit the fast leave of the multicast group


7.2.3 Configure the MLD SSM Mapping

Configuration Condition

Before configuring the MLD SSM mapping, first complete the following tasks:

l Enable the interface IPv6

l Enable the interface MLD

Configure the MLD SSM Mapping

To provide the PIM-SMv6 SSM service for the receiver not supporting MLDv2 in the PIM-SMv6 SSM network, we can configure the MLD SSM Mapping function on the device.

The user can configure the MLD SSM Mapping rule according to the demand of the network receiver. The group member relation report permitted by the rule is converted to the MLD non-member (IS_EX, TO_EX) relation report, and the multicast source address is the source address specified by the MLD SSM mapping rule.

Table 7‑11 Configure the MLD SSM mapping

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enable MLD SSM Mapping | ipv6 mld ssm-map enable [ vrf vrf-name ] | Mandatory By default, MLD SSM Mapping is not enabled.
Configure the MLD SSM Mapping rule | ipv6 mld ssm-map static { access-list-number | access-list-name } source-ipv6-address [ vrf vrf-name ] | Mandatory By default, there is no MLD SSM Mapping rule.

l The ipv6 mld ssm-map static command only supports the extended ACL.


7.2.4 MLD Monitoring and Maintaining

Table 7‑12 MLD monitoring and maintaining

Command | Description
clear ipv6 mld group [ group-ipv6-address ] [ interface-name ] [ vrf vrf-name ] | Clear the MLD multicast group information
clear ipv6 mld statistic interface interface-name | Clear the MLD packet statistics information on the interface
show ipv6 mld groups [ [ static ] | [ interface-name ] [ group-ipv6-address ] [ detail ] ] [ vrf vrf-name ] | Display the MLD multicast group information
show ipv6 mld interface [ interface-name ] [ vrf vrf-name ] | Display the interface MLD information
show ipv6 mld statistic interface interface-name [ vrf vrf-name ] | Display the statistics information of the MLD packets


7.3 MLD Typical Configuration Example


7.3.1 Configure MLD Basic Functions

Network Requirements

l The whole network runs the PIM-SMv6 protocol.

l Device1, Device2, and Receiver are in the same LAN and Device1 is the querier.

l Receiver is one receiver of Device1 and Device2 stub network.

l Run MLDv2 between Device1, Device2 and stub network.

Network Topology

Figure 7-1 Networking of configuring MLD basic functions

Configuration Steps

Step 1: | Configure the IPv6 address of the interface (omitted).
Step 2: | Globally enable the IPv6 multicast forwarding and enable the multicast protocol PIM-SMv6 on the interface. Enable MLD on the interface of Device1 and Device2 connecting the Receiver.

#Configure Device1.

Globally enable the IPv6 multicast forwarding, enable the multicast protocol PIM-SMv6 on the related interfaces, and enable MLD on the interface of connecting Receiver.

Device1#configure terminal

Device1(config)#ipv6 multicast-routing

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ipv6 pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ipv6 pim sparse-mode

Device1(config-if-gigabitethernet1)#ipv6 mld enable

Device1(config-if-gigabitethernet1)#exit

#Configure Device2.

Globally enable the IPv6 multicast forwarding, enable the multicast protocol PIM-SMv6 on the related interfaces, and enable MLD on the interface of connecting Receiver.

Device2#configure terminal

Device2(config)#ipv6 multicast-routing

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ipv6 pim sparse-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ipv6 pim sparse-mode

Device2(config-if-gigabitethernet1)#ipv6 mld enable

Device2(config-if-gigabitethernet1)#exit

Step 3:

Check the result.

#View the MLD version information and querier election result of Device1 interface gigabitethernet1.

Device1#show ipv6 mld interface gigabitethernet 1

Interface gigabitethernet1 (Index 23)

MLD Enabled, Active

Querier: fe80::201:2ff:fe03:406 (Self)

Default version: 2

Querier parameter:

Query interval is 125 seconds

Querier timeout is 255 seconds

Query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

Robustness variable is 2

#View the MLD version information and querier election result of Device2 interface gigabitethernet1.

Device2#show ipv6 mld interface gigabitethernet 1

Interface gigabitethernet1 (Index 50331674)

MLD Enabled, Active

Querier: fe80::201:2ff:fe03:406

Non-Querier: fe80::201:7aff:febc:662b Expires: 00:04:07

Default version: 2

Querier parameter:

Query interval is 125 seconds

Querier timeout is 255 seconds

Query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

Robustness variable is 2

# Receiver sends the MLDv2 member report packet to add to multicast group FF1E::1.

#View the multicast member table of Device1.

Device1#show ipv6 mld groups

MLD Connected Group Membership

Total 1 Connected Groups

Group Interface Uptime Expires V1-Expires Last Reporter

ff1e::1 gigabitethernet1 00:00:02 00:04:17 not used fe80::b

#View the multicast member table of Device2.

Device2#show ipv6 mld groups

MLD Connected Group Membership

Total 1 Connected Groups

Group Interface Uptime Expires V1-Expires Last Reporter

ff1e::1 gigabitethernet1 00:00:02 00:04:17 not used fe80::b

l On the interface, run the MLDv2 version, be compatible with the MLDv1 member relation report and MLDv1 member leave packet by default. You can configure the running MLD version of the interface via the command ipv6 mld version.

l When multiple devices run MLD in one LAN, elect the MLD querier and the one with the smallest address is elected as the MLD querier of the LAN.


7.3.2 Configure IGMP Static Adding

Network Requirements

l The whole network runs the PIM-SMv6 protocol.

l Receiver is one receiver of the Device stub network.

l Run MLDv2 between Device and the stub network.

l Device interface gigabitethernet1 adds to multicast group FF1E::1 statically.

Network Topology

Figure 7-2 Networking of configuring MLD static adding

Configuration Steps

Step 1: | Configure the IPv6 address of the interface (omitted).
Step 2: | Globally enable the IPv6 multicast forwarding, enable the multicast protocol PIM-SMv6 on the interface. Enable MLD on the interface of connecting the Receiver.

#Configure Device.

Globally enable the IPv6 multicast forwarding, enable the multicast protocol PIM-SMv6 on the related interfaces, and enable MLD on the interface of connecting Receiver.

Device#configure terminal

Device(config)#ipv6 multicast-routing

Device(config)#interface gigabitethernet0

Device(config-if-gigabitethernet0)#ipv6 pim sparse-mode

Device(config-if-gigabitethernet0)#exit

Device(config)#interface gigabitethernet1

Device(config-if-gigabitethernet1)#ipv6 pim sparse-mode

Device(config-if-gigabitethernet1)#ipv6 mld enable

Device(config-if-gigabitethernet1)#exit

#View the MLD information of Device interface gigabitethernet1.

Device#show ipv6 mld interface gigabitethernet 1

Interface gigabitethernet1 (Index 23)

MLD Enabled, Active

Querier: fe80::201:2ff:fe03:406 (Self)

Default version: 2

Querier parameter:

Query interval is 125 seconds

Querier timeout is 255 seconds

Query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

Robustness variable is 2

Step 3:

Device interface gigabitethernet 1 adds to multicast group FF1E::1 statically.

#Configure Device.

Device interface gigabitethernet 1 adds to multicast group FF1E::1 statically.

Device(config)#interface gigabitethernet1

Device(config-if-gigabitethernet1)#ipv6 mld static-group ff1e::1

Device(config-if-gigabitethernet1)#exit

Step 4:

Check the result.

#Source sends the multicast packet with multicast group FF1E::1.

#View the multicast member table of Device.

Device#show ipv6 mld groups

MLD Static Group Membership

Total 1 Static Groups

Group Source Interface

ff1e::1 :: gigabitethernet1

#View the multicast route table of Device.

Device#show ipv6 pim mroute

IP Multicast Routing Table:

PIM6 VRF Name: Default

Total 0 (*,*,RP) entry

Total 1 (*,G) entry

Total 1 (S,G) entry

Total 1 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(*, ff1e::1)

Up time: 00:01:06

RP: ::

RPF nbr: ::

RPF idx: None

Flags:

Upstream State: NOT JOINED

Local interface list:

gigabitethernet1

Joined interface list:

Asserted interface list:

(1000::a, ff1e::1)

Up time: 00:00:04

KAT time: 00:03:26

RPF nbr: ::

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

COULD REGISTER

Upstream State: JOINED

Local interface list:

Joined interface list:

register_vif0

Asserted interface list:

Outgoing interface list:

register_vif0

gigabitethernet1

Packet count 1

(1000::a, ff1e::1, rpt)

Up time: 00:00:04

RP: ::

Flags:

RPT JOIN DESIRED

RPF SGRPT XG EQUAL

Upstream State: NOT PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

#Receiver can receive the multicast packet with multicast group FF1E::1 sent by Source.


7.3.3 Configure MLD SSM Mapping

Network Requirements

l The whole network runs the PIM-SMv6 SSM protocol.

l Receiver1, Receiver2, and Device2 are all in one LAN.

l Run MLDv2 between Device2 and the stub network.

l Use the MLD SSM mapping on Device2 so that Receiver2 can only receive the multicast service packets sent by Source1.

Network Topology

Figure 7-3 Networking of configuring the MLD SSM mapping

Configuration Steps

Step 1: | Configure the IPv6 address of the interface (omitted).
Step 2: | Enable the IPv6 unicast routing OSPFv3 so that all network devices in the network can communicate with each other.

#Configure Device1.

Device1#configure terminal

Device1(config)#ipv6 router ospf 100

Device1(config-ospf6)#router-id 1.1.1.1

Device1(config-ospf6)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ipv6 router ospf 100 area 0

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ipv6 router ospf 100 area 0

Device1(config-if-gigabitethernet1)#exit

Device1(config)#interface gigabitethernet2

Device1(config-if-gigabitethernet2)#ipv6 router ospf 100 area 0

Device1(config-if-gigabitethernet2)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#ipv6 router ospf 100

Device2(config-ospf6)#router-id 2.2.2.2

Device2(config-ospf6)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ipv6 router ospf 100 area 0

Device2(config-if-gigabitethernet0)#exit

#View the route table of Device2.

Device2#show ipv6 route

Codes: C - Connected, L - Local, S - static, R - RIP, B - BGP, i-ISIS

U - Per-user Static route O - OSPF, OE-OSPF External, M - Management

L ::1/128 [0/0]

via ::, 05:20:37, lo0

O 1000::/64 [110/2]

via fe80::201:2ff:fe03:406, 00:35:30, gigabitethernet0

O 2000::/64 [110/2]

via fe80::201:2ff:fe03:406, 00:37:15, gigabitethernet0

C 3000::/64 [0/0]

via ::, 00:38:24, gigabitethernet0

L 3000::2/128 [0/0]

via ::, 00:38:22, lo0

C 4000::/64 [0/0]

via ::, 00:31:55, gigabitethernet1

L 4000::2/128 [0/0]

via ::, 00:31:53, lo0

l The viewing method of Device1 is the same as that of Device2, so the viewing process is omitted.

Step 3:

Enable the IPv6 multicast forwarding globally, configure PIM-SMv6 SSM globally and the multicast group range of the SSM service is FF3X::/32. On the interfaces, enable the multicast protocol PIM-SMv6. The interface gigabitethernet1 of Device2 runs MLDv2.

#Configure Device1.

Enable the IPv6 multicast forwarding globally, configure the PIM-SMv6 SSM globally and enable the multicast protocol PIM-SMv6 on the interface.

Device1(config)#ipv6 multicast-routing

Device1(config)#ipv6 pim ssm default

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ipv6 pim sparse-mode

Device1(config-if-gigabitethernet0)#exit

Device1(config)#interface gigabitethernet1

Device1(config-if-gigabitethernet1)#ipv6 pim sparse-mode

Device1(config-if-gigabitethernet1)#exit

Device1(config)#interface gigabitethernet2

Device1(config-if-gigabitethernet2)#ipv6 pim sparse-mode

Device1(config-if-gigabitethernet2)#exit

#Configure Device2.

Enable the IPv6 multicast forwarding globally, configure the PIM-SMv6 SSM globally, enable the multicast protocol PIM-SMv6 on the related interfaces, and run MLDv2 on the interface gigabitethernet1.

Device2(config)#ipv6 multicast-routing

Device2(config)#ipv6 pim ssm default

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#ipv6 pim sparse-mode

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#ipv6 pim sparse-mode

Device2(config-if-gigabitethernet1)#ipv6 mld enable

Device2(config-if-gigabitethernet1)#exit

#View the MLD information of the interface gigabitethernet1 on Device2.

Device2#show ipv6 mld interface gigabitethernet 1

Interface gigabitethernet1 (Index 23)

MLD Enabled, Active

Querier: fe80::201:2ff:fe03:406 (Self)

Default version: 2

Querier parameter:

Query interval is 125 seconds

Querier timeout is 255 seconds

Query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

Robustness variable is 2

Step 4:

Enable the MLD SSM mapping on Device2 and configure the MLD SSM mapping rule so that Receiver1 and Receiver2 can only receive the multicast packets sent by Source1.

#Configure Device2.

Enable the MLD SSM mapping, configure the multicast group range of the MLD SSM as FF3E::/64, and the multicast source address is 1000::a.

Device2(config)#ipv6 access-list extended 7001

Device2(config-std-nacl)#permit ipv6 any ff3e::/64

Device2(config-std-nacl)#exit

Device2(config)#ipv6 mld ssm-map enable

Device2(config)#ipv6 mld ssm-map static 7001 1000::a

Step 5:

Check the result.

# Receiver1 sends the MLDv2 member report packet of the specified source group to add to the multicast group FF3E::1 and the specified multicast source is 2000::a; Receiver2 sends the MLDv1 member report packet to add to the multicast group FF3E::2.

#Source1 and Source2 both send the multicast service packets with multicast groups FF3E::1 and FF3E::2.

#View the multicast member table of Device2.

Device2#show ipv6 mld groups

MLD Connected Group Membership

Total 2 Connected Groups

Group Interface Uptime Expires V1-Expires Last Reporter

ff3e::1 gigabitethernet1 00:00:33 not used not used fe80::a

ff3e::2 gigabitethernet1 00:00:33 not used not used fe80::b

Device2#show ipv6 mld groups detail

MLD Connected Group Membership

Total 2 Connected Groups

Group Interface Uptime Expires V1-Expires Last Reporter

ff3e::1 gigabitethernet1 00:00:36 not used not used fe80::a

Group mode : Include

TIB-A Count: 1

TIB-B Count: 0

TIB-A

Source list: (R - Remote, M - SSM Mapping)

Source Uptime Expires Flags

2000::a 00:00:36 00:03:49 R

ff3e::2 gigabitethernet1 00:00:36 not used not used fe80::b

Group mode : Include

TIB-A Count: 1

TIB-B Count: 0

TIB-A

Source list: (R - Remote, M - SSM Mapping)

Source Uptime Expires Flags

1000::a 00:00:36 00:03:45 RM

#View the multicast route table of Device2.

Device2#show ipv6 pim mroute

IP Multicast Routing Table:

PIM6 VRF Name: Default

Total 0 (*,*,RP) entry

Total 0 (*,G) entry

Total 2 (S,G) entries

Total 0 (S,G,rpt) entry

Total 0 FCR entry

Up timer/Expiry timer

(2000::a, ff3e::1)

Up time: 00:01:36

KAT time: 00:01:54

RPF nbr: fe80::201:2ff:fe03:406

RPF idx: gigabitethernet0

SPT bit: FALSE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet1

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 0

(1000::a, ff3e::2)

Up time: 00:01:36

KAT time: 00:01:54

RPF nbr: fe80::201:2ff:fe03:406

RPF idx: gigabitethernet0

SPT bit: FALSE

Flags:

JOIN DESIRED

Upstream State: JOINED

Local interface list:

gigabitethernet1

Joined interface list:

Asserted interface list:

Outgoing interface list:

gigabitethernet1

Packet count 0

#Receiver1 can only receive the multicast service packets sent by Source2; Receiver2 can only receive the multicast service packets sent by Source1.

l The viewing method of Device1 is the same as that of Device2, so the viewing process is omitted.

l MLD SSM mapping needs to be used with PIM-SMv6 SSM; the multicast group range in the MLD SSM mapping rule should belong to the PIM-SMv6 SSM multicast group range. IGMP SSM mapping mainly runs MLDv1 and cannot be upgraded to the receiver host of MLDv2 to provide the supporting for the SSM model.

l The MLD SSM mapping is invalid for the MLDv2 member report packet.


7.3.4 Configure MLD Multicast Group Filter

Network Requirements

l The whole network runs the PIM-SMv6 protocol.

l Receiver is one receiver of the Device stub network.

l Run MLDv2 between Device and the stub network.

l Device interface gigabitethernet1 filters the multicast group; the range of the multicast groups Receiver is permitted to add is ff10::/16.

Network Topology

Figure 7-4 Networking of configuring IGMP multicast group filter

Configuration Steps

Step 1: | Configure the IPv6 address of the interface (omitted).
Step 2: | Globally enable the IPv6 multicast forwarding and enable the multicast protocol PIM-SMv6 on the interface.

#Configure Device.

Globally enable the IPv6 multicast forwarding, enable the multicast protocol PIM-SMv6 on the related interfaces, and enable MLD on the interface of connecting Receiver.

Device#configure terminal

Device(config)#ipv6 multicast-routing

Device(config)#interface gigabitethernet0

Device(config-if-gigabitethernet0)#ipv6 pim sparse-mode

Device(config-if-gigabitethernet0)#exit

Device(config)#interface gigabitethernet1

Device(config-if-gigabitethernet1)#ipv6 pim sparse-mode

Device(config-if-gigabitethernet1)#ipv6 mld enable

Device(config-if-gigabitethernet1)#exit

#View the MLD information of Device interface gigabitethernet1.

Device#show ipv6 mld interface gigabitethernet 1

Interface gigabitethernet1 (Index 23)

MLD Enabled, Active

Querier: fe80::201:2ff:fe03:406 (Self)

Default version: 2

Querier parameter:

Query interval is 125 seconds

Querier timeout is 255 seconds

Query response time is 10 seconds

Last member query response interval is 1 seconds

Last member query count is 2

Group Membership interval is 260 seconds

Robustness variable is 2

Step 3:

Configure the multicast group filter on Device interface gigabitethernet1.

#Configure Device.

Configure the multicast group filter on Device interface gigabitethernet1; the range of the multicast groups Receiver is permitted to add is ff10::/16.

Device(config)#ipv6 access-list extended 7001

Device(config-std-nacl)#permit ipv6 any ff10::/16

Device(config-std-nacl)#exit

Device(config)#interface gigabitethernet1

Device(config-if-gigabitethernet1)#ipv6 mld access-group 7001

Device(config-if-gigabitethernet1)#exit

Step 4:

Check the result.

#Receiver sends the IGMPv2 member report packet to add to multicast group FF10::1 and FF11::1.

#Source sends the multicast packets with multicast group FF10::1 and FF11::1.

#View the multicast member table of Device.

Device#show ipv6 mld groups

MLD Connected Group Membership

Total 1 Connected Groups

Group Interface Uptime Expires V1-Expires Last Reporter

ff10::1 gigabitethernet1 01:06:32 00:04:15 00:04:15 fe80::b

#View the multicast route table of Device.

Device#show ipv6 pim mroute

IP Multicast Routing Table:

PIM6 VRF Name: Default

Total 0 (*,*,RP) entry

Total 1 (*,G) entry

Total 2 (S,G) entries

Total 2 (S,G,rpt) entries

Total 0 FCR entry

Up timer/Expiry timer

(*, ff10::1)

Up time: 00:01:00

RP: ::

RPF nbr: ::

RPF idx: None

Flags:

Upstream State: NOT JOINED

Local interface list:

gigabitethernet1

Joined interface list:

Asserted interface list:

(1000::a, ff10::1)

Up time: 00:00:06

KAT time: 00:03:24

RPF nbr: ::

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

COULD REGISTER

Upstream State: JOINED

Local interface list:

gigabitethernet1

Joined interface list:

register_vif0

Asserted interface list:

Outgoing interface list:

register_vif0

gigabitethernet1

Packet count 1

(1000::a, ff10::1, rpt)

Up time: 00:00:06

RP: ::

Flags:

RPT JOIN DESIRED

RPF SGRPT XG EQUAL

Upstream State: NOT PRUNED

Local interface list:

Pruned interface list:

Outgoing interface list:

(1000::a, ff11::1)

Up time: 00:00:06

KAT time: 00:03:24

RPF nbr: ::

RPF idx: None

SPT bit: TRUE

Flags:

JOIN DESIRED

COULD REGISTER

Upstream State: JOINED

Local interface list:

Joined interface list:

register_vif0

Asserted interface list:

Outgoing interface list:

register_vif0

Packet count 1

(1000::a, ff11::1, rpt)

Up time: 00:00:06

RP: ::

Flags:

RPF SGRPT XG EQUAL

Upstream State: RPT NOT JOINED

Local interface list:

Pruned interface list:

Outgoing interface list:

#Receiver can only receive the multicast service packets with multicast group FF10::1 sent by Source.

l To filter based on multicast source group, use the command ipv6 mld access-group to realize, and configure the corresponding source address in the associated ACL. For example, permit ipv6 1000::/16 ff10::/16 indicates permitting the source group in the group range FF10::/16 and the specified source range 1000::/16 to add. When using the function, it is required that the interface runs MLDv2.


8 IPv6 Multicast Basics


8.1 Overview

IPv6 multicast basics is the basis of running the IPv6 multicast protocol and the common part of all multicast protocols. No matter which multicast route protocol runs, we first need to enable the IPv6 multicast forwarding function so that the device can forward the multicast service packets.


8.2 Basic Function Configuration of IPv6 Multicast

Table 8‑1 Basic function configuration list of IPv6 multicast

Configuration task

Enable the IPv6 multicast forwarding

Enable the IPv6 multicast forwarding


8.2.1 Enable IPv6 Multicast Forwarding

IPv6 multicast forwarding is the basic module of the multicast forwarding. The device can forward the IPv6 multicast service packets only after enabling the IPv6 multicast forwarding function. Both the general IPv6 multicast forwarding and IPv6 multicast fast forwarding are controlled by whether to enable the IPv6 multicast forwarding.

IPv6 multicast fast forwarding is one IPv64 fast multicast forwarding technology designed to improve the forwarding performance of the service packets. It completes the route selection and service processing for a time, so as to reduce the resource consumption caused by the switching between the internal tasks of the system and the packet cache management. At last, improve the data forwarding performance of the whole system.

Configuration Condition

Before configuring the IPv6 multicast forwarding function, first complete the following task:

l Configure the IPv6 address of the interface, making the neighboring node network layer reachable;

l Configure any unicast routing protocol, making the routes in the domain reachable;

l Configure any multicast routing protocol.

Enable IPv6 Multicast Forwarding

The device can forward the IPv6 multicast service packets only after enabling the IPv6 multicast forwarding function.

Table 8‑2 Enable the IPv6 multicast forwarding

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enable the IPv6 multicast forwarding | ipv6 multicast-routing [ vrf vrf-name ] | Mandatory By default, the IPv6 multicast forwarding is not enabled.


8.2.2 Monitoring and Maintaining of IPv6 Multicast Basics

Table 8‑3 Monitoring and maintaining of IPv6 multicast basics

Command | Description
clear ipv6 mroute [ source source-ipv6-address ] [ group group-ipv6-address ] [ vrf vrf-name ] | Clear the multicast core route table
show ipv6 mroute [ source source-ipv6-address ] [ group group-ipv6-address ] [ vrf vrf-name ] | Display the multicast core route table information
show ipv6 mcast fib [ source source-ipv6-address ] [ group group-ipv6-address ][ vrf vrf-name| vrf-id vrf-id ] | Display the multicast fast forwarding table information
show ipv6 multicast-if [ vrf vrf-name ] | Display the multicast virtual interface information


1.1 Overview

MPLS (Multiprotocol Label Switching) integrates the simplicity of the L2 switching and the flexibility of the L3 route selection, providing the connection-oriented feature for the connectionless IP network.

Compared with the traditional IP network, MPLS has the following technical advantages:

l Perform the packet forwarding based on the label, simplify the forwarding mechanism, and improve the forwarding efficiency

l Expand the service functions flexibly by bringing in the label, realizing the route selection, traffic engineering, QoS, VPN and other functions

l The label itself does not have the specific meaning and it can map the target IP address, fiber channel, wave length, even the VC channel in SDH/SONET

The following describes some important basic concepts of MPLS.

1. FEC

FEC (Forwarding Equivalence Class) indicates the packet set of complying with the same forwarding path in the network (the destination addresses of the packets can be different). The packets of the same FEC are processed by the LSR in the same mode during the forwarding. The ingress LSR of the MPLS searches for the corresponding label value according to FEC for the IP packet entering the MPLS domain, and encapsulates in the packet, forming the label packet and transmitting in the MPLS network.

2. Label

In the MPLS network, the MPLS packet is forwarded according to the label varied by the packet. The label is inserted between the L3 and L2 packet headers, called MPLS label header. The format is shown in Figure 1-1:

Figure 1-1 MPLS label structure

One MPLS packet can bear multiple label headers and this structure is called label stack. The labels are organized according to the “Last in, first out” mode. The outermost label is called stack top label and the innermost label is called stack bottom label. Each label consists of the following fields:

l TTL: 8 bits, with the same functions the TTL field in the IP header

l Stack bottom (S): 1bit, the value 1 indicates that the corresponding label is the last label in the label stack (stack bottom); the value 0 indicates all other labels except for the stack bottom label.

l Service-class information: 3bit, reserved, not defined in the protocol, usually used as the service level.

l Label Value: 20bit, used to identify FEC. The label value 0-15 are the reserved label value. The specific meanings are as follows:

Table 1‑1 The meaning of the reserved label value

Label Value | Meaning
0 | IPv4 explicit null label
1 | Router alarm label
2 | IPv6 explicit null label
3 | Implicit empty label
4－15 | Reserved

3. Label switching router

LSR (Label Switching Router) indicates the device supporting the MPLS service. It can distribute the label and receive and transmit the packet with label on the data link.

4. LER

LER (Label Edge Router) indicates the LSR connecting other network at the MPLS network edge.

5. LSP

LSP (Label Switched Path) indicates the forwarding path of the packets of the same FEC in the MPLS network.

6. MPLS network node

The MPLS network includes the following important network nodes:

l Ingress node: The ingress LER of the MPLS network, encapsulating the label for the packet entering the MPLS network

l Transit node: The internal LSR of the MPLS network, search for the MPLS forwarding table according to the label, execute the label operation, and send the packet to the egress LER along the LSP

l Egress node: The egress LER of the MPLS network, responsible for removing the label and sending the packet to the destination network

7. Label forwarding table

LFIB (Label Forwarding Information Base), similar to the EIB of IP, used to forward the MPLS packet, including the following types:

l NHLFE (Next Hop Label Forwarding Entry): Record the MPLS forwarding operation mode and forwarding information

l FTN (FEC to NHLFE): Used to search for FTN according to the FEC of the packet at the Ingress node and map to the NHLFE

l ILM (Incoming Label Map): Used to search for ILM according to the incoming label and map to the NHLFE


1.2 MPLS Basis Function Configuration

Table 1‑2 MPLS basis function configuration list

Configuration Task
Configure the MPLS basic functions | Enable the global MPLS function
 | Enable the MPLS function on the interface
 | Configure the label distributing range
Configure the MPLS forwarding control | Configure the interface MPLS MTU
 | Configure the packet load mode
 | Configure the packet TTL copy mode
 | Configure the packet TTL timeout processing mode


1.2.1 Configure MPLS Basic Functions

On the router taking part in the MPLS forwarding, it is necessary to enable the global and interface MPLS function.

Configuration Condition

Before configuring the MPLS basic functions, first complete the following tasks:

l Configure the link-layer protocol, ensuring the normal communication of the link layer

l Configure the network-later address of the interface, making the neighboring network node reachable at the network layer

l Configure the static route or IGP protocol, ensuring the LSRs communication with each other at the network layer

Enable Global MPLS Function

Table 1‑3 Enable the global MPLS function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the global MPLS function | mpls ip | Mandatory By default, the MPLS function is not enabled.

Enable Interface MPLS Function

Table 1‑4 Enable the interface MPLS function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface_name | -
Enable the interface MPLS function | mpls ip | Mandatory By default, the interface MPLS function is not enabled.

Configure Label Distributing Range

Table 1‑5 Configure the label distributing range

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the range of the local distributing label | mpls label range min-label max-label | Optional By default, the range of the permitted distributed label values is 16~1048575.

l Usually, it is not necessary to configure the range of the local distributed labels. If configuring the function after configuring the protocol of distributing the label resource (such as LDP and BGP), it is necessary to save and restart the device.


1.2.2 Configure MPLS Forwarding Control

Configuration Condition

Before configuring the MPLS forwarding control, complete the following task:

l Enable the MPLS basic functions globally and on the interface, ensuring that the MPLS packet can be received and sent.

Configure Interface MPLS MTU

In the MPLS network, the length of the packet encapsulated with the MPLS label may exceed the egress interface MTU and as a result, the packet needs to execute the fragment processing or be dropped. Therefore, define MPLS MTU and compare the length of the packet encapsulated with the MPLS label with the MPLS MTU of the egress interface. According to whether the interface is configured with MPLS MTU, there are the following processing actions:

l The egress interface of the packet is configured with MPLS MTU. If the ingress packet is the IP packet, that is, IP to MPLS forwarding, and the length of the packet being encapsulated with the MPLS label is larger than the MPLS MTU of the egress interface, fragment according to the interface MPLS MTU (not set DF bit) or send the error packet with unreachable ICMP destination (set the DF bit). If the ingress packet is the MPLS packet, that is, MPLS to MPLS forwarding, directly forward the packet no matter whether the length of the packet is larger than the MPLS MTU of the egress interface.

l The egress interface of the packet is not configured with MPLS MTU. If the ingress packet is the IP packet, that is, IP to MPLS forwarding, and the length of the packet being encapsulated with the MPLS label is larger than the MTU of the egress interface, fragment according to the interface MTU (not set DF bit) or send the error packet with unreachable ICMP destination (set the DF bit). If the ingress packet is the MPLS packet, that is, MPLS to MPLS forwarding, directly forward no matter whether the packet length is larger than the egress interface MTU.

Table 1‑6 Configure the interface MPLS MTU

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the specified interface | interface interface_name | -
Configure the interface MPLS MTU | mpls mtu mtu-size | Mandatory By default, the interface is not configured with MPLS MTU.

l The minimum value of the interface MPLS MTU is 64 bytes. For different interface types, the maximum value may be different and it is the maximum link MTU value supported by the current interface.

l The MPLS MTU on the interface is valid only for the egress MPLS packet of the interface, but not valid for the egress IP packet of the interface.

l If the ingress packet is the IP packet, that is, IP to MPLS forwarding and when fragmenting according to the MPLS MTU of the egress interface, first fragment the IP packet (the fragment size is MPLS MTU value minus the length of the label stack), and then encapsulate the MPLS label stack for each fragment and forward.

Configure Packet Load Mode

In the MPLS network, you can use the command to set the multi-path packet load forwarding mode. There are two modes:

l Per-packet load mode: The packet is forwarded from the load path. The number of the packets forwarded from the load paths are basically the same.

l Per-label load mode: Select the load path according to the ingress label of the packet. The packets with the same label select the same load path to forward.

Table 1‑7 Configure the packet load mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the load mode of the MPLS packet | mpls load-balancing { per-label | per-packet } | Optional By default, adopt the per-label load mode to forward.

l When adopting the per-label load mode and if the packet has multiple layers of ingress labels, all ingress labels serve as the evidence of selecting the load path.

l The mpls load-balancing command is valid only when the ingress packet is the MPLS packet. If the ingress packet is IP packet, forward according to the IP load mode.

Configure Packet TTL Copy Mode

When the IP packet encapsulates the label at the Ingress node of the MPLS network, the system reduce the TTL value of the IP packet by 1 and copy to the TTL field of the MPLS label by default. The user also can configure the command to set the TTL field of the MPLS label to 255, but do not copy the TTL value of the IP packet any more.

Table 1‑8 Configure the TTL copy mode of the packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the TTL copy mode of the MPLS packet to not copy the TTL value in the IP packet | no mpls ttl-propagate [ forwarded | local ] | Optional By default, the forward packet and local sent packet reduce the TTL value in the IP packet by 1 and copy to the TTL field of the MPLS label.

Configure Packet TTL Timeout Processing Mode

When the LSR receives the MPLS packet with TTL 1, the LSR will generate the TTL timeout message of ICMP. There are two modes of LSR returning the ICMP timeout message to the sender of the packet:

l Forward the ICMP message along the previous LSP. At the Egress node, search for the route of the packet sender and return the ICMP message to the packet sender.

l On the LSR device discovering the TTL timeout, query the route of the packet sender and return the ICMP message to the packet sender.

You can configure the label layers via the mpls ttl-expiration command. After discovering the TTL timeout of the MPLS packet, compare the ingress label layers with the configured label layers to determine the sending mode of the ICMP message. If the layers of the ingress labels do not exceed the configured label layers, adopt the second mode to return the ICMP message to the packet sender. Otherwise, adopt the first mode.

Table 1‑9 Configure the packet TTL timeout processing mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the label layers processed by the packet TTL timeout | mpls ttl-expiration labels-num | Optional By default, the label layers processed by the packet TTL timeout is 1.


1.2.3 MPLS Basis Monitoring and Maintaining

Table 1‑10 MPLS basis monitoring and maintaining

Command | Description
clear mpls forwarding-table statistics [ packet | total ] | Clear the packet statistics of the MPLS service
show mpls cache [ ip address [ mask length ] ] [ detail ] | Display the MPLS fast forwarding table information
show mpls cache ftn [ detail | vrf [ vrf name ] ] | Display the FTN information of the MPLS fast forwarding table
show mpls cache global [ detail ] | Display the global forwarding table information of the MPLS fast forwarding table
show mpls cache ilm [ detail ] | Display the ILM information of the MPLS fast forwarding table
show mpls cache tunnel [ detail ] | Display the MPLS TE tunnel forwarding table information
show mpls cache vrf vrf-name [ detail ] | Display the MPLS fast forwarding table information of the specified VPN
show mpls forwarding-table [ prefix-address [ prefix-length ] ] [ detail ] | Display the MPLS forwarding table information
show mpls forwarding-table ftn [ vrf vrf-name ] [ detail ] | Display the global FTN information
show mpls forwarding-table global [ ftn | ilm ] [ detail ] | Display the global MPLS forwarding table information
show mpls forwarding-table ilm [ vrf vrf-name ] [ detail ] | Display the ILM information
show mpls forwarding-table statistics { packet | record | total } | Display the statistics information of the MPLS forwarding packet and the statistics of various types of the forwarding tables
show mpls forwarding-table tunnel [ ftn [ tunnel-id ] | ilm ] [ detail ] | Display the MPLS TE tunnel forwarding table information
show mpls forwarding-table vrf vrf-name [ prefix-address prefix-length ] [ detail ] | Display the MPLS forwarding table details of the specified VPN
show mpls interface [ interface_name ] statistics | Display the information about the interface configured with the MPLS function
show mpls label range | Display the label distributing range
show mpls label used-block-data [ detail ] | Display the MPLS label block distributing information
show mpls vpn-tunnel statistics vrf-name nexthop | Display the statistics information of the packets forwarded to the specified next hop in the specified VPN


2 MPLS LDP


2.1 Overview

LDP (Label Distribution Protocol) is one basic signaling protocol of MPLS, used to distribute and advertise the label and set up the LSP (Label Switching Path) dynamically.

Besides distributing the label, LDP also has some features:

l Support the label filter: Adopt the ACL to advertise and receive the label selectively, so as to save the resources and reduce the network load.

l Support loopback detection: Adopt he loopback detection to avoid the LSP loop.

l Support the MD5 authentication: Improve the security of the information exchange between LSRs

l Support the GR capability: When the device control layer fails, the data transmission is not interrupted

l Support the BFD linkage: Realize the fast convergence of the LDP protocol layer via the BFD fast detection.


2.2 MPLS LDP Function Configuration

Table 2‑1 LDP function configuration list

Configuration Task
Configure the LDP basic function | Enable the LDP protocol
Configure the LDP neighbor parameters | Configure the direct-connected session parameters
 | Configure the remote session parameters
Configure the LDP MD5 authentication | Configure the LDP MD5 authentication
Configure the LDP control attributes | Configure the label accept filter
 | Configure the label advertise filter
 | Configure the label re-advertise
 | Configure the PHP feature
 | Configure the loopback detection
 | Configure the session re-connection
Configure LDP GR | Configure LDP GR
Configure the LDP to link with BFD | Configure the LDP to link with the BFD


2.2.1 Configure LDP Basic Functions

Configuration Condition

Before configuring the LDP basic functions, first complete the following tasks:

l Configure the link layer protocol, ensuring the normal communication of the link layer

l Configure the network layer address of the interface, making the neighbor network nodes reachable at the network layer

l Configure the static route or IGP protocol, ensuring that the LSRs can communicate with each other at the network layer

l Enable the MPLS basic functions on the interface and globally, ensuring that the MPLS packet can be received and sent.

Enable the LDP Protocol

Table 2‑2 Enable the LDP protocol

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the LDP protocol globally | mpls ldp | Mandatory By default, do not enable the LDP protocol globally.
Exit the LDP configuration mode | exit | -
Enter the interface configuration mode | interface interface-name | -
Enable the LDP protocol on the interface | mpls ldp | Mandatory By default, the interface does not enable the LDP protocol.


2.2.2 Configure LDP Neighbor Parameters

Configuration Condition

Before configuring the LDP neighbor parameters, first complete the following tasks:

l Configure the LDP basic functions

Configure Direct-connected Session Parameters

The session set up between the direct-connected peers is called LDP direct-connected session.

Table 2‑3 Configure the direct-connected session parameters

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | -
Configure Router ID | router-id ip-address | Optional By default, select the interface address of the local device, first selecting the loopback port address.
Configure the transmission address | transport-address ip-address | Optional By default, first select the Router ID as the transmission address.
Configure the interval of sending the Keepalive message | keepalive interval value | Optional The default value is 60s and the value range is 1-65535s.
Configure the keepalive message timeout | keepalive timeout value | Optional The default value is 180s and the value range is 1-65535s.
Configure the interval of sending the link Hello | discovery hello interval value | Optional The default value is 5s and the value range is 1-65535s.
Configure the keepalive timer timeout of the link Hello | discovery hello holdtime value | Optional The default value is 15s and the value range is 1-65535s.
Exit the LDP configuration mode | exit | -
Enter the interface mode | interface interface-name | -
Configure the interval of sending the interface link Hello | mpls ldp discovery hello interval value | Optional The default value is 5s and the value range is 1-65535s.
Configure the keepalive timer timeout of the interface link Hello | mpls ldp discovery hello holdtime value | Optional The default value is 15s and the value range is 1-65535s.

l To set up the LDP session between the peers, it is necessary to ensure that the LDP protocol is enabled on two peers.

l Before setting up a session with the direct-connected peer, the user needs to ensure that the transmission address route from the local transmission address to the peer transmission address is reachable. Otherwise, the session connection cannot be set up.

l Modifying Router ID or transmission address will cause the re-setup of the session. Therefore, it is suggested to modify Router ID or transmission address carefully.

l The sending interval of the link Hello and keepalive time can be configured globally and also can be configured on the interface. When being configured globally, but not configured on the interface, the sending interval and keepalive time of the interface link Hello adopt the global configured time. When being configured on the interface and globally, the sending interval and keepalive time of the interface link Hello adopt the configured time on the interface.

Configure Remote Session Parameters

The session set up with the target peer is called LDP remote session. The LDP remote session is mainly applied to Martini MPLS L2VPN and Martini VPLS.

Table 2‑4 Configure the remote session parameters

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | Mandatory
Create the target peer | targeted-peer peer-address | Mandatory By default, do not create the target peer.
Configure the Router ID | router-id ip-address | Optional By default, select the interface address of the local device, first selecting the loopback port address.
Configure the transmission address | transport-address ip-address | Optional By default, first select the Router ID as the transmission address.
Configure the interval of sending the Keepalive message | keepalive interval value | Optional The default value is 60s and the value range is 1-65535s.
Configure the keepalive timer timeout of the Keepalive message | keepalive timeout value | Optional The default value is 180s and the value range is 1-65535s.
Configure the interval of sending the target Hello | discovery targeted-hello interval value | Optional The default value is 10s and the value range is 1-65535s.
Configure the keepalive timer timeout of the target Hello | discovery targeted-hello holdtime value | Optional The default value is 90s and the value range is 1-65535s.

l The configured sending interval of the Keepalive message and the timeout of the keepalive timer are applicable to the direct-connected session and remote session.

l The configured router ID and transmission address are also applicable to the direct-connected session and remote session.

l Before setting up the session with the target peer, the user needs to ensure that the address route to the peer is reachable and also needs to confirm that the target peer to the local end is also created at the peer. Otherwise, the remote session cannot be set up.


2.2.3 Configure LDP MD5 Authentication

Configuration Condition

Before configuring the LDP neighbor parameters, complete the following tasks:

l Configure the LDP basic functions

Configure LDP MD5 Authentication

To improve the security of the LDP session, the LDP session based on the TCP connection supports configuring the MD5 authentication. The session can be set up only when the local and the peer passwords are consistent.

Table 2‑5 Configure LDP MD5 authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | Mandatory
Configure the LDP MD5 authentication | peer peer-address password [ 0 | 7 ] string | Mandatory By default, do not configure the MD5 authentication password.


2.2.4 Configure LDP Control Attribute

Configuration Condition

Before configuring the LDP control attribute, first complete the following task:

l Configure the LDP basic functions

Configure Label Accept Filter

The label accept filter is used to filter the labels received from the FEC downstream, only accepting the labels of the FEC passing the ACL check. The function can reduce the scale of the MPLS forwarding table. To configure the label accept filter, you need to first configure the standard ACL, and then adopt the label accept filter command to reference in the LDP.

Besides, because most MPLS networks only need the labels of the FEC with the 32-bit mask length, LDP divides FEC to 32-bit mask and non-32-bit mask according to the mask length. By default, the system only accepts the labels of the FEC with the 32-bit mask length. To reduce the control complexity, provide the separate command to control the 32-bit prefix and non-32-bit prefix.

Table 2‑6 Configure the label accept filter

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | Mandatory
Configure the label accept filter | accept-labels for prefix-accesslist-name | Optional By default, do not configure the label accept filter.
Configure only accepting the labels of the FEC with 32-bit mask length | accept-labels for 32bit-mask-fec-only | Optional By default, only accept the labels of the FEC with the 32-bit mask length.

l The prefix-accesslist-name parameter only supports the standard ACL.

l The labels of the FEC not passing the ACL filter will not be installed with FTN, but still saves and installs ILM.

l By default, only accept the labels of the FEC with the 32-bit mask length, so usually use the no format to configure accepting the labels of the FEC with any mask length.

l The command accept-labels for 32bit-mask-fec-only/no accept-labels for 32bit-mask-fec-only and the accept-labels for prefix-accesslist-name command can be configured at the same time. If the accept-labels for 32bit-mask-fec-only command is configured (the default configuration of the system), the FTN of all FECs with 32-bit mask passing the ACL filter in the accept-labels for prefix-accesslist-name command can be installed, but the FTN of all FECs with non-32-bit mask will not be installed (even the FEC with non-32-bit mask passing the filter of the ACL in the accept-labels for prefix-accesslist-name command). If the command is configured, the FTN of all FECs passing the filter of the ACL in the accept-labels for prefix-accesslist-name command will be installed.

Configure Label Advertise Filter

The label advertise filter is used to filter the advertised labels. The function can prevent the LSR from advertising lots of labels, so as to reduce the network load. To configure the label advertise filter, you need to first configure the standard ACL, and then adopt the label advertise filter command to reference in the LDP.

Besides, because most MPLS networks only need the labels of the FEC with the 32-bit mask length, LDP divides FEC to 32-bit mask and non-32-bit mask according to the mask length. By default, the system only advertises the labels of the FEC with the 32-bit mask length. To reduce the control complexity, provide the separate command to control the 32-bit prefix and non-32-bit prefix.

Table 2‑7 Configure the label advertise filter

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | Mandatory
Configure the label advertise filter | advertise-labels for prefix-accesslist-name to peer-accesslist-name | Optional By default, do not configure the label advertise filter.
Configure advertising the labels of some FECs to all upstream devices | advertise-labels for prefix-accesslist-name to any | Optional By default, do not configure the label advertise filter.
Configure not advertising the label to any upstream device | advertise-labels for any to none | Optional By default, do not configure not advertising the label to any upstream device.
Configure only advertising the label of the FEC with the 32-bit mask length | advertise-labels for 32bit-mask-fec-only | Optional By default, only advertise the label of the FEC with the 32-bit mask length.

l The prefix-accesslist-name parameter and the peer-accesslist-name parameter only support the standard ACL.

l By default, LDP only advertises the labels of the FEC with the 32-bit mask length, so usually use the no format to configure advertising the labels of the FEC with any mask length to the upstream device.

l The advertise-labels for any to none command and the advertise-labels for prefix-accesslist-name to any command can be seen as the special format of the advertise-labels prefix-accesslist-name to peer-accesslist-name command. any indicates permit any, and none indicates deny any. The three commands all can be called passing the ACL control label advertising and can be configured with the advertise-labels for 32bit-mask-fec-only command.

l If the advertise-labels for 32bit-mask-fec-only command is configured (by default), all FECs with non-32-bit mask refuse advertising the label, while the FEC with the 32-bit mask performs the label advertising according to the ACL check result. If the no advertise-labels for 32bit-mask-fec-only command is configured, all FECs with any mask length perform the label advertising according to the ACL check result.

Configure Label Re-advertising

After configuring the label advertising, the LDP periodically re-advertises all label mappings to the upstream neighbor.

Table 2‑8 Configure the label re-advertising

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | -
Configure the label re-advertising | du-readvertise | Mandatory By default, do not re-advertise the label mapping.
Configure the re-advertising interval | du-readvertise timer value | Optional The default value is 30 and the value range is 1-65535s.

Configure PHP Features

When a device serves as the Egress node, distribute the implicit null label to the last second-hop device by default. After configuring the explicit-null command, the Egress node sends the explicit null label to the last second-hop device. If the Egress node distributes the implicit null label, the last second-hop device will pop up the label. If the Egress node distributes the explicit null label, the last second-hop device will not pop up the label.

Table 2‑9 Configure the PHP features

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | Mandatory
Configure the Egress node to advertise the explicit null label to the upstream device | explicit-null | Optional By default, the Egress node advertises the implicit null label to the last second-hop device.

l To configure or delete the explicit-null command, you need to use the clear mpls ldp session command to re-set the session so that the command can take effect.

Configure Loopback Detection

There are two LSP loop detection modes. One is max. hop mode and the other is path vector mode.

The max. hop mode is the hops contained in the message of transmitting the label. When passing one LSR, the value is added by one. When the value reaches the maximum value of the detection, it is regarded that there is loop and the setup of the LSP is terminated.

The path vector mode is to record the LSR ID information in the message of transmitting the label. When passing one hop, the device checks whether its own LSR ID is recorded. If its own LSR ID is not recorded, add its own LSR ID to the record. If there is the LSR ID in the record, it is regarded that there is loop and the setup of the LSP is terminated.

Table 2‑10 Configure the loop detection

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | Mandatory
Configure the loop detection | loop-detection | Mandatory By default, do not configure the loop detection.
Configure the maximum hops of the loop detection | maxhops value | Optional After configuring the loopback detection, the default threshold of the detection hops is 255 and the value range is 1-255.

l The loop detection configurations on the LDP peers should be consistent. Otherwise, the LDP session cannot be set up.

l After configuring the loop detection, the LDP adopts the max. hops and path vector to detect the LSP loop. The default value of the maximum hops is 255.

Configure Session Re-connection

When setting up the TCP connection with the peer fails, the LDP tries to re-set up. The process is called session re-connection.

Table 2‑11 Configure the session re-connection

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | Mandatory
Configure not permitting increasing the re-connection delay | reconnection-delay-disable | Optional By default, permit increasing the re-connection delay.
Configure the re-connection interval | reconnect-interval value | Optional The default value is 15s and the value range is 1-15s.

l The initial delay of the LDP re-connecting the peer is 15s. If permitting increasing the re-connection delay and after initiating the TCP connection to the peer failed, the delay time doubles successively, that is, 15s, 30s, 60s, 120s. The maximum value cannot exceed 120s. If the initial delay time of the LDP re-connecting the peer is 1s, the re-connection delay time is 1s, 2s, 4s…., and the maximum value also cannot exceed 120s. If not permitting increasing the re-connection delay, the re-connection interval is always the configured initial re-connection interval.


2.2.5 Configure LDP GR

Configuration Condition

Before configuring the LDP GR capability, first complete the following tasks:

l Configure the LDP basic functions

l The IGP protocol enables the GR capability

Configure LDP GR

The MPLS forwarding plane is separate from the control plane. When the control plane becomes abnormal, LDP GR reserves the MPLS label forwarding entry and the LSR still forwards the packet according to the entry, so as to ensure that the data transmission is not interrupted.

During the GR process, the devices in the MPLS network are divided to two roles:

l GR restarter: GR restart router, indicating the device with dual control cards that still can keep forwarding data when restarting the control layer protocol because the user switches over the control card manually or the device fails.

l GR helper: The neighbor of GR restarter, keeping the neighbor relationship with the restarted GR restarter and negotiating the GR capability with the GR restarter. After the GR restarter restarts, help it restore the forwarding status before restarting.

The work process of the LDP GR is as follows:

l When the session is set up between the neighbors, negotiate the time value of the GR timer between the LSRs configured with the GR capability.

l After GR restarter restarts, GR helper detects that the session with the GR restarter is down, all label mappings learned by the session are marked as stale, and reserve the label mappings within the timeout of the GR neighbor keepalive timer.

l If the keepalive timer of the GR neighbor times out, the GR Helper deletes the label mappings marked as stale. If the LDP session is set up successfully within the timeout of the GR neighbor keepalive timer, GR restarter and GR helper interact the label mapping via the new setup LDP session within the LDP recovery time, update the label forwarding table, and clear the stale label of the forwarding entry. After the LDP recovery timer times out, GR helper deletes the label mapping still marked as stale.

l The timeout of the holding timer of the MPLS forwarding status indicates that the GR process ends.

Table 2‑12 Configure LDP GR

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | Mandatory
Enable the GR capability | graceful-restart | Mandatory By default, do not enable the GR capability.
Configure the holding timer timeout of the GR forwarding status | graceful-restart timer forwarding-holding value | Optional The default value is 300s and the value range is 30-300s.
Configure the GR recovery timer timeout | graceful-restart timer max-recovery value | Optional The default value is 120s and the value range is 15-600s.
Configure the keepalive timer timeout of the GR neighbor | graceful-restart timer neighbor-liveness value | Optional The default value is 120s and the value range is 5-300s.

l Before the LDP session is set up, it is necessary to configure GR on the peers of the two sides of the session so that the GR capability can be negotiated successfully. Before enabling the GR capability, the setup LDP session does not have the GR capability.


2.2.6 Configure LDP to Link with BFD

Configuration Condition

Before configuring LDP to link with BFD, first complete the following tasks:

l Configure the LDP basic functions

l Enable the LDP protocol on the interface that needs to configure LDP to link with BFD

Configure LDP to Link with BFD

When the link fault happens between two neighboring devices, the time of the LDP detecting the neighbor line fault is long. After detecting the line fault, the LDP session is down and the MPLS forwarding is interrupted. LDP links with BFD and can fast detect the line fault of the LDP neighbor, improving the performance of the MPLS network.

Table 2‑13 Configure LDP to link with BFD

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the LDP configuration mode | mpls ldp | -
Configure globally enabling LDP to link with BFD | bfd all-interfaces | Optional By default, do not globally enable the LDP to link with BFD.
Exit the LDP configuration mode | exit | -
Enter the interface configuration mode | interface interface-name | -
Configure the interface to enable LDP to link with BFD | mpls ldp bfd | Optional By default, do not enable the LDP to link with BFD on the interface.
Configure the interface to disable LDP from linking with BFD | mpls ldp bfd disable | Optional By default, permit the interface to enable LDP to link with BFD

l For the BFD configuration, refer to the BFD chapter in the configuration manual “Reliability”.

l The current LDP only supports single-hop detection result of linking with BFD, but does not support the multi-hop detection result.

l On the interface, the mpls ldp bfd disable command is exclusive with the mpls ldp bfd command and has higher priority than the bfd all-interfaces command in the MPLS LDP mode. The influence of the configuration combination between them for the enabling result of the interface LDP and BFD linkage is shown in the following table.

Table 2‑14 Influence for the enabling result of the interface LDP and BFD linkage

bfd all-interfaces | mpls ldp bfd | mpls ldp bfd disable | Whether one interface enables LDP to link with BFD
Configured | Not configured or no | Not configured or no | Enabled
Configured | Not configured or no | Configured | Disabled
Configured | Configured | Not configured or no | Enabled
Not configured or no | Not configured or no | Not configured or no | Disabled
Not configured or no | Not configured or no | Configured | Disabled
Not configured or no | Configured | Not configured or no | Enabled


2.2.7 LDP Monitoring and Maintaining

Table 2‑15 LDP monitoring and maintaining command list

Command | Description
clear mpls ldp adjacency { ip-address | all } | Reset all adjacencies of LDP or the specified adjacency
clear mpls ldp session { peer-address | all } | Reset all LDP sessions or the session of the specified peer
clear mpls ldp statistics | Clear the statistics information of the received and sent LDP message
clear mpls ldp statistics advertise-labels [ for prefix-accesslist-name [ to peer-accesslist-name ] ] | Clear the statistics information of the LDP label advertising filter
show mpls ldp adjacency | Display all adjacency information of LDP
show mpls ldp advertise-labels | Display the statistics information of the LDP label advertising filter
show mpls ldp downstream [ prefix-address prefixlen ] | Display all downstream information of LDP or the downstream information of the specified FEC
show mpls ldp fec [ number | prefix-address prefixlen ] | Display all FEC information of the LDP or the FEC information of the specified number, prefix
show mpls ldp interface [ interface-name ] | Display the detailed information of all LDP interfaces or the specified LDP interface
show mpls ldp lsp [ advertise-list | prefix-address prefixlen [ advertise-list ] ] | Display all LSP information of LDP or the LSP detail information of the FEC with the specified prefix
show mpls ldp parameter [ detail ] | Display the LDP parameters
show mpls ldp session [ statistics | peer-address [ detail ] ] | Display the LDP session and related statistics or the detailed information of the specified session
show mpls ldp statistics advertise-labels | Display the statistics information of the LDP label advertising
show mpls ldp statistics message | Display the statistics information of the received and sent LDP packets
show mpls ldp targeted-peers | Display all target peer information of the LDP
show mpls ldp upstream [ prefix-address prefixlen ] | Display all downstream information of the LDP or the downstream information of the specified FEC


2.3 MPLS LDP Typical Configuration Example


2.3.1 Configure LDP Basic Functions

Network Requirements

l The whole network uses OSPF to interact the route.

l The device enables MPLS IP and MPLS LDP; set up the LDP session between Device1 and Device2, Device2 and Device3.

Network Topology

Figure 2‑1 Networking of configuring the LDP basic functions

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | Configure OSPF.

#Configure OSPF on Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

Device1(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

Device1(config-ospf)#exit

# Configure OSPF on Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

Device2(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

Device2(config-ospf)#network 22.22.22.22 0.0.0.0 area 0

Device2(config-ospf)#exit

# Configure OSPF on Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

Device3(config-ospf)#network 33.33.33.33 0.0.0.0 area 0

Device3(config-ospf)#exit

#View the route table on the device.

Take Device1 as an example:

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.2.0/24 is directly connected, 06:19:07, gigabitethernet0

O 10.1.3.0/24 [110/2] via 10.1.2.2, 06:05:08, gigabitethernet0

C 127.0.0.0/8 is directly connected, 102:05:13, lo0

C 11.11.11.11/32 is directly connected, 06:18:54, loopback0

O 22.22.22.22/32 [110/2] via 10.1.2.2, 06:12:40, gigabitethernet0

O 33.33.33.33/32 [110/3] via 10.1.2.2, 06:02:59, gigabitethernet0

You can see that there is the route to the Loopback0 interface of Device2 and Device3 in the route table of Device1.

l For the checking method of Device2 and Device3, refer to Device1.

Step 3:

Enable MPLS IP and MPLS LDP.

#Enable MPLS IP and MPLS LDP globally on Device1; enable MPLS IP and MPLS LDP on the interface at the same time.

Device1(config)#mpls ip

Device1(config)#mpls ldp

Device1(config-ldp)#router-id 11.11.11.11

Device1(config-ldp)#transport-address 11.11.11.11

Device1(config-ldp)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#mpls ip

Device1(config-if-gigabitethernet0)#mpls ldp

Device1(config-if-gigabitethernet0)#exit

#Enable MPLS IP and MPLS LDP globally on Device2; enable MPLS IP and MPLS LDP on the interface at the same time.

Device2(config)#mpls ip

Device2(config)#mpls ldp

Device2(config-ldp)#router-id 22.22.22.22

Device2(config-ldp)#transport-address 22.22.22.22

Device2(config-ldp)#exit

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#mpls ip

Device2(config-if-gigabitethernet0)#mpls ldp

Device2(config-if-gigabitethernet0)#exit

Device2(config)#interface gigabitethernet1

Device2(config-if-gigabitethernet1)#mpls ip

Device2(config-if-gigabitethernet1)#mpls ldp

Device2(config-if-gigabitethernet1)#exit

#Enable MPLS IP and MPLS LDP globally on Device3; enable MPLS IP and MPLS LDP on the interface at the same time.

Device3(config)#mpls ip

Device3(config)#mpls ldp

Device3(config-ldp)#router-id 33.33.33.33

Device3(config-ldp)#transport-address 33.33.33.33

Device3(config-ldp)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#mpls ip

Device3(config-if-gigabitethernet0)#mpls ldp

Device3(config-if-gigabitethernet0)#exit

l router-id and transport-address can be configured manually or generated automatically. Usually, they are configured to be the same. If router-id and transport-address are not configured manually, the device selects automatically. From the up interfaces, first select the one with the maximum IP address in the Loopback interfaces. If the device is not configured with the Loopback interface address, select the maximum IP address in the common interfaces.

Step 4:

Check the result.

#View the LDP session information on the device.

Take Device1 as an example:

Device1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

22.22.22.22 Multicast Passive OPERATIONAL 00:02:01

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

The content of the State list is displayed as OPERATIONAL, and you can see that Device1 and Device2 set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take Device1 as an example:

Device1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 22.22.22.22/32 / 3 gigabitethernet0 10.1.2.2 758 37108

L global 33.33.33.33/32 / 17 gigabitethernet0 10.1.2.2 882 47253

You can see that the MPLS forwarding table of Device1 has the label information of the route to the loopback0 interface address of Device2 and Device3.

#View the LSP information on the device.

Take Device1 as an example:

Device1#show mpls ldp lsp

FEC IPV4:10.1.2.0/24 -> 0.0.0.0, gigabitethernet0

FEC IPV4:10.1.3.0/24 -> 10.1.2.2, gigabitethernet0

FEC IPV4:11.11.11.11/32 -> 0.0.0.0, loopback0

Downstream state: Established Label: none RequestID: 0 Peer: EGRESS Attr: None

Upstream state: Established Label: impl-null RequestID: 0 Peer: 22.22.22.22 Attr: None

FEC IPV4:22.22.22.22/32 -> 10.1.2.2, gigabitethernet0

Downstream state: Established Label: impl-null RequestID: 0 Peer: 22.22.22.22 Attr: None

FEC IPV4:33.33.33.33/32 -> 10.1.2.2, gigabitethernet0

Downstream state: Established Label: 17 RequestID: 0 Peer: 22.22.22.22 Attr: None

You can see that there is the FEC LSP information of the loopback0 interface address of Device2 and Device3 on Device1.

l For the checking method of Device2 and Device3, refer to Device1.


2.3.2 Configure LDP Remote Session

Network Requirements

l The whole network uses OSPF to interact the route.

l Device1 and Device3 enable MPLS IP and MPLS LDP; set up the LDP remote session between Device1 and Device3.

Network Topology

Figure 2‑2 Networking of configuring the LDP remote session

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | Configure OSPF.

#Configure OSPF on Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

Device1(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

Device1(config-ospf)#exit

#Configure OSPF on Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

Device2(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

Device2(config-ospf)#network 22.22.22.22 0.0.0.0 area 0

Device2(config-ospf)#exit

#Configure OSPF on Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

Device3(config-ospf)#network 33.33.33.33 0.0.0.0 area 0

Device3(config-ospf)#exit

#View the route table on the device.

Take Device1 as an example:

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.2.0/24 is directly connected, 06:19:07, gigabitethernet0

O 10.1.3.0/24 [110/2] via 10.1.2.2, 06:05:08, gigabitethernet0

C 127.0.0.0/8 is directly connected, 102:05:13, lo0

C 11.11.11.11/32 is directly connected, 06:18:54, loopback0

O 22.22.22.22/32 [110/2] via 10.1.2.2, 06:12:40, gigabitethernet0

O 33.33.33.33/32 [110/3] via 10.1.2.2, 06:02:59, gigabitethernet0

You can see that there is the route to the loopback0 interface of Device2 and Device3 in the route table of Device1.

l For the checking method of Device2 and Device3, refer to Device1.

Step 3:

Enable MPLS IP and MPLS LDP, and configure the remote LDP session.

#Enable MPLS IP and MPLS LDP globally on Device1; enable MPLS IP and MPLS LDP on the interface at the same time; configure the remote LDP peer.

Device1(config)#mpls ip

Device1(config)#mpls ldp

Device1(config-ldp)#router-id 11.11.11.11

Device1(config-ldp)#transport-address 11.11.11.11

Device1(config-ldp)#targeted-peer 33.33.33.33

Device1(config-ldp)#exit

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#mpls ip

Device1(config-if-gigabitethernet0)#mpls ldp

Device1(config-if-gigabitethernet0)#exit

#Enable MPLS IP and MPLS LDP globally on Device3; enable MPLS IP and MPLS LDP on the interface at the same time; configure the remote LDP peer.

Device3(config)#mpls ip

Device3(config)#mpls ldp

Device3(config-ldp)#router-id 33.33.33.33

Device3(config-ldp)#transport-address 33.33.33.33

Device3(config-ldp)#targeted-peer 11.11.11.11

Device3(config-ldp)#exit

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#mpls ip

Device3(config-if-gigabitethernet0)#mpls ldp

Device3(config-if-gigabitethernet0)#exit

Step 4:

Check the result.

#View the remote LDP session information on Device1 and Device3.

Take Device1 as an example:

Device1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

33.33.33.33 Targeted Passive OPERATIONAL 00:02:57

The content of thw State list is displayed as OPERATIONAL, the content of the Peer Type list is displayed as Trageted, and you can see that Device1 and Devic3 successfully set up the remote LDP session.

#View the LDP adjacency on Device1 and Device3.

Take Device1 as an example:

Device1#show mpls ldp adjacency

IP Address Intf Name Deadtime LDP-Identifier

33.33.33.33 / 00:01:20 33.33.33.33:0

In the LDP adjacency table of Device1, you can see the Targeted adjacency 33.33.33.33 of the interface “/”.

#View the remote peer on Device1 and Device3.

Take Device1 as an example:

Device1#show mpls ldp targeted-peers

IP Address State

33.33.33.33 Active

You can see that there is the Device3 information in the remote peer table of Device1.

l For the checking method of Device3, refer to Device1.

l The LDP remote session is usually used in the MPLS L2VPN environment.


3 MPLS VPLS


3.1 Overview

MPLS VPLS (Virtual Private LAN Service) is one point-to-multipoint L2VPN (Layer 2 Virtual Private Network) technology provided in the Ethernet LAN. The technology can connect the access points validly, and realize the point-to-point, point-to-multipoint, and multipoint-to-multipoint Ethernet service on the network topology.

The MPLS VPLS technology includes two layers, that is, signaling control layer and data forwarding layer.

l Signaling control layer: The VPLS technology uses the signaling protocol to set up the PW (Pseudo Wire) across the core network between the PEs (Provider Edge). With the PW, the Ethernet data unit can be transmitted on the core network. Most of the core networks are PSN (Packet Switch Network), like IP/MPLS. The PW in VPLS is set up by setting up one pair of uni-directional MPLS VC-LSP(Virtual Circuit-Label Switching Path) between two PEs. The setup PSN tunnel can bear multiple MPLS VPLS services, and meanwhile, shield the transmitted data and protect the security of the data across the core network. Besides, the VPLS technology adopts the signaling protocol to dynamically discover the added and logout PE node, updating the network topology information in real time.

l Data forwarding layer: One VPLS domain corresponds to one VPN user. PE maintains one bridge MAC address table of containing the corresponding relation of the MAC address and the forwarding path for each MPLS VPLS domain. MPLS VPLS creates the table via the source MAC learning, and forwards data based on the bridge MAC address table.

The VPLS technology simulates one LAN, similar to connect the user branch LAN to one switch, and inevitably, there are loops. To solve the loop topology problem, the VPLS technology puts forward the hierarchical VPLS, that is, H-VPLS (Hierarchy of VPLS) technology.

The L2 transparent transmission service provided by MPLS VPLS is different from the traditional L2VPN service. The traditional L2VPN service is the point-to-point connection service, while MPLS VPLS simulates one virtual switch on the PE device for the VPN users to use. The virtual switch has the same functions as the traditional switch. In this way, the VPN user can realize the interconnection in the VPN groups via the MPLS VPLS, realizing the multipoint connection. Besides, the MPLS VPLS technology has one advantage that after configuring the PE device with the multipoint connectivity and when adding, deleting or re-deploying the CE device in the VPN, you just need to re-configure the direct-connected PE device. If using the traditional point-to-point L2VPN, you need to re-configure each PE device. Maipu supports Martini MPLS VPLS, which can make the LDP protocol distribute the label for the VC FEC by expanding the LDP protocol.


3.2 MPLS VPLS Function Configuration

Table 3‑1 MPLS VPLS function configuration list

Configuration task
Configure the VPLS instance | Configure the VPLS instance
Bind the VPLS instance | Bind the VPLS instance
Configure the VPLS instance attributes | Configure MTU
Configure H-VPLS | Configure SVC H-VPLS


3.2.1 Configure the VPLS Instance

Configuration Condition

When configuring the VPLS instance, first complete the following tasks:

l Ensure the IGP connectivity on the MPLS core network

l Enable LDP and set up the global LSP on the MPLS core network

Configure the VPLS Instance

When configuring the VPLS instance, specify the VPN ID and peer PE address. VPN ID is used to distinguish different VPLS domains. LDP creates the VC FEC according to VPN ID, distributes the label for the VC FEC, and sets up the LDP target session according to the peer PE address. LDP negotiates the PW parameters and exchanges the label information via the target session.

Table 3‑2 Configure the VPLS instance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create one VPLS instance | mpls vpls vsi-name [ manual ] | Mandatory By default, do not create the VPLS instance.
Configure VPN ID | vpn-id value | Mandatory By default, do not create the VPN ID.
Configure the peer PE | peer peer-address [ preferred-path tunnel tunnel-id [ disable-fallback ] ] | Mandatory By default, do not create the peer PE.

l If the VPLS forwarding path prefers tunnel, and then, configure the disable-fallback parameter, it indicates that you can only use the specified tunnel to forward the packets of the VPLS instance.

l VPN ID should be unique globally, and cannot repeat with VPN ID and VC ID of other VPLS instance and the VC ID in VPWS.

l The peer PE address should be the LDP transmission address of the peer PE, and the address is used to set up the target session between PEs.


3.2.2 Bind the VPLS Instance

Configuration Condition

Before the interface binds the MPLS VPLS instance, first complete the following tasks:

l Configure the VPLS instance

l Enable the MPLS forwarding capability on the desired interface, and do not configure the IP address

Bind the VPLS Instance

On the PE device, the interface connecting the CE binds the corresponding VPLS instance, and the packet received from the interface enters the VPLS instance for forwarding.

When binding the VPLS instance, you can specify the packet encapsulation mode between CE and PE as ethernet or vlan mode. By default, it is Ethernet. The meanings of the two modes are as follows:

l ethernet mode: The packet received from the CE is forwarded to the peer PE via PW. No matter whether the packet carries the service delimiter, PE directly presses the label, and then, forwards. After receiving the packet, the peer PE device directly pops up the label, and then, forwards the packet to CE.

l vlan mode: When the packet received from CE is forwarded to the peer PE via PW and if the packet carries the service delimiter, PE removes the service delimiter, presses the label, and forwards the packet. After the peer PE receives the popup label of the packet, add the corresponding service delimiter according to the AC interface type. If the packet does not carry the service delimiter, PE directly presses the label, and then, forwards the packet. After the peer PD receives the popup label of the packet, add the corresponding service delimiter according to the AC interface type.

Table 3‑3 Bind the VPLS instance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Bind the VPLS instance | mpls vpls vsi-name [ ethernet | vlan ] | Mandatory By default, do not bind the VPLS instance on the interface.

l As for the ethernet mode and vlan mode, the VLAN interface, L3 Ethernet main interface, and L3 Ethernet sub interface support configuring any one of the two modes. For details, refer to MPLS VPLS command manual.


3.2.3 Configure the VPLS Instance Attribute

Configuration Condition

None

Configure MTU

The MTU in the VPLS instance is the maximum transmission unit of the VPLS instance. The MTUs of the VPLS instances on the peer PE devices should be consistent. Otherwise, the PW connection cannot be set up.

Table 3‑4 Configure MTU

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the VPLS configuration mode | mpls vpls vsi-name | --
Configure MTU | mtu value | Optional By default, the MTU value of the VPLS instance is 1500 bytes.

l The configure MTU value is used only when the LDP protocol negotiates the PW parameter, not affecting the VPLS instance forwarding the packet.


3.2.4 Configure H-VPLS

Configuration Condition

When configuring H-VPLS, first complete the following tasks:

l Ensure the IGP connectivity on the MPLS core network

l Enable LDP and set up the global LSP on the MPLS core network

Configure SVC H-VPLS

H-VPLS (Hierarchical VPLS) uses a centralized star layout to build the hierarchical MPLS L2VPN network. The PE devices are divided to two kinds: One is the PE on the MPLS core network, called NPE, and the other is the PE device connecting the user, called UPE. UPE can be the L2 device only supporting the switching function, and also can be the L3 device supporting the switching function and the routing function. One end of it sets up PW to connect NPE, and the other end can connect one or multiple user CE devices. The PEs on the MPLS core network still remains a fully-meshed topology.

The PW between the NPE and UPE in the SVC H-VPLS is created via the Spoke VC function of LDP. When configuring the SVC H-VPLS, it is necessary to specify the UPE and VCID on the NPE.

Table 3‑5 Configure the SVC H-VPLS

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the VPLS configuration mode | mpls vpls vsi-name | Mandatory By default, do not create the VPLS instance.
Configure VPN ID | vpn-id value | Mandatory By default, do not configure the VPN ID.
Configure the peer PE of SVC | peer peer-address vc vc-id[ raw | taged ] [ preferred-path tunnel tunnel-id [ disable-fallback ] ] | Mandatory By default, do not configure the peer PE.


3.2.5 MPLS VPLS Monitoring and Maintaining

Table 3‑6 MPLS VPLS monitoring and maintaining

Command | Description
show bridge | Display the bridge MAC address table information (for details, refer to the bridge configuration manual)
show mpls cache vpls [ detail ] | Display the MPLS VPLS fast forwarding table information
show mpls ldp vpls [ vpn-id | detail | peer peer-address | statistics | svc [vpn-id][detail] ] | Display the PW information of the VPLS instance in the LDP protocol
show mpls forwarding-table vpls [ ftn [ vpls_name ] | ilm ][ detail ] | Display the forwarding entry information of the VPLS instance
show mpls vpls vsi [ vsi-name ] | Display the details of the forwarding table of the VPLS instance


3.3 MPLS VPLS Typical Configuration Example


3.3.1 Configure VPLS Basic Functions

Network Requirements

l The three CEs in the whole MPLS network belong to one VPN, and the CEs in one VPN can communicate with each other.

l PE and P adopt OSPF as IGP to realize the intercommunication in the PEs. Configure LDP to distribute the global label.

Network Topology

Figure 3‑1 Networking of configuring VPLS basic functions

Device | Interface | IP Address | Device | Interface | IP Address
E1 | Gi0 | 1.0.0.1/24 | PE1 | Gi1 | 3.0.0.2/24
CE2 | Gi0 | 1.0.0.2/24 |  | Loopback0 | 11.0.0.1/32
CE3 | Gi0 | 1.0.0.3/24 | PE2 | Gi0 | -
P | Gi0 | 3.0.0.1/24 |  | Gi1 | 4.0.0.2/24
 | Gi1 | 4.0.0.1/24 |  | Loopback0 | 12.0.0.1/32
 | Gi2 | 5.0.0.1/24 | PE3 | Gi0 | -
 | Loopback0 | 10.0.0.1/32 |  | Gi1 | 5.0.0.2/24
PE1 | Gi0 | - |  | Loopback0 | 13.0.0.1/32

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Configure the global OSPF, and advertise the global route.

#On PE1, configure the global OSPF.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 11.0.0.1 0.0.0.0 area 0

PE1(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#On P, configure the global OSPF.

P#configure terminal

P(config)#router ospf 100

P(config-ospf)#network 10.0.0.1 0.0.0.0 area 0

P(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

P(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

P(config-ospf)#network 5.0.0.0 0.0.0.255 area 0

P(config-ospf)#exit

#On PE2, configure the global OSPF.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 12.0.0.1 0.0.0.0 area 0

PE2(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#On PE3, configure the global OSPF.

PE3#configure terminal

PE3(config)#router ospf 100

PE3(config-ospf)#network 13.0.0.1 0.0.0.0 area 0

PE3(config-ospf)#network 5.0.0.0 0.0.0.255 area 0

PE3(config-ospf)#exit

#After configuration, view the global route table on PE and P.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 3.0.0.0/24 is directly connected, 00:35:39, gigabitethernet1

O 4.0.0.0/24 [110/2] via 3.0.0.1, 00:30:20, gigabitethernet1

O 5.0.0.0/24 [110/2] via 3.0.0.1, 00:30:20, gigabitethernet1

C 127.0.0.0/8 is directly connected, 2066:16:18, lo0

O 10.0.0.1/32 [110/2] via 3.0.0.1, 00:29:44, gigabitethernet1

C 11.0.0.1/32 is directly connected, 00:31:06, loopback0

O 12.0.0.1/32 [110/3] via 3.0.0.1, 00:04:00, gigabitethernet1

O 13.0.0.1/32 [110/3] via 3.0.0.1, 00:27:58, gigabitethernet1

You can see that there is the information of the route to loopback0 segment of P, PE2, and PE3 in the route table of PE1.

l For the checking methods of P, PE2, and PE3, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 11.0.0.1

PE1(config-ldp)#transport-address 11.0.0.1

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#mpls ip

PE1(config-if-gigabitethernet1)#mpls ldp

PE1(config-if-gigabitethernet1)#exit

#On P, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

P(config)#mpls ip

P(config)#mpls ldp

P(config-ldp)#router-id 10.0.0.1

P(config-ldp)#transport-address 10.0.0.1

P(config-ldp)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#mpls ip

P(config-if-gigabitethernet0)#mpls ldp

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#mpls ip

P(config-if-gigabitethernet1)#mpls ldp

P(config-if-gigabitethernet1)#exit

P(config)#interface gigabitethernet2

P(config-if-gigabitethernet2)#mpls ip

P(config-if-gigabitethernet2)#mpls ldp

P(config-if-gigabitethernet2)#exit

#On PE2, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 12.0.0.1

PE2(config-ldp)#transport-address 12.0.0.1

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#mpls ip

PE2(config-if-gigabitethernet1)#mpls ldp

PE2(config-if-gigabitethernet1)#exit

#On PE3, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE3(config)#mpls ip

PE3(config)#mpls ldp

PE3(config-ldp)#router-id 13.0.0.1

PE3(config-ldp)#transport-address 13.0.0.1

PE3(config-ldp)#exit

PE3(config)#interface gigabitethernet1

PE3(config-if-gigabitethernet1)#mpls ip

PE3(config-if-gigabitethernet1)#mpls ldp

PE3(config-if-gigabitethernet1)#exit

l router-id and transport-address can be configured manually and also can be generated automatically. Usually, they are configured to be the same. If not manually configuring router-id and transport-address, the device automatically select: from the up interfaces, first select the maximum IP address in the Loopback interfaces; if the device is not configured with the Loopback interface address, select the maximum IP address in the common interfaces.

# After configuration, view the LDP session information on PE and P.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

10.0.0.1 Multicast Active OPERATIONAL 00:02:43

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

State is displayed as OPERATIONAL, indicating that the PE1 and P set up the LDP session successfully.

#On the device, view the MPLS forwarding table.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 10.0.0.1/32 / 3 gigabitethernet1 3.0.0.1 20 982

L global 12.0.0.1/32 / 18 gigabitethernet1 3.0.0.1 0 0

L global 13.0.0.1/32 / 17 gigabitethernet1 3.0.0.1 0 0

You can see that there is the FEC label information of the route to the loopback interface address segment of P and PE2 in the MPLS forwarding table of PE1.

l For the checking methods of P, PE2, and PE3, refer to PE1.

Step 4:

Configure the VPLS instance and bind the VPLS instance on the AC interface.

#On PE1, configure the VPLS instance 100 and specify the remote PE, and meanwhile, bind the VPLS instance on gigabitethernet0.

PE1(config)#mpls vpls 100

PE1(config-vpls)#vpn-id 1

PE1(config-vpls)#peer 12.0.0.1

PE1(config-vpls)#peer 13.0.0.1

PE1(config-vpls)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#mpls ip

PE1(config-if-gigabitethernet0)#mpls vpls 100

PE1(config-if-gigabitethernet0)#exit

#On PE2, configure the VPLS instance 100 and specify the remote PE, and meanwhile, bind the VPLS instance on gigabitethernet0.

PE2(config)#mpls vpls 100

PE2(config-vpls)#vpn-id 1

PE2(config-vpls)#peer 11.0.0.1

PE2(config-vpls)#peer 13.0.0.1

PE2(config-vpls)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls vpls 100

PE2(config-if-gigabitethernet0)#exit

#On PE3, configure the VPLS instance 100 and specify the remote PE, and meanwhile, bind the VPLS instance on gigabitethernet0.

PE3(config)#mpls vpls 100

PE3(config-vpls)#vpn-id 1

PE3(config-vpls)#peer 11.0.0.1

PE3(config-vpls)#peer 12.0.0.1

PE3(config-vpls)#exit

PE3(config)#interface gigabitethernet0

PE3(config-if-gigabitethernet0)#mpls ip

PE3(config-if-gigabitethernet0)#mpls vpls 100

PE3(config-if-gigabitethernet0)#exit

#On PE, view the VPLS setup status.

Take PE1 as an example:

PE1#show mpls ldp vpls

VPLS-ID Peer Address State Type Local-MTU Remote-MTU Label-Sent Label-Rcvd

1 12.0.0.1 Up ethernet 1500 1500 16 16

1 13.0.0.1 Up ethernet 1500 1500 20 20

Statistics for ldp vpls:

LDP VPLS up: 2

LDP VPLS down: 0

State is displayed as UP, indicating that the VPLS is set up successfully on PE1.

l For the checking method of PE2 and PE3, refer to PE1.

l On the desired AC interface, enable the MPLS forwarding capability, and do not configure the IP address.

Step 5:

Check the result.

#On the PE, view the MPLS forwarding table.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 10.0.0.1/32 / 3 gigabitethernet1 3.0.0.1 2090 102412

L global 12.0.0.1/32 / 18 gigabitethernet1 3.0.0.1 8263 518638

L global 13.0.0.1/32 / 17 gigabitethernet1 3.0.0.1 6236 411162

L -VPLS- 1 / 16 gigabitethernet1 12.0.0.1 0 0

L -VPLS- 1 / 20 gigabitethernet1 13.0.0.1 0 0

L -VPLS- 12.0.0.1/32 16 / VPLS 1 / 0 0 0

L global 10.0.0.1/32 17 3 gigabitethernet1 3.0.0.1 0 0 0

L global 12.0.0.1/32 18 18 gigabitethernet1 3.0.0.1 0 0 0

L global 13.0.0.1/32 19 17 gigabitethernet1 3.0.0.1 0 0 0

L -VPLS- 13.0.0.1/32 20 / VPLS 1 / 0 0 0

You can see that there are the VPLS entries in the MPLS forwarding table of PE1.

l For the checking method of PE2 and PE3, refer to PE1.

l You can execute the command show bridge on the PE to display the bridge MAC address table information (for details, refer to the bridge configuration manual).

#On CE1, ping the gigabitethernet0 address of CE2 and CE3, and the ping can be connected.

CE1#ping 1.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 1.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/3/16 ms.

CE1#ping 1.0.0.3

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 1.0.0.3 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/3/16 ms.

You can see that the CE devices in the same VPN can communicate with each other.


3.3.2 Configure H-VPLS

Network Requirements

l There are two VPNs in the whole MPLS network, the CEs in the same VPN can communicate with each other, and the CEs in different VPNs cannot communicate with each other.

l UPE and NPE can set up the virtual connection via the SVC mode.

l Adopt OSPF as IGP to realize the communication between the PEs, and configure LDP to distribute the global label.

Network Topology

Figure 3‑2 Networking of configuring H-VPLS

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 1.0.0.1/24 | PE1 | Gi2 |
CE2 | Gi0 | 2.0.0.1/24 |  | Loopback0 | 12.0.0.1/32
CE3 | Gi0 | 1.0.0.2/24 | PE2 | Gi0 | 5.0.0.1/24
CE4 | Gi0 | 2.0.0.2/24 |  | Gi1 | 6.0.0.1/24
NPE | Gi0 | 3.0.0.2/24 |  | Gi2 |
 | Gi1 | 4.0.0.2/24 |  | Loopback0 | 13.0.0.1/32
 | Gi2 | 5.0.0.2/24 | UPE | Gi0 | 3.0.0.1/24
 | Loopback0 | 11.0.0.1/32 |  | Gi1 | -
PE1 | Gi0 | 6.0.0.2/24 |  | Gi2 | -
 | Gi1 | 4.0.0.2/24 |  | Loopback0 | 10.0.0.1/32

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Configure the global OSPF, and advertise the global route.

#On UPE, configure the global OSPF.

UPE#configure terminal

UPE(config)#router ospf 100

UPE(config-ospf)#network 10.0.0.1 0.0.0.0 area 0

UPE(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

UPE(config-ospf)#exit

#On NPE, configure the global OSPF.

NPE#configure terminal

NPE(config)#router ospf 100

NPE(config-ospf)#network 11.0.0.1 0.0.0.0 area 0

NPE(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

NPE(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

NPE(config-ospf)#network 5.0.0.0 0.0.0.255 area 0

NPE(config-ospf)#exit

#On PE1, configure the global OSPF.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 12.0.0.1 0.0.0.0 area 0

PE1(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

PE1(config-ospf)#network 6.0.0.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#On PE2, configure the global OSPF.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 13.0.0.1 0.0.0.0 area 0

PE2(config-ospf)#network 5.0.0.0 0.0.0.255 area 0

PE2(config-ospf)#network 6.0.0.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#After configuration, view the global route table on the PE.

Take NPE as an example:

NPE#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 3.0.0.0/24 is directly connected, 88:26:40, gigabitethernet0

C 4.0.0.0/24 is directly connected, 88:26:30, gigabitethernet1

C 5.0.0.0/24 is directly connected, 88:26:24, gigabitethernet2

O 6.0.0.0/24 [110/2] via 4.0.0.1, 88:12:10, gigabitethernet1

[110/2] via 5.0.0.1, 88:09:45, gigabitethernet2

C 127.0.0.0/8 is directly connected, 278:36:42, lo0

O 10.0.0.1/32 [110/2] via 3.0.0.1, 88:24:04, gigabitethernet0

C 11.0.0.1/32 is directly connected, 88:25:07, loopback0

O 12.0.0.1/32 [110/2] via 4.0.0.1, 88:11:59, gigabitethernet1

O 13.0.0.1/32 [110/2] via 5.0.0.1, 88:09:35, gigabitethernet2

You can see that there is the information of the route to loopback0 segment of UPE, PE1, and PE1 in the route table of NPE.

l For the checking methods of UPE, PE1, and PE2, refer to NPE.

Step 3:

Enable MPLS IP and MPLS LDP.

#On UPE, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

UPE(config)#mpls ip

UPE(config)#mpls ldp

UPE(config-ldp)#router-id 10.0.0.1

UPE(config-ldp)#transport-address 10.0.0.1

UPE(config-ldp)#exit

UPE(config)#interface gigabitethernet0

UPE(config-if-gigabitethernet0)#mpls ip

UPE(config-if-gigabitethernet0)#mpls ldp

UPE(config-if-gigabitethernet0)#exit

#On NPE, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

NPE(config)#mpls ip

NPE(config)#mpls ldp

NPE(config-ldp)#router-id 11.0.0.1

NPE(config-ldp)#transport-address 11.0.0.1

NPE(config-ldp)#exit

NPE(config)#interface gigabitethernet0

NPE(config-if-gigabitethernet0)#mpls ip

NPE(config-if-gigabitethernet0)#mpls ldp

NPE(config-if-gigabitethernet0)#exit

NPE(config)#interface gigabitethernet1

NPE(config-if-gigabitethernet1)#mpls ip

NPE(config-if-gigabitethernet1)#mpls ldp

NPE(config-if-gigabitethernet1)#exit

NPE(config)#interface gigabitethernet2

NPE(config-if-gigabitethernet2)#mpls ip

NPE(config-if-gigabitethernet2)#mpls ldp

NPE(config-if-gigabitethernet2)#exit

#On PE1, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 12.0.0.1

PE1(config-ldp)#transport-address 12.0.0.1

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#mpls ip

PE1(config-if-gigabitethernet0)#mpls ldp

PE1(config-if-gigabitethernet0)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#mpls ip

PE1(config-if-gigabitethernet1)#mpls ldp

PE1(config-if-gigabitethernet1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 13.0.0.1

PE2(config-ldp)#transport-address 13.0.0.1

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#mpls ip

PE2(config-if-gigabitethernet1)#mpls ldp

PE2(config-if-gigabitethernet1)#exit

# After configuration, view the LDP session information on PE.

Take NPE as an example:

NPE#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

10.0.0.1 Multicast Active OPERATIONAL 00:02:51

12.0.0.1 Multicast Passive OPERATIONAL 00:02:32

13.0.0.1 Multicast Passive OPERATIONAL 00:02:00

Statistics for ldp sessions:

Multicast sessions: 3

Targeted sessions: 0

State is displayed as OPERATIONAL, indicating that the PE1 and P set up the LDP session successfully.

#On the device, view the MPLS forwarding table.

Take NPE as an example:

NPE#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts Flag

L global 10.0.0.1/32 / 3 gigabitethernet0 3.0.0.1 40

L global 12.0.0.1/32 / 3 gigabitethernet1 4.0.0.1 38

L global 13.0.0.1/32 / 3 gigabitethernet2 5.0.0.1 28

L global 10.0.0.1/32 16 3 gigabitethernet0 3.0.0.1 0 0

L global 12.0.0.1/32 17 3 gigabitethernet1 4.0.0.1 0 0

L global 13.0.0.1/32 18 3 gigabitethernet2 5.0.0.1 0 0

You can see that there is the FEC label information of the route to the loopback interface address segment of UPE, PE1 and PE2 in the MPLS forwarding table of NPE.

l For the checking methods of UPE, PE1, and PE2, refer to NPE.

Step 4:

Configure the VPLS instance and bind the VPLS instance on the AC interface.

#On PE1, configure the VPLS instance and specify the remote PE, and meanwhile, bind the VPLS instance 100 on gigabitethernet0.

PE1(config)#mpls vpls 100

PE1(config-vpls)#vpn-id 1

PE1(config-vpls)#peer 11.0.0.1

PE1(config-vpls)#peer 13.0.0.1

PE1(config-vpls)#exit

PE1(config)#interface gigabitethernet2

PE1(config-if-gigabitethernet2)#mpls ip

PE1(config-if-gigabitethernet2)#mpls vpls 100

PE1(config-if-gigabitethernet2)#exit

#On PE2, configure the VPLS instance and specify the remote PE, and meanwhile, bind the VPLS instance 200 on gigabitethernet2.

PE2(config)#mpls vpls 200

PE2(config-vpls)#vpn-id 2

PE2(config-vpls)#peer 11.0.0.1

PE2(config-vpls)#peer 12.0.0.1

PE2(config-vpls)#exit

PE2(config)#interface gigabitethernet2

PE2(config-if-gigabitethernet2)#mpls ip

PE2(config-if-gigabitethernet2)#mpls vpls 200

PE2(config-if-gigabitethernet2)#exit

#On NPE, configure the VPLS instance and specify the remote PE, and meanwhile, configure the SVC peer.

NPE(config)#mpls vpls 100

NPE(config-vpls)#vpn-id 1

NPE(config-vpls)#peer 12.0.0.1

NPE(config-vpls)#peer 13.0.0.1

NPE(config-vpls)#peer 10.0.0.1 vc 10

NPE(config-vpls)#exit

NPE(config)#mpls vpls 200

NPE(config-vpls)#vpn-id 2

NPE(config-vpls)#peer 12.0.0.1

NPE(config-vpls)#peer 13.0.0.1

NPE(config-vpls)#peer 10.0.0.1 vc 20

NPE(config-vpls)#exit

#On UPE, configure the VPLS instance and configure the SVC peer, and meanwhile, bind the VPLS instance 100 on gigabitethernet1 and bind the VPLS instance 200 on gigabitethernet2.

UPE(config)#mpls vpls 100

UPE(config-vpls)#vpn-id 1

UPE(config-vpls)#peer 11.0.0.1 vc 10

UPE(config-vpls)#exit

UPE(config)#mpls vpls 200

UPE(config-vpls)#vpn-id 2

UPE(config-vpls)#peer 11.0.0.1 vc 20

UPE(config-vpls)#exit

UPE(config)#interface gigabitethernet1

UPE(config-if-gigabitethernet1)#mpls ip

UPE(config-if-gigabitethernet1)#mpls vpls 100

UPE(config-if-gigabitethernet1)#exit

UPE(config)#interface gigabitethernet2

UPE(config-if-gigabitethernet2)#mpls ip

UPE(config-if-gigabitethernet2)#mpls vpls 200

UPE(config-if-gigabitethernet2)#exit

#On the PE, view the VPLS setup status.

Take NPE as an example:

NPE#show mpls ldp vpls

VPLS-ID Peer Address State Type Local-MTU Remote-MTU Label-Sent Label-Rcvd

1 12.0.0.1 Up ethernet 1500 1500 19 19

2 13.0.0.1 Up ethernet 1500 1500 23 19

Statistics for ldp vpls:

LDP VPLS up: 2

LDP VPLS down: 0

State is displayed as UP, indicating that the VPLS is set up successfully on NPE.

#On NPE and UPE, view the SVC setup status.

Take UPE as an example:

UPE#show mpls ldp vpls svc

VC-ID Interface State Type Local-Label Remote-Label Destination-Address

10 VPLS:1 UP ethernet 16 21 11.0.0.1

20 VPLS:2 UP ethernet 17 24 11.0.0.1

Statistics for VPLS SVC:

VPLS SVC up: 2

VPLS SVC down: 0

State is displayed as UP, indicating that the SVC is set up successfully between UPE and NPE.

Step 5:

Check the result.

#On UPE, view the MPLS forwarding table.

UPE#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.0.0.1/32 / 3 gigabitethernet0 3.0.0.2 667 34482

L global 12.0.0.1/32 / 17 gigabitethernet0 3.0.0.2 0 0

L global 13.0.0.1/32 / 18 gigabitethernet0 3.0.0.2 0 0

L -VPLS- 1/vc:10 / 21 gigabitethernet0 11.0.0.1 9 726

L -VPLS- 2/vc:20 / 24 gigabitethernet0 11.0.0.1 0 0

L -VPLS- 11.0.0.1/32 16 / VPLS 1 / 9 9 690

L -VPLS- 11.0.0.1/32 17 / VPLS 2 / 0 0 0

#On NPE, view the MPLS forwarding table.

NPE#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts Flag

L global 10.0.0.1/32 / 3 gigabitethernet0 3.0.0.1 694

L global 12.0.0.1/32 / 3 gigabitethernet1 4.0.0.1 704

L global 13.0.0.1/32 / 3 gigabitethernet2 5.0.0.1 695

L -VPLS- 1 / 19 gigabitethernet1 12.0.0.1 9

L -VPLS- 1/vc:10 / 16 gigabitethernet0 10.0.0.1 9

L -VPLS- 2 / 19 gigabitethernet2 13.0.0.1 0

L -VPLS- 2/vc:20 / 17 gigabitethernet0 10.0.0.1 0

L global 10.0.0.1/32 16 3 gigabitethernet0 3.0.0.1 0 0

L global 12.0.0.1/32 17 3 gigabitethernet1 4.0.0.1 0 0

L global 13.0.0.1/32 18 3 gigabitethernet2 5.0.0.1 0 0

L -VPLS- 12.0.0.1/32 19 / VPLS 1 / 9 9

L -VPLS- 10.0.0.1/32 21 / VPLS 1 / 9 9

L -VPLS- 13.0.0.1/32 23 / VPLS 2 / 0 0

L -VPLS- 10.0.0.1/32 24 / VPLS 2 / 0 0

#On PE1, view the MPLS forwarding table.

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 10.0.0.1/32 / 16 gigabitethernet1 4.0.0.2 0 0

L global 11.0.0.1/32 / 3 gigabitethernet1 4.0.0.2 1932 112704

L global 13.0.0.1/32 / 3 gigabitethernet0 6.0.0.1 1919 111994

L -VPLS- 1 / 19 gigabitethernet1 11.0.0.1 11 854

L global 10.0.0.1/32 16 16 gigabitethernet1 4.0.0.2 0 0 0

L global 11.0.0.1/32 17 3 gigabitethernet1 4.0.0.2 0 0 0

L global 13.0.0.1/32 18 3 gigabitethernet0 6.0.0.1 0 0 0

L -VPLS- 11.0.0.1/32 19 / VPLS 1 / 11 11 810

You can see that there are the VPLS entries in the MPLS forwarding table of the device.

l For the checking method of PE2, refer to PE1.

l You can execute the command show bridge on the PE to display the bridge MAC address table information (for details, refer to the bridge configuration manual).

#On CE1, ping the gigabitethernet0 address of CE3, and the ping can be connected.

CE1#ping 1.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 1.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/3/16 ms.

#On CE2, ping the gigabitethernet0 address of CE4, and the ping can be connected.

CE2#ping 2.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 2.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/3/16 ms.

You can see that the CE devices in the same VPN can communicate with each other.


4 MPLS VPWS


4.1 Overview

MPLS VPWS (Virtual Private Wire Service) is one point-to-point virtual private wire technology, used to provide the L2 VPN service of different media for the user via the MPLS network, supporting ATM, FR, VLAN, Ethernet, PPP, HDLC and other L2 media. Meanwhile, the MPLS network still can provide the common IP, L3 VPN, traffic engineering, QoS and other services, greatly saving the investment of the carrier in the network construction.

MPLS VPWS encapsulates the label stack before the L2 packet to transmit the L2 data transparently on the MPLS network. The outer label is called the tunnel label, mainly used to transmit the packet from one PE to another PE; the inner label is called VC label, used to distinguish the different connections in different L2VPN. After receiving the packet with the VC label, the PE decides to which VPN user the packet is transmitted according to the VC label.

With the MPLS VPWS network, you can set up the L2 connection between different sites. The carrier just needs to provide the L2 connectivity for the user, while does not need to take part in the route calculation of the VPN user. Because of this feature, MPLS VPWS has better scalability than MPLS L3VPN. Maipu supports Martini MPLS VPWS, that is, make the LDP protocol distribute the label for the VC FEC via the expanded LDP protocol.


4.2 MPLS VPWS Function Configuration

Table 4‑1 MPLS VPWS function configuration list

Configuration task
Configure MPLS VPWS | Configure MPLS VPWS
Configure MPLS VPWS across domain | Configure MPLS VPWS across domain


4.2.1 Configure MPLS VPWS

Configuration Condition

Before configuring MPLS VPWS, first complete the following tasks:

l On the MPLS core network, ensure the IGP connectivity.

l On the MPLS core network, enable the label signaling protocol, and set up the global LSP.

l Enable the MPLS forwarding basic capability on the desired interface.

Configure MPLS VPWS

Martini expands the LDP protocol, and adds the VC FEC type in the LDP protocol, making the LDP distribute the VC label for the VC FEC. Besides, the two PE devices exchanging the VC label may be not directly connected, so LDP should use the peer PE address of the VPWS VC connection to set up the target session, and transmits the VC label on the session. When the label exchanging and binding between two PEs are complete, and the parameters are negotiated to be consistent, the PW between the two PEs is set up, and the CEs can transmit the L2 data via the PW. The MPLS VPWS realized by expanding the LDP signaling protocol can bear various link-layer protocols, but it is required that the link layer protocols of each site of the VPN are the same.

When MPLS VPWS bears the Ethernet link data, the MPLS VPWS VC connection created on the L3 interface can specify the ethernet or vlan mode:

l By default, the VLAN interface is vlan mode, and the parameter can only be specified as vlan mode.

l By default, the L3 Ethernet sub interface is vlan mode, and the parameter can be configured as the ethernet mode or vlan mode.

l By default, the L3 Ethernet main interface is the ethernet mode, and the parameter can only be specified as the ethernet mode.

Table 4‑2 Configure MPLS VPWS

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Create the VPWS connection | xconnect peer-address vc-id encapsulation mpls [ ethernet | vlan ] [ preferred-path tunnel tunnel-id [ disable-fallback ] ] | Mandatory By default, do not create the VPWS connection on the interface.

l When configuring MPLS VPWS, it is necessary to confirm the interface type of the peer PE connecting CE, and ensure that the interface types of the two sides are consistent.

l It is necessary to plan VC ID, and ensure that the VC ID is unique globally, and cannot repeat with VPN ID or VC ID in the VPLS instance.

l For the meaning of the ethernet and vlan parameters when creating VPWS, refer to MPLS VPWS command manual.


4.2.2 Configure MPLS VPWS across Domain

Configuration Condition

Before configuring the MPLS VPWS across domain, first complete the following tasks:

l Configure MPLS VPWS in the domain

l Configure the direct-connected IP address of ASBR, realizing that the IP between ASBR is reachable.

Configure MPLS VPWS across Domain

MPLS VPWS across domain is the expanding for the previous MPLS VPWS, so as to realize the VPWS interconnection between AS. MPLS VPWS across domain can splice the multiple segmented PWs in the AS into one end-to-end PW. Seeing from the CEs at the two sides, the functions of the end-to-end PW are the same as the common PW.

MPLS VPWS across domain is divided to Option-A, Option-B, and Option-C. Currently, support Option-A and Option-B.

MPLS VPWS Option-A across domain is the simplest mode of realizing the VPWS interconnection between AS. Option-A across domain regards another ASBR as the CE device to splice the PWs. ASBR does not need additional configuration. For the configuration of MPLS VPWS Option-A across domain, refer to “Configure MPLS VPWS”.

MPLS VPWS Option-B across domain needs to run MP-EBGP between ASBR to distribute the global label, and create the VFI (Virtual Forwarding Interface) on the ASBR, using the expanded LDP protocol to distribute the VC label between ASBR. Meanwhile, inherit the VC attributes (such as AC MTU and encapsulation type).

Table 4‑3 Configure MPLS VPWS Option-B across domain

Step | Command | Description
Enter the interface configuration mode | interface interface-name | -
Enable the MPLS forwarding on the interface | mpls ip | Mandatory Configure on the interconnected interfaces of two ASBR. By default, do not enable the MPLS forwarding on the interface.
Enable the LDP protocol on the interface | mpls ldp | Mandatory Configure on the interconnected interfaces of two ASBR. By default, the interface does not enable the LDP protocol.
Return to the global configuration mode | exit | -
Create VPWS VFI and enter the VPWS VFI configuration mode | l2 vfi vfi-name point-to-point | Mandatory By default, do not create VPWS VFI.
Configure the local PE address and VC ID of VPWS VFI | peer peer-address vc-id encapsulation mpls | Mandatory By default, do not configure the local PE address and VC ID of VPWS VFI.
Configure the peer ASBR address and VC ID of VPWS VFI | peer peer-address vc-id encapsulation mpls | Mandatory By default, do not configure the peer ASBR address and VC ID of VPWS VFI.
Return to the global configuration mode | exit | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Configure the peer ASBR as the EBGP neighbor | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory By default, do not configure any EBGP neighbor.
Enable advertising the IPv4 route with the label between neighbors | neighbor [ neighbor-address ] send-label | Mandatory By default, do not enable advertising the IPv4 route with the label between neighbors.

l When configuring the peer address and VC ID of VPWS VFI, it is necessary to plan the VC ID and ensure that the VC ID is unique globally, and cannot repeat with VPN ID or VC ID in the VPLS instance.

l The above only lists the basic configuration of MPLS VPWS Option-B across domain on ASBR. For the configuration between ASBR and the PE in the local AS, between the P devices, refer to the VPWS VFI part of “Configure MPLS VPWS”.


4.2.3 MPLS VPWS Monitoring and Maintaining

Table 4‑4 MPLS VPWS monitoring and maintaining

Command | Description
show mpls cache l2-circuit [ detail ] | Display the MPLS VPWS fast forwarding table information
show mpls cache vfi [ detail ] | Display MPLS VPWS VFI fast forwarding table information
show mpls forwarding-table l2-circuit [ ftn [ vc-id ] | ilm ] [ detail ] | Display the VPWS MPLS forwarding information
show mpls forwarding-table vfi [ ftn [vfi-name ] | ilm ] [ detail ] | Display the MPLS forwarding table information of VPWS VFI
show mpls ldp l2-circuit [ vc-id ] [ detail ] | Display the VPWS information in the LDP protocol
show mpls ldp l2-circuit statistics | Display the VPWS statistics information in the LDP protocol
show running-config vfi | Display the VPWS VFI configuration information
show vfi [vfi-name] | Display the VPWS VFI information


4.3 MPLS VPWS Typical Configuration Example


4.3.1 Configure VPWS Basic Functions

Network Requirements

l The whole MPLS network includes two VPNs, VPN1 and VPN2. The CEs in the same VPN can communicate with each other, and the CEs in different VPNs cannot communicate with each other.

l CE1 and CE3 belong to VPN1; CE2 and CE4 belong to VPN2.

l Adopt OSPF as IGP to realize the communication between the PE and P, and configure LDP to distribute the global label.

Network Topology

Figure 4‑1 Networking of configuring VPWS basic functions

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 1.0.0.1/24 | P | Gi0 | 3.0.0.2/24
CE2 | Gi0 | 2.0.0.1/24 |  | Gi1 | 4.0.0.1/24
CE3 | Gi0 | 1.0.0.2/24 |  | Loopback0 | 11.0.0.1/32
CE4 | Gi0 | 2.0.0.2/24 | PE2 | Gi0 | 4.0.0.2/24
PE1 | Gi0 | 3.0.0.1/24 |  | Gi1 | -
 | Gi1 | - |  | Gi2 | -
 | Gi2 | - |  | Loopback0 | 12.0.0.1/32
 | Loopback0 | 10.0.0.1/32 |  |  |

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Configure the global OSPF, and advertise the global route.

#On PE1, configure the global OSPF.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 10.0.0.1 0.0.0.0 area 0

PE1(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#On P, configure the global OSPF.

P#configure terminal

P(config)#router ospf 100

P(config-ospf)#network 11.0.0.1 0.0.0.0 area 0

P(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

P(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

P(config-ospf)#exit

#On PE2, configure the global OSPF.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 12.0.0.1 0.0.0.0 area 0

PE2(config-ospf)#network 4.0.0.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#After configuration, view the global route table on PE and P.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 3.0.0.0/24 is directly connected, 00:17:14, gigabitethernet0

O 4.0.0.0/24 [110/2] via 3.0.0.2, 00:01:44, gigabitethernet0

C 127.0.0.0/8 is directly connected, 2860:10:17, lo0

C 10.0.0.1/32 is directly connected, 00:30:04, loopback0

O 11.0.0.1/32 [110/2] via 3.0.0.2, 00:01:22, gigabitethernet0

O 12.0.0.1/32 [110/3] via 3.0.0.2, 00:00:49, gigabitethernet0

You can see that there is the information of the route to loopback0 segment of P, PE2 in the route table of PE1.

l For the checking methods of P, PE2, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 10.0.0.1

PE1(config-ldp)#transport-address 10.0.0.1

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#mpls ip

PE1(config-if-gigabitethernet0)#mpls ldp

PE1(config-if-gigabitethernet0)#exit

#On P, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

P(config)#mpls ip

P(config)#mpls ldp

P(config-ldp)#router-id 11.0.0.1

P(config-ldp)#transport-address 11.0.0.1

P(config-ldp)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#mpls ip

P(config-if-gigabitethernet0)#mpls ldp

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#mpls ip

P(config-if-gigabitethernet1)#mpls ldp

P(config-if-gigabitethernet1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP, and meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 12.0.0.1

PE2(config-ldp)#transport-address 12.0.0.1

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

l router-id and transport-address can be configured manually and also can be generated automatically. Usually, they are configured to be the same. If not manually configuring router-id and transport-address, the device automatically select: from the up interfaces, first select the maximum IP address in the Loopback interfaces; if the device is not configured with the Loopback interface address, select the maximum IP address in the common interfaces.

# After configuration, view the LDP session information on PE and P.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

11.0.0.1 Multicast Passive OPERATIONAL 00:02:44

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

State is displayed as OPERATIONAL, indicating that the PE1 and P set up the LDP session successfully.

#On the device, view the MPLS forwarding table.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.0.0.1/32 / 3 gigabitethernet0 3.0.0.2 0 0

L global 12.0.0.1/32 / 17 gigabitethernet0 3.0.0.2 0 0

You can see that there is the FEC label information of the route to the loopback interface address segment of P and PE2 in the MPLS forwarding table of PE1.

l For the checking method of P and PE2, refer to PE1.

Step 4:

Configure VPWS.

#On the AC interface gigabitethernet1 and gigabitethernet2 of PE1, configure VPWS.

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#mpls ip

PE1(config-if-gigabitethernet1)#xconnect 12.0.0.1 2 encapsulation mpls

PE1(config-if-gigabitethernet1)#exit

PE1(config)#interface gigabitethernet2

PE1(config-if-gigabitethernet2)#mpls ip

PE1(config-if-gigabitethernet2)#xconnect 12.0.0.1 1 encapsulation mpls

PE1(config-if-gigabitethernet2)#exit

#On the AC interface gigabitethernet1 and gigabitethernet2 of PE2, configure VPWS.

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#mpls ip

PE2(config-if-gigabitethernet1)#xconnect 10.0.0.1 1 encapsulation mpls

PE2(config-if-gigabitethernet1)#exit

PE2(config)#interface gigabitethernet2

PE2(config-if-gigabitethernet2)#mpls ip

PE2(config-if-gigabitethernet2)#xconnect 10.0.0.1 2 encapsulation mpls

PE2(config-if-gigabitethernet2)#exit

#On the PE, view the VPWS setup status.

Take PE1 as an example:

PE1#show mpls ldp l2-circuit

VC-ID Interface State Type Local-Label Remote-Label Destination-Address

1 gigabitethernet2 UP ethernet 16 19 12.0.0.1

2 gigabitethernet1 UP ethernet 17 16 12.0.0.1

Statistics for L2-circuit:

L2-circuit up: 2

L2-circuit down: 0

State is displayed as UP, indicating that the VPWS is set up successfully on PE1.

l For the checking method of PE2, refer to PE1.

l Enable the MPLS forwarding basic capability on the desired AC interface, and do not configure the IP address.

Step 5:

Check the result.

#On the PE, view the MPLS forwarding table.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.0.0.1/32 / 3 gigabitethernet0 3.0.0.2 45 2214

L global 12.0.0.1/32 / 17 gigabitethernet0 3.0.0.2 132 8438

L -VC- 2 / 16 gigabitethernet0 12.0.0.1 0 0

L -VC- 1 / 19 gigabitethernet0 12.0.0.1 0 0

L -VC- 1 16 / gigabitethernet2 12.0.0.1 0 0 0

L -VC- 2 17 / gigabitethernet1 12.0.0.1 0 0 0

L global 11.0.0.1/32 18 3 gigabitethernet0 3.0.0.2 0 0 0

L global 12.0.0.1/32 19 17 gigabitethernet0 3.0.0.2 0 0 0

You can see that there are the VPWS entries in the MPLS forwarding table of PE1.

l For the checking method of PE2, refer to PE1.

#On CE1, ping the gigabitethernet0 address of CE3, and the ping can be connected

CE1#ping 1.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 1.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/3/16 ms.

#On CE2, ping the gigabitethernet0 address of CE4, and the ping can be connected.

CE2#ping 2.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 2.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/3/16 ms.

You can see that the CE devices in the same VPN can communicate with each other.


5 MPLS L3VPN


5.1 Overview

MPLS L3VPN is one network technology of permitting the service provider to use its IP backbone network to provide the L3 VPN service for the user. In the MPLS L3VPN network, BGP is used to release the VPN route information in the backbone network of the service provider. MPLS is used to forward the VPN service from one VPN site to another site.

VRF (VPN Routing/Forwarding Instance) is one basic concept in the MPLS L3VPN network technology. Each VRF can be seen as one virtual router and owns one separate route table. Meanwhile, VRF has the separate address space, one group of interface set belonging to the VRF, and one group of route protocol only used by the VRF. The VRF technology can be used to separate different VPN users and solve the problem of the network address overlapping.

The following figure is the diagram of the MPLS L3VPN network architecture.

Figure 5‑1 MPLS L3VPN networking

In the above figure, each PE contains two VRFs, connecting two sites. The two interfaces connecting the sites belong to two VRFs respectively. Site 1 and site 2 belong to one VPN. Site 3 and site 4 belong to the other VPN.


5.2 MPLS L3VPN Function Configuration

Table 5‑1 MPLS L3VPN function configuration list

Configuration Task
Configure the VPN basic functions | Configure the VPN instance
 | Configure PE-PE route exchange
 | Configure PE-CE route exchange
Configure M-VRF | Configure M-VRF
Configure the VPN route label distributing | Configure the VPN route label distributing
Configure the VPN cross-domain | Configure the Option-A cross-domain
 | Configure the Option-B cross-domain
Configure the VPN user to access Internet | Configure CE to access Internet
 | Configure PE to access Internet
Configure the AS covering | Configure the AS covering
Configure the OSPF sham link | Configure the OSPF sham link


5.2.1 Configure VPN Basic Functions

Configuration Condition

Before configuring the VPN basic functions, first complete the following tasks:

l Configure the IGP of the MPLS backbone network, making the IP between the PE devices reachable

l Configure the MPLS basic capability and LDP of the MPLS backbone network, and set up LSP between PE devices

Configure VPN Instance

VRF can separate the routes between different VPNs, between VPN and public network. When configuring L3VPN, it is necessary to configure the VPN instance on the PE device and associate the Site in the VPN instance.

1. Configure VRF

VRF is used to separate different VPN users. In different VRFs, permit the address overlapping. When the VRF route is transmitted in the service provider network, it is sure to solve the problem of address overlapping. This requires that each VRF needs one local unique RD. When PE sends the VRF route to the remote PE, add RD to the front of each IPv4 prefix, forming the unique VPNv4 address.

Table 5‑2 Configure VRF

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create one VRF and enter the VRF configuration mode | ip vrf vrf-name | Mandatory By default, do not configure any VRF.
Configure the VRF RD | rd route-distinguisher | Mandatory By default, do not configure the RD of the VRF.

l After configuring VRF, you should configure RD at the same time so that VRF can be used.

l After configuring the VRF RD, you cannot directly delete or modify it. When it is necessary to delete or modify, use the no ip vrf command to delete VRF, and then configure RD. The RD cannot be the same as the other VRF RD of the device.

2. Configure VRF to associate with the interface

The PE device connects with the CE via the local configured VRF. The interface connected with the CE needs to associate with the corresponding VRF.

Table 5‑3 Configure the VRF to associate with the interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the interface to associate with VRF | ip vrf forwarding vrf-name | Mandatory By default, the interface does not associate with any VRF.
Configure the interface IP address | ip address ip-address { network-mask | mask-len } | Mandatory By default, the interface is not configured with the IP address.

l After configuring the ip vrf forwarding command in the interface, the existing IP address of the interface will be deleted automatically and needs to be configured again.

3. Configure the VRF attribute

When the local PE receives the VPNv4 route information sent by the remote PE device, the local PE device needs to confirm in which local VRF the VPNv4 route is placed. To control the distributing of the VPNv4 route, each VRF needs one or multiple RT attributes. There are two kinds of RT attributes: Export RT and Import RT. When the PE initiates the VPNv4 route, carry the Export RT attribute. When the PE decides which VRF the VPNv4 route is imported to, use the Export RT attribute carried by the route to match with the Import RT of the local VRF.

Besides that the VRF RT attribute can control the distributing of the VPNv4 route, the route policy on VRF also can control the route distributing. Two route policies can be configured: Import map and Import map. Import map uses the route map to control whether the route can import the VRF. Export map uses the route map to change the attributes of the route initiated from the VRF.

Table 5‑4 Configure the VRF attributes

Step

Command

Description

Enter the global configuration mode

configure terminal

-

Create one VRF and enter the VRF configuration mode

ip vrf vrf-name

Mandatory

By default, do not configure any VRF.

Configure the VRF RT

route-target
[ both | export | import ]
{ ASN:nn | IP-address:nn }

Optional

By default, do not configure the Export, Import RT attributes of the VRF.

Configure the VRF ingress route policy

import map rtmap-name

Optional

By default, do not configure the VRF ingress route policy.

Configure the VRF egress route policy

export map rtmap-name

Optional

By default, do not configure the VRF egress route policy.

l The Import map and Export map policies are valid only for the local route.

l Export map cannot perform the route filter, but can only modify the attributes of the VPN route released by the VRF. The attributes that can be modified include: community, extcommunity, and local-preference.

l When the PE imports the VPNv4 to the VRF, the RT match rule has higher priority than Import map, that is, first match the RT rule, and then match the Import map.

Configure PE-PE Route Exchange

In the MPLS L3VPN network, the PEs exchange the VPNv4 route via MP-IBGP. The configuration modes of the two PEs are the same.

Table 5‑5 Configure PE-PE route exchange

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Configure the PE neighbor | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory By default, do not configure any PE neighbor.
Configure the source address used by setting up the PE neighbor | neighbor { neighbor-address | peer-group-name } update-source { interface | ip-address } | Mandatory By default, use the egress interface address to the PE neighbor route as the source address.
Enter the BGP VPNv4 configuration mode | address-family vpnv4 [ unicast ] | Mandatory
Activate the VPNv4 address family of the PE neighbor | neighbor { neighbor-address | peer-group-name } activate | Mandatory By default, the BGP neighbors can only receive and send the IPv4 unicast route.
Configure sending the extended community attributes to the PE neighbor | neighbor { neighbor-address | peer-group-name } send-community [ both | extended | standard ] | Optional By default, the VPNv4 address family of the activated neighbor will automatically configure sending the extended community attribute.

l Many route features in the BGP VPNv4 address family are the same as the route features in the BGP IPv4 unicast address family. Whether to select the features is decided by the networking demands. For details, refer to the MPLS L3VPN chapter of the command manual.

Configure PE-CE Route Exchange

PE and CE can use the static route, RIP, OSPF, ISIS and BGP route protocol to exchange the route. Which protocol is adopted depends on the actual network environment. The PE configuration is the same as the CE configuration mode.

1. Configure PE-CE to use static route

Table 5‑6 Configure PE-CE to use the static route

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the static route to the CE | ip route vrf vrf-name destination-ip-address destination-mask nexthop-ip-address | Mandatory By default, do not configure the static route to the CE.
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Enter the BGP IPv4 VRF configuration mode | address-family ipv4 vrf vrf-name | Mandatory By default, it is in the BGP IPv4 unicast configuration mode.
Configure BGP to re-distribute the static route | redistribute static [ route-map map-name / metric value ] | Optional By default, do not configure BGP to re-distribute the static route.

2. Configure PE-CE to use RIP

Table 5‑7 Configure PE-CE to use RIP

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the RIP protocol and enter the RIP configuration mode | router rip | Mandatory By default, do not enable RIP.
Enter the VRF address family configuration mode of the RIP protocol | address-family ipv4 vrf vrf-name | Mandatory By default, do not enable the VRF address family of the RIP protocol.
Configure the RIP version in the VRF address family mode | version {1 | 2} | Mandatory By default, the RIP version is 1. Usually modify it to version 2.
Configure RIP to cover the connected interface of the PE and CE | network [network-address | interface ] | Mandatory By default, RIP does not cover the connected interface of the PE and CE.
Exit the VRF address family configuration mode of the RIP protocol | exit-address-family | -
Exit the RIP configuration mode | exit | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Enter the BGP IPv4 VRF configuration mode | address-family ipv4 vrf vrf-name | Mandatory By default, it is in the BGP IPv4 unicast configuration mode.
Configure the BGP to re-distribute RIP | redistribute rip [ route-map map-name / metric value ] | Optional By default, do not re-distribute the RIP protocol route.

3. Configure PE-CE to use OSPF

Table 5‑8 Configure PE-CE to use OSPF

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create one OSPF process and enter the OSPF configuration mode | router ospf process-id vrf vrf-name | Mandatory In VRF, enable the OSPF process. By default, the system does not enable the OSPF protocol. When enabling OSPF in the VRF, the OSPF process belonging to one VRF can only manage the interfaces belonging to the VRF.
Configure OSPF to cover the connected interface of the PE and CE | network ip-address wildcard-mask area area-id | Mandatory By default, the interface does not belong to any OSPF process or area. One interface can only belong to one OSPF process and area.
Exit the OSPF configuration mode | exit | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Enter the BGP IPv4 VRF configuration mode | address-family ipv4 vrf vrf-name | Mandatory By default, it is in the BGP IPv4 unicast configuration mode.
Configure BGP to re-distribute OSPF | redistribute ospf as-number [ route-map map-name / metric value / match level ] | Optional By default, do not re-distribute the OSPF protocol route.

4. Configure PE-CE to use ISIS

Table 5‑9 Configure PE-CE to use ISIS

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IS-IS configuration mode | router isis [ instance-name ] | -
Configure the network entity title for ISIS | net entry-title | Mandatory By default, ISIS does not have the network entity title.
Configure the VRF attribute of the ISIS | vrf vrf-name | Optional By default, the ISIS process is in the global VRF.
Return to the global configuration mode | exit | -
Enter the interface configuration mode | interface interface-name | -
Configure the interface to associate the VRF instance | ip vrf forwarding vrf-name | Mandatory By default, the interface does not associate any VRF.
The interface enables the IS-IS protocol | ip router isis [ instance-name ] | Mandatory By default, the interface does not enable the IS-IS protocol.
Return to the global configuration mode | exit | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Enter the BGP IPv4 VRF configuration mode | address-family ipv4 vrf vrf-name | Mandatory By default, the system is in the BGP IPv4 unicast configuration mode.
Configure BGP to re-distribute ISIS | redistribute isis [ instance-name ] [ route-map map-name / metric value / match level ] | Optional By default, do not re-distribute the IS-IS protocol route.

5. Configure PE-CE to use BGP

Table 5‑10 Configure PE-CE to use BGP

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Enter the BGP IPv4 VRF configuration mode | address-family ipv4 vrf vrf-name | Mandatory By default, the system is in the BGP IPv4 unicast configuration mode.
Configure CE as the EBGP neighbor | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory By default, do not configure any CE neighbor.


5.2.2 Configure M-VRF

Configuration Condition

Before configuring M-VRF, first complete the following task:

l Configure the link-layer protocol of the connecting interfaces of the M-VRF device with the PE and site and keep connected

Configure M-VRF

M-VRF is one cheap method of expanding the VPN function to the CE. When the customer has multiple services, do not need to divide multiple services to one CE, but configure multiple VRFs on the M-VRF device, virtualizing multiple CEs and separating each service. The following describes one M-VRF example.

Figure 5‑2 Networking of configuring M-VRF

On the M-VRF device, each VRF has one interface to connect the site and the other interface connects the PE. Usually, the M-VRF device is connected with the PE via the Ethernet link. Each VRF uses one interface (or sub interface).

1. Configure the route exchange between the M-VRF device and PE

The route exchange between the M-VRF device and the CE can use the static route, RIP, OSPF, ISIS and BGP route protocol. The following example uses the RIP to exchange the route.

Table 5‑11 Configure the route exchange between the M-VRF device and PE

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create one VRF and enter the VRF configuration mode | ip vrf vrf-name | Mandatory By default, do not configure any VRF.
Configure the VRF RD | rd route-distinguisher | Mandatory By default, do not configure the VRF RD.
Exit the VRF configuration mode | exit | -
Enter the interface configuration mode | interface interface_name | -
Configure the interface to associate with the VRF | ip vrf forwarding vrf-name | Mandatory By default, the interface is not associated with any VRF.
Configure the interface IP address | ip address ip-address { network-mask | mask-len } | Mandatory By default, the interface is not configured with the IP address.
Exit the interface configuration mode | exit | -
Enable the RIP protocol and enter the RIP configuration mode | router rip | Mandatory By default, do not enable RIP.
Enter the VRF address family configuration mode of the RIP protocol | address-family ipv4 vrf vrf-name | Mandatory By default, the RIP protocol does not enable the VRF address family.
Configure the RIP version in the VRF address family mode | version {1 | 2} | Mandatory By default, RIP version is 1.
Configure RIP to cover the connected interface of the M-VRF device and PE | network [ network-address | interface ] | Mandatory By default, RIP does not cover the connected interface of the M-VRF device and PE.

l On the M-VRF device, each VRF should be configured according to the above steps.

l For the configuration of the PE, refer to the part of “Configure VPN basic functions”.

2. Configure the route exchange between the M-VRF device and site

The route exchange between the M-VRF device and the site, you can use the static route, RIP, OSPF, ISIS and BGP route protocol. The following example uses the static route.

Table 5‑12 Configure the route exchange between the M-VRF and site

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create one VRF and enter the VRF configuration mode | ip vrf vrf-name | Mandatory By default, do not configure any VRF.
Configure the VRF RD | rd route-distinguisher | Mandatory By default, do not configure the VRF RD.
Exit the VPN instance configuration mode | exit | -
Enter the interface configuration mode | interface interface_name | -
Configure the interface to associate with the VRF | ip vrf forwarding vrf-name | Mandatory By default, the interface does not associate with any VRF.
Configure the interface IP address | ip address ip-address { network-mask | mask-len } | Mandatory By default, the interface is not configured with the IP address.
Exit the interface configuration mode | exit | -
Configure the static route to the site | ip route vrf vrf-name destination-ip-address destination-mask nexthop-ip-address | Mandatory By default, do not configure the static route to the site.

l On the M-VRF device, each VRF should be configured according to the above steps.

l The configuration mode on the site is the same as the common static route configuration.


5.2.3 Configure VPN Route Label Distributing

Configuration Condition

Before configuring the VPN route label distributing mode, first complete the following task:

l Configure VPN basic functions

Configure VPN Route Label Distributing

BGP has two modes of distributing the label for the VPN route: per-route label distributing mode and per-VRF label distributing mode. When adopting the per-route mode, BGP distributes different labels for each VPN route. When adopting per-VRF mode, BGP distributes the same label for the VPN routes in one VRF, but distributes different labels for the routes in different VRFs.

By default, BGP adopts the per-VRF label distributing mode. The mode can save the label resources. When there are lots of local released VPN routes, the per-VRF label distributing mode can reduce the generating of the ILM entries and improve the performance.

Table 5‑13 Configure the VPN route label distributing

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Configure the per-route label distributing mode | no unque-label-per-vrf | Optional By default, enable the per-VRF label distributing mode.


5.2.4 Configure VPN Cross-Domain

Configuration Condition

Before configuring the VPN cross-domain, first complete the following tasks:

l Configure the VPN basic functions

l Configure the ASBR direct-connected IP address, making the IP between ASBRs reachable

Configure Option-A Cross-Domain

Option-A cross-domain is also called VRF-to-VRF and it is the simplest mode of realizing the VPN access between AS. VRF-to-VRF takes another ASBR as the CE device to process the VPNv4 connectivity between AS. The following describes one VRF-to-VRF.

Figure 5‑3 Configure Option-A cross-domain (VRF-to-VRF)

In the above figure, VPN site 1 and site 2 are connected to two different service providers respectively: AS1 and AS2. The service providers are connected via ASBR. Two AS areas configure the MPLS L3VPN network. The VPN crossing the AS needs the local ASBR to serve as the PE device of the VPN and the peer ASBR to serve as the CE device of the VPN. Meanwhile, on two ASBR devices, configure the VRF of the VPN. In this way, the VPN route transmits the VPNv4 route via MP-IBGP in the AS. ASBR transmits the unicast route in the VRF of the VPN, so as to realize the inter-connection of site 1 and site 2.

The advantage of the VRF-to-VRF mode is that it is necessary to run MPLS between ASBR. The disadvantage is that ASBR needs to maintain all VPN routes and distribute the interface and link for each cross-domain VPN. Therefore, the expansibility is poor.

For the configuration of the VRF-to-VRF cross-domain mode, refer to the part of “Configure VPN Basic Functions”.

Configure Option-B Cross-Domain

Figure 5‑4 Configure Option-B cross-domain (MP-EBGP carries the VPNv4 route)

Option-B cross-domain needs to run MP-EBGP between ASBR. After ASBR learns all VPN routes of the local AS PE, distribute the new label for the VPN route, and then advertise the route information and new label to the peer ASBR. ASBR needs to maintain all VPN routes received from the local PE and the peer ASBR.

Option-B cross-domain does not need ASBR to configure the VRF for each VPN, does not need to import the VPNv4 route, and does not need to distribute the interface for each VPN, but ASBR still needs to maintain all VPNv4 routes, and distribute the new label for each label. Install the ILM entry of the old and new label translation at the local. Therefore, ASBR has the good load capability.

Table 5‑14 Configure Option-B cross-domain

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the MPLS forwarding globally | mpls ip | Mandatory By default, do not enable the MPLS forwarding.
Enter the interface configuration mode | interface interface_name | -
Enable the MPLS forwarding on the interface | mpls ip | Mandatory Configure on the interconnection interfaces of the two ASBR. By default, do not enable the MPLS forwarding on the interface.
Return to the global configuration mode | exit | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Configure the peer ASBR as the EBGP neighbor | neighbor { neighbor-address | peer-group-name } remote-as as-number | Mandatory By default, do not configure any EBGP neighbor.
Enter the BGP VPNv4 configuration mode | address-family vpnv4 [ unicast ] | Mandatory By default, the system is in the BGP IPv4 unicast configuration mode.
Activate the MP-EBGP neighbor to advertise the VPN route | neighbor { neighbor-address | peer-group-name } activate | Mandatory By default, BGP only advertises the IPv4 unicast route.
Configure changing the next hop when advertising the route to the PE | neighbor { neighbor-address | peer-group-name } next-hop-self | Mandatory By default, do not configure changing the next hop when advertising the route to the PE.

l The above just lists the basic configuration of the Option-B cross-domain on ASBR. For the configuration of the ASBR and the PE, P devices in the AS, refer to the part of “Configure VPN Basic Functions”.


5.2.5 Configure VPN User to Access Internet

Configuration Condition

Before configuring the VPN user to access Internet, first complete the following task:

l Configure VPN basic functions

Configure CE to Access Internet

In the actual application environment, the customer does not hope the VPN user to access Internet directly, but requires controlling the connection of the VPN user with Internet via the security devices, such as firewall. Each VPN site sends the Internet data flow to the central site. The VPN member forwards the data flow of the accessed Internet to the central site by importing one default route of accessing Internet (the next hop is the central site CE). The central site forwards the data flow of the accessed Internet to the enterprise firewall. Perform the necessary access control and NAT processing in the firewall according to the made security policy. At last, the firewall forwards the data flow to Internet. The following figure describes one instance of using CE to access Internet.

Figure 5‑5 Configure CE to access Internet

In the above figure, CE3 serves as the central site of the customer controlling Internet access. You just need to configure the next hop as the default route of Internet gateway on CE3. The route is transmitted to the PE device via the route exchange of PE-CE, and then transmitted to the VPN site via MP-IBGP. In this way, each VPN site can access Internet via the default route (the next hop is PE3). The data of the accessed Internet first reaches CE3 via MPLS, and then reaches Internet via the configured default route on CE3.

The CE access mode just needs to be configured and deployed in the VPN, but does not need the carrier to take part in. The user can freely control the security policy of the internal user accessing Internet. However, the mode requires the user to have strong security management capability, and the carrier cannot manage the user accessing Internet in a unified manner.

Table 5‑15 Configure CE to access Internet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
On the central site CE, configure the default route and the next hop is Internet gateway | ip route destination-ip-address destination-mask nexthop-ip-address | Mandatory By default, CE does not configure the default route of access Internet.

l For the configuration of the other device, refer to the part of “Configure VPN Basic Functions”.

Configure PE to Access Internet

Forward the traffic of the VPN user to the Internet gateway of the service provider network to provide the Internet access for the VPN user. The mode is called PE accessing Internet. To provide the Internet access for the VPN user, the global route table on the PE should be able to forward the VPN traffic. This need to create one static route in the VRF of the PE and the next hop is realized in the global route table mode. The following figure describes one instance of the PE accessing Internet.

Figure 5‑6 Configure CE to access Internet

In the above figure, VPN A has two users CE1 and CE2 to access Internet. First, configure one cross-VRF default static route of accessing Internet in the VRF route table of PE1 and PE2 respectively. The next hop of the cross-VRF default static route in PE1 is Internet gateway, and the next hop of the cross-VRF default static route in PE2 is PE1. To ensure that the packet returned from Internet can return to CE1 and CE4 successfully, you also need to configure one cross-VRF route to CE1 in the global route table of PE1 and the next hop is the CE1 in the VRF. In the global route table of PE2, you also need to configure one cross-VRF route to CE4, the next hop is CE4 in VRF, and advertise the route to the MPLS network via IGP.

Table 5‑16 Configure the PE to access Internet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
In the VRF route table of PE, configure the cross-VRF default static route of accessing Internet and the next hop is Internet gateway | ip route vrf vrf-name destination-ip-address destination-mask nexthop-ip-address vrf global | Mandatory By default, do not configure the deault static route of accessing Internet.
In the global route table of the PE, configure the cross-VRF static route to CE, and the next hop is CE | ip route destination-ip-address destination-mask nexthop-ip-address vrf vrf-name | Mandatory By default, do not configure PE-CE cross-VRF static route.

l The above is the key configuration of the PE (PE1 in the figure) connecting the Internet gateway. For the other PE (such as PE2 in the figure), configure the cross-VRF default static route of accessing Internet and the next hop need to point to the loopback port address of PE1 (the loopback port of setting up the BGP neighbor).


5.2.6 Configure AS Coverage

Configuration Condition

Before configuring the AS coverage, first complete the following task:

l Configure the VPN basic functions

l Configure the PE-CE route exchange to use EBGP

Configure AS Coverage

When the PE and CE routers run BGP, the customer VPN may hope to re-use the AS number in different sites. As a result, when CP receives the PE route, the route AS-PATH attribute will contain the AS number of the CE device and the CE will drops the route from the PE. To solve the problem, PE needs to enable the BGP AS cover function. After the PE device enables the AS cover function and advertises the route to the CE neighbor, and if there is the same AS number as CE in the route AS-PATH, PE uses its own AS number to replace the AS number of the CE neighbor contained in the route AS-PATH, and then advertises to the CE neighbor.

Table 5‑17 Configure the AS coverage

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Enter the BGP IPv4 VRF configuration mode | address-family ipv4 vrf vrf-name | Mandatory By default, the system is in the BGP IPv4 unicast configuration mode.
Configure the AS cover function | neighbor { neighbor-address | peer-group-name } as-override | By default, do not enable the AS cover function.


5.2.7 Configure OSPF False Link

Configuration Condition

Before configuring the OSPF sham link, first complete the following task:

l Configure the VPN basic functions, configure the route exchange between PE and CE to use OPSF

Configure OSPF False Link

In the MPLS L3VPN environment, when there is the direct-associated backup link (called backdoor link) between two CE of different sites, the route in the OSPF domain is prior to the external route re-distributed by BGP, and as a result, the traffic between CEs does not pass VPN, but first passes the backdoor link. To make the traffic between two CEs first pass VPN, it is necessary to set up one OSPF sham link between two PEs.

The source address and destination address of the sham link are reachable in the BGP domain, and cannot be covered and re-distributed by OSPF. The route to the destination address of the sham link can only be learned by the BGP.

The configuration steps of the OSPF sham link on the PE are as follows:

1. Configure the VRF loopback interface

Table 5‑18 Configure the VRF loopback interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create one loopback interface and enter the interface configuration mode | interface loopback interface-number | Mandatory By default, do not create a loopback interface.
Configure the loopback interface to associate VRF | ip vrf forwarding vrf-name | Mandatory By default, the interface does not associate with any VRF.
Configure the IP address of the loopback interface | ip address ip-address { mask | mask-length } | Mandatory By default, do not configure the interface IP address.
Exit the interface configuration mode | exit | -

2. Configure BGP to re-distribute OSPF and direct-connected route of the loopback interface

Table 5‑19 Configure BGP to re-distribute OSPF and the direct-connected route of the loopback interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the BGP protocol and enter the BGP configuration mode | router bgp autonomous-system | -
Enter the BGP IPv4 VRF configuration mode | address-family ipv4 vrf vrf-name | Mandatory By default, the system is in the BGP IPv4 unicast configuration mode.
Configure BGP to re-distribute the direct-connected route of the loopback interface | redistribute connected [ route-map map-name / metric value ] | Mandatory By default, BGP does not re-distribute the direct-connected route.
Configure BGP to re-distribute OSPF | redistribute ospf as-number [ match route-sub-type / route-map map-name / metric value ] | Mandatory By default, BGP does not re-distribute the OSPF route.
Exit the BGP IPv4 VRF configuration mode | exit-address-family | -
Exit the BGP configuration mode | exit | -

3. Configure the OSPF sham link

Table 5‑20 Configure the OSPF sham link

Step

Command

Description

Enter the global configuration mode

configure terminal

-

Create one OSPF process and enter the OSPF configuration mode

router ospf process-id [ vrf vrf-name ]

Mandatory

Enable or enable the OSPF process in the VRF. By default, the system does not enable the OSPF protocol.

When enabling OSPF in the VRF, the OSPF process belonging to one VRF can only manage the interfaces belonging to the VRF.

Configure the segment covered by the OSPF area

network ip-address wildcard-mask area area-id

Mandatory

By default, the interface does not belong to any OSPF process or area.

One interface can only belong to one OSPF process and area.

Configure the OSPF sham link

area area-id sham-link source-ip-address desinationt-ip-address [ cost cost ]

Mandatory

source-ip-address is the address of the local loopback interface. desinationt-ip-address is the peer loopback port address.

By default, do not configure the OSPF sham link.


5.2.8 MPLS L3VPN Monitoring and Maintaining

Table 5‑21 MPLS L3VPN monitoring and maintaining

Command | Description
clear ip bgp { * | neighbor-address | as-number | peer-group peer-group-name | external } [vrf vrf-name |vpnv4 unicast] | Re-set the BGP neighbor.
clear ip bgp { * | neighbor-address | as-number | peer-group peer-group-name | external } [vpnv4 unicast | vrf vrf-name ] { [ soft ] [ in | out ] } | Soft-reset the neighbor.
show ip bgp ilm { ip-address | list | statistic } | Display the ILM information of the VPNv4 route
show ip bgp vpnv4 { all | vrf vrf-name | rd route-distinguisher } [ ip-address | ip-address/mask-length ] | Display the route database information in the BGP VPNv4 address family
show ip bgp vpnv4 { all | vrf vrf-name | rd route-distinguisher } dampening { dampened-paths | flap-statistics | parameters } | Display the details of the BGP VPNv4 route dampening
show ip bgp [ vpnv4 { all | vrf vrf-name | rd route-distinguisher } ] labels | Display the route label information in the BGP VPNv4 address family
show ip bgp vpnv4 all neighbors [ ip-address ] | Display the neighbor details in the BGP VPNv4 address family
show ip bgp vpnv4 { all | vrf vrf-name | rd route-distinguisher } summary | Display all neighbor information in the BGP VPNv4 address family
show ip bgp vrf vrf-name | Display the BGP VRF information


5.3 MPLS L3VPN Typical Configuration Example


5.3.1 Configure Intra-domain MPLS L3VPN

Network Requirements

l The whole MPLS network includes two VPNs, VPN1 and VPN2. The two VPNs uses different Route-Target, so as to ensure that two VPNs cannot communicate with each other.

l CE1 and CE3 belong to VPN1; CE2 and CE4 belong to VPN2.

l CE and PE adopt OSPF to advertise the route.

l PEs adopt OSPF as IGP to make PEs communicate with each other. Configure MP-IBGP to exchange the VPN route information.

Network Topology

Figure 5‑7Networking of configuring the intra-domain MPLS L3VPN

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 95.1.1.2/16 | P | Loopback0 | 11.11.11.11/32
 | Loopback0 | 5.5.5.5/32 | PE2 | Gi0 | 92.1.1.1/16
PE1 | Gi0 | 93.1.1.2/16 |  | Gi1 | 90.1.1.1/16
 | Gi1 | 94.1.1.1/16 |  | Gi2 | 91.1.1.1/16
 | Gi2 | 95.1.1.1/16 |  | Loopback0 | 75.75.75.75/32
 | Loopback0 | 90.90.90.90/32 | CE3 | Gi0 | 90.1.1.2/16
CE2 | Gi0 | 94.1.1.2/16 |  | Loopback0 | 8.8.8.8/32
 | Loopback0 | 2.2.2.2/32 | CE4 | Gi0 | 91.1.1.2/16
P | Gi0 | 93.1.1.1/16 |  | Loopback0 | 3.3.3.3/32
 | Gi1 | 92.1.1.2/16 |  |  |

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | Configure the global OSPF and advertise the global route.

#Configure the global OSPF on PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 90.90.90.90 0.0.0.0 area 0

PE1(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

PE1(config-ospf)#exit

#Configure the global OSPF on P.

P#configure terminal

P(config)#router ospf 100

P(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

P(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

P(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

P(config-ospf)#exit

#Configure the global OSPF on PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 75.75.75.75 0.0.0.0 area 0

PE2(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

#After the configuration is complete, view the global route table on the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 93.1.0.0/16 is directly connected, 00:34:54, gigabitethernet0

O 92.1.0.0/16 [110/2] via 93.1.1.1, 00:08:12, gigabitethernet0

C 90.90.90.90/32 is directly connected, 154:02:28, loopback0

O 11.11.11.11/32 [110/2] via 93.1.1.1, 00:05:12, gigabitethernet0

O 75.75.75.75/32 [110/3] via 93.1.1.1, 00:06:03, gigabitethernet0

You can see that there is the route information of P and PE2 loopback ports in the global route table of PE1.

l For the checking method of P and PE2, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 90.90.90.90

PE1(config-ldp)#transport-address 90.90.90.90

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#mpls ip

PE1(config-if-gigabitethernet0)#mpls ldp

PE1(config-if-gigabitethernet0)#exit

#On P, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

P(config)#mpls ip

P(config)#mpls ldpP(config-ldp)#router-id 11.11.11.11

P(config-ldp)#transport-address 11.11.11.11

P(config-ldp)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#mpls ip

P(config-if-gigabitethernet0)#mpls ldp

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#mpls ip

P(config-if-gigabitethernet1)#mpls ldp

P(config-if-gigabitethernet1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 75.75.75.75

PE2(config-ldp)#transport-address 75.75.75.75

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

l router-id and transport-address can be configured manually and also can be generated automatically. Usually, they are configured the same. If not configuring router-id and transport-address manually, the device will select automatically. From the up interfaces, first select the Loopback interface with the maximum IP address. If the device does not configure the Loopback interface address, select the common interface with the maximum IP address.

#After the configuration is complete, view the LDP session information on the device.

Take the PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

11.11.11.11 Multicast Active OPERATIONAL 00:02:20

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

You can see that PE1 and P set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take the PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 44 2000

L global 75.75.75.75/32 / 16 gigabitethernet0 93.1.1.1 47 3232

You can see that there is the label information of P and PE2 loopback ports on PE1.

l For the checking method of P and PE2, refer to PE1.

Step 3:

Configure the VPN instance and advertise the CE route to PE via OSPF.

#On PE1, configure the VPN instance and the OSPF in VPN1 and VPN2.

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

PE1(config)#ip vrf 2

PE1(config-vrf)#rd 200:1

PE1(config-vrf)#route-target export 200:1

PE1(config-vrf)#route-target import 200:1

PE1(config-vrf)#exit

PE1(config)#interface gigabitethernet2

PE1(config-if-gigabitethernet2)#ip vrf forwarding 1

PE1(config-if-gigabitethernet2)#ip address 95.1.1.1 255.255.0.0

PE1(config-if-gigabitethernet2)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#ip vrf forwarding 2

PE1(config-if-gigabitethernet1)#ip address 94.1.1.1 255.255.0.0

PE1(config-if-gigabitethernet1)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#network 95.1.0.0 0.0.255.255 area 0

PE1(config-ospf)#exit

PE1(config)#router ospf 300 vrf 2

PE1(config-ospf)#network 94.1.0.0 0.0.255.255 area 0

PE1(config-ospf)#exit

#Configure OSPF on CE1.

CE1#configure terminal

CE1(config)#router ospf 100

CE1(config-ospf)#network 5.5.5.5 0.0.0.0 area 0

CE1(config-ospf)#network 95.1.0.0 0.0.255.255 area 0

CE1(config-ospf)#exit

#Configure OSPF on CE2.

CE2#configure terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 2.2.2.2 0.0.0.0 area 0

CE2(config-ospf)#network 94.1.0.0 0.0.255.255 area 0

CE2(config-ospf)#exit

#Configure the VPN instance on PE2 and configure the OSPF in VPN1 and VPN2.

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 100:1

PE2(config-vrf)#route-target export 100:1

PE2(config-vrf)#route-target import 100:1

PE2(config-vrf)#exit

PE2(config)#ip vrf 2

PE2(config-vrf)#rd 200:1

PE2(config-vrf)#route-target export 200:1

PE2(config-vrf)#route-target import 200:1

PE2(config-vrf)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#ip vrf forwarding 1

PE2(config-if-gigabitethernet1)#ip address 90.1.1.1 255.255.0.0

PE2(config-if-gigabitethernet1)#exit

PE2(config)#interface gigabitethernet2

PE2(config-if-gigabitethernet2)#ip vrf forwarding 2

PE2(config-if-gigabitethernet2)#ip address 91.1.1.1 255.255.0.0

PE2(config-if-gigabitethernet2)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#network 90.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

PE2(config)#router ospf 300 vrf 2

PE2(config-ospf)#network 91.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

#Configure OSPF on CE3.

CE3#configure terminal

CE3(config)#router ospf 100

CE3(config-ospf)#network 8.8.8.8 0.0.0.0 area 0

CE3(config-ospf)#network 90.1.0.0 0.0.255.255 area 0

CE3(config-ospf)#exit

# Configure OSPF on CE4.

CE4#configure terminal

CE4(config)#router ospf 100

CE4(config-ospf)#network 3.3.3.3 0.0.0.0 area 0

CE4(config-ospf)#network 91.1.0.0 0.0.255.255 area 0

CE4(config-ospf)#exit

#View the VPN route table on PE.

Take PE1 as an example.

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 95.1.0.0/16 is directly connected, 00:11:45, gigabitethernet2

O 5.5.5.5/32 [110/2] via 95.1.1.2, 00:11:11, gigabitethernet2

PE1#show ip route vrf 2

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 94.1.0.0/16 is directly connected, 00:23:25, gigabitethernet1

O 2.2.2.2/32 [110/2] via 94.1.1.2, 00:22:53, gigabitethernet1

You can see that there are the routes of CE1 and CE2 in the VPN1 and VPN2 route tables of PE1.

l For the checking method of PE2, refer to PE1.

Step 5:

Configure MP-IBGP, and use the loopback interface as the peer address; re-distribute the route with the IGP protocol in the VPN instance.

#On PE1, configure MP-IBGP, enable the VPNv4 address family, and re-distribute the route with the IGP protocol in the VPN instance.

PE1(config)#router bgp 100

PE1(config-bgp)#neighbor 75.75.75.75 remote-as 100

PE1(config-bgp)#neighbor 75.75.75.75 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 75.75.75.75 activate

PE1(config-bgp-af)#neighbor 75.75.75.75 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute ospf 200

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 2

PE1(config-bgp-af)#redistribute ospf 300

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#redistribute bgp 100

PE1(config-ospf)#exit

PE1(config)#router ospf 300 vrf 2

PE1(config-ospf)#redistribute bgp 100

PE1(config-ospf)#exit

#On PE2, configure MP-IBGP, enable the VPNv4 address family, and re-distribute the route with the IGP protocol in the VPN instance.

PE2(config)#router bgp 100

PE2(config-bgp)#neighbor 90.90.90.90 remote-as 100

PE2(config-bgp)#neighbor 90.90.90.90 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 90.90.90.90 activate

PE2(config-bgp-af)#neighbor 90.90.90.90 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 200

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 2

PE2(config-bgp-af)#redistribute ospf 300

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

PE2(config)#router ospf 300 vrf 2

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

l In the actual application, if one site has two or more PE devices, it is suggested not to re-distribute the route between different route protocols directly. If it is necessary to configure, you need to configure the route policy to prevent the route loop.

Step 6:

Check the result.

#After the configuration is complete, view the BGP neighbor information on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 90.90.90.90, local AS number 100

BGP table version is 6

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

75.75.75.75 4 100 40 41 5 0 0 00:32:01 4

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and PE2 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table and VPN route table on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 43, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[O]*> 5.5.5.5/32 95.1.1.2 2 32768 ?

[B]*>i8.8.8.8/32 75.75.75.75 2 100 0 ?

[B]*>i90.1.0.0/16 75.75.75.75 1 100 0 ?

[O]*> 95.1.0.0/16 0.0.0.0 1 32768 ?

PE1#show ip bgp vpnv4 vrf 2

BGP table version is 43, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 200:1 (Default for VRF 2)

[O]*> 2.2.2.2/32 94.1.1.2 2 32768 ?

[B]*>i3.3.3.3/32 75.75.75.75 2 100 0 ?

[B]*>i91.1.0.0/16 75.75.75.75 1 100 0 ?

[O]*> 94.1.0.0/16 0.0.0.0 1 32768 ?

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 90.1.0.0/16 [200/1] via 75.75.75.75, 00:01:06, gigabitethernet0

C 95.1.0.0/16 is directly connected, 00:23:25, gigabitethernet2

O 5.5.5.5/32 [110/2] via 95.1.1.2, 00:22:51, gigabitethernet2

B 8.8.8.8/32 [200/2] via 75.75.75.75, 00:01:06, gigabitethernet0

PE1#show ip route vrf 2

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 91.1.0.0/16 [200/1] via 75.75.75.75, 00:01:15, gigabitethernet0

C 94.1.0.0/16 is directly connected, 00:23:25, gigabitethernet1

O 2.2.2.2/32 [110/2] via 94.1.1.2, 00:22:53, gigabitethernet1

B 3.3.3.3/32 [200/2] via 75.75.75.75, 00:01:15, gigabitethernet0

You can see that there is the route information to the peer CE3 and CE4 in the BGP VPNv4 route table, VPN1 and VPN2 route table of PE1.

#View the MPLS forwarding table on the PE.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 44 2000

L global 75.75.75.75/32 / 16 gigabitethernet0 93.1.1.1 47 3232

B 1 8.8.8.8/32[V] / 5120 gigabitethernet0 75.75.75.75 0 0

B 1 90.1.0.0/16[V] / 5120 gigabitethernet0 75.75.75.75 0 0

B 2 3.3.3.3/32[V] / 5121 gigabitethernet0 75.75.75.75 5 400

B 2 91.1.0.0/16[V] / 5121 gigabitethernet0 75.75.75.75 0 0

B 1 0.0.0.0/0 10240 / / / 10 10 760

B 2 0.0.0.0/0 10241 / / / 10 10 760

You can see that there is the route label information of VPN1 and VPN2 in the MPLS forwarding table of PE1.

l For the checking method of PE2, refer to PE1.

#Ping the loopback port of CE3 at CE1.

CE1#ping 8.8.8.8

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 8.8.8.8 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

You can see that CE1 can ping the loopback port of CE3.

#Ping the loopback port of CE4 at CE1.

CE1#ping 3.3.3.3

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 3.3.3.3 , timeout is 2 seconds:

.....

Success rate is 0% (0/5).

You can see that CE1 can ping the loopback port of CE4.

You can see that the devices in one VPN can communicate normally, the devices of different VPNs cannot communicate, and the routes are separated.


5.3.2 Configure M-VRF

Network Requirements

l MCE is the device used by the user for the VPN multi-instance exchange.

l Separate the routes of the user networks VPN1 and VPN2, the sites of the same VPN can communicate with each other, and the sites of different VPNs cannot communicate.

l CE1, CE3 are the sites of VPN1; CE2, Ce4 are the sites of VPN2.

l PE1 and CE1 use EBGP; PE1 and CE2 use RIP.

l MCE and PE2 use OSPF; MCE and CE3, CE4 use the static route.

Network Topology

Figure 5‑8 Networking of configuring M-VRF

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 95.1.1.2/16 | PE2 | Gi1.2 | 92.1.1.2/16
 | Loopback0 | 5.5.5.5/32 |  | Loopback0 | 11.11.11.11/32
PE1 | Gi0 | 93.1.1.2/16 | MCE | Gi0.1 | 97.1.1.2/16
 | Gi1 | 95.1.1.1/16 |  | Gi0.2 | 92.1.1.1/16
 | Gi2 | 94.1.1.1/16 |  | Gi1 | 90.1.1.1/16
 | Loopback0 | 90.90.90.90/32 |  | Gi2 | 91.1.1.1/16
CE2 | Gi0 | 94.1.1.2/16 | CE3 | Gi0 | 90.1.1.2/16
 | Loopback0 | 2.2.2.2/32 |  | Loopback0 | 8.8.8.8/32
PE2 | Gi0 | 93.1.1.1/16 | CE4 | Gi0 | 91.1.1.2/16
 | Gi1.1 | 97.1.1.1/16 |  | Loopback0 | 3.3.3.3/32
 | Gi1.2 | 92.1.1.2/16 |  |  |

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | Configure the global OSPF and advertise the global route.

#Configure the global OSPF on PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 90.90.90.90 0.0.0.0 area 0

PE1(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

PE1(config-ospf)#exit

#Configure the global OSPF on PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

PE2(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

#After the configuration is complete, view the global route table on the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 11.11.11.11/32 [110/2] via 93.1.1.1, 03:19:45, gigabitethernet0

C 93.1.0.0/16 is directly connected, 03:20:31, gigabitethernet0

C 90.90.90.90/32 is directly connected, 03:22:09, loopback0

You can see that there is the route information of the PE2 loopback port in the global route table of PE1.

l For the checking method of PE2, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 90.90.90.90

PE1(config-ldp)#transport-address 90.90.90.90

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#mpls ip

PE1(config-if-gigabitethernet0)#mpls ldp

PE1(config-if-gigabitethernet0)#exit

#On PE2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 11.11.11.11

PE2(config-ldp)#transport-address 11.11.11.11

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

#After the configuration is complete, view the LDP session information on the device.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

11.11.11.11 Multicast Active OPERATIONAL 00:02:19

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

You can see that PE1 and PE2 set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 387 22502

You can see that there is the label information of PE2 loopback port in the MPLS forwarding table of PE1.

l For the checking method of PE2, refer to PE1.

Step 4:

Configure the VPN instance, and advertise the CE1, CE2 route to PE1.

#On PE1, configure the VPN instance, configure EBGP in VPN1, and configure RIP in VPN2.

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

PE1(config)#ip vrf 2

PE1(config-vrf)#rd 200:1

PE1(config-vrf)#route-target export 200:1

PE1(config-vrf)#route-target import 200:1

PE1(config-vrf)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#ip vrf forwarding 1

PE1(config-if-gigabitethernet1)#ip address 95.1.1.1 255.255.0.0

PE1(config-if-gigabitethernet1)#exit

PE1(config)#interface gigabitethernet2

PE1(config-if-gigabitethernet2)#ip vrf forwarding 2

PE1(config-if-gigabitethernet2)#ip address 94.1.1.1 255.255.0.0

PE1(config-if-gigabitethernet2)#exit

PE1(config)#router bgp 100

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#neighbor 95.1.1.2 remote-as 200

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router rip

PE1(config-rip)#address-family ipv4 vrf 2

PE1(config-rip-af)#version 2

PE1(config-rip-af)#network 94.1.0.0

PE1(config-rip-af)#exit-address-family

PE1(config-rip)#exit

#On CE1, configure EBGP, and advertise the CE route to PE1.

CE1#configure terminal

CE1(config)#router bgp 200

CE1(config-bgp)#neighbor 95.1.1.1 remote-as 100

CE1(config-bgp)#network 5.5.5.5 255.255.255.255

CE1(config-bgp)#network 95.1.0.0 255.255.0.0

CE1(config-bgp)#exit

#On CE2, configure RIP, and advertise the CE route to PE1.

CE2#configure terminal

CE2(config)#router rip

CE2(config-rip)#version 2

CE2(config-rip)#network 2.2.2.2

CE2(config-rip)#network 94.1.0.0

CE2(config-rip)#exit

#After the configuration is complete, view the route tables of VPN1 and VPN2 on PE1.

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 95.1.0.0/16 is directly connected, 03:48:37, gigabitethernet1

B 5.5.5.5/32 [20/0] via 95.1.1.2, 03:22:26, gigabitethernet1

PE1#show ip route vrf 2

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 94.1.0.0/16 is directly connected, 03:58:11, gigabitethernet2

R 2.2.2.2/32 [120/1] via 94.1.1.2, 03:46:36, gigabitethernet2

You can see that there are the information of the routes to CE1 and CE2 in the VPN1 and VPN2 route tables of PE1.

Step 5:

On PE2 and MCE, configure the VPN instance; on CE3, CE4, configure the default route to MCE.

#On PE2, configure the VPN instance, and configure OSPF in VPN1 and VPN2.

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 100:1

PE2(config-vrf)#route-target export 100:1

PE2(config-vrf)#route-target import 100:1

PE2(config-vrf)#exit

PE2(config)#ip vrf 2

PE2(config-vrf)#rd 200:1

PE2(config-vrf)#route-target export 200:1

PE2(config-vrf)#route-target import 200:1

PE2(config-vrf)#exit

PE2(config)#interface gigabitethernet1.2

PE2(config-if-gigabitethernet1.2)#ip vrf forwarding 1

PE2(config-if-gigabitethernet1.2)#encapsulation dot1q 2

PE2(config-if-gigabitethernet1.2)#ip address 92.1.1.1 255.255.0.0

PE2(config-if-gigabitethernet1.2)#exit

PE2(config)#interface gigabitethernet1.1

PE2(config-if-gigabitethernet1.1)#ip vrf forwarding 2

PE2(config-if-gigabitethernet1.1)#encapsulation dot1q 1

PE2(config-if-gigabitethernet1.1)#ip address 97.1.1.2 255.255.0.0

PE2(config-if-gigabitethernet1.1)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

PE2(config)#router ospf 300 vrf 2

PE2(config-ospf)#network 97.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

#On MCE, configure the VPN instance; configure OSPF in VPN1 and VPN2, configure the static route to the CE loopback port, and re-distribute to OSPF.

MCE#configure terminal

MCE(config)#ip vrf 1

MCE(config-vrf)#rd 100:1

MCE(config-vrf)#exit

MCE(config)#ip vrf 2

MCE(config-vrf)#rd 200:1

MCE(config-vrf)#exit

MCE(config)#interface gigabitethernet0.2

MCE(config-if-gigabitethernet0.2)#ip vrf forwarding 1

MCE(config-if-gigabitethernet0.2)#encapsulation dot1q 2

MCE(config-if-gigabitethernet0.2)#ip address 92.1.1.2 255.255.0.0

MCE(config-if-gigabitethernet0.2)#exit

MCE(config)#interface gigabitethernet0.1

MCE(config-if-gigabitethernet0.1)#ip vrf forwarding 2

MCE(config-if-gigabitethernet0.1)#encapsulation dot1q 1

MCE(config-if-gigabitethernet0.1)#ip address 97.1.1.1 255.255.0.0

MCE(config-if-gigabitethernet0.1)#exit

MCE(config)#interface gigabitethernet1

MCE(config-if-gigabitethernet1)#ip vrf forwarding 1

MCE(config-if-gigabitethernet1)#ip address 90.1.1.1 255.255.0.0

MCE(config-if-gigabitethernet1)#exit

MCE(config)#interface gigabitethernet2

MCE(config-if-gigabitethernet2)#ip vrf forwarding 2

MCE(config-if-gigabitethernet2)#ip address 91.1.1.1 255.255.0.0

MCE(config-if-gigabitethernet2)#exit

MCE(config)#ip route vrf 1 8.8.8.8 255.255.255.255 90.1.1.2

MCE(config)#ip route vrf 2 3.3.3.3 255.255.255.255 91.1.1.2

MCE(config)#router ospf 100 vrf 1

MCE(config-ospf)#network 90.1.0.0 0.0.255.255 area 0

MCE(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

MCE(config-ospf)#redistribute static

MCE(config-ospf)#exit

MCE(config)#router ospf 200 vrf 2

MCE(config-ospf)#network 91.1.0.0 0.0.255.255 area 0

MCE(config-ospf)#network 97.1.0.0 0.0.255.255 area 0

MCE(config-ospf)#redistribute static

MCE(config-ospf)#exit

#On CE3, configure the default route, and the egress interface points to MCE.

CE3#configure terminal

CE3(config)#ip route 0.0.0.0 0.0.0.0 90.1.1.1

#On CE4, configure the default route, and the egress interface points to MCE.

CE4#configure terminal

CE4(config)#ip route 0.0.0.0 0.0.0.0 91.1.1.1

l On CE3 and CE4, you just need to configure one default route and the egress interface points to MCE.

#After the configuration is complete, view the route tables of VPN1 and VPN2 on the MCE.

MCE#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

S 8.8.8.8/32 [1/10] via 90.1.1.2, 20:18:48, gigabitethernet1

C 90.1.0.0/16 is directly connected, 22:59:50, gigabitethernet1

C 92.1.0.0/16 is directly connected, 01:02:01, gigabitethernet0.2

MCE#show ip route vrf 2

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 91.1.0.0/16 is directly connected, 23:00:53, gigabitethernet2

C 97.1.0.0/16 is directly connected, 01:02:04, gigabitethernet0.1

S 3.3.3.3/32 [1/10] via 91.1.1.2, 20:18:33, gigabitethernet2

You can see that there is the static route information of CE3 and CE4 on the route tables of VPN1 and VPN2 of the MCE.

#View the route tables of VPN1 and VPN2 on PE2.

PE2#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

OE 8.8.8.8/32 [150/20] via 92.1.1.1, 00:27:44, gigabitethernet1.2

O 90.1.0.0/16 [110/2] via 92.1.1.1, 00:27:45, gigabitethernet1.2

C 92.1.0.0/16 is directly connected, 00:27:57, gigabitethernet1.2

PE2#show ip route vrf 2

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 91.1.0.0/16 [110/2] via 97.1.1.2, 00:27:49, gigabitethernet1.1

C 97.1.0.0/16 is directly connected, 00:28:00, gigabitethernet1.1

OE 3.3.3.3/32 [150/20] via 97.1.1.2, 00:27:48, gigabitethernet1.1

You can see that there is the route information of CE3 and CE4 on the route tables of VPN1 and VPN2 of PE2.

Step 6:

Configure MP-IBGP, use the loopback interface as the peer address, and re-distribute the route with the IGP protocol in the VPN instance.

#On PE1, configure MP-IBGP, enable VPNv4 address family, and re-distribute the route with the IGP protocol in the VPN instance.

PE1(config)#router bgp 100

PE1(config-bgp)#neighbor 11.11.11.11 remote-as 100

PE1(config-bgp)#neighbor 11.11.11.11 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 11.11.11.11 activate

PE1(config-bgp-af)#neighbor 11.11.11.11 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 2

PE1(config-bgp-af)#redistribute rip

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router rip

PE1(config-rip)#address-family ipv4 vrf 2

PE1(config-rip-af)#redistribute bgp 100

PE1(config-rip-af)#exit-address-family

PE1(config-rip)#exit

#On PE2, configure MP-IBGP, enable VPNv4 address family, and re-distribute the route with the IGP protocol in the VPN instance.

PE2(config)#router bgp 100

PE2(config-bgp)#neighbor 90.90.90.90 remote-as 100

PE2(config-bgp)#neighbor 90.90.90.90 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 90.90.90.90 activate

PE2(config-bgp-af)#neighbor 90.90.90.90 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 200

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 2

PE2(config-bgp-af)#redistribute ospf 300

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

PE2(config)#router ospf 300 vrf 2

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

Step7:

Check the result.

#After the configuration is complete, view the BGP neighbor information on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 90.90.90.90, local AS number 100

BGP table version is 4

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

11.11.11.11 4 100 11 12 4 0 0 00:07:25 6

Total number of neighbors 1

BGP VRF 1 Route Distinguisher:

100:1

BGP table version is 1

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

95.1.1.2 4 200 8 7 1 0 0 00:04:20 2

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and PE2, CE1 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table and VPN route table on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 33, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[B]*> 5.5.5.5/32 95.1.1.2 0 0 200 i

[B]*>i8.8.8.8/32 11.11.11.11 20 100 0 ?

[B]*>i90.1.0.0/16 11.11.11.11 2 100 0 ?

[B]*>i92.1.0.0/16 11.11.11.11 1 100 0 ?

[B]*> 95.1.0.0/16 95.1.1.2 0 0 200 i

PE1#show ip bgp vpnv4 vrf 2

BGP table version is 33, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 200:1 (Default for VRF 2)

[R]*> 2.2.2.2/32 94.1.1.2 1 32768 ?

[B]*>i3.3.3.3/32 11.11.11.11 20 100 0 ?

[B]*>i91.1.0.0/16 11.11.11.11 2 100 0 ?

[R]*> 94.1.0.0/16 0.0.0.0 1 32768 ?

[B]*>i97.1.0.0/16 11.11.11.11 1 100 0 ?

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 8.8.8.8/32 [200/20] via 11.11.11.11, 00:07:03, gigabitethernet0

B 90.1.0.0/16 [200/2] via 11.11.11.11, 00:07:03, gigabitethernet0

B 92.1.0.0/16 [200/1] via 11.11.11.11, 00:07:03, gigabitethernet0

C 95.1.0.0/16 is directly connected, 23:13:25, gigabitethernet1

B 5.5.5.5/32 [20/0] via 95.1.1.2, 22:47:14, gigabitethernet1

PE1#show ip route vrf 2

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 91.1.0.0/16 [200/2] via 11.11.11.11, 00:07:05, gigabitethernet0

C 94.1.0.0/16 is directly connected, 23:10:58, gigabitethernet2

B 97.1.0.0/16 [200/1] via 11.11.11.11, 00:07:05, gigabitethernet0

R 2.2.2.2/32 [120/1] via 94.1.1.2, 22:59:23, s gigabitethernet2

B 3.3.3.3/32 [200/20] via 11.11.11.11, 00:07:05, gigabitethernet0

You can see that there is the information of the routes to the peer CE3 and CE4 in the BGP VPNv4 route table, VPN1 and VPN2 route table of PE1.

#View the MPLS forwarding table on the PE.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 387 22502

B 2 3.3.3.3/32[V] / 17 gigabitethernet0 11.11.11.11 0 0

B 2 91.1.0.0/16[V] / 17 gigabitethernet0 11.11.11.11 0 0

B 2 97.1.0.0/16[V] / 17 gigabitethernet0 11.11.11.11 0 0

B 1 8.8.8.8/32[V] / 16 gigabitethernet0 11.11.11.11 0 0

B 1 90.1.0.0/16[V] / 16 gigabitethernet0 11.11.11.11 40 3200

B 1 92.1.0.0/16[V] / 16 gigabitethernet0 11.11.11.11 0 0

B 1 0.0.0.0/0 5120 / / / 80 80 6080

B 2 0.0.0.0/0 5121 / / / 0 0 0

You can see that there is the route label information of VPN1 and VPN2 in the MPLS forwarding table of PE1.

l For the checking method of PE2, refer to PE1.

#Ping the loopback port of CE3 at CE1.

CE1#ping 8.8.8.8

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 8.8.8.8 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

You can see that CE1 can ping the loopback port of CE3.

#Ping the loopback port of CE4 at CE1.

CE1#ping 3.3.3.3

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 3.3.3.3 , timeout is 2 seconds:

.....

Success rate is 0% (0/5).

You can see that CE1 cannot ping the loopback port of CE4.

You can see that the devices in one VPN can communicate normally, the devices of different VPNs cannot communicate, and the routes are separated.


5.3.3 Configure Cross-Domain OptionA

Network Requirements

l The whole MPLS network includes two AS domains. CE1 in AS100 needs to communicate with CE2 in AS200.

l CE1 and CE2 belong to VPN1 at the same time; use OSPF to interact the route with PE.

l Use the VRF-to-VRF mode to exchange the VPN route between ASBRs.

l Route-Targets of the VPN instances of different AS do not need to match.

l ASBR and PE use MP-IBGP to exchange the route.

Network Topology

Figure 5‑9 Networking of configuring the cross-domain OptionA

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 10.1.1.1/24 | ASBR2 | Gi0 | 10.1.3.2/24
 | Loopback0 | 1.1.1.1/32 |  | Gi1 | 10.1.4.1/24
PE1 | Gi0 | 10.1.1.2/24 |  | Loopback0 | 33.33.33.33/32
 | Gi1 | 10.1.2.1/24 | PE2 | Gi0 | 10.1.4.2/24
 | Loopback0 | 11.11.11.11/32 |  | Gi1 | 10.1.5.1/24
ASBR1 | Gi0 | 10.1.2.2/24 |  | Loopback0 | 44.44.44.44/32
 | Gi1 | 10.1.3.1/24 | CE2 | Gi0 | 10.1.5.2/24
 | Loopback0 | 22.22.22.22/32 |  | Loopback0 | 2.2.2.2/32

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | In one AS domain, configure the global OSPF to advertise the global route.

#Configure the global OSPF on PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

PE1(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

PE1(config-ospf)#exit

#Configure the global OSPF on ASBR1.

ASBR1#configure terminal

ASBR1(config)#router ospf 100

ASBR1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

ASBR1(config-ospf)#network 22.22.22.22 0.0.0.0 area 0

ASBR1(config-ospf)#exit

#Configure the global OSPF on ASBR2.

ASBR2#configure terminal

ASBR2(config)#router ospf 100

ASBR2(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

ASBR2(config-ospf)#network 33.33.33.33 0.0.0.0 area 0

ASBR2(config-ospf)#exit

#Configure the global OSPF on PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

PE2(config-ospf)#network 44.44.44.44 0.0.0.0 area 0

PE2(config-ospf)#exit

#After the configuration is complete, view the global route table on the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.2.0/24 is directly connected, 69:53:53, gigabitethernet1

C 127.0.0.0/8 is directly connected, 1183:09:57, lo0

C 11.11.11.11/32 is directly connected, 69:53:37, loopback0

O 22.22.22.22/32 [110/2] via 10.1.2.2, 48:14:20, gigabitethernet1

You can see that there is the route information of ASBR1 loopback port in the global route table of PE1.

l For the checking method of PE2 and ASBR, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 11.11.11.11

PE1(config-ldp)#transport-address 11.11.11.11

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#mpls ldp

PE1(config-if-gigabitethernet1)#mpls ip

PE1(config-if-gigabitethernet1)#exit

#On ASBR1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

ASBR1(config)#mpls ip

ASBR1(config)#mpls ldp

ASBR1(config-ldp)#router-id 22.22.22.22

ASBR1(config-ldp)#transport-address 22.22.22.22

ASBR1(config-ldp)#exit

ASBR1(config)#interface gigabitethernet0

ASBR1(config-if-gigabitethernet0)#mpls ip

ASBR1(config-if-gigabitethernet0)#mpls ldp

ASBR1(config-if-gigabitethernet0)#exit

#On ASBR2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

ASBR2(config)#mpls ip

ASBR2(config)#mpls ldp

ASBR2(config-ldp)#router-id 33.33.33.33

ASBR2(config-ldp)#transport-address 33.33.33.33

ASBR2(config-ldp)#exit

ASBR2(config)#interface gigabitethernet1

ASBR2(config-if-gigabitethernet1)#mpls ldp

ASBR2(config-if-gigabitethernet1)#mpls ip

ASBR2(config-if-gigabitethernet1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 44.44.44.44

PE2(config-ldp)#transport-address 44.44.44.44

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

#After the configuration is complete, view the LDP session information on the device.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

22.22.22.22 Multicast Passive OPERATIONAL 00:02:34

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

You can see that PE1 and ASBR1 set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 22.22.22.22/32 / 3 gigabitethernet1 10.1.2.2 13230 654389

You can see that there is the route label information of the ASBR1 loopback port in the MPLS forwarding table of PE1.

l For the checking method of PE2 and ASBR, refer to PE1.

Step 4:

Configure the VPN instance and advertise the CE route to PE via OSPF.

#Configure OSPF on CE1.

CE1#configure terminal

CE1(config)#router ospf 100

CE1(config-ospf)#network 1.1.1.1 0.0.0.0 area 0

CE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

CE1(config-ospf)#exit

#On PE1, configure the VPN instance and OSPF in VPN.

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#ip vrf forwarding 1

PE1(config-if-gigabitethernet0)#ip address 10.1.1.2 255.255.255.0

PE1(config-if-gigabitethernet0)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#On ASBR1, configure the VPN instance.

ASBR1(config)#ip vrf 1

ASBR1(config-vrf)#rd 100:1

ASBR1(config-vrf)#route-target export 100:1

ASBR1(config-vrf)#route-target import 100:1

ASBR1(config-vrf)#exit

ASBR1(config)#interface gigabitethernet1

ASBR1(config-if-gigabitethernet1)#ip vrf forwarding 1

ASBR1(config-if-gigabitethernet1)#ip address 10.1.3.1 255.255.255.0

ASBR1(config-if-gigabitethernet1)#exit

#On ASBR2, configure the VPN instance.

ASBR2(config)#ip vrf 1

ASBR2(config-vrf)#rd 200:1

ASBR2(config-vrf)#route-target export 200:1

ASBR2(config-vrf)#route-target import 200:1

ASBR2(config-vrf)#exit

ASBR2(config)#interface gigabitethernet0

ASBR2(config-if-gigabitethernet0)#ip vrf forwarding 1

ASBR2(config-if-gigabitethernet0)#ip address 10.1.3.2 255.255.255.0

ASBR2(config-if-gigabitethernet0)#exit

#On PE2, configure the VPN instance and OSPF in VPN.

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 200:1

PE2(config-vrf)#route-target export 200:1

PE2(config-vrf)#route-target import 200:1

PE2(config-vrf)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#ip vrf forwarding 1

PE2(config-if-gigabitethernet1)#ip address 10.1.5.1 255.255.255.0

PE2(config-if-gigabitethernet1)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#network 10.1.5.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#Configure OSPF on CE2.

CE2#configure terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 2.2.2.2 0.0.0.0 area 0

CE2(config-ospf)#network 10.1.5.0 0.0.0.255 area 0

CE2(config-ospf)#exit

#After the configuration is complete, view the VPN route table on the PE.

Take PE1 as an example:

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 70:09:30, gigabitethernet0

O 1.1.1.1/32 [110/2] via 10.1.1.1, 70:07:57, gigabitethernet0

You can see that there is the information of the route to CE1 in the VPN1 route table of PE1.

l For the checking method of PE2, refer to PE1.

Step 5:

Configure MP-IBGP between PE and ASBR, and use the loopback interface as the peer address; configure EBGP between ASBR, and re-distribute the route with the IGP protocol in the VPN instance.

#On PE1, configure MP-IBGP, enable the VPNv4 address family, and re-distribute the route with the IGP protocol in the VPN instance.

PE1(config)#router bgp 100

PE1(config-bgp)#neighbor 22.22.22.22 remote-as 100

PE1(config-bgp)#neighbor 22.22.22.22 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 22.22.22.22 activate

PE1(config-bgp-af)#neighbor 22.22.22.22 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute ospf 200

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 200

PE1(config-ospf)#redistribute bgp 100

PE1(config-ospf)#exit

#On ASBR1, configure MP-IBGP with PE1, enable the VPNv4 address family, and configure EBGP with ASBR2 in the VRF address family.

ASBR1(config)#router bgp 100

ASBR1(config-bgp)#neighbor 11.11.11.11 remote-as 100

ASBR1(config-bgp)#neighbor 11.11.11.11 update-source loopback0

ASBR1(config-bgp)#address-family vpnv4

ASBR1(config-bgp-af)#neighbor 11.11.11.11 activate

ASBR1(config-bgp-af)#neighbor 11.11.11.11 send-community extended

ASBR1(config-bgp-af)#exit-address-family

ASBR1(config-bgp)#address-family ipv4 vrf 1

ASBR1(config-bgp-af)#redistribute connected

ASBR1(config-bgp-af)#neighbor 10.1.3.2 remote-as 200

ASBR1(config-bgp-af)#exit-address-family

ASBR1(config-bgp)#exit

#On ASBR2, configure MP-IBGP with PE2, enable the VPNv4 address family, and configure EBGP with ASBR1 in the VRF address family.

ASBR2(config)#router bgp 200

ASBR2(config-bgp)#neighbor 44.44.44.44 remote-as 200

ASBR2(config-bgp)#neighbor 44.44.44.44 update-source loopback0

ASBR2(config-bgp)#address-family vpnv4

ASBR2(config-bgp-af)#neighbor 44.44.44.44 activate

ASBR2(config-bgp-af)#neighbor 44.44.44.44 send-community extended

ASBR2(config-bgp-af)#exit-address-family

ASBR2(config-bgp)#address-family ipv4 vrf 1

ASBR2(config-bgp-af)#redistribute connected

ASBR2(config-bgp-af)#neighbor 10.1.3.1 remote-as 100

ASBR2(config-bgp-af)#exit-address-family

ASBR2(config-bgp)#exit

#On PE2, configure MP-IBGP, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE2(config)#router bgp 200

PE2(config-bgp)#neighbor 33.33.33.33 remote-as 200

PE2(config-bgp)#neighbor 33.33.33.33 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 33.33.33.33 activate

PE2(config-bgp-af)#neighbor 33.33.33.33 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 200

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#redistribute bgp 200

PE2(config-ospf)#exit

Step 6:

Check the result.

#After the configuration is complete, view the BGP neighbor information on the PE and ASBR.

Take PE1, ASBR1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 11.11.11.11, local AS number 100

BGP table version is 6

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

22.22.22.22 4 100 44 43 6 0 0 00:34:07 3

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and ASBR1 set up the BGP neighbor successfully.

ASBR1#show ip bgp vpnv4 all summary

BGP router identifier 22.22.22.22, local AS number 100

BGP table version is 5

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

11.11.11.11 4 100 20 21 4 0 0 00:14:56 2

Total number of neighbors 1

BGP VRF 1 Route Distinguisher:

100:1

BGP table version is 1

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

10.1.3.2 4 200 3 3 1 0 0 00:00:03 3

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that ASBR1 and PE1, ASBR2 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table on the PE and ASBR.

Take PE1, ASBR1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 28, local router ID is 11.11.11.11

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[O]*> 1.1.1.1/32 10.1.1.1 2 32768 ?

[B]*>i2.2.2.2/32 22.22.22.22 0 100 0 200 ?

[O]*> 10.1.1.0/24 0.0.0.0 1 32768 ?

[B]*>i10.1.3.0/24 22.22.22.22 0 100 0 ?

[B]*>i10.1.5.0/24 22.22.22.22 0 100 0 200 ?

ASBR1#show ip bgp vpnv4 vrf 1

BGP table version is 386, local router ID is 22.22.22.22

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[B]*>i1.1.1.1/32 11.11.11.11 2 100 0 ?

[B]*> 2.2.2.2/32 10.1.3.2 0 0 200 ?

[B]*>i10.1.1.0/24 11.11.11.11 1 100 0 ?

[B]* 10.1.3.0/24 10.1.3.2 0 0 200 ?

[C]*> 0.0.0.0 0 32768 ?

[B]*> 10.1.5.0/24 10.1.3.2 0 0 200 ?

You can see that there is the BGP route information to the peer CE2 in the BGP VPNv4 route table of PE1 and ASBR1.

#View the MPLS forwarding table on the PE and ASBR.

Take PE1, ASBR1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 22.22.22.22/32 / 3 gigabitethernet1 10.1.2.2 13230 654389

B 1 2.2.2.2/32[V] / 20480 gigabitethernet1 22.22.22.22 5 400

B 1 10.1.3.0/24[V] / 20480 gigabitethernet1 22.22.22.22 0 0

B 1 10.1.5.0/24[V] / 20480 gigabitethernet0/2/1 22.22.22.22 0 0

B 1 0.0.0.0/0 5120 / / / 10 10 760

ASBR1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 10.1.2.1 13176 651021

B 1 1.1.1.1/32[V] / 5120 gigabitethernet0 11.11.11.11 0 0

B 1 10.1.1.0/24[V] / 5120 gigabitethernet0 11.11.11.11 5 400

B 1 0.0.0.0/0 20480 / / / 10 10 760

You can see that there is the route label information of VPN1 in the MPLS forwarding table of PE1 and ASBR1.

l For the checking method of PE2, ASBR2 , refer to PE1, ASBR1.

#View the route table on the PE and CE.

Take PE1, CE1 as an example:

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 72:01:01, gigabitethernet0

B 10.1.3.0/24 [200/0] via 22.22.22.22, 01:13:44, gigabitethernet1

B 10.1.5.0/24 [200/0] via 22.22.22.22, 01:12:06, gigabitethernet1

O 1.1.1.1/32 [110/2] via 10.1.1.1, 71:59:28, gigabitethernet0

B 2.2.2.2/32 [200/0] via 22.22.22.22, 01:12:06, gigabitethernet1

CE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 72:07:55, gigabitethernet0

OE 10.1.3.0/24 [150/1] via 10.1.1.2, 01:14:28, gigabitethernet0

OE 10.1.5.0/24 [150/1] via 10.1.1.2, 01:12:50, gigabitethernet0

C 127.0.0.0/8 is directly connected, 210:21:32, lo0

C 1.1.1.1/32 is directly connected, 72:03:40, loopback0

OE 2.2.2.2/32 [150/1] via 10.1.1.2, 01:12:50, gigabitethernet0

You can see that there is the route information to the peer CE2 in the route table of PE1 and CE1.

#On CE1, ping the loopback port of CE2.

CE1#ping 2.2.2.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 2.2.2.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

You can see that CE1 can ping CE2.


5.3.4 Configure Cross-Domain OptionB

Network Requirements

l The whole MPLS network includes two AS domains. CE1 in AS100 needs to communicate with CE2 in AS200.

l CE1 and CE2 belong to VPN1 at the same time; use OSPF to exchange the route with PE.

l Use the MP-EBGP to exchange the route between ASBR.

l ASBR and PE use MP-IBGP to exchange the route.

Network Topology

Figure 5‑10 Networking of configuring cross-domain OptionB

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 10.1.1.1/24 | ASBR2 | Gi0 | 10.1.3.2/24
 | Loopback0 | 1.1.1.1/32 |  | Gi1 | 10.1.4.1/24
PE1 | Gi0 | 10.1.1.2/24 |  | Loopback0 | 33.33.33.33/32
 | Gi1 | 10.1.2.1/24 | PE2 | Gi0 | 10.1.4.2/24
 | Loopback0 | 11.11.11.11/32 |  | Gi1 | 10.1.5.1/24
ASBR1 | Gi0 | 10.1.2.2/24 |  | Loopback0 | 44.44.44.44/32
 | Gi1 | 10.1.3.1/24 | CE2 | Gi0 | 10.1.5.2/24
 | Loopback0 | 22.22.22.22/32 |  | Loopback0 | 2.2.2.2/32

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | In one AS domain, configure the global OSPF to advertise the global route.

#Configure the global OSPF on PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

PE1(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

PE1(config-ospf)#exit

#Configure the global OSPF on ASBR1.

ASBR1#configure terminal

ASBR1(config)#router ospf 100

ASBR1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

ASBR1(config-ospf)#network 22.22.22.22 0.0.0.0 area 0

ASBR1(config-ospf)#exit

#Configure the global OSPF on ASBR2.

ASBR2#configure terminal

ASBR2(config)#router ospf 100

ASBR2(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

ASBR2(config-ospf)#network 33.33.33.33 0.0.0.0 area 0

ASBR2(config-ospf)#exit

#Configure the global OSPF on PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

PE2(config-ospf)#network 44.44.44.44 0.0.0.0 area 0

PE2(config-ospf)#exit

#After the configuration is complete, view the global route table on the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.2.0/24 is directly connected, 04:52:00, gigabitethernet0

C 127.0.0.0/8 is directly connected, 18:08:05, lo0

C 11.11.11.11/32 is directly connected, 04:51:45, loopback0

O 22.22.22.22/32 [110/2] via 10.1.2.2, 01:45:41, gigabitethernet0

You can see that there is the route information of ASBR1 loopback port in the global route table of PE1.

l For the checking method of PE2 and ASBR, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 11.11.11.11

PE1(config-ldp)#transport-address 11.11.11.11

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#mpls ldp

PE1(config-if-gigabitethernet1)#mpls ip

PE1(config-if-gigabitethernet1)#exit

#On ASBR1, enable the global MPLS IP and MPLS LDP; meanwhile, enable MPLS IP and MPLS LDP on the interface with PE1. The interfaces between ASBR only need to enable MPLS IP, but do not need to configure MPLS LDP.

ASBR1(config)#mpls ip

ASBR1(config)#mpls ldp

ASBR1(config-ldp)#router-id 22.22.22.22

ASBR1(config-ldp)#transport-address 22.22.22.22

ASBR1(config-ldp)#exit

ASBR1(config)#interface gigabitethernet0

ASBR1(config-if-gigabitethernet0)#mpls ip

ASBR1(config-if-gigabitethernet0)#mpls ldp

ASBR1(config-if-gigabitethernet0)#interface gigabitethernet1

ASBR1(config-if-gigabitethernet1)#mpls ip

ASBR1(config-if-gigabitethernet1)#exit

#On ASBR2, enable the global MPLS IP and MPLS LDP; meanwhile, enable MPLS IP and MPLS LDP on the interface with PE2. The interfaces between ASBR only need to enable MPLS IP, but do not need to configure MPLS LDP.

ASBR2(config)#mpls ip

ASBR2(config)#mpls ldp

ASBR2(config-ldp)#router-id 33.33.33.33

ASBR2(config-ldp)#transport-address 33.33.33.33

ASBR2(config-ldp)#exit

ASBR2(config)#interface gigabitethernet0

ASBR2(config-if-gigabitethernet0)#mpls ip

ASBR2(config-if-gigabitethernet0)#interface gigabitethernet1

ASBR2(config-if-gigabitethernet1)#mpls ldp

ASBR2(config-if-gigabitethernet1)#mpls ip

ASBR2(config-if-gigabitethernet1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 44.44.44.44

PE2(config-ldp)#transport-address 44.44.44.44

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

#After the configuration is complete, view the LDP session information on the device.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

22.22.22.22 Multicast Passive OPERATIONAL 00:02:34

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

You can see that PE1 and ASBR1 set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 22.22.22.22/32 / 3 gigabitethernet1 10.1.2.2 206 10526

You can see that there is the label information to the ASBR1 loopback port in the MPLS forwarding table of PE1.

l For the checking method of PE2 and ASBR, refer to PE1.

Step 4:

Configure the VPN instance and advertise the CE route to the PE via OSPF.

#On PE1, configure the VPN instance and OSPF in the VPN instance.

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#ip vrf forwarding 1

PE1(config-if-gigabitethernet0)#ip address 10.1.1.2 255.255.255.0

PE1(config-if-gigabitethernet0)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

PE1(config-ospf)#exit

#Configure OSPF on CE1.

CE1#configure terminal

CE1(config)#router ospf 100

CE1(config-ospf)#network 1.1.1.1 0.0.0.0 area 0

CE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

CE1(config-ospf)#exit

#On PE2, configure the VPN instance and OSPF in the VPN instance.

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 100:1

PE2(config-vrf)#route-target export 100:1

PE2(config-vrf)#route-target import 100:1

PE2(config-vrf)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#ip vrf forwarding 1

PE2(config-if-gigabitethernet1)#ip address 10.1.5.1 255.255.255.0

PE2(config-if-gigabitethernet1)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#network 10.1.5.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#Configure OSPF on CE2.

CE2#configure terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 2.2.2.2 0.0.0.0 area 0

CE2(config-ospf)#network 10.1.5.0 0.0.0.255 area 0

CE2(config-ospf)#exit

#After the configuration is complete, view the VPN route table on the PE.

Take PE1 as an example:

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 05:59:50, gigabitethernet0

O 1.1.1.1/32 [110/2] via 10.1.1.1, 05:58:17, gigabitethernet0

You can see that there is the route to the CE1 in the VPN1 route table of PE1.

l For the checking method of PE2, refer to PE1.

Step 5:

Configure MP-IBGP between PE and ASBR, and use the loopback interface as the peer address; configure EBGP between ASBR, and re-distribute the route with the IGP protocol in the VPN instance.

#On PE1, configure MP-IBGP, enable the VPNv4 address family, and re-distribute the route with the IGP protocol in the VPN instance.

PE1(config)#router bgp 100

PE1(config-bgp)#neighbor 22.22.22.22 remote-as 100

PE1(config-bgp)#neighbor 22.22.22.22 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 22.22.22.22 activate

PE1(config-bgp-af)#neighbor 22.22.22.22 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute ospf 200

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#redistribute bgp 100

PE1(config-ospf)#exit

#On ASBR1, configure MP-IBGP with PE1, configure MP-EBGP between ASBR1 and ASBR2, and enable the VPNv4 address family.

ASBR1(config)#router bgp 100

ASBR1(config-bgp)#neighbor 10.1.3.2 remote-as 200

ASBR1(config-bgp)#neighbor 11.11.11.11 remote-as 100

ASBR1(config-bgp)#neighbor 11.11.11.11 update-source loopback0

ASBR1(config-bgp)#address-family vpnv4

ASBR1(config-bgp-af)#neighbor 10.1.3.2 activate

ASBR1(config-bgp-af)#neighbor 10.1.3.2 send-community extended

ASBR1(config-bgp-af)#neighbor 11.11.11.11 activate

ASBR1(config-bgp-af)#neighbor 11.11.11.11 next-hop-self

ASBR1(config-bgp-af)#neighbor 11.11.11.11 send-community extended

ASBR1(config-bgp-af)#exit-address-family

ASBR1(config-bgp)#exit

#On ASBR2, configure MP-IBGP with PE2, configure MP-EBGP between ASBR1 and ASBR2, and enable the VPNv4 address family.

ASBR2(config)#router bgp 200

ASBR2(config-bgp)#neighbor 10.1.3.1 remote-as 100

ASBR2(config-bgp)#neighbor 44.44.44.44 remote-as 200

ASBR2(config-bgp)#neighbor 44.44.44.44 update-source loopback0

ASBR2(config-bgp)#address-family vpnv4

ASBR2(config-bgp-af)#neighbor 10.1.3.1 activate

ASBR2(config-bgp-af)#neighbor 10.1.3.1 send-community extended

ASBR2(config-bgp-af)#neighbor 44.44.44.44 activate

ASBR2(config-bgp-af)#neighbor 44.44.44.44 next-hop-self

ASBR2(config-bgp-af)#neighbor 44.44.44.44 send-community extended

ASBR2(config-bgp-af)#exit-address-family

ASBR2(config-bgp)#exit

#On PE2, configure MP-IBGP, enable the VPNv4 address family, and re-distribute the route with the IGP protocol in the VPN instance.

PE2(config)#router bgp 200

PE2(config-bgp)#neighbor 33.33.33.33 remote-as 200

PE2(config-bgp)#neighbor 33.33.33.33 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 33.33.33.33 activate

PE2(config-bgp-af)#neighbor 33.33.33.33 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 200

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#redistribute bgp 200

PE2(config-ospf)#exit

Step 6:

Check the result.

#After the configuration is complete, view the BGP neighbor information on the PE and ASBR.

Take PE1, ASBR1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 11.11.11.11, local AS number 100

BGP table version is 1

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

22.22.22.22 4 100 4 4 1 0 0 00:02:08 2

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and ASBR1 set up the BGP neighbor successfully.

ASBR1#show ip bgp vpnv4 all summary

BGP router identifier 22.22.22.22, local AS number 100

BGP table version is 1

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

11.11.11.11 4 100 2 2 1 0 0 00:00:14 2

10.1.3.2 4 200 7 8 1 0 0 00:05:28 2

Total number of neighbors 2

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that ASBR1 and PE1, ASBR2 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table on the PE and ASBR.

Take PE1, ASBR1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 8, local router ID is 11.11.11.11

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[O]*> 1.1.1.1/32 10.1.1.1 2 32768 ?

[B]*>i2.2.2.2/32 22.22.22.22 0 100 0 200 ?

[O]*> 10.1.1.0/24 0.0.0.0 1 32768 ?

[B]*>i10.1.5.0/24 22.22.22.22 0 100 0 200 ?

ASBR1#show ip bgp vpnv4 all

BGP table version is 364, local router ID is 22.22.22.22

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1

[B]*>i1.1.1.1/32 11.11.11.11 2 100 0 ?

[B]*> 2.2.2.2/32 10.1.3.2 0 0 200 ?

[B]*>i10.1.1.0/24 11.11.11.11 1 100 0 ?

[B]*> 10.1.5.0/24 10.1.3.2 0 0 200 ?

You can see that there is the BGP route information to the peer CE2 in the BGP VPNv4 route table of PE1 and ASBR1.

#View the MPLS forwarding table on the PE and ASBR.

Take PE1, ASBR1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 22.22.22.22/32 / 3 gigabitethernet1 10.1.2.2 206 10526

B 1 2.2.2.2/32[V] / 20480 gigabitethernet1 22.22.22.22 0 0

B 1 10.1.5.0/24[V] / 20481 gigabitethernet1 22.22.22.22 5 400

B 1 0.0.0.0/0 5120 / / / 10 10 760

ASBR1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 10.1.2.1 208 10567

B global 2.2.2.2/32 20480 16 gigabitethernet1 10.1.3.2 0 0 0

B global 10.1.5.0/24 20481 17 gigabitethernet1 10.1.3.2 5 5 400

B global 1.1.1.1/32 20482 5120 gigabitethernet0 11.11.11.11 5 5 380

You can see that there is the route label information of VPN1 in the MPLS forwarding table of PE1 and ASBR1.

l For the checking method of PE2, ASBR2 , refer to PE1, ASBR1.

#View the route table on the device.

Take PE1, CE1 as an example:

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 22:15:35, gigabitethernet0

B 10.1.5.0/24 [200/0] via 22.22.22.22, 00:35:06, gigabitethernet1

O 1.1.1.1/32 [110/2] via 10.1.1.1, 22:14:02, gigabitethernet0

B 2.2.2.2/32 [200/0] via 22.22.22.22, 00:35:06, gigabitethernet1

CE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 22:22:30, gigabitethernet0

O 10.1.5.0/24 [110/2] via 10.1.1.2, 00:35:47, gigabitethernet0

C 127.0.0.0/8 is directly connected, 160:36:07, lo0

C 1.1.1.1/32 is directly connected, 22:18:15, loopback0

O 2.2.2.2/32 [110/2] via 10.1.1.2, 00:35:47, gigabitethernet0

You can see that there is the route information to the peer CE2 in the route table of PE1 and CE1.

#On CE1, ping the loopback port of CE2 and view whether the ping can be connected.

CE1#ping 2.2.2.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 2.2.2.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

You can see that CE1 can ping CE2.


5.3.5 Configure BGP AS Replacing

Network Requirements

l Configure the intra-domain MPLS L3VPN.

l CE1 and CE2 are both the devices of VPN1.

l CE1 and CE2 both belong to AS100, use EBGP to advertise the route to PE, and configure AS coverage to ensure that the two CEs can receive the peer route normally.

Network Topology

Figure 5‑11 Networking of configuring BGP AS replacing

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 95.1.1.2/16 | P | Loopback0 | 11.11.11.11/32
 | Loopback0 | 5.5.5.5/32 | PE2 | Gi0 | 92.1.1.1/16
PE1 | Gi0 | 93.1.1.2/16 |  | Gi1 | 90.1.1.1/16
 | Gi1 | 95.1.1.1/16 |  | Loopback0 | 75.75.75.75/32
 | Loopback0 | 90.90.90.90/32 | CE2 | Gi0 | 90.1.1.2/16
P | Gi0 | 93.1.1.1/16 |  | Loopback0 | 8.8.8.8/32
 | Gi1 | 92.1.1.2/16 |  |  |

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | Configure the global OSPF and advertise the global route.

#Configure the global OSPF on PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 90.90.90.90 0.0.0.0 area 0

PE1(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

PE1(config-ospf)#exit

# Configure the global OSPF on P.

P#configure terminal

P(config)#router ospf 100

P(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

P(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

P(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

P(config-ospf)#exit

#Configure the global OSPF on PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 75.75.75.75 0.0.0.0 area 0

PE2(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

#After the configuration is complete, view the global route table on the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 93.1.0.0/16 is directly connected, 00:34:54, gigabitethernet0

O 92.1.0.0/16 [110/2] via 93.1.1.1, 00:08:12, gigabitethernet0

C 90.90.90.90/32 is directly connected, 154:02:28, loopback0

O 11.11.11.11/32 [110/2] via 93.1.1.1, 00:05:03, gigabitethernet0

O 75.75.75.75/32 [110/3] via 93.1.1.1, 00:06:03, gigabitethernet0

You can see that there is the route information of P and PE2 loopback ports in the global route table of PE1.

l For the checking method of PE2, P, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 90.90.90.90

PE1(config-ldp)#transport-address 90.90.90.90

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#mpls ip

PE1(config-if-gigabitethernet0)#mpls ldp

PE1(config-if-gigabitethernet0)#exit

#On P, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

P(config)#mpls ip

P(config)#mpls ldp

P(config-ldp)#router-id 11.11.11.11

P(config-ldp)#transport-address 11.11.11.11

P(config-ldp)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#mpls ip

P(config-if-gigabitethernet0)#mpls ldp

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#mpls ip

P(config-if-gigabitethernet1)#mpls ldp

P(config-if-gigabitethernet1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 75.75.75.75

PE2(config-ldp)#transport-address 75.75.75.75

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

#After the configuration is complete, view the LDP session information on the device.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

11.11.11.11 Multicast Active OPERATIONAL 00:02:20

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

You can see that PE1 and P set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 44 2690

L global 75.75.75.75/32 / 16 gigabitethernet0 93.1.1.1 19 1230

You can see that there is the label information of P and PE2 loopback ports on PE1.

l For the checking method of PE2, P, refer to PE1.

Step 4:

On the PE, configure the VPN instance, and configure BGP between PE and CE.

#On PE1, configure the VPN instance and set up the EBGP neighbor with CE.

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#ip vrf forwarding 1

PE1(config-if-gigabitethernet1)#ip address 95.1.1.1 255.255.0.0

PE1(config-if-gigabitethernet1)#exit

PE1(config)#router bgp 200

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#neighbor 95.1.1.2 remote-as 100

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

#On CE1, configure the EBGP with PE.

CE1#configure terminal

CE1(config)#router bgp 100

CE1(config-bgp)#network 5.5.5.5 255.255.255.255

CE1(config-bgp)#network 95.1.0.0 255.255.0.0

CE1(config-bgp)#neighbor 95.1.1.1 remote-as 200

CE1(config-bgp)#exit

#On PE2, configure the VPN instance and set up the EBGP neighbor with the CE.

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 100:1

PE2(config-vrf)#route-target export 100:1

PE2(config-vrf)#route-target import 100:1

PE2(config-vrf)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#ip vrf forwarding 1

PE2(config-if-gigabitethernet1)#ip address 90.1.1.1 255.255.0.0

PE2(config-if-gigabitethernet1)#exit

PE2(config)#router bgp 200

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#neighbor 90.1.1.2 remote-as 100

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

#On CE2, configure EBGP with the PE.

CE2#configure terminal

CE2(config)#router bgp 100

CE2(config-bgp)#network 8.8.8.8 255.255.255.255

CE2(config-bgp)#network 90.1.0.0 255.255.0.0

CE2(config-bgp)#neighbor 90.1.1.1 remote-as 200

CE2(config-bgp)#exit

#After the configuration is complete, view the EBGP neighbor information on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 90.90.90.90, local AS number 200BGP VRF 1 Route Distinguisher:

100:1

BGP table version is 1

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

95.1.1.2 4 100 2 2 1 0 0 00:00:08 2

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and CE1 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table and VPN route table on the PE.

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 18, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[B]*> 5.5.5.5/32 95.1.1.2 0 0 100 i

[B]*> 95.1.0.0/16 95.1.1.2 0 0 100 i

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 95.1.0.0/16 is directly connected, 15:40:01, gigabitethernet1

B 5.5.5.5/32 [20/0] via 95.1.1.2, 01:13:15, gigabitethernet1

You can see that there is the route to CE1 in the BGP route table and VPN route table of PE1.

l For the checking method of PE2, refer to PE1.

Step 5:

Configure MP-IBGP, and use the loopback interface as the peer address.

#On PE1, configure MP-IBGP and enable the VPNv4 address family.

PE1(config)#router bgp 200

PE1(config-bgp)#neighbor 75.75.75.75 remote-as 200

PE1(config-bgp)#neighbor 75.75.75.75 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 75.75.75.75 activate

PE1(config-bgp-af)#neighbor 75.75.75.75 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

#On PE2, configure MP-IBGP and enable the VPNv4 address family.

PE2(config)#router bgp 200

PE2(config-bgp)#neighbor 90.90.90.90 remote-as 200

PE2(config-bgp)#neighbor 90.90.90.90 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 90.90.90.90 activate

PE2(config-bgp-af)#neighbor 90.90.90.90 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

#After the configuration is complete, view the BGP neighbor information.

Take PE1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 90.90.90.90, local AS number 200

BGP table version is 2

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

75.75.75.75 4 200 3 3 1 0 0 00:00:06 4

Total number of neighbors 1

BGP VRF 1 Route Distinguisher:

100:1

BGP table version is 1

2 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

95.1.1.2 4 100 18 18 1 0 0 00:14:25 2

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and PE2, CE1 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table and VPN route table on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 27, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[B]*> 5.5.5.5/32 95.1.1.2 0 0 100 i

[B]*>i8.8.8.8/32 75.75.75.75 0 100 0 100 i

[B]*>i90.1.0.0/16 75.75.75.75 0 100 0 100 i

[B]*> 95.1.0.0/16 95.1.1.2 0 0 100 i

PE1#show ip bgp vpnv4 vrf 1 8.8.8.8

Route Distinguisher: 100:1 (Default for VRF 1), Prefix: 8.8.8.8/32

Not advertised to any peer

100

75.75.75.75 (metric 3) from 75.75.75.75 (75.75.75.75)

Origin IGP, metric 0, localpref 100, valid, internal, best, vrf ftn installed, vrf duplicated, vrf external

Extended Community: RT:100:1

Last update: 01:38:32 ago

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 90.1.0.0/16 [200/0] via 75.75.75.75, 00:04:05, gigabitethernet0

C 95.1.0.0/16 is directly connected, 18:33:25, gigabitethernet1

B 5.5.5.5/32 [20/0] via 95.1.1.2, 00:09:40, gigabitethernet1

B 8.8.8.8/32 [200/0] via 75.75.75.75, 01:46:03, gigabitethernet0

You can see that there is the route information to CE2 in the BGP VPNv4 route table of PE1. AS-PATH is displayed as 100 and there is also the route information to CE2 in the VPN1 route table of PE1.

l For the checking method of PE2, refer to PE1.

#View the BGP route table on the CE.

Take CE1 as an example:

CE1#show ip bgp

BGP table version is 1, local router ID is 5.5.5.5

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 5.5.5.5/32 0.0.0.0 0 32768 i

[B]*> 95.1.0.0/16 0.0.0.0 0 32768 i

You can see that there is no route information to CE2 in the BGP route table of CE1.

l CE discovers that the AS PATH attribute of the received peer route contains the same AS number 100, so refuses the BGP route. After configuring the AS cover on the PE, CE can learn the peer route.

Step 6:

On the PE, configure the AS coverage.

#In the BGP VRF address family of PE1, configure the AS cover for the EBGP neighbor, so as to cover the same AS number with its own local AS number and transmit to the CE.

PE1(config)#router bgp 200

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#neighbor 95.1.1.2 as-override

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

#In the BGP VRF address family of PE2, configure the AS cover for the EBGP neighbor, so as to cover the same AS number with its own local AS number and transmit to the CE.

PE2(config)#router bgp 200

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#neighbor 90.1.1.2 as-override

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

Step7:

Check the result.

#After the configuration is complete, view the BGP VPNv4 route table and VPN route table on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 27, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[B]*> 5.5.5.5/32 95.1.1.2 0 0 100 i

[B]*>i8.8.8.8/32 75.75.75.75 0 100 0 100 i

[B]*>i90.1.0.0/16 75.75.75.75 0 100 0 100 i

[B]*> 95.1.0.0/16 95.1.1.2 0 0 100 i

PE1#show ip bgp vpnv4 vrf 1 8.8.8.8

Route Distinguisher: 100:1 (Default for VRF 1), Prefix: 8.8.8.8/32

Not advertised to any peer

100

75.75.75.75 (metric 3) from 75.75.75.75 (75.75.75.75)

Origin IGP, metric 0, localpref 100, valid, internal, best, vrf ftn installed, vrf duplicated, vrf external

Extended Community: RT:100:1

Last update: 01:38:32 ago

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 90.1.0.0/16 [200/0] via 75.75.75.75, 00:04:05, gigabitethernet0

C 95.1.0.0/16 is directly connected, 18:33:25, gigabitethernet1

B 5.5.5.5/32 [20/0] via 95.1.1.2, 00:09:40, gigabitethernet1

B 8.8.8.8/32 [200/0] via 75.75.75.75, 01:46:03, gigabitethernet0

You can see that there is the route information to CE2 in the BGP VPNv4 route table of PE1. AS-PATH is displayed as 100 and there is also the route information to CE2 in the VPN1 route table of PE1.

#View the MPLS forwarding table on the PE.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 44 2690

L global 75.75.75.75/32 / 16 gigabitethernet0 93.1.1.1 19 1230

B 1 8.8.8.8/32[V] / 10241 gigabitethernet0 75.75.75.75 7 560

B 1 90.1.0.0/16[V] / 10241 gigabitethernet0 75.75.75.75 0 0

B 2 3.3.3.3/32[V] / 10240 gigabitethernet0 75.75.75.75 0 0

B 2 91.1.0.0/16[V] / 10240 gigabitethernet0 75.75.75.75 0 0

B 1 0.0.0.0/0 15360 / / / 24 24 1824

B 2 0.0.0.0/0 15361 / / / 0 0 0

You can see that there is the route label information of VPN1 and VPN2 in the MPLS forwarding table of PE1.

l For the checking method of PE2, refer to PE1.

#View the BGP route bale again on the CE.

CE1#show ip bgp

BGP table version is 4, local router ID is 5.5.5.5

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

[B]*> 5.5.5.5/32 0.0.0.0 0 32768 i

[B]*> 8.8.8.8/32 95.1.1.1 0 0 200 200 i

[B]*> 90.1.0.0/16 95.1.1.1 0 0 200 200 i

[B]*> 95.1.0.0/16 0.0.0.0 0 32768 i

CE1#show ip bgp 8.8.8.8

BGP routing table entry for 8.8.8.8/32

Paths: (1 available, best #1, table Default-IP-Routing-Table)

Not advertised to any peer

200 200

95.1.1.1 (metric 100) from 95.1.1.1 (90.90.90.90)

Origin IGP, metric 0, localpref 100, valid, external, best

Last update: 00:06:06 ago

CE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 90.1.0.0/16 [20/0] via 95.1.1.1, 00:03:09, gigabitethernet0

C 95.1.0.0/16 is directly connected, 23:33:15, gigabitethernet0

C 5.5.5.5/32 is directly connected, 04:05:46, loopback0

B 8.8.8.8/32 [20/0] via 95.1.1.1, 00:08:51, gigabitethernet0

You can see that there is the route information to CE2 in the BGP route table of the CE1 and the global route table and the AS-PATH of CE2 route is modified to 200 200 in the BGP route table.

On CE1, ping the loopback port of CE2 and view whether the ping can be connected.

CE1#ping 8.8.8.8

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 8.8.8.8 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

You can see that CE1 can ping CE2.


5.3.6 Configure OSPF Sham Link

Network Requirements

l CE1 and CE2 belong to VPN1; CE and PE use OSPF to advertise the route.

l There is one backdoor link between CE1 and CE2; configure the sham link between PEs to make the VPN traffic between CE1 and CE2 first be forwarded via the global MPLS and only use the backdoor link to back up.

l Configure OSPF between PEs to make PEs communicate with each other; configure MP-IBGP to exchange the VPN route information.

Network Topology

Figure 5‑12 Networking of configuring the OSPF sham link

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 95.1.1.2/16 | P | Loopback0 | 11.11.11.11/32
 | Gi1 | 98.1.1.1/16 | PE2 | Gi0 | 92.1.1.1/16
 | Loopback0 | 5.5.5.5/32 |  | Gi1 | 90.1.1.1/16
PE1 | Gi0 | 93.1.1.2/16 |  | Loopback0 | 75.75.75.75/32
 | Gi1 | 95.1.1.1/16 |  | Loopback1 | 6.6.6.6/32
 | Loopback0 | 90.90.90.90/32 | CE2 | Gi0 | 90.1.1.2/16
 | Loopback1 | 1.1.1.1/32 |  | Gi1 | 98.1.1.2/16
P | Gi0 | 93.1.1.1/16 |  | Loopback0 | 8.8.8.8/32
 | Gi1 | 92.1.1.2/16 |  |  |

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | Configure the global OSPF and advertise the global route.

#Configure the global OSPF on PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 90.90.90.90 0.0.0.0 area 0

PE1(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

PE1(config-ospf)#exit

#Configure the global OSPF on P.

P#configure terminal

P(config)#router ospf 100

P(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

P(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

P(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

P(config-ospf)#exit

#Configure the global OSPF on PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 75.75.75.75 0.0.0.0 area 0

PE2(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

#After the configuration is complete, view the global route table on the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 93.1.0.0/16 is directly connected, 00:34:54, gigabitethernet0

O 92.1.0.0/16 [110/2] via 93.1.1.1, 00:08:12, gigabitethernet0

C 90.90.90.90/32 is directly connected, 00:08:28, loopback0

O 11.11.11.11/32 [110/2] via 93.1.1.1, 00:05:03, gigabitethernet0

O 75.75.75.75/32 [110/3] via 93.1.1.1, 00:06:03, gigabitethernet0

You can see that there is the route information of the PE2 and P loopback ports in the global route table of PE1.

l For the checking method of P, PE2, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 90.90.90.90

PE1(config-ldp)#transport-address 90.90.90.90

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#mpls ip

PE1(config-if-gigabitethernet0)#mpls ldp

PE1(config-if-gigabitethernet0)#exit

#On P, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

P(config)#mpls ip

P(config)#mpls ldp

P(config-ldp)#router-id 11.11.11.11

P(config-ldp)#transport-address 11.11.11.11

P(config-ldp)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#mpls ip

P(config-if-gigabitethernet0)#mpls ldp

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#mpls ip

P(config-if-gigabitethernet1)#mpls ldp

P(config-if-gigabitethernet1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 75.75.75.75

PE2(config-ldp)#transport-address 75.75.75.75

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

#After the configuration is complete, view the LDP session information on the device.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

11.11.11.11 Multicast Active OPERATIONAL 00:02:20

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

You can see that PE1 and P set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 44 2690

L global 75.75.75.75/32 / 16 gigabitethernet0 93.1.1.1 19 1230

You can see that there is the label information to the PE2 and P loopback ports on PE1.

l For the checking method of P, PE2, refer to PE1.

Step 4:

Configure the VPN instance and advertise the CE route to the PE via OSPF.

#On PE1, configure the VPN instance and OSPF in the VPN instance.

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#ip vrf forwarding 1

PE1(config-if-gigabitethernet1)#ip address 95.1.1.1 255.255.0.0

PE1(config-if-gigabitethernet1)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#network 95.1.0.0 0.0.255.255 area 0

PE1(config-ospf)#exit

#On CE1, configure OSPF with PE1, CE2.

CE1#configure terminal

CE1(config)#router ospf 100

CE1(config-ospf)#network 5.5.5.5 0.0.0.0 area 0

CE1(config-ospf)#network 95.1.0.0 0.0.255.255 area 0

CE1(config-ospf)#network 98.1.0.0 0.0.255.255 area 0

CE1(config-ospf)#exit

#On PE2, configure the VPN instance and OSPF in the VPN instance.

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 100:1

PE2(config-vrf)#route-target export 100:1

PE2(config-vrf)#route-target import 100:1

PE2(config-vrf)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#ip vrf forwarding 1

PE2(config-if-gigabitethernet1)#ip address 90.1.1.1 255.255.0.0

PE2(config)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#network 90.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

#On CE2, configure OSPF with PE2, CE1.

CE2#configure terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 8.8.8.8 0.0.0.0 area 0

CE2(config-ospf)#network 90.1.0.0 0.0.255.255 area 0

CE2(config-ospf)#network 98.1.0.0 0.0.255.255 area 0

CE2(config-ospf)#exit

#After the configuration is complete, view the VPN route table on the PE.

Take PE1 as an example:

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 95.1.0.0/16 is directly connected, 00:11:45, gigabitethernet1

O 98.1.0.0/16 [110/2] via 95.1.1.2, 00:10:11, gigabitethernet1

O 5.5.5.5/32 [110/2] via 95.1.1.2, 00:11:11, gigabitethernet1

You can see that there is the route information to CE1 loopback port in the VPN route table of PE1.

l For the checking method of PE2, refer to PE1.

Step 5:

Configure MP-IBGP, and use the loopback interface as the peer address; re-distribute the route with the IGP protocol in the VPN instance.

#On PE1, configure MP-IBGP, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE1(config)#router bgp 100

PE1(config-bgp)#neighbor 75.75.75.75 remote-as 100

PE1(config-bgp)#neighbor 75.75.75.75 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 75.75.75.75 activate

PE1(config-bgp-af)#neighbor 75.75.75.75 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute ospf 200

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#redistribute bgp 100

PE1(config-ospf)#exit

#On PE2, configure MP-IBGP, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE2(config)#router bgp 100

PE2(config-bgp)#neighbor 90.90.90.90 remote-as 100

PE2(config-bgp)#neighbor 90.90.90.90 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 90.90.90.90 activate

PE2(config-bgp-af)#neighbor 90.90.90.90 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 200

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

#After the configuration is complete, view the BGP neighbor information on PE1.

Take PE1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 90.90.90.90, local AS number 100

BGP table version is 6

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

75.75.75.75 4 100 40 41 5 0 0 00:32:01 2

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and PE2 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table and VPN route table on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 19, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[B]* i5.5.5.5/32 75.75.75.75 5 100 0 ?

[O]*> 95.1.1.2 2 32768 ?

[O]*> 8.8.8.8/32 95.1.1.2 5 32768 ?

[B]* i 75.75.75.75 2 100 0 ?

[O]*> 90.1.0.0/16 95.1.1.2 5 32768 ?

[B]* i 75.75.75.75 1 100 0 ?

[B]* i95.1.0.0/16 75.75.75.75 5 100 0 ?

[O]*> 0.0.0.0 1 32768 ?

[B]* i98.1.0.0/16 75.75.75.75 4 100 0 ?

[O]*> 95.1.1.2 4 32768 ?

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 90.1.0.0/16 [110/5] via 95.1.1.2, 00:00:05, gigabitethernet1

C 95.1.0.0/16 is directly connected, 03:01:34, gigabitethernet1

O 98.1.0.0/16 [110/4] via 95.1.1.2, 02:58:04, gigabitethernet1

O 5.5.5.5/32 [110/2] via 95.1.1.2, 03:00:43, gigabitethernet1

O 8.8.8.8/32 [110/5] via 95.1.1.2, 00:00:05, gigabitethernet1

You can see that the route to CE2 in the BGP VPNv4 route table and VPN route table passes the CE1 backdoor link, but does not pass the global MPLS network.

l For the checking method of PE2, refer to PE1.

Step 6:

On the PE, configure the OSPF sham link and configure the COST value of the interface on the CE1 backdoor link, making CEs communicate with each other via the global network.

#On PE1, configure the OSPF sham link and advertise the loopback port route of the OSPF sham link starting point in the BGP.

PE1(config)#interface loopback 1

PE1(config-if-loopback1)#ip vrf forwarding 1

PE1(config-if-loopback1)#ip address 1.1.1.1 255.255.255.255

PE1(config-if-loopback1)#exit

PE1(config)#router bgp 100

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#network 1.1.1.1 255.255.255.255

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#area 0 sham-link 1.1.1.1 6.6.6.6

PE1(config-ospf)#exit

#On PE2, configure the OSPF sham link and advertise the loopback port route of the OSPF sham link starting point in the BGP.

PE2(config)#interface loopback 1

PE2(config-if-loopback1)#ip vrf forwarding 1

PE2(config-if-loopback1)#ip address 6.6.6.6 255.255.255.255

PE2(config-if-loopback1)#exit

PE2(config)#router bgp 100

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#network 6.6.6.6 255.255.255.255

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#area 0 sham-link 6.6.6.6 1.1.1.1

PE2(config-ospf)#exit

#On CE1, modify the COST value of the backdoor route interface, making CEs communicate via the global network.

CE1(config)#interface gigabitethernet1

CE1(config-if-gigabitethernet1)#ip ospf cost 4

CE1(config-if-gigabitethernet1)#exit

#On CE2, modify the COST value of the backdoor route interface, making CEs communicate via the global network.

CE2(config)#interface gigabitethernet1

CE2(config-if-gigabitethernet1)#ip ospf cost 4

CE2(config-if-gigabitethernet1)#exit

Step7:

Check the result.

#After the configuration is complete, view the OSPF sham link information on the PE.

PE1#show ip ospf sham-links

Sham Link SLINK0 to addr 6.6.6.6 is up

Area 0.0.0.0 source address 1.1.1.1

Run as demand circuit

DoNotAge LSA allowed. Cost of using 1 State Point-To-Point,

Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

Hello due in 00:00:07

Adjacency state Full(Hello suppressed)

PE2#show ip ospf sham-links

Sham Link SLINK0 to addr 1.1.1.1 is up

Area 0.0.0.0 source address 6.6.6.6

Run as demand circuit

DoNotAge LSA allowed. Cost of using 1 State Point-To-Point,

Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

Hello due in 00:00:04

Adjacency state Full(Hello suppressed)

#On the PE, view the BGP VPNv4 route table and VPN route table again.

Take PE1 as an example:

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 90.1.0.0/16 [110/2] via 75.75.75.75, 00:11:32, gigabitethernet0

C 95.1.0.0/16 is directly connected, 03:22:25, gigabitethernet1

O 98.1.0.0/16 [110/4] via 95.1.1.2, 03:18:55, gigabitethernet1

C 1.1.1.1/32 is directly connected, 00:12:09, loopback1

O 5.5.5.5/32 [110/2] via 95.1.1.2, 03:21:34, gigabitethernet1

B 6.6.6.6/32 [200/0] via 75.75.75.75, 03:09:38, gigabitethernet0

O 8.8.8.8/32 [110/3] via 75.75.75.75, 00:11:32, gigabitethernet0

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 17, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[B]*> 1.1.1.1/32 0.0.0.0 0 32768 i

[O]*> 5.5.5.5/32 95.1.1.2 2 32768 ?

[B]*>i6.6.6.6/32 75.75.75.75 0 100 0 i

[B]*>i8.8.8.8/32 75.75.75.75 2 100 0 ?

[B]*>i90.1.0.0/16 75.75.75.75 1 100 0 ?

[O]*> 95.1.0.0/16 0.0.0.0 1 32768 ?

[B]* i98.1.0.0/16 75.75.75.75 4 100 0 ?

[O]*> 95.1.1.2 4 32768 ?

You can see that the route to CE2 in the BGP VPNv4 route table and VPN route table of PE1 passes the global MPLS network, but does not pass the CE1 backdoor link.

#View the MPLS forwarding table on the PE.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 767 34880

L global 75.75.75.75/32 / 16 gigabitethernet0 93.1.1.1 492 28552

B 1 6.6.6.6/32[V] / 5120 gigabitethernet0 75.75.75.75 49 4248

B 1 8.8.8.8/32[V] / 5120 gigabitethernet0 75.75.75.75 0 0

B 1 90.1.0.0/16[V] / 5120 gigabitethernet0 75.75.75.75 0 0

B 1 0.0.0.0/0 5120 / / / 58 58 4896

You can see that there is the route label information of VPN1 in the MPLS forwarding table of PE1.

l For the checking method of PE2, refer to PE1.

#On CE1, view the VPN route table and traceroute the loopback port of CE2.

CE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

O 90.1.0.0/16 [110/3] via 95.1.1.1, 00:00:02, gigabitethernet0

C 95.1.0.0/16 is directly connected, 04:22:46, gigabitethernet0

C 98.1.0.0/16 is directly connected, 05:05:23, gigabitethernet1

C 127.0.0.0/8 is directly connected, 241:57:31, lo0

C 5.5.5.5/32 is directly connected, 29:40:05, loopback0

O 8.8.8.8/32 [110/4] via 95.1.1.1, 00:00:02, gigabitethernet0

CE1#traceroute 8.8.8.8

Type escape sequence to abort.

Tracing the route to 8.8.8.8 , min ttl = 1, max ttl = 30 .

1 95.1.1.1 0 ms 0 ms 0 ms

2 93.1.1.1 [MPLS: Labels 16/5120 Exp 0] 0 ms 0 ms 0 ms

3 92.1.1.1 [MPLS: Labels 5120 Exp 0] 0 ms 0 ms 0 ms

4 8.8.8.8 16 ms 0 ms 0 ms

You can see that the path from CE1 to CE2 passes the global network.


5.3.7 Enterprise Intranet Accessing Internet

Network Requirements

l PE1, PE2 connect the CE of VPN1 respectively; CE1 and CE2 belong to one VPN.

l Internet gateway is the external route of the VPN, and all sites in the VPN are connected to Internet via the enterprise intranet.

l The VPN member forwards the data flow of the accessed Internet to the CE (CE1) of connecting Internet gateway by importing one default route of accessing Internet.

l Configure OSPF between PEs to make PEs communicate with each other; configure MP-IBGP to exchange the VPN route information.

Network Topology

Figure 5‑13 The access mode of the enterprise intranet

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 98.1.1.1/16 | P | Loopback0 | 11.11.11.11/32
 | Gi1 | 95.1.1.2/16 | PE2 | Gi0 | 92.1.1.1/16
 | Loopback0 | 5.5.5.5/32 |  | Gi1 | 90.1.1.1/16
PE1 | Gi0 | 93.1.1.2/16 |  | Loopback0 | 75.75.75.75/32
 | Gi1 | 95.1.1.1/16 | CE2 | Gi0 | 90.1.1.2/16
 | Loopback0 | 90.90.90.90/32 |  | Loopback0 | 8.8.8.8/32
P | Gi0 | 93.1.1.1/16 | GW | Gi0 | 98.1.1.2/16
 | Gi1 | 92.1.1.2/16 |  | Loopback0 | 1.1.1.1/32

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | Configure the global OSPF and advertise the global route.

#Configure the global OSPF on PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 90.90.90.90 0.0.0.0 area 0

PE1(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

PE1(config-ospf)#exit

#Configure the global OSPF on P.

P#configure terminal

P(config)#router ospf 100

P(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

P(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

P(config-ospf)#network 93.1.0.0 0.0.255.255 area 0

P(config-ospf)#exit

#Configure the global OSPF on PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 75.75.75.75 0.0.0.0 area 0

PE2(config-ospf)#network 92.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

#After the configuration is complete, view the global route table on the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 93.1.0.0/16 is directly connected, 00:34:54, gigabitethernet0

O 92.1.0.0/16 [110/2] via 93.1.1.1, 00:08:12, gigabitethernet0

C 90.90.90.90/32 is directly connected, 154:02:28, loopback0

O 11.11.11.11/32 [110/2] via 93.1.1.1, 00:06:12, gigabitethernet0

O 75.75.75.75/32 [110/3] via 93.1.1.1, 00:06:03, gigabitethernet0

You can see that there is the route information of the PE2 and P loopback ports in the global route table of PE1.

l For the checking method of P and PE2, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 90.90.90.90

PE1(config-ldp)#transport-address 90.90.90.90

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#mpls ip

PE1(config-if-gigabitethernet0)#mpls ldp

PE1(config-if-gigabitethernet0)#exit

#On P, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

P(config)#mpls ip

P(config)#mpls ldp

P(config-ldp)#router-id 11.11.11.11

P(config-ldp)#transport-address 11.11.11.11

P(config-ldp)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#mpls ip

P(config-if-gigabitethernet0)#mpls ldp

P(config-if-gigabitethernet0)#exit

P(config)#interface gigabitethernet1

P(config-if-gigabitethernet1)#mpls ip

P(config-if-gigabitethernet1)#mpls ldp

P(config-if-gigabitethernet1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 75.75.75.75

PE2(config-ldp)#transport-address 75.75.75.75

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

#After the configuration is complete, view the LDP session information on the device.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

11.11.11.11 Multicast Active OPERATIONAL 00:02:20

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

You can see that PE1 and P set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 44 2690

L global 75.75.75.75/32 / 16 gigabitethernet0 93.1.1.1 19 1230

You can see the label information to the loopback ports of P and PE2 on PE1.

l For the checking method of P and PE2, refer to PE1.

Step 4:

Configure the VPN instance and advertise the CE route to the PE via OSPF.

#On PE1, configure the VPN instance and OSPF in the VPN instance.

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#ip vrf forwarding 1

PE1(config-if-gigabitethernet1)#ip address 95.1.1.1 255.255.0.0

PE1(config-if-gigabitethernet1)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#network 95.1.0.0 0.0.255.255 area 0

PE1(config-ospf)#exit

#Configure OSPF on CE1.

CE1#configure terminal

CE1(config)#router ospf 100

CE1(config-ospf)#network 5.5.5.5 0.0.0.0 area 0

CE1(config-ospf)#network 95.1.0.0 0.0.255.255 area 0

CE1(config-ospf)#exit

#On PE2, configure the VPN instance and OSPF in the VPN instance.

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 100:1

PE2(config-vrf)#route-target export 100:1

PE2(config-vrf)#route-target import 100:1

PE2(config-vrf)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#ip vrf forwarding 1

PE2(config-if-gigabitethernet1)#ip address 90.1.1.1 255.255.0.0

PE2(config)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#network 90.1.0.0 0.0.255.255 area 0

PE2(config-ospf)#exit

#Configure OSPF on CE2.

CE2#configure terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 8.8.8.8 0.0.0.0 area 0

CE2(config-ospf)#network 90.1.0.0 0.0.255.255 area 0

CE2(config-ospf)#exit

#After the configuration is complete, view the VPN route table on the PE.

Take PE1 as an example:

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 95.1.0.0/16 is directly connected, 00:11:45, gigabitethernet1

O 5.5.5.5/32 [110/2] via 95.1.1.2, 00:11:11, gigabitethernet1

You can see that there is the route information to CE1 loopback port in the VPN route table of PE1.

l For the checking method of PE2, refer to PE1.

Step 5:

Configure MP-IBGP, and use the loopback interface as the peer address; re-distribute the route with the IGP protocol in the VPN instance.

#On PE1, configure MP-IBGP, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE1(config)#router bgp 100

PE1(config-bgp)#neighbor 75.75.75.75 remote-as 100

PE1(config-bgp)#neighbor 75.75.75.75 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 75.75.75.75 activate

PE1(config-bgp-af)#neighbor 75.75.75.75 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute ospf 200

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#redistribute bgp 100

PE1(config-ospf)#exit

#On PE2, configure MP-IBGP, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE2(config)#router bgp 100

PE2(config-bgp)#neighbor 90.90.90.90 remote-as 100

PE2(config-bgp)#neighbor 90.90.90.90 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 90.90.90.90 activate

PE2(config-bgp-af)#neighbor 90.90.90.90 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 200

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

#After the configuration is complete, view the BGP neighbor information.

Take PE1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 90.90.90.90, local AS number 100

BGP table version is 6

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

75.75.75.75 4 100 40 41 5 0 0 00:32:01 4

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and PE2 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table and VPN1 route table on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 39, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[O]*> 5.5.5.5/32 95.1.1.2 2 32768 ?

[B]*>i8.8.8.8/32 75.75.75.75 2 100 0 ?

[B]*>i90.1.0.0/16 75.75.75.75 1 100 0 ?

[O]*> 95.1.0.0/16 0.0.0.0 1 32768 ?

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

B 90.1.0.0/16 [200/1] via 75.75.75.75, 00:20:04, gigabitethernet0

C 95.1.0.0/16 is directly connected, 00:51:28, gigabitethernet1

O 5.5.5.5/32 [110/2] via 95.1.1.2, 00:50:39, gigabitethernet1

B 8.8.8.8/32 [200/2] via 75.75.75.75, 00:20:04, gigabitethernet0

You can see that there is the route information to CE2 in the BGP VPNv4 route table and VPN1 route table of CE1..

#View the MPLS forwarding table on the PE.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 11.11.11.11/32 / 3 gigabitethernet0 93.1.1.1 77 3520

L global 75.75.75.75/32 / 16 gigabitethernet0 93.1.1.1 71 4900

B 1 8.8.8.8/32[V] / 5120 gigabitethernet0 75.75.75.75 0 0

B 1 90.1.0.0/16[V] / 5120 gigabitethernet0 75.75.75.75 15 1200

B 1 0.0.0.0/0 5120 / / / 42 42 3048

You can see that there is the route label information of VPN1 in the MPLS forwarding table of PE1.

l For the checking method of PE2, refer to PE1.

Step 6:

Configure the static route to make the VPN member access Internet.

#On CE1, configure the default route to Internet.

CE1(config)#ip route 0.0.0.0 0.0.0.0 98.1.1.2

#On PE1, configure the default route to Internet and re-distribute the default route to BGP, so as to advertise the route to Internet to the peer PE and CE.

PE1(config)#ip route vrf 1 0.0.0.0 0.0.0.0 95.1.1.2

PE1(config)#router bgp 100

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute static

PE1(config-bgp-af)#default-information originate

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

#In OSPF of PE2, enable the function of importing the default route, receiving the re-distributed route.

PE2(config)#router ospf 200

PE2(config-ospf)#default-information originate

PE2(config-ospf)#exit

#On the Internet gateway, configure the default route.

GW#configure terminal

GW(config)#ip route 0.0.0.0 0.0.0.0 98.1.1.1

l To configure the BGP to re-distribute the default route, use the default-information originate command.

Step7:

Check the result.

#After the configuration is complete, view the BGP VPNv4 route table and VPN1 route table on the device.

Take PE1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 39, local router ID is 90.90.90.90

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[S]*> 0.0.0.0/0 95.1.1.2 0 32768 ?

[B]*>i8.8.8.8/32 75.75.75.75 2 100 0 ?

[O]*> 5.5.5.5/32 95.1.1.2 2 32768 ?

[B]*>i90.1.0.0/16 75.75.75.75 1 100 0 ?

[O]*> 95.1.0.0/16 0.0.0.0 1 32768 ?

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 95.1.1.2 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 95.1.1.2, 01:12:43, gigabitethernet1

B 90.1.0.0/16 [200/1] via 75.75.75.75, 00:41:19, gigabitethernet0

C 95.1.0.0/16 is directly connected, 01:12:43, gigabitethernet1

O 5.5.5.5/32 [110/2] via 95.1.1.2, 01:11:55, gigabitethernet1

B 8.8.8.8/32 [200/2] via 75.75.75.75, 00:41:19, gigabitethernet0

You can see that there is one default route to CE1 on the BGP VPNv4 route table and VPN route table of PE1.

#Check the reachability of the device to Internet.

PE1#ping vrf 1 1.1.1.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 98.1.1.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

PE2#ping vrf 1 1.1.1.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 98.1.1.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

CE2#ping 1.1.1.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 98.1.1.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/3/16 ms.

You can see that PC1, PE2, CE2 can ping the loopback ports of the Internet gateway.


5.3.8 Service Provider Network Accessing Internet

Network Requirements

l PE1, PE2 connect the CE of VPN1 respectively; CE1 and CE2 belong to one VPN.

l Internet gateway is the external route of the VPN, and all sites in the VPN are connected to Internet via the service provider network.

l The VPN member forwards the data flow of the accessed Internet to the PE (PE1) of connecting Internet gateway by importing one default route of accessing Internet.

l Configure OSPF between PEs to make PEs communicate with each other; configure MP-IBGP to exchange the VPN route information.

Network Topology

Figure 5‑14 The access mode of the service provider network

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 10.1.1.1/24 | P | Loopback0 | 22.22.22.22/32
 | Loopback0 | 1.1.1.1/32 | PE2 | Gi0 | 10.1.3.2/24
PE1 | Gi0 | 10.1.1.2/24 |  | Gi1 | 10.1.4.1/24
 | Gi1 | 10.1.2.1/24 |  | Loopback0 | 33.33.33.33/32
 | Gi2 | 10.1.5.1/24 | CE2 | Gi0 | 10.1.4.2/24
 | Loopback0 | 11.11.11.11/32 |  | Loopback0 | 2.2.2.2/32
P | Gi0 | 10.1.2.2/24 | GW | Gi0 | 10.1.5.2/24
 | Gi1 | 10.1.3.1/24 |  | Loopback0 | 3.3.3.3/32

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | Configure the global OSPF and advertise the global route.

#Configure the global OSPF on PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

PE1(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

PE1(config-ospf)#exit

#Configure the global OSPF on P.

P#configure terminal

P(config)#router ospf 100

P(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

P(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

P(config-ospf)#network 22.22.22.22 0.0.0.0 area 0

P(config-ospf)#exit

#Configure the global OSPF on PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

PE2(config-ospf)#network 33.33.33.33 0.0.0.0 area 0

PE2(config-ospf)#exit

#After the configuration is complete, view the global route table on the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.2.0/24 is directly connected, 65:47:37, gigabitethernet1

O 10.1.3.0/24 [110/2] via 10.1.2.2, 01:18:39, gigabitethernet1

C 10.1.5.0/24 is directly connected, 00:22:25, gigabitethernet2

C 127.0.0.0/8 is directly connected, 65:47:57, lo0

C 11.11.11.11/32 is directly connected, 65:47:37, loopback0

O 22.22.22.22/32 [110/2] via 10.1.2.2, 65:11:53, gigabitethernet1

O 33.33.33.33/32 [110/3] via 10.1.2.2, 01:18:34, gigabitethernet1

You can see that there is the route information of the PE2 and P loopback ports in the global route table of PE1.

l For the checking method of P and PE2, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 11.11.11.11

PE1(config-ldp)#transport-address 11.11.11.11

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet1

PE1(config-if-gigabitethernet1)#mpls ip

PE1(config-if-gigabitethernet1)#mpls ldp

PE1(config-if-gigabitethernet1)#exit

#On P, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

P(config)#mpls ip

P(config)#mpls ldp

P(config-ldp)#router-id 22.22.22.22

P(config-ldp)#transport-address 22.22.22.22

P(config-ldp)#exit

P(config)#interface gigabitethernet0

P(config-if-gigabitethernet0)#mpls ip

P(config-if-gigabitethernet0)#mpls ldp

P(config-if-gigabitethernet0)#interface gigabitethernet1

P(config-if-gigabitethernet1)#mpls ip

P(config-if-gigabitethernet1)#mpls ldp

P(config-if-gigabitethernet1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 33.33.33.33

PE2(config-ldp)#transport-address 33.33.33.33

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#mpls ip

PE2(config-if-gigabitethernet0)#mpls ldp

PE2(config-if-gigabitethernet0)#exit

#After the configuration is complete, view the LDP session information on the device.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

22.22.22.22 Multicast Passive OPERATIONAL 00:02:34

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

You can see that PE1 and P set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 22.22.22.22/32 / 3 gigabitethernet1 10.1.2.2 17078 841066

L global 33.33.33.33/32 / 17 gigabitethernet1 10.1.2.2 658 36003

You can see that there is the label information to the loopback ports of P and PE2 on PE1.

l For the checking method of P and PE2, refer to PE1.

Step 4:

Configure the VPN instance and advertise the CE route to the PE via OSPF.

#On PE1, configure the VPN instance and OSPF in the VPN instance.

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#ip vrf forwarding 1

PE1(config-if-gigabitethernet0)#ip address 10.1.1.2 255.255.255.0

PE1(config-if-gigabitethernet0)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#network 10.1.1.0 0.255.255.255 area 0

PE1(config-ospf)#exit

#Configure OSPF on CE1.

CE1#configure terminal

CE1(config)#router ospf 100

CE1(config-ospf)#network 1.1.1.1 0.0.0.0 area 0

CE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

CE1(config-ospf)#exit

#On PE2, configure the VPN instance and OSPF in the VPN instance.

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 100:1

PE2(config-vrf)#route-target export 100:1

PE2(config-vrf)#route-target import 100:1

PE2(config-vrf)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#ip vrf forwarding 1

PE2(config-if-gigabitethernet1)#ip address 10.1.4.1 255.255.255.0

PE2(config)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

PE2(config-ospf)#exit

#Configure OSPF on CE2.

CE2#configure terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 2.2.2.2 0.0.0.0 area 0

CE2(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

CE2(config-ospf)#exit

#After the configuration is complete, view the VPN route table on the PE.

Take PE1 as an example:

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:00:23, gigabitethernet0

O 1.1.1.1/32 [110/2] via 10.1.1.1, 00:00:12, gigabitethernet0

You can see that there is the route information to CE1 loopback port in the VPN route table of PE1.

l For the checking method of PE2, refer to PE1.

Step 5:

Configure MP-IBGP, and use the loopback interface as the peer address; re-distribute the route with the IGP protocol in the VPN instance.

#On PE1, configure MP-IBGP, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE1(config)#router bgp 100

PE1(config-bgp)#neighbor 33.33.33.33 remote-as 100

PE1(config-bgp)#neighbor 33.33.33.33 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 33.33.33.33 activate

PE1(config-bgp-af)#neighbor 33.33.33.33 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute ospf 200

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#redistribute bgp 100

PE1(config-ospf)#exit

#On PE2, configure MP-IBGP, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE2(config)#router bgp 100

PE2(config-bgp)#neighbor 11.11.11.11 remote-as 100

PE2(config-bgp)#neighbor 11.11.11.11 update-source loopback0

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 11.11.11.11 activate

PE2(config-bgp-af)#neighbor 11.11.11.11 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 200

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

#After the configuration is complete, view the BGP neighbor information.

Take PE1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 11.11.11.11, local AS number 100

BGP table version is 3

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

33.33.33.33 4 100 8 9 3 0 0 00:04:26 2

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and PE2 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table and VPN1 route table on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 3, local router ID is 11.11.11.11

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[O]*> 1.1.1.1/32 10.1.1.1 2 32768 ?

[B]*>i2.2.2.2/32 33.33.33.33 2 100 0 ?

[O]*> 10.1.1.0/24 0.0.0.0 1 32768 ?

[B]*>i10.1.4.0/24 33.33.33.33 1 100 0 ?

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 00:20:42, gigabitethernet0

B 10.1.4.0/24 [200/1] via 33.33.33.33, 00:09:33, gigabitethernet1

O 1.1.1.1/32 [110/2] via 10.1.1.1, 00:20:31, gigabitethernet0

B 2.2.2.2/32 [200/2] via 33.33.33.33, 00:08:17, gigabitethernet1

You can see that there is the route information to CE2 in the BGP VPNv4 route table and VPN1 route table of PE1..

#View the MPLS forwarding table on the PE.

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 22.22.22.22/32 / 3 gigabitethernet1 10.1.2.2 114 5586

L global 33.33.33.33/32 / 17 gigabitethernet1 10.1.2.2 59 3848

B 1 2.2.2.2/32[V] / 16 gigabitethernet1 33.33.33.33 5 400

B 1 10.1.4.0/24[V] / 16 gigabitethernet1 33.33.33.33 11 880

B 1 0.0.0.0/0 16 / / / 0 0 0

You can see that there is the route label information of VPN1 in the MPLS forwarding table of the PE.

l For checking method of PE2, refer to PE1.

Step 6:

On the PE and CE, configure the static route to make the VPN member access Internet.

#On CE1, configure the default route to Internet.

CE1(config)#ip route 0.0.0.0 0.0.0.0 10.1.1.2

#Configure the default route to Internet and the route to CE1 globally on PE1; in the VPN, configure the cross-VPN default route to Internet, and cancel distributing and receiving the label for the 32-bit mask in the MPLS LDP process.

PE1(config)#ip route 0.0.0.0 0.0.0.0 10.1.5.2

PE1(config)#ip route vrf global 1.1.1.1 255.255.255.255 10.1.1.1 vrf 1

PE1(config)#ip route vrf global 10.1.1.0 255.255.255.0 10.1.1.1 vrf 1

PE1(config)#ip route vrf 1 0.0.0.0 0.0.0.0 10.1.5.2 vrf global

PE1(config)#router bgp 100

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute connected

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#mpls ldp

PE1(config-ldp)#no advertise-labels for 32bit-mask-fec-only

PE1(config-ldp)#no accept-labels for 32bit-mask-fec-only

PE1(config-ldp)#exit

#Configure the default route to Internet and the route to CE2 globally on PE2; in the VPN, configure the cross-VPN default route to Internet, the next hop is the BGP neighbor address of PE2, re-distribute the global static route in the global OSPF, re-distribute the route to the private network to PE1, and cancel distributing and receiving the label for the 32-bit mask in the MPLS LDP process.

PE2(config)#ip route vrf global 2.2.2.2 255.255.255.255 10.1.4.2 vrf 1

PE2(config)#ip route vrf global 10.1.4.0 255.255.255.0 10.1.4.2 vrf 1

PE2(config)#ip route vrf 1 0.0.0.0 0.0.0.0 11.11.11.11 vrf global

PE2(config)#router ospf 100

PE2(config-ospf)#redistribute static

PE2(config-ospf)#exit

PE2(config)#mpls ldp

PE2(config-ldp)#no advertise-labels for 32bit-mask-fec-only

PE2(config-ldp)#no accept-labels for 32bit-mask-fec-only

PE2(config-ldp)#exit

#On CE2, configure the default route to Internet.

CE2(config)#ip route 0.0.0.0 0.0.0.0 10.1.4.1

#On the Internet gateway, configure the default routte.

GW#configure terminal

GW(config)#ip route 0.0.0.0 0.0.0.0 10.1.5.1

Step7:

Check the result.

#After the configuration is complete, view the global route table on the PE.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 10.1.5.2 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 10.1.5.2, 00:11:42, gigabitethernet2

S 10.1.1.0/24 [1/10] via 10.1.1.1, 95:27:49, gigabitethernet0

C 10.1.2.0/24 is directly connected, 96:57:55, gigabitethernet1

O 10.1.3.0/24 [110/2] via 10.1.2.2, 72:44:34, gigabitethernet1

OE 10.1.4.0/24 [150/20] via 10.1.2.2, 00:13:22, gigabitethernet1

C 10.1.5.0/24 is directly connected, 96:57:41, gigabitethernet2

C 127.0.0.0/8 is directly connected, 458:41:50, lo0

S 1.1.1.1/32 [1/10] via 10.1.1.1, 95:27:42, gigabitethernet0

OE 2.2.2.2/32 [150/20] via 10.1.2.2, 00:13:22, gigabitethernet1

C 11.11.11.11/32 is directly connected, 96:47:46, loopback0

O 22.22.22.22/32 [110/2] via 10.1.2.2, 72:44:34, gigabitethernet1

0 33.33.33.33/32 [110/3] via 10.1.2.2, 00:14:28, gigabitethernet1

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 10.1.5.2 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 10.1.5.2, 95:27:24, gigabitethernet2

C 10.1.1.0/24 is directly connected, 95:57:28, gigabitethernet0

B 10.1.4.0/24 [200/0] via 33.33.33.33, 00:14:12, gigabitethernet1

O 1.1.1.1/32 [110/2] via 10.1.1.1, 95:57:17, gigabitethernet/0

B 2.2.2.2/32 [200/2] via 33.33.33.33, 00:13:44, gigabitethernet1

You can see that there is one default route to Internet in the global route table and VPN route table of PE1.

l For the checking method of PE2, refer to PE1.

#On PE2, view the MPLS forwarding table.

PE2#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 10.1.2.0/24 / 3 gigabitethernet0 10.1.3.1 0 0

L global 11.11.11.11/32 / 18 gigabitethernet0 10.1.3.1 112 6134

L global 22.22.22.22/32 / 3 gigabitethernet0 10.1.3.1 92 4508

M 1 0.0.0.0/0[V] / 18 gigabitethernet0 11.11.11.11 333 328732

B 1 1.1.1.1/32[V] / 16 gigabitethernet0 11.11.11.11 0 0

B 1 10.1.1.0/24[V] / 16 gigabitethernet0 11.11.11.11 0 0

B 1 0.0.0.0/0 16 / / / 0 0 0

You can see that PE2 generates one VPN1 MPLS label mapping.

#View the reachability of the device to Internet.

CE1#ping 3.3.3.3

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 3.3.3.3 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

CE2#ping 3.3.3.3

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 3.3.3.3 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

You can see that CE1 and C2 both can ping Internet route.


5.3.9 Configure Share VPN

Network Requirements

l The whole MPLS network includes three VPNs, VPN1, VPN2, and VPN-Share.

l CE1 belongs to the user network of VPN1, CE2 belongs to the user network of VPN2, and the Import Target attribute of any PE connecting the non-share VPN is not the same as the Export Target attribute of the other PE connecting the non-share VPN so that the non-share VPNs cannot communicate with each other.

l CE3 belongs to the user network of the share VPN, the share VPN can accept the routes of all non-share VPN sites, and the routes released by the share-VPN sites also can be received by all non-share VPN sites.

l The share VPN site can communicate with any non-share VPN site; the non-share VPN sites cannot communicate with each other.

Network Topology

Figure 5‑15 Configure the share VPN

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 10.1.1.1/24 | PE2 | Gi1 | 10.1.4.1/24
 | Loopback0 | 1.1.1.1/32 |  | Loopback0 | 22.22.22.22/32
PE1 | Gi0 | 10.1.1.2/24 | PE3 | Gi0 | 10.1.2.2/24
 | Gi1 | 10.1.2.1/24 |  | Gi1 | 10.1.4.2/24
 | Loopback0 | 11.11.11.11/32 |  | Gi2 | 10.1.3.1/24
CE2 | Gi0 | 10.1.5.1/24 |  | Loopback0 | 33.33.33.33/32
 | Loopback0 | 2.2.2.2/32 | CE3 | Gi0 | 10.1.3.2/24
PE2 | Gi0 | 10.1.5.2/24 |  | Loopback0 | 3.3.3.3/32

Configuration Steps

Step 1: | Configure the IP address of the interface (omitted).
Step 2: | Configure the global OSPF and advertise the global route.

#Configure the global OSPF on PE1.

PE1#configure terminal

PE1(config)#router ospf 100

PE1(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

PE1(config-ospf)#network 11.11.11.11 0.0.0.0 area 0

PE1(config-ospf)#exit

#Configure the global OSPF on PE2.

PE2#configure terminal

PE2(config)#router ospf 100

PE2(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

PE2(config-ospf)#network 22.22.22.22 0.0.0.0 area 0

PE2(config-ospf)#exit

#Configure the global OSPF on PE3.

PE3#configure terminal

PE3(config)#router ospf 100

PE3(config-ospf)#network 10.1.2.0 0.0.0.255 area 0

PE3(config-ospf)#network 10.1.4.0 0.0.0.255 area 0

PE3(config-ospf)#network 33.33.33.33 0.0.0.0 area 0

PE3(config-ospf)#exit

#After the configuration is complete, view the global route table on the device.

Take PE1 as an example:

PE1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.2.0/24 is directly connected, 04:39:17, gigabitethernet1

O 10.1.4.0/24 [110/2] via 10.1.2.2, 03:46:04, gigabitethernet1

C 127.0.0.0/8 is directly connected, 1579:41:11, lo0

C 11.11.11.11/32 is directly connected, 04:39:05, loopback0

O 22.22.22.22/32 [110/3] via 10.1.2.2, 03:46:04, gigabitethernet1

O 33.33.33.33/32 [110/2] via 10.1.2.2, 03:45:25, gigabitethernet1

You can see that there is the route information og PE2 and PE3 loopback ports in the global route table of PE1.

l For the checking method of PE2, PE3, refer to PE1.

Step 3:

Enable MPLS IP and MPLS LDP.

#On PE1, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE1(config)#mpls ip

PE1(config)#mpls ldp

PE1(config-ldp)#router-id 11.11.11.11

PE1(config-ldp)#transport-address 11.11.11.11

PE1(config-ldp)#exit

PE1(config)#interface gigabitethernet0/2/1

PE1(config-if-gigabitethernet0/2/1)#mpls ip

PE1(config-if-gigabitethernet0/2/1)#mpls ldp

PE1(config-if-gigabitethernet0/2/1)#exit

#On PE2, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE2(config)#mpls ip

PE2(config)#mpls ldp

PE2(config-ldp)#router-id 22.22.22.22

PE2(config-ldp)#transport-address 22.22.22.22

PE2(config-ldp)#exit

PE2(config)#interface gigabitethernet1

PE2(config-if-gigabitethernet1)#mpls ip

PE2(config-if-gigabitethernet1)#mpls ldp

PE2(config-if-gigabitethernet1)#exit

#On PE3, enable the global MPLS IP and MPLS LDP. Meanwhile, enable MPLS IP and MPLS LDP on the interface.

PE3(config)#mpls ip

PE3(config)#mpls ldp

PE3(config-ldp)#router-id 33.33.33.33

PE3(config-ldp)#transport-address 33.33.33.33

PE3(config-ldp)#exit

PE3(config)#interface gigabitethernet0

PE3(config-if-gigabitethernet0)#mpls ip

PE3(config-if-gigabitethernet0)#mpls ldp

PE3(config-if-gigabitethernet0)#exit

PE3(config)#interface gigabitethernet1

PE3(config-if-gigabitethernet1)#mpls ip

PE3(config-if-gigabitethernet1)#mpls ldp

PE3(config-if-gigabitethernet1)#exit

#After the configuration is complete, view the LDP session information on the device.

Take PE1 as an example:

PE1#show mpls ldp session

Peer IP Address Peer Type My Role State DeadTime

33.33.33.33 Multicast Passive OPERATIONAL 00:02:48

Statistics for ldp sessions:

Multicast sessions: 1

Targeted sessions: 0

You can see that PE1 and PE3 set up the LDP session successfully.

#View the MPLS forwarding table on the device.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 22.22.22.22/32 / 17 gigabitethernet1 10.1.2.2 0 0

L global 33.33.33.33/32 / 3 gigabitethernet1 10.1.2.2 1016 50183

You can see that there is the label information of PE2, PE3 loopback ports on PE1.

l For the checking method of PE2 and PE3, refer to PE1.

Step 4:

Configure the VPN instance and advertise the CE route to the PE via OSPF.

#On PE1, configure the VPN instance and OSPF in the VPN instance.

PE1(config)#ip vrf 1

PE1(config-vrf)#rd 100:1

PE1(config-vrf)#route-target export 100:1

PE1(config-vrf)#route-target import 100:1

PE1(config-vrf)#route-target export 1100:1

PE1(config-vrf)#route-target import 1000:1

PE1(config-vrf)#exit

PE1(config)#interface gigabitethernet0

PE1(config-if-gigabitethernet0)#ip vrf forwarding 1

PE1(config-if-gigabitethernet0)#ip address 10.1.1.2 255.255.255.0

PE1(config-if-gigabitethernet0)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

PE1(config-ospf)#exit

l import-target and export-target in the Rt attribute of PE1 is 100:1, which is used to import and export the VPN internal route. export-target is 1100:1, which is used to export the VPN internal route to the share VPN; import-target is 1000:1, which is used to import the route from the share-VPN.

#Configure OSPF on CE1.

CE1#configure terminal

CE1(config)#router ospf 100

CE1(config-ospf)#network 1.1.1.1 0.0.0.0 area 0

CE1(config-ospf)#network 10.1.1.0 0.0.0.255 area 0

CE1(config-ospf)#exit

#On PE2, configure the VPN instance and OSPF in the VPN instance.

PE2(config)#ip vrf 1

PE2(config-vrf)#rd 200:1

PE2(config-vrf)#route-target export 200:1

PE2(config-vrf)#route-target import 200:1

PE2(config-vrf)#route-target export 1100:1

PE2(config-vrf)#route-target import 1000:1

PE2(config-vrf)#exit

PE2(config)#interface gigabitethernet0

PE2(config-if-gigabitethernet0)#ip vrf forwarding 1

PE2(config-if-gigabitethernet0)#ip address 10.1.5.2 255.255.255.0

PE2(config)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#network 10.1.5.0 0.0.0.255 area 0

PE2(config-ospf)#exit

l import-target and export-target in the Rt attribute of PE2 is 100:1, which is used to import and export the VPN internal route. export-target is 1100:1, which is used to export the VPN internal route to the share VPN; import-target is 1000:1, which is used to import the route from the share-VPN.

#Configure OSPF on CE2.

CE2#configure terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 2.2.2.2 0.0.0.0 area 0

CE2(config-ospf)#network 10.1.5.0 0.0.0.255 area 0

CE2(config-ospf)#exit

#On PE3, configure the VPN instance and OSPF in the VPN instance.

PE3(config)#ip vrf vpn-share

PE3(config-vrf)#rd 300:1

PE3(config-vrf)#route-target export 1000:1

PE3(config-vrf)#route-target import 1100:1

PE3(config-vrf)#exit

PE3(config)#interface gigabitethernet2

PE3(config-if-gigabitethernet2)#ip vrf forwarding vpn-share

PE3(config-if-gigabitethernet2)#ip address 10.1.3.1 255.255.255.0

PE3(config)#exit

PE3(config)#router ospf 200 vrf vpn-share

PE3(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

PE3(config-ospf)#exit

l export-target in the Rt attribute of PE3 is 1000:1, which is used to export the local VPN route to the other VPN; import-target is 1100:1, which is used to import the route from the other VPN.

#On CE3, configure OSPF.

CE2#configure terminal

CE2(config)#router ospf 100

CE2(config-ospf)#network 3.3.3.3 0.0.0.0 area 0

CE2(config-ospf)#network 10.1.3.0 0.0.0.255 area 0

CE2(config-ospf)#exit

#After the configuration is complete, view the VPN route table on the PE.

Take PE1 as an example:

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 04:19:47, gigabitethernet0

O 1.1.1.1/32 [110/2] via 10.1.1.1, 04:09:32, gigabitethernet0

You can see that there is the route information to CE1 loopback port in the VPN route table of PE1.

l For the checking method of PE2 and PE3, refer to PE1.

Step 5:

Configure MP-IBGP, and use the loopback interface as the peer address; re-distribute the route with the IGP protocol in the VPN instance.

#On PE1, configure MP-IBGP, set up the BGP neighbor with PE3, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE1(config)#router bgp 100

PE1(config-bgp)#neighbor 33.33.33.33 remote-as 100

PE1(config-bgp)#neighbor 33.33.33.33 update-source loopback0

PE1(config-bgp)#address-family vpnv4

PE1(config-bgp-af)#neighbor 33.33.33.33 activate

PE1(config-bgp-af)#neighbor 33.33.33.33 send-community extended

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#address-family ipv4 vrf 1

PE1(config-bgp-af)#redistribute ospf 200

PE1(config-bgp-af)#exit-address-family

PE1(config-bgp)#exit

PE1(config)#router ospf 200 vrf 1

PE1(config-ospf)#redistribute bgp 100

PE1(config-ospf)#exit

#On PE2, configure MP-IBGP, set up the BGP neighbor with PE3, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE2(config)#router bgp 100

PE2(config-bgp)#neighbor 33.33.33.33 remote-as 100

PE2(config-bgp)#address-family vpnv4

PE2(config-bgp-af)#neighbor 33.33.33.33 activate

PE2(config-bgp-af)#neighbor 33.33.33.33 send-community extended

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#address-family ipv4 vrf 1

PE2(config-bgp-af)#redistribute ospf 200

PE2(config-bgp-af)#exit-address-family

PE2(config-bgp)#exit

PE2(config)#router ospf 200 vrf 1

PE2(config-ospf)#redistribute bgp 100

PE2(config-ospf)#exit

#On PE3, configure MP-IBGP, set up the BGP neighbor with PE1, PE2, and enable the VPNv4 address family; re-distribute the route with the IGP protocol in the VPN instance.

PE3(config)#router bgp 100

PE3(config-bgp)#neighbor 11.11.11.11 remote-as 100

PE3(config-bgp)#neighbor 11.11.11.11 update-source loopback0

PE3(config-bgp)#neighbor 22.22.22.22 remote-as 100

PE3(config-bgp)#neighbor 22.22.22.22 update-source loopback0

PE3(config-bgp)#address-family vpnv4

PE3(config-bgp-af)#neighbor 11.11.11.11 activate

PE3(config-bgp-af)#neighbor 11.11.11.11 send-community extended

PE3(config-bgp-af)#neighbor 22.22.22.22 activate

PE3(config-bgp-af)#neighbor 22.22.22.22 send-community extended

PE3(config-bgp-af)#exit-address-family

PE3(config-bgp)#address-family ipv4 vrf vpn-share

PE3(config-bgp-af)#redistribute ospf 200

PE3(config-bgp-af)#exit-address-family

PE3(config-bgp)#exit

PE3(config)#router ospf 200 vrf vpn-share

PE3(config-ospf)#redistribute bgp 100

PE3(config-ospf)#exit

Step 6:

Check the result.

#On the PE, view the BGP neighbor information.

Take PE1 as an example:

PE1#show ip bgp vpnv4 all summary

BGP router identifier 11.11.11.11, local AS number 100

BGP table version is 2

1 BGP AS-PATH entries

0 BGP community entries

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

33.33.33.33 4 100 305 302 2 0 0 04:16:40 2

Total number of neighbors 1

The content of the State/PfxRcd list is displayed as number (the number of the route prefixes received from the neighbor), and you can see that PE1 and PE3 set up the BGP neighbor successfully.

#View the BGP VPNv4 route table and VPN route table on the PE.

Take PE1 as an example:

PE1#show ip bgp vpnv4 vrf 1

BGP table version is 2, local router ID is 11.11.11.11

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 100:1 (Default for VRF 1)

[O]*> 1.1.1.1/32 10.1.1.1 2 32768 ?

[B]*>i3.3.3.3/32 33.33.33.33 2 100 0 ?

[O]*> 10.1.1.0/24 0.0.0.0 1 32768 ?

[B]*>i10.1.3.0/24 33.33.33.33 1 100 0 ?

PE1#show ip route vrf 1

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.1.1.0/24 is directly connected, 04:58:53, gigabitethernet0

B 10.1.3.0/24 [200/1] via 33.33.33.33, 04:46:00, gigabitethernet1

O 1.1.1.1/32 [110/2] via 10.1.1.1, 04:48:39, gigabitethernet0

B 3.3.3.3/32 [200/2] via 33.33.33.33, 04:46:00, gigabitethernet1

You can see that there is the route information to CE3 in the BGP VPNv4 route table and VPN1 route table of PE1.

#View the MPLS forwarding table on the PE.

Take PE1 as an example:

PE1#show mpls forwarding-table

Codes: L - LDP, B - MP-BGP, R - RSVP, M - Mapped-Route U - UNSPEC S - SYNC Flag

Pro Ident FEC Inlabel Outlabel Outgoing Next hop RxPkts TxPkts TxBytes Flag

L global 22.22.22.22/32 / 17 gigabitethernet1 10.1.2.2 0 0

L global 33.33.33.33/32 / 3 gigabitethernet1 10.1.2.2 1249 61847

B 1 3.3.3.3/32[V] / 5120 gigabitethernet1 33.33.33.33 5 400

B 1 10.1.3.0/24[V] / 5120 gigabitethernet1 33.33.33.33 5 400

B 1 0.0.0.0/0 5120 / / / 15 15 1140

You can see that there is the route label information of VPN1 in the MPLS forwarding table of PE1.

l For the checking method of PE2 and PE3, refer to PE1.

#On CE3, ping the loopback ports of CE1 and CE2.

CE3#ping 1.1.1.1

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 1.1.1.1 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/3/16 ms.

CE3#ping 2.2.2.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 2.2.2.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

You can see that CE3 can ping the loopback ports of CE1 and CE2.

#On CE1, ping the loopback ports of CE2.

CE1#ping 2.2.2.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 2.2.2.2 , timeout is 2 seconds:

.....

Success rate is 0% (0/5).

You can see that CE1 cannot ping the loopback port of CE2.


6 MPLS OAM


6.1 Overview

The MPLS OAM function is used to detect and maintain the fault in the MPLS network. MPLS LSP Ping/Traceroute are two common methods, and can detect the end-to-end LSP connectivity and the consistency of the control plane and data plane.


6.2 MPLS OAM Function Configuration

Table 6‑1 MPLS OAM function configuration list

Configuration Task
Configure MPLS OAM function | Enable the MPLS OAM function
Detect LSP | MPLS LSP Ping function
 | MPLS LSP Traceroute function
 | Interactive MPLS LSP Ping function
 | Interactive MPLS LSP Traceroute function


6.2.1 Configure MPLS OAM Functions

Configuration Condition

Before configuring the MPLS OAM function, first complete the following task:

l Configure the MPLS basic functions, ensuring that the MPLS packet can be received and sent normally.

Enable MPLS OAM Function

Table 6‑2 Enable the MPLS OAM function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the MPLS OAM function | mpls oam | Mandatory By default, do not enable the MPLS OAM function.


6.2.2 Detect LSP

Configuration Condition

To detect the validity of the detection result, complete the following task before detecting the LSP:

l When using MPLS LSP Ping detection, it is necessary to enable the MPLS OAM function on the Ingress node and Egress node of LSP.

l When using MPLS LSP Traceroute detection, it is necessary to enable the MPLS OAM function on all nodes of the LSP path.

MPLS LSP Ping Function

MPLS LSP Ping detects the LSP connectivity by receiving and sending the echo request and echo reply packet. The echo request packet sent by the Ingress node carries the label to the specified FEC. The detected LSP sends the packet to the Egress node, and the Egress node processes and returns the echo reply packet. If the the echo reply packet received by the Ingress node does not have error information, it indicates that the detected LSP is reachable. If not receiving the echo reply packet or the received echo reply packet carries the error TLV, it indicates that the detected LSP is unreachable.

Table 6‑3 MPLS LSP Ping function

Step | Command | Description
Use the ping command to detect the LSP connectivity | ping mpls [ { ipv4 prefix-address prefix-mask-length [ destination address-start address-end address-increment ] | vrf vrf-name ipv4 prefix-address prefix-mask-length [ destination address-start address-end address-increment ] | traffic-eng tunnel tunnel-unit } [ ttl time-to-live / source source-address / repeat count / timeout seconds / size packet-size / sweep minimum-size maximum-size size-increment / pad pattern / reply-pad-tlv / reply-mode { ipv4 | router-alert } / interval msec / exp exp-bits / verbose ] ] | Mandatory

MPLS LSP Traceroute Function

MPLS LSP Traceroute is used to detect the reachability of each hop and the label consistency on the LSP path. The Ingress node sends the echo request packet by adding the TTL, and receives the echo reply packet returned by each hop on the LSP path, so as to discover the information of each hop on the LSP path until reaching Egress.

Table 6‑4 MPLS LSP Traceroute function

Step | Command | Description
Detect the reachability of each hop and the label consistency on the LSP path | traceroute mpls [ { ipv4 prefix-address prefix-mask-length [ destination address-start address-end address-increment ] | vrf vrf-name ipv4 prefix-address prefix-mask-length [ destination address-start address-end address-increment ] | traffic-eng tunnel tunnel-unit } [ ttl max-hop-count / source source-address / timeout seconds / reply-pad-tlv / reply-mode { ipv4 | router-alert } / exp exp-bits ] ] | Mandatory

Interactive MPLS LSP Ping Function

Table 6‑5 Interactive MPLS LSP Ping function

Step | Command | Description
Enter the ping mpls interactive mode | ping mpls | Mandatory
Specify the detected FEC type | Target ipv4, traffic-eng, or vrf [ ipv4 ]: [ ipv4 | traffic-eng | vrf ] | Mandatory By default, the FEC type is ipv4.
Specify the IPv4 address of the detected FEC | Target IPv4 address: { prefix-address } | Mandatory
Specify the IPv4 mask length of the detected FEC | Target mask length [32]: [ prefix-mask-length ] | Optional By default, the IPv4 mask length is 32.
Specify the times of sending the same MPLS echo request packet repeatedly | Repeat count [5]: [ count ] | Optional By default, the times of sending the packet repeatedly is 5.
Specify the length of the MPLS echo request packet | Datagram size [120]: [ packet-size ] | Optional By default, the packet length is 120 bytes.
Specify the timeout of the MPLS echo request packet | Timeout in seconds [2]: [ seconds ] | Optional By default, the timeout is 2s.
Specify the interval of sending the MPLS echo request packet | Send interval in msec [0]: [ msec ] | Optional By default, the interval of sending the MPLS echo request packet is 0ms.
Select whether to enable the MPLS OAM function extended option | Extended command? [no]: [ yes | no ] | Optional By default, the extended option is not enabled.
Specify the start address of the MPLS echo request packets sent by increasing the destination IPv4 address | Destination address or destination start address [127.0.0.1]: [ address-start ] | Optional By default, the destination address of the sent MPLS echo request packet does not increase, but is fixed as 127.0.0.1.
Specify the end address of the MPLS echo request packets sent by increasing the destination IPv4 address | Destination end address: [ address-end ] | Optional
Specify the address increment of the MPLS echo request packets sent by increasing the destination IPv4 address | Destination address increment [0.0.0.1]: [ address-increment ] | Optional By default, the increment value is 0.0.0.1.
Specify the IPv4 source address of the MPLS echo request packet | Source address: [ source-address ] | Optional
Specify the value of the EXP field in the MPLS label of the MPLS echo request packet | EXP bits in mpls header [0]: [ exp-bits ] | Optional By default, the value of the EXP field in the label is 0.
Specify the filling value in the pad TLV of the MPLS echo request packet | Pad TLV pattern [ 0xABCD ]: [ pattern ] | Optional By default, the filling value in pad TLV is 0xABCD.
Specify whether to contain pad TLV in the MPLS echo reply packet | Reply Pad TLV? [no]: [ yes | no ] | Optional By default, do not contain pad TLV in the MPLS echo reply packet.
Set the TTL of the outermost label of the MPLS echo request packet | Time To Live [255]: [ time-to-live ] | Optional By default, the TTL value of the outermost label is 255.
Specify the reply mode of the MPLS echo reply packet | Reply mode (2-ipv4 via udp, 3-ipv4 via udp with router alert) [2]: | Optional By default, the reply mode is 2, that is, return by the IPv4 UDP packet.
Select whether to display the result of the MPLS LSP Ping operation in the detail mode | Verbose mode? [no]: [ yes | no ] | Optional By default, display the result of the MPLS LSP Ping operation in the simple mode.
Select whether to send the MPLS echo request packet by increasing the length | Sweep range of sizes? [no]: [ yes | no ] | Optional By default, send the MPLS echo request packet by the fixed packet length.
Specify the start value of the sent MPLS echo request packet length | Sweep min size [120]: [ minimum-size ] | Optional By default, the start value of the packet length is 120 bytes.
Specify the maximum value of the sent MPLS echo request packet length | Sweep max size [18024]: [ maximum-size ] | Optional By default, the maximum value of the increment of the packet length is 18024 bytes.
Specify the length increment of the sent MPLS echo request packet | Sweep interval [100]: [ size-increment ] | Optional By default, the length increment is 100 bytes.

Interactive MPLS LSP Traceroute Function

Table 6‑6 Interactive MPLS LSP Traceroute function

Step | Command | Description
Enter the traceroute mpls interactive mode | traceroute mpls | Mandatory
Specify the type of the detected FEC | Target ipv4, traffic-eng, or vrf [ipv4]: [ ipv4 | traffic-eng | vrf ] | Mandatory By default, the FEC type is ipv4.
Specify the IPv4 address of the detected FEC | Target IPv4 address: { prefix-address } | Mandatory
Specify the IPv4 mask length of the detected FEC | Target mask length [32]: [ prefix-mask-length ] | Optional By default, the IPv4 mask length is 32.
Specify the timeout of the MPLS echo request packet | Timeout in seconds [2]: [ seconds ] | Optional By default, the timeout is 2s.
Select whether to enable the MPLS OAM function extended option | Extended command? [no]: [ yes | no ] | Optional By default, the extended option is not enabled.
Specify the start address of sending the MPLS echo request packet by increasing the destination IPv4 address | Destination address or destination start address [127.0.0.1]: [ address-start ] | Optional By default, the destination address of sending the MPLS echo request packet does not increase, but is fixed as 127.0.0.1.
Specify the end address of sending the MPLS echo request packet by increasing the destination IPv4 address | Destination end address: [ address-end ] | Optional
Specify the address increment of sending the MPLS echo request packet by increasing the destination IPv4 address | Destination address increment [0.0.0.1]: [ address-increment ] | Optional By default, the increment is 0.0.0.1.
Specify the IPv4 source packet of the MPLS echo request packet | Source address: [ source-address ] | Optional
Specify whether to contain pad TLV in the MPLS echo reply packet | Reply Pad TLV? [no]: [ yes | no ] | Optional By default, the MPLS echo reply packet does not contain pad TLV.
Set the TTL value of the outermost label of the MPLS echo request packet | Time To Live [30]: [ max-hop-count ] | Optional By default, the maximum hops the MPLS echo request packet is permitted to pass is 30
Specify the reply mode of the MPLS echo request packet | Reply mode ( 2-ipv4 via udp, 3-ipv4 via udp with router alert) [2]: | Optional By default, the reply mode is 2, that is, return by the IPv4 UDP packet.


6.3 MPLS OAM Typical Configuration Example


6.3.1 Configure LSP Ping

Network Requirements

l In the MPLS L3VPN network, use the LSP Ping to detect the availability of MPLS LSP.

Network Topology

Figure 6‑1 Configure LSP Ping

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 10.1.1.1/24 | P | Loopback0 | 22.22.22.22/32
 | Loopback0 | 1.1.1.1/32 | PE2 | Gi0 | 10.1.3.2/24
PE1 | Gi0 | 10.1.1.2/24 |  | Gi1 | 10.1.4.1/24
 | Gi1 | 10.1.2.1/24 |  | Loopback0 | 33.33.33.33/32
 | Loopback0 | 11.11.11.11/32 | CE2 | Gi0 | 10.1.4.2/24
P | Gi0 | 10.1.2.2/24 |  | Loopback0 | 2.2.2.2/32
 | Gi1 | 10.1.3.1/24 |  |  |

Configuration Steps

Step 1: | Configure the interface IP address; CE1, PE1, P and PE2, CE2 form the MPLS L3VPN network; CE1 and CE2 can communicate with each other; VRF on PE1 is 1 (omitted, refer to the configuration manual-the MPLS L3VPN chapter).
Step 2: | On the Ingress node and Egress node of the detected LSP, configure MPLS OAM.

#On PE1, configure MPLS OAM.

PE1#configure terminal

PE1(config)#mpls oam

#On PE2, configure MPLS OAM.

PE2#configure terminal

PE2(config)#mpls oam

Step 3:

Check the result.

#On the PE, perform the LSP ping operation.

Take PE1 as an example:

PE1#ping mpls ipv4 33.33.33.33 32

Sending 5, 120-byte MPLS Echos to 33.33.33.33/32, TTL is 255, timeout is 2 seconds:

Codes: '!' - success, 'Q' - request not transmitted,

'.' - timeout, 'U' - unreachable,

'R' - downstream router but not destination,

'M' - malformed request,

'MR' - malformed reply

Press key (ctrl + shift + 6) to abort.

!!!!!

Success rate is 100% percent (5/5), round-trip min/avg/max = 0/0/0 ms.

You can see that when PE1 pings the Loopback0 interface of PE2, PE1 sends five echo request packets to the egress LSR PE2 successively, and receives the echo reply packet from PE2.

PE1#ping mpls vrf 1 ipv4 2.2.2.2 32

Sending 5, 120-byte MPLS Echos to vrf 1 2.2.2.2/32, TTL is 255, timeout is 2 seconds:

Codes: '!' - success, 'Q' - request not transmitted,

'.' - timeout, 'U' - unreachable,

'R' - downstream router but not destination,

'M' - malformed request,

'MR' - malformed reply

Press key (ctrl + shift + 6) to abort.

!!!!!

Success rate is 100% percent (5/5), round-trip min/avg/max = 0/3/16 ms.

You can see that when PE1 pings the Loopback0 interface of CE2, PE1 sends five echo request packets to CE2 successively, and receives the echo reply packet from CE2.

l For the checking method of PE2, refer to PE1.


6.3.2 Configure LSP Traceroute

Network Requirements

l In the MPLS L3VPN network, use LSP Traceroute to detect the reachability of MPLS LSP and discover each hop on the LSP path.

Network Topology

Figure 6‑2 Configure LSP Traceroute

Device | Interface | IP Address | Device | Interface | IP Address
CE1 | Gi0 | 10.1.1.1/24 | P | Loopback0 | 22.22.22.22/32
 | Loopback0 | 1.1.1.1/32 | PE2 | Gi0 | 10.1.3.2/24
PE1 | Gi0 | 10.1.1.2/24 |  | Gi1 | 10.1.4.1/24
 | Gi1 | 10.1.2.1/24 |  | Loopback0 | 33.33.33.33/32
 | Loopback0 | 11.11.11.11/32 | CE2 | Gi0 | 10.1.4.2/24
P | Gi0 | 10.1.2.2/24 |  | Loopback0 | 2.2.2.2/32
 | Gi1 | 10.1.3.1/24 |  |  |

Configuration Steps

Step 1: | Configure the interface IP address; CE1, PE1, P and PE2, CE2 form the MPLS L3VPN network; CE1 and CE2 can communicate with each other; VRF on PE1 is 1 (omitted, refer to the configuration manual-the MPLS L3VPN chapter).
Step 2: | On all nodes passed by the detected LSP, configure MPLS OAM.

#On PE1, configure MPLS OAM.

PE1#configure terminal

PE1(config)#mpls oam

#On P, configure MPLS OAM.

P#configure terminal

P(config)#mpls oam

#On PE2, configure MPLS OAM.

PE2#configure terminal

PE2(config)#mpls oam

Step 3:

Check the result.

#On PE, CE, perform the LSP Traceroute operation.

Take PE1 as an example:

PE1#traceroute mpls ipv4 33.33.33.33 32

Tracing MPLS Label Switched Path to 33.33.33.33/32, timeout is 2 seconds:

Codes: '!' - success, 'Q' - request not transmitted,

'.' - timeout, 'U' - unreachable,

'R' - downstream router but not destination,

'M' - malformed request,

'MR' - malformed reply

Press key (ctrl + shift + 6) to abort.

0 10.1.2.1 mtu 1500 [Labels: 17 EXP: 0]

R 1 10.1.2.2 mtu 1500 [Labels: 3 EXP: 0] 0 ms

! 2 10.1.3.2 0 ms

You can see the path of the packet forwarded from PE1 to PE2 Loopback0 address and the label information of each hop.

PE1#traceroute mpls vrf 1 ipv4 2.2.2.2 32

Tracing MPLS Label Switched Path to vrf 1 2.2.2.2/32, timeout is 2 seconds:

Codes: '!' - success, 'Q' - request not transmitted,

'.' - timeout, 'U' - unreachable,

'R' - downstream router but not destination,

'M' - malformed request,

'MR' - malformed reply

Press key (ctrl + shift + 6) to abort.

0 10.1.2.1 mtu 1500 [Labels: 17/5120 EXP: 0/0]

R 1 10.1.2.2 mtu 1500 [Labels: 3/5120 EXP: 0/0] 0 ms

! 2 10.1.3.2 0 ms

You can see the path of the packet forwarded from PE1 to CE2 Loopback0 address and the label information of each hop.

l For the checking method of PE2, refer to PE1.

Take CE1 as an example:

CE1#traceroute 2.2.2.2

Type escape sequence to abort.

Tracing the route to 2.2.2.2 , min ttl = 1, max ttl = 30 .

1 10.1.1.2 0 ms 0 ms 0 ms

2 10.1.2.2 [MPLS: Labels 17/5120 Exp 0] 0 ms 0 ms 0 ms

3 10.1.4.1 0 ms 0 ms 0 ms

4 2.2.2.2 16 ms 0 ms 0 ms

You can see the path of the packet forwarded from CE1 to CE2 Loopback0 address and the label information.

l If it is necessary to hide the MPLS core network for CE, configure the no mpls ttl-propagate forwarded command on the PE.

l For the checking method of CE2, refer to CE1.


1 QoS


1.1 Overview


1.1.1 Background

In the traditional IP network, the forwarding device treats all packets equally, adopts “First in, first out” (FIFO) to process all packets and tries best effort to transmit the packet to the destination, so it cannot provide any guarantee for the reliability and delay of the packet transmission.

However, with the development of the IP network, the new applications based on the IP network emerge in endlessly, which put forward new requirements for the service quality of the IP network, especially the demand for the service packets with high real-time requirement is more obvious. For example, the network flow media, VoIP and other real-time services put forward high requirement for the transmission delay of the packets. If the packet transmission delay is long, the user cannot accept (relatively, E-mail and FTP services are not sensitive to the transmission delay). To support the communication services with different service quality requirements, it is required that the network can intelligently distinguish different communication types, so as to provide the corresponding service. The capability of distinguishing the communication types is the basic premise of providing different service qualities for different communications, so the best-effort service mode of the traditional IP network cannot meet the requirements of the present IP network application. The QoS (Quality of Service) technology is to solve the problem, so as to meet the different service quality requirements of the users for the network.


1.1.2 Service Model

QoS provides the following three kinds of service models, that is, Best-Effort service, Integrated service, and Differentiated service (DiffServ for short).

Best-Effort is a single service model and also the simplest service model. The application program can send out any quantity of packets at any time without getting the permission or informing the network in advance. For the best-effort service, the network tries best to send the packets, but does not provide ant guarantee for the transmission delay and reliability of the packets. Best-Effort is the default service model of Internet and is applicable to most of network applications, such as FTP and E-Mail. It is realized via the FITO queue mechanism.

IntServ is one service model that can provide various service types. It can meet various QoS requirements. Before sending packets, the service model needs to apply for the specified service resources from the network. The request is completed via the RSVP signaling. RSVP applies for the network resources for the application before the application program starts to send packets, so it belongs to the out-band signaling. Before sending data, the application program first informs the network of its own traffic parameters and the needed specified service quality request, including bandwidth, delay and so on. After receiving the resource request of the application program, the network executes the resource distributing check, that is, judge whether to distribute resources for the application program based on the resource application of the application program and the present resources of the network. Once the network confirms to distribute resources for the application program, the network maintains one state for the specified flow (Flow, confirmed by the IP addresses, port numbers and protocol numbers of the two sides) and executes the packet classification, traffic monitoring, queuing and scheduling based on the state. After receiving the confirming information of the network (that is, confirm that the network already reserves resources for the packets of the application program), the application program can send packets. As long as the packets of the application program are controlled within the range described by the traffic parameters, the network will undertake to meet the QoS requirements of the application program.

DiffServ classifies the communications according to the service requirements, and then processes the ingress and egress packets according to the classification result, so as to ensure that the network is always in the good communication connection status. It is one multi-channel service model and can meet the QoS requirements of different flows. The largest difference with IntServ is that DiffServ can reserve resources in the network without signaling exchange. It just functions on one port of one transmission device in the network, processing the ingress and egress packets of the port. DiffServ does not need to maintain the status information for each kind of communication. It distinguishes the QoS level of each packet according to the configured QoS mechanism and provides the service for the packet according to the level. Therefore, the mechanism providing the QoS scheme is also called CoS. There are many classification methods and the common modes are to classify according to the priority of the IP packet, classify according to the source, destination address and port of the packet, classify according to the packet protocol, classify according to the packet size and packet ingress port, and so on.

Priority mapping, flow classification, traffic monitoring, traffic shaping, congestion management and congestion avoidance are the main components of DiffServ. The flow classification identifies the packets according to some matching rules and is the basis and premise of DiffServ; traffic monitoring, traffic shaping, congestion management and congestion avoidance distribute and schedule the resources for the network traffic from different aspects and they are the embodiment of the DiffServ idea.


1.1.3 Introduction to QoS Functions

Flow Classification and Marking

Flow classification adopts some rule to identify the packets that comply with one feature, divides the packets of different features to multiple classes, and then uses the corresponding QoS mechanism to provide different services for different classes. Therefore, the flow classification is the premise and basis of providing different services.

The flow classification rule can use the priority field of the packet, including IP DSCP, 802.1P, and MPLS-EXP priority, to identify the traffic with different priority features; the network manager also can set the policy of the flow classification. For example, integrate the source address, destination address, MAC address, IP protocol or port number of the application program to classify the flow. The general classification basis is limited to the header information for encapsulating the packet. Using the packet content as the classification standard is relatively rare. The classification result does not have the range limitation and it can be the small range determined by the quintuple (source address, source port number, protocol number, destination address, destination port number) and also can be all packets to one segment. When classifying the packets at the network edge, set the priority in the ToS field of the packet IP header. In this way, we can directly use the IP priority as the classification standard inside the network. However, the queue technology also can use the priority to perform different processing for the packets. The downstream network can select to accept the classification result of the upstream network, and also can re-classify according to its own standard. The flow classification is to provide differentiated services. It should be associated with one flow control or resource distribution action. Which flow control action to adopt depends on the stage and the current load condition of the network. For example, when the packet enters the network, monitor it according to the CIR; shape before flowing out of the node; during congestion, perform the queue scheduling management; when the congestion is intensified, adopt the congestion avoidance measures and so on.

Flow marking means to set or modify the attributes of one kind of packets. After classifying the packets to different types by the flow classification, the flow marking can modify the attributes of one flow packet to prepare for the subsequent processing of the flow packet. For example, we can specify to modify the DSCP of the packet matching one flow classification rule to 5, while specify the DSCP of the packet matching another classification rule as 0. Distinguish the packets by traffic marking. Perform the differentiated processing according to the DSCP value of the packet in the subsequent operations. For example, first send the packet with the DSCP tag 5. When the congestion happens, first drop the packet with DSCP 0.

The following attributes can perform the traffic marking:

1. The CoS value of the packet

2. The DSCP value in the IP packet header

3. The EXP value of the MPLS packet

4. The Precedence field in the ToS domain of the IP packet

5. QoS Group ID (valid only for the device)

Traffic Monitoring

Traffic monitoring limits the rate for the packets entering the interface by the token bucket and perform various operations for the packets within the committed access rate and exceeding the rate, including sending, dropping and modifying the IP DSCP, IP priority of the packet or marking QoS private attribute and so on. Its typical application is to limit the traffic entering one network. Usually, drop the data exceeding the rate or reduce its priority. The following figure is the general processing flow of the traffic monitoring:

Figure ‎1‑1The general processing flow of the traffic monitoring

Token bucket is one common traffic measuring method. It has two parameters, that is, Burst size and Mean rate, used to report whether the packet matches with the configured rate parameter, but as one measuring tool, the token bucket does not filter, change or take one measure for the communication.

Token bucket places the token according to the rate set by the user. Besides, the user also can set the capacity of the token bucket. When the number of the tokens in the token bucket exceeds the capacity of the bucket, the tokens in the token bucket overflows and the token quantity does not increase any more. When adopting the token bucket to process the packet and if there are tokens in the token bucket, the packets can pass the bucket (the token quantity can be negative, which is called token borrowing). Meanwhile, the tokens in the token bucket reduce according to the length of the packet; when the tokens in the token bucket are 0 (or negative), the packet cannot pass the bucket.

Figure ‎1‑2 Typical token bucket processing flow

The green box in the above figure indicates the token, the gray box indicates the data flow, and the small bucket is used to hold the tokens. The meaning of the algorithm is: When passing one unit of data flow (such as 1 Byte) from the token bucket, consume one token in the bucket. When there are tokens in the token bucket, the packet is marked as green. Otherwise, it is marked as red. When the data flow does not use the bandwidth distributed to it, the token bucket accumulates the tokens and here, the packets indicated by all tokens in the bucket can be sent. This can permit the burst transmission of the data. When there is no token in the token bucket, the packet cannot be sent. Only when there is new token generated in the bucket, the packet can be sent. In this way, we can limit the packet traffic to be smaller than or equal to the generating rate of the token, so as to limit the traffic.

The token bucket has three mechanisms of assessing the rate, that is, single-bucket single-speed, double-bucket single-speed, and double-bucket double-speed:

l Single-bucket single-speed token bucket: Use one token bucket to measure whether the data comply with or violate the rule. The capacity of the bucket is Bc. If the data does not make the tokens in the token bucket smaller than 0, the data complies with the rule. Otherwise, the overflow data is the violation data.

l Double-bucket single-speed token bucket: Use two token buckets to measure data and only define CIR. The capacity of the first bucket is Bc. If the data does not overflow the first bucket, the data complies with the rule; the capacity of the second bucket is Be. When the data of the first bucket overflows and the data of the second bucket does not overflow, the data becomes the data exceeding the rule; if the data flow is too large and overflows the second bucket, the overflow data is the data violating the rule.

l Double-bucket double-speed token bucket: Define two rates, that is, CIR and PIR. Meanwhile, use two token buckets to measure data. The capacity of the first token bucket is Bc, used to measure whether the data complies with or exceed CIR. If not making the tokens in the first token bucket be smaller than 0, the data complies with the rule. Otherwise, the data exceeds the rule; the capacity of the second token bucket is Be, used to measure whether the data rate is larger than PIR. When the data makes the tokens in the second token bucket be smaller than 0, the overflow data violates the rule.

Traffic Shaping

The typical function of the traffic shaping means to limit the traffic of flowing out from one network, making the packets be sent with an average rate. Usually, it is divided to the port traffic shaping and queue traffic shaping. When the sending rate of the packets exceeds the shaping rate, the speeding packets are buffered in the queue and then are sent out with an average rate. The difference between the traffic shaping and traffic monitoring: When using the traffic monitoring to control the packet traffic, the speeding packets are not buffered, but are directly dropped, while the traffic shaping buffers the speeding packets, reducing the dropped packets caused by the burst traffic. However, the traffic shaping may increase the delay, while the traffic monitoring nearly does not increase the delay. The following figure is the general processing flow of the traffic shaping:

Figure ‎1‑3 The general processing flow of the traffic shaping

Congestion Management

When the device traffic load is light, do not generate the congestion and the packets are forwarded out when reaching the port. When the arriving rate of the packets is larger than the sending rate of the port and exceeds the processing limit of the port or the device resources are not enough, congestion happens to the device. The congestion may make the communication of the whole network become unreliable. The end-to-end delay, jitter and packet loss rate used to measure the network service quality all increase. If enabling the congestion management and when the congestion happens, the packets queue at the port and waits for the port to forward. The congestion management usually adopts the queue technology and the port determines which queue the packet should be placed according to the packet priority and queue mechanism and how to schedule and forward packets. The common scheduling includes FIFO, FQ, PQ, CBWFQ and so on.

FIFO is the default queue of the interface in the system, processing the packets by “First In, First Out”.

FQ (Fair Queuing): It is put forward to share the network resources fairly and try to make the delay and jitter of all flows reach best. Classify the packets by flow and each flow is distributed with one queue. Each queue schedules by turns fairly.

PQ is short for priority queue, that is, high (high priority) queue, medium (medium priority) queue, normal (normal priority) queue and low (low priority) queue. The default queue is the normal queue. The packets in the four queues are scheduled and sent according to the strict priority. When there are packets in the high queue to be sent, the packets in the medium queue cannot be scheduled or sent until the high queue is empty, and so on. Obviously, the “starve to death” phenomenon may happen to the low queue in PQ, that is, it cannot be scheduled.

CBWFQ is class-based weighted fair queue. It lets the user define the data class according to the communication parameters (priority, access list, protocol type and so on) and distribute one queue for each data class, and then set the occupied bandwidth, drop policy for each queue and perform the traffic monitoring and shaping. The queue weight is the bandwidth value of the queue and also the bandwidth that can be used by the queue when the interface is congested. Currently, CBWFQ supports LLQ, Bandwidth and BE queues. The default data enters the BE queue.

Congestion Avoidance

The congestion avoidance technology monitors the communication load of the network, so as to avoid the congestion before the network congestion happens. The common used technology is RED (Random Early Detection). The difference with the tail drop method is that RED drops the data in the queue at random. Based on the RED algorithm, generate WRED (Weighted Random Early Detection). It selects the dropped packet according to the DSCP or IP priority and can provide different performance features for different service types of data. It also can avoid the TCP global synchronization.

In the WRED algorithm, the dropped packets depend on the average length, minimum threshold and maximum threshold of the queue. When the average length of the queue is smaller than the minimum threshold, do not drop the packets; when the average length of the queue is larger than the minimum threshold and smaller than the maximum threshold, the packet dropping rate increases with the average queue length; at last, when the average length of the queue is larger than the maximum threshold, drop all the packets. The formula of calculating the average length of the queue is: the average length of the queue = (previous average queue length × (1-1 / (2 ^ n))) + (current queue length × (1 / (2 ^ n))). Here, n can be configured by the command. The average length of the queue reflects the change trend of the queue and is not sensitive with the burst change of the queue length, avoiding the unfair treat for the burst data flow.

Figure ‎1‑4 WRED diagram


1.2 QoS Function Configuration

Table ‎1‑1 QoS function configuration list

Configuration Task
Configure the traffic monitoring | Configure the interface-based CAR
 | Configure the flow-based CAR
Configure the traffic shaping | Configure the general traffic shaping
Configure the congestion management | Configure the QoS used bandwidth
 | Configure the FIFO queue
 | Configure the FQ queue
 | Configure the PQ queue
 | Configure the CBWFQ queue
Configure the congestion avoidance | Configure the WRED
Configure the sub interface re-direction | Configure the sub interface re-direction


1.2.1 Configure Traffic Monitoring

Configuration Condition

None

Configure Interface-based CAR

Provide the rate limitation and marking at the ingress and egress directions for all IP and MPLS packets on the interface. It is used on the network edge device, limiting the traffic rate of entering or leaving the device. We can configure multiple CAR policy on the interface. When the packet passes, check every policy one by one until the packet matches with one policy; if not matching any policy, the packet is directly forwarded.

Table ‎1‑2 Configure the interface-based CAR

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the interface-based CAR | rate-limit { input | output } cir conform-brust exceed-brust conform-action { { continue | drop | transmit | set-qos-transmit | set-qos-continue | set-prec-transmit | set-prec-continue | set-dscp-transmit | set-dscp-continue | set-mpls-exp-imposition-transmit | set-mpls-exp- imposition -continue } [ action-value ] } exceed-action { { continue | drop | transmit | set-qos-transmit | set-qos-continue | set-prec-transmit | set-prec-continue | set-dscp-transmit | set-dscp-continue | set-mpls-exp-imposition-transmit | set-mpls-exp- imposition -continue } [ action- value ] } [ color-keep ] | Mandatory By default, do not configure the interface-based CAR. For details, refer to the related commands of the QoS command manual.

l color-keep is non-color-blind mode. If the packet is colored by the previous CAR polict, keep the color.

l The configured token bucket parameters of CAR BC (conform-brust) and BE (exceed-brust) indicate the layer-1 and layer-2 bucket lengths respectively. The BE in the CAR parameters of some friend-manufacturers’ devices indicates the sum of layer-1 and layer-2 bucket depths. Usually, it is suggested to configure BC as rate (cir)/8/2.

Configure Flow-based CAR

After classifying the packets on the interface, limit the rate and mark at the egress and ingress directions. It is used on the network edge devices, limiting the traffic rate of entering or leaving the device. We can configure multiple CAR policies on the interface. When the packet passes, check every policy one by one until the packet matches with one policy; if not matching any policy, the packet is directly forwarded. Currently, the classification matching conditions on CAR include QOS Group ID, ACL, MPLS-EXP and so on.

Table ‎1‑3 Configure the flow-based CAR

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the flow-based CAR | rate-limit { input | output } [ [access-group access-list ] | [mpls experimental topmost exp ] | [qos-group group-val ] ] cir conform-brust exceed-brust conform-action {{ continue | drop | transmit | set-qos-transmit | set-qos-continue | set-prec-transmit | set-prec-continue | set-dscp-transmit | set-dscp-continue | set-mpls-exp-imposition-transmit | set-mpls-exp-imposition -continue } [ action-value ] } exceed-action { { continue | drop | transmit | set-qos-transmit | set-qos-continue | set-prec-transmit | set-prec-continue | set-dscp-transmit | set-dscp-continue | set-mpls-exp-imposition-transmit | set-mpls-exp-imposition -continue } [ action- value] } [ color-keep ] | Mandatory By default, do not configure CAR matching ACL. Match all packets of IP and MPLS, QoS Group ID, MPLS-EXP CAR. For details, refer to the related commands of the QoS command manual.

l CAR cannot configure matching QoS Group ID at the ingress direction of the interface; at the egress direction of the interface, we cannot mark Qos Group ID.

l CAR cannot configure set-mpls-exp-imposition-transmit and set-mpls-exp-imposition-continue at the egress direction of the interface.

l Configuring color-keep means that the CAR is non-color-bind mode. If the packet is colored by the previous CAR policy, keep the color.

l The configured token bucket parameters of CAR BC (conform-brust) and BE (exceed-brust) indicate the layer-1 and layer-2 bucket lengths respectively. The BE in the CAR parameters of some friend-manufacturers’ devices indicates the sum of layer-1 and layer-2 bucket depths. Usually, it is suggested to configure BC as rate (cir)/8/2.


1.2.2 Configure Traffic Shaping

Configuration Condition

None

Configure General Traffic Shaping

General traffic shaping (GTS) is configured on the interface, performing the traffic shaping control for the packets at the egress direction of the interface.

Table ‎1‑4 Configure the general traffic shaping

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the specified interface | interface interface-name | -
Configure the general traffic shaping | traffic-shape conform-rate [ permit-sub-burst ] | Mandatory By default, do not configure the general traffic shaping. If not specifying permit-sub-burst, it is the traffic passing by the rate conform-rate within 25ms by default (that is conform-rate*25/1000)


1.2.3 Configure Congestion Management

The default adopted congestion management policy of the interface is the FIFO queue, treating the packets entering the packets fairly by the principle of “First in, First out”.

Configuration Condition

None

Configure QoS Used Bandwidth

By default, the QoS used bandwidth adopts the logical bandwidth of the interface, corresponding to the value configured by the bandwidth command on the interface. We also can adopt the qos max-bandwidth command to specify the QoS used bandwidth.

Table ‎1‑5 Configure the QoS used bandwidth

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the QoS used bandwidth | qos max-bandwidth bandwidth | Mandatory By default, the QoS used bandwidth adopts the logical bandwidth of the interface.

l After configuring the QoS used bandwidth, the bandwidth calculation of the QoS queue in the interface takes the QoS used bandwidth as reference.

l QoS used bandwidth needs to be set to be consistent with the actual available bandwidth of the physical interface. For example, the default bandwidth of some logical interface is smaller than the associated physical interface (for example, the default bandwidth of the tunnel interface is 10k and the associated physical interface is larger than the value). To work normally, we need to set the QoS used bandwidth to be consistent with the actual available of the physical interface.

Configure FIFO Queue

FIFO does not classify the packets. When the packets enter the interface, FIFO always lets the packet enter the queue by the order of the packets reaching the interface. Meanwhile, FIFO lets the packets leave the queue by the order of the packets entering the queue. The packet first entering the queue leaves the queue first and the packet entering the queue later leaves the queue later.

FIFO queue is used on the interface by default and does not need to be configured. Besides, the user can configure the FIFO queue depth according to the packet cache demand, as follows:

Table ‎1‑6 Configure the FIFO queue depth

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the FIFO queue depth | hold-queue queue-length out | Optional By default, FIFO queue depth is 256 packets.

Configure FQ Queue

FQ classifies the packets by flow. For the IP packets, perform the hash algorithm according to the IP quintuple, including the source IP address, destination IP address, source port number, destination port number and protocol number, to hash different flows to different queues. For MPLS packets, perform hash algorithm according to some feature information of the MPLS header. The FQ queue quantity is configured by the user and the queues schedule by turns fairly.

Table ‎1‑7 Configure the FQ queue

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable FQ on the interface | fair-queue [ queue-num ] | Mandatory The interface enables FQ. The optional parameter queue-num is used to specify the number of the FQ queues. If not specifying, there are 32 queues by default. By default, do not enable FQ on the interface.
Configure the FQ queue depth | fair-queue queue-limit queue-limit-value | Optional By default, the FQ queue depth is 256 packets.

Configure PQ Queue

The application of the PQ policy: The user classifies the packets by configuring the IP or ingress interface classification rule as desired, and then the packets enter the PQ queues, that is, high queue, medium queue, normal queue, and low queue. Their priorities reduce in turn. By default, the data flow enters the normal queue. After the flow classification, the packets enter the corresponding queues. When scheduling to leave the queue, PQ strictly complies with the priority order from high to low, first sending the packets in the high-priority queue. When the queue with high priority is empty, send the packets in the lower-priority queue.

Table ‎1‑8 Configure the PQ queue

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the IP classification rule | priority-list list-number protocol ip { high | normal | medium | low } { fragments | gt packet-size | lt packet-size | list access-list-name | tcp port-number | udp port-number} | Optional packet-size contains the length of the packet link header; access-list-name only supports IP ACL; PQ does not support MAC ACL.
Configure the classification rule of the ingress interface | priority-list list-number interface interface-name { high | low | medium |normal } | Optional According to the ingress interface, distribute the packets to the specified queue. By default, the packet enters the default queue.
Configure the PQ default queue | priority-list list-number default { high | medium | normal | low } | Optional By default, the default queue is normal queue.
Configure the PQ queue depth | priority-list list-number queue-limit high-queue-length medium-queue-length normal-queue-length low-queue-length | Optional The user can adjust the depths of the four PQ queues as desired. By default, the depth of each queue is 256 packets.
Enter the interface configuration mode | interface interface-name | -
Apply the PQ policy | priority-group list-number | Mandatory Apply the PQ policy with list-number to the interface and the range of list-number is 1-16.

Configure CBWFQ Queue

Configuring CBWFQ includes the following steps:

1. Use the class-map command to define the communication class, distinguishing the flows according to one rule;

2. Use the policy-map command to define the policy, defining the rule for the communication class, including bandwidth, dropping policy, queue depth and perform the marking, traffic monitoring and shaping for the data class;

3. Apply the policy: Use the service-policy command to apply the policy to the interface.

Define the communication class: The communication class is used to distinguish the flows entering one policy, convenient for the later operations for the flows. There is one default communication class in the system class-default: match the default data flow. The user can define the communication class according to the common rule, including the class name and class mapping rule.

Table ‎1‑9 Configure class-map

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create communication class | class-map [ match-all | match-any] class-name | Mandatory By default, use match-all. match-all means that when matching all items in class-map, the matching succeeds; match-any means that when matching any item in match-any, the matching succeeds.
Configure the communication class matching the ingress interface | match input-interface input-interface-name | Optional
Configure the communication class matching the egress interface | match output-interface output-interface-name | Optional Configure the communication class matching the egress interface mainly to be used with the re-direction function of the sub interface.
Configure the communication class matching the routing protocol packet | match protocol-class | Optional By default, the communication class does not configure matching the routing protocol packets.
Configure the communication class matching the IP priority | match ip precedence precedence-value | Optional
Configure the communication class matching the IP DSCP | match ip dscp dscp-value | Optional
Configure the communication class matching the MPLS-EXP | match mpls experimental topmost exp-value | Optional
Configure the communication class matching the VLAN ID | match vlan vlan-id | Optional In one match, we can match multiple (four at most) VLAN IDs. As long as matching any one, the matching succeeds.
Configure the communication type matching vrf | match vrf vrf-name | Optional
Configure the communication class matching the 802.1p CoS | match cos cos-value | Optional In one match, we can match multiple (four at most) CoS. As long as matching any one, the matching succeeds.
Configure the communication class matching the QoS Group | match qos-group qos-group-id | Optional QoS Group is valid only at the local device; In one match, we can match multiple (four at most) QoS Group IDs. As long as matching any one, the matching succeeds.
Configure the communication class matching the nested class-map | match class-map class-name | Optional Define the current communication class nested to match other communication class.

l We can only configure matching QoS Group at the egress direction. During the general application, mark QoS Group at the ingress direction and match QoS Group at the egress direction.

l Matching output interface can only be used for the re-direction function of the sub interface.

l When the communication class matches the access list, the corresponding access list definition should adopt the permit rule, but not the deny rule, because the refused flow will enter the matching of the next communication class and is meaningless for the local communication class.

Define policy: CBWFQ policy can be applied at the ingress and egress directions of the interface. The policy at the ingress direction includes the flow classification and marking, while the policy at the egress direction includes the flow classification, marking and the mechanism of distributing queue for each communication class, traffic monitoring and shaping, as well as drop policy. The supported queues of the system include LLQ, Bandwidth and BE queues. Each policy has one default communication class (class-default) and default BE queue.

Table ‎1‑10 Configure the policy-map

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create CBWFQ policy | policy-map policy-name | Mandatory
Enter the policy configuration mode | class class-name | Mandatory Apply the communication class to the policy. If at the egress direction, the user can specify the queue type for the communication class and by default, it is BE queue; while at the ingress direction, there is no queue.
Specify the EF queue for the communication class | priority { percent percentage | bandwidth } [burst] [limited] | Optional The bandwidth can be absolute bandwidth value and also can be percentage. After configuring limited, the priority queue bandwidth is limited to the value configured by the user and cannot occupy the remaining bandwidth.
Specify the AF queue for the communication class | bandwidth { percent percentage | bandwidth-in-kbps } | Optional The bandwidth can be absolute bandwidth value and also can be percentage.
Specify the queue depth for the communication type | queue-limit queue-depth | Optional
Enable the queue WRED drop policy for the communication class | random-detect [prec-based | dscp-based] | Optional
Configure the WRED parameters for the communication class | random-detect [ precedence | dscp ] pre-dscp-val min-threshold max-threshold [ pro- denominator ] | Optional
Configure fair-queue for the communication class | fair-queue [numb-of-queue] | Optional
Specify the nested CBWFQ sub policy for the communication class | service-policy sub-policy-name | Optional
Configure marking the packet IP priority for the communication class | set ip precedence prec-value | Optional
Configure marking the packet DSCP for the communication class | set ip dscp dscp-value | Optional
Configure marking the EXP of the MPLS packet for the communication class | set mpls experimental { imposition | topmost } exp-value | Optional Imposition and topmost are mutually exclusive.
Configure marking 802.1p CoS for the communication class | set cos cos-value | Optional
Configure marking QoS Group for the communication class | set qos-group qos-group-id | Optional QoS Group is valid only for the local device.
Configure the traffic monitoring for the communication class | police cir cir-value [ bc bc-value [ be be-value | pir pir-value be pir-be-value ] ] | Optional Police is to perform the traffic monitoring for the communication class in the QoS policy. There are various monitoring modes, including single-speed double-color, single-speed three-color and double-speed three-color, and perform the related actions for the colored packets. By default, conform-action is forwarding; exceed-action and violate-action are dropping. For details, refer to QoS Command Manual.
Configure the traffic shaping for the communication class | shape average { percent percentage | bandwidth } | Optional The traffic shaping bandwidth can be absolute value and also can be percentage.
Configure dropping for the communication class | drop | Optional The drop command is mutually exclusive; after configuring the drop command for one communication class, we cannot configure other commands any more.

l Inpolicy-map, configure the priority or bandwidth or shape average commandfor one communication class, indicating that the communication class has the independent queue. Here, the policy-map can only be applied to the egress direction of the interface, but cannot be applied to the ingress direction of the interface.

l queue-limit, fair-queue and wred are all the attributes of the queue. If one communication class does not configure the priority or bandwidth or shapge average command first, we cannot configure the above three commands in the communication class. Except for class-default, its default queue is BE queue, so we can directly configure the queue attributes on it.

l The expressing forms of the AF queue bandwidths in one policy-map should be consistent, absolute value or percentage. For some (such as SA card asynchronization) interface card with escape, when configuring the bandwidth distribution on this kind of interfaces, it is suggested to use the bandwidth absolute value, but not percentage.

l In one policy-map, the user can configure 254 queues at most, including LLQ (priority), AF (bandwidth), and new BE queue. And the user cannot configure the fair-queue queue in the LLQ queue.

l policy-map of imposition-exp marked with QoS Group and MPLS can only be applied to the ingress direction of the interface, while the policy-map marked with 802.1p CoS can only be applied to the egress direction of the Ethernet sub interface.

l The description of the CBWFQ bandwidth calculation:

Configure as follows:

Policy-map: 1

class 1

bandwidth percent 20

class 2

priority percent 50

class 3

shape average percent 20

class 4

policy-map 1 is applied to one 1000M interface. The corresponding guarantee bandwidth and maximum bandwidth of the policy-map 1 policy instance are both 1000M.

The policy-map 1 will generate four queues; class 1 corresponds to the af queue; the maximum bandwidth is 1000M; the guarantee bandwidth is 20/100*1000 = 200M. class 2 corresponds to the ef queue, the maximum bandwidth is 1000M, and the guarantee bandwidth is 50/100*1000 = 500M.

Class 3 corresponds to the be queue. Except for the guarantee bandwidth of af and ef, the remaining guarantee bandwidth of the policy instance is distributed to the be queues on average). The guarantee bandwidth of class 3 is 1000-500-200/2 (two be queues) = 150M, the maximum bandwidth is 20/100*1000=200M. Class 4 does not configure the queue packet to enter the default queue.

The description for the be queue calculation: Each policy instance has one default be queue and the queue is unavailable for the user.

For the case with nesting, the description of the further instance:

There is the configuration of policy-map 1; configure one policy-map sub again, as follows:

Policy-map: sub

class sub-1

bandwidth percent 20

class sub-2

priority percent 50

class sub-3

shape average percent 20

class sub-4

1: If nesting the policy sub under class 1:

Policy-map: 1

class 1

bandwidth percent 20

service-policy sub

class 2

priority percent 50

......

In this case, the bandwidth calculation of the sub policy instance is:

If the guarantee bandwidth of class 1 is 200M, and the maximum bandwidth is 1000M (refer to the above description), the guarantee bandwidth of the sub policy is 200M and the maximum bandwidth is 1000M.

The guarantee bandwidth of sub-1 is 20/100*200 = 40M, the maximum bandwidth is 1000M, the guarantee bandwidth of sub-2 is 50/100*200 = 100M, the maximum bandwidth is 1000M, the guarantee bandwidth of sub-3 is (200-40-100)/2 = 30M, and the maximum bandwidth is 20/100*1000M = 200M.

2: If nesting policy sub in class 3:

Router#show policy-map 1

Policy-map: 1

...

class 2

priority percent 50

class 3

shape average percent 20

service-policy sub

class 4

In this case, the bandwidth calculation of the sub policy instance is:

If the guarantee bandwidth of class 3 is 150M, and the maximum bandwidth is 200M (refer to the above description), the guarantee bandwidth of the sub policy is 150M and the maximum bandwidth is 200M.

The guarantee bandwidth of sub-1 is 20/100*150 = 30M, the maximum bandwidth is 200M, the guarantee bandwidth of sub-2 is 50/100*150 = 75M, the maximum bandwidth is 200M, the guarantee bandwidth of sub-3 is (150-30-75)/2 = 22.5M, and the maximum bandwidth is 20/100*200M = 40M.

3: When configuring shape and bandwidth or priority in one class at the same time, the guarantee bandwidth the configured bandwidth or priority value, and the maximum bandwidth is the configured shape value.

Configure as follows:

Policy-map: 1

class 1

bandwidth percent 20

shape average percent 30

class 2

...

l The guarantee bandwidth of class 1 is 200M, the maximum bandwidth is the configured of shape 30/100*1000M = 300M. For the case, it is not suggested that the shape bandwidth value configured by the user is smaller than the bandwidth value of bandwidth or priority.

Apply policy: Adopt the service-policy command to apply the policy to the ingress or egress direction of the interface.

Table ‎1‑11 Apply the CBWFQ policy

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Apply the CBWFQ policy | service-policy { input | output } policy-name | Mandatory

l policy-map with the queue features (configured with queue-limit, wred, shape, bandwidth, priority) cannot be applied to the ingress direction.

By default, for CBWFQ, the queue scheduling policy order of exceeding the guarantee bandwidth is BE >AF >EF; in some special applications, we may need to modify the order. We can use the following command to adjust dynamically.

Table ‎1‑12 Configure CBWFQ guarantee bandwidth scheduling policy

Step

Command

Description

Enter the global configuration mode

configure terminal

-

Adjust CBWFQ scheduling policy

qos-cbwfq excess-prio
high { af | be | ef }
middle { af | be | ef }
low { af | be | ef }

Mandatory

By default, the queue scheduling policy order of exceeding the guarantee bandwidth is BE >AF >EF

l It is suggested to use the qos-cbwfq excess-prio command for the special application. Usually, adopt the default configuration.


1.2.4 Configure Congestion Avoidance

When the congestion happens to the interface, WRED selects to drop the data with low priority. This provides the differentiated performance features for the different service types of data. Usually, the lower the IP priority of the data is, the more possibly the data is dropped. When enabling WRED on the interface, the user can modify the drop parameters as desired, including average queue threshold, drop probability denominator and so on. For the WRED applications with the same drop parameter requirement, we can use the WRED group, which is convenient for the user to set the parameters. The default drop policy of the system congestion avoidance is tail drop.

WRED can be enabled in the class queues of CBWFQ and also can be enabled in the interface. The former is described in “Configure the congestion management—Configure the CBWFQ queue”. The following mainly describes enabling the WRED function in the interface.

Configuration Condition

None

Configure WRED

Table ‎1‑13 Configure the WRED

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the WRED group | random-detect-group group-name | Mandatory
Configure the minimum threshold, maximum threshold and drop probability percentage of the average queue based on the IP DSCP drop mode | dscp dscp minimum-threshold maximum-threshold [discard-probability-percent ] | Optional
Configure the minimum threshold, maximum threshold and drop probability percentage of the average queue based on the IP Precedence drop mode | precedence precedence minimum-threshold maximum-threshold [discard-probability-percent ] | Optional
Return to the global configuration mode | exit | -
Enter the interface configuration mode | interface interface-name | -
Enable the WRED group | random-detect attach group-name | Mandatory (alternative of enabling WRED group and enabling WRED)
Enable WRED | random-detect [prec-based | dscp-based] | Mandatory (alternative of enabling WRED group and enabling WRED)
Configure the minimum threshold, maximum threshold and drop probability percentage of the average queue based on the IP Precedence drop mode | random-detect precedence precedence minimum-threshold maximum-threshold [discard-probability-percent] | Optional
Configure the minimum threshold, maximum threshold and drop probability percentage of the average queue based on the IP DSCP drop mode | random-detect dscp dscp minimum-threshold maximum-threshold [discard-probability-percent ] | Optional

l On one interface, we can configure only one WRED or WRED group.

l If CBWFQ is enabled on one interface, we cannot apply WRED or WRED group on the interface.


1.2.5 Configure Sub Interface Re-direction

By default, each sub interface of the system performs the QoS control independently (queue scheduling, traffic shaping, traffic monitoring and so on), not related with the corresponding main interface. However, in some application scenarios, for example, adopt three sub interfaces to distinguish three kinds of services, while the three kinds of services share one WAN line and the bandwidth is also shared. To adopt the QoS queue (PQ queue, CBWFQ queue and so on) to distribute the bandwidth for the services dynamically, we need to configure the re-direction for the sub interfaces, making the packets sent by the sub interface be re-directed to the corresponding main interface for QoS queue scheduling. And then configure the QoS queue on the main interface to control the bandwidth distribution.

Configuration Condition

None

Configure Sub Interface Re-direction

Table ‎1‑14 Configure the sub interface re-direction function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the re-direction function of the sub interface | qos sub-interface redirect | Mandatory By default, do not enable the re-direction function of the sub interface.
Add the sub interface to be re-directed | redirect interface-name [target-interface-name] | Mandatory

l If there are several sub interfaces in one main interface, the system permits some to add and the others not to add to the re-direction, the sub interfaces not added to the re-direction still perform the QoS control independently.

l After configuring the sub interface re-direction, we also need to configure the QoS control policy (queue scheduling, traffic shaping, traffic monitoring and so on) on the corresponding main interface.


1.2.6 QoS Monitoring and Maintaining

Table ‎1‑15 QoS monitoring and maintaining

Command | Description
clear policy-map interface interface-name [ input | output ] | Clear the statistics information of the CBWFQ policy on the interface
clear queueing interface interface-name | Clear the statistics information of the queue on the specified interface
show class-map [ class-name ] | Display the class-map information configured by the user
show fifo [ interface interface-name ] | Display the configuration and statistics information of the FIFO queue on the interface
show policy-map | Display the CBWFQ policy information configured by the user
show policy-map user-config policy-name [ class { class-name | class-default }] | Display the CBWFQ policy information specified by the user
show policy-map interface interface-name [ pvc pvc-number ] [ input | output ] | Display the information of the CBWFQ policy on the interface
show priority { list [ list-number ] | queue [ interface interface-name [ pvc pvc-number ] ] } | Display the configured PQ queue rule information or the statistics information of the PQ queue on the interface
show qos-cbwfq excess-prio | Display the scheduling priority of the queues after exceeding the guarantee bandwidth in CBWFQ
show qos-apply interface { cbq | pq | wfq } | Display the information of applying the QoS queue on the interface
show qos interface [ interface-name ] | Display the QoS information of the interface
show qos sub-interface redirect | Display the configured sub interface re-direction information
show queueing interface interface-name | Display the statistics information of the queue on the specified interface
show random-detect-group [ group-name ] | Display the configuration information of the WRED group
show rate-limit interface interface-name | Display the configuration of CAR in one interface and the statistics information during running
show traffic-shape [ interface interface-name ] | Display the GTS configuration and statistics information on the interface
show wred [ interface interface-name ] | Display the WRED configuration information


1.3 QoS Typical Configuration Example


1.3.1 Configure Basic CAR

Network Requirements

l There is the video server and data server in the network.

l It is required to configure CAR to limit the egress traffic of the video server not larger than 30M 9:00-18:00 every day, configure the IP priority of the video traffic as 5, and the egress traffic of the data server not larger than 50M in one day.

Network Topology

Figure ‎1‑5 Networking of configuring the basic CAR

Configuration Steps

Step 1: | Configure the IP address and configuration route of the interface. (omitted)
Step 2: | Configure the ACL rule list matching the video server and data server traffic.

#Configure the time domain of 9:00-18:00 every day.

Device1#configure terminal

Device1(config)#time-range video-time

Device1(config-time-range)#periodic daily 9:00 to 18:00

Device1(config-time-range)#exit

#Configure the ACL rule list matching the video server and associating the time domain.

Device1(config)#ip access-list extended video

Device1(config-ext-nacl)#10 permit ip host 100.0.0.1 any time-range video-time

Device1(config-ext-nacl)#exit

#Configure the ACL rule list matching the data server.

Device1(config)#ip access-list extended data

Device1(config-ext-nacl)#10 permit ip host 100.0.0.2 any

Device1(config-ext-nacl)#exit

Step 3:

Configure the CAR matching ACL.

#On Device1, connect the ingress direction of the interface of the video server; configure the CAR matching the video traffic ACL; limit the video traffic to 30M in the specified time; conform traffic action is to forward packets and mark the IP priority as 5.

Device1(config)#interface vlan100

Device1(config-if-vlan100)#rate-limit input access-group video 30000000 1875000 0 conform-action set-prec-transmit 5 exceed-action drop

#On Device1, connect the ingress direction of the interface of the data server, configure the CAR matching the data traffic ACL, and limit the data traffic speed to 50M.

Device1(config-if-vlan100)#rate-limit input access-group data 50000000 3125000 0 conform-action transmit exceed-action drop

Step 4:

Check the result.

#View the CAR packet statistics. If there is traffic, we can see that whether the configured CAR matches the packet.

Device1#show rate-limit interface vlan100

display input direct carInst running-info:

matches: access-group video

color-mode: blind

params: 30000000 bps, 1875000 limit, 0 extended limit

conformed 106484 packets, 82312132 bytes; action: set-prec-transmit

exceeded 64649 packets, 49973677 bytes; action: drop

current burst: 55362 ns

matches: access-group data

color-mode: blind

params: 50000000 bps, 3125000 limit, 0 extended limit

conformed 251160 packets, 127589280 bytes; action: transmit

exceeded 0 packets, 0 bytes; action: drop

current burst: 69683072 ns


1.3.2 Configure Non-Color-Blind CAR

Network Requirements

l There is the video server and data server in the network.

l It is required to configure CAR to ensure the video traffic 20M, but not exceeding 20M. The total of the video traffic and data traffic does not exceed 50M. That is to say, the traffic passing Device1 does not exceed 50M. When the video traffic is larger than 20M, ensure that the passing video traffic is 20M; when the video traffic is smaller than 20M, the remaining bandwidth can be occupied by the data traffic.

Network Topology

Figure ‎1‑6 Networking of configuring the non-color-blind CAR

Configuration Steps

Step 1: | Configure the IP address and configuration route of the interface. (omitted)
Step 2: | Configure the ACL rule list matching the video server traffic.

Device1#configure terminal

Device1(config)#ip access-list extended video

Device1(config-ext-nacl)#10 permit ip host 100.0.0.1 any

Device1(config-ext-nacl)#exit

Step 3:

Configure CAR on the interface.

#On Device1, connect the ingress direction of the interface of the video and data servers, configure CAR matching the video traffic ACL, limit the video traffic to 20M, and the conform traffic action is to continue to match the next CAR (continue).

Device1(config)#interface vlan100

Device1(config-if-vlan100)#rate-limit input access-group video 20000000 2500000 0 conform-action continue exceed-action drop

#On Device1, connect the ingress direction of the interface of the video and data servers, configure the interface-based CAR, limit the speed to 50M and the mode is color-keep.

Device1(config-if-vlan100)#rate-limit input 50000000 6250000 0 conform-action transmit exceed-action drop color-keep

Step 4:

Check the result.

#View the CAR packet statistics. If there is traffic, we can see that whether the configured CAR matches the packet.

Device1#show rate-limit interface vlan100

display input direct carInst running-info:

matches: access-group video

color-mode: blind

params: 20000000 bps, 2500000 limit, 0 extended limit

conformed 106745 packets, 82513885 bytes; action: continue

exceeded 143893 packets, 111229289 bytes; action: drop

current burst: -8800 ns

matches: all traffic

color-mode: color-aware

params: 50000000 bps, 6250000 limit, 0 extended limit

conformed 253633 packets, 148346649 bytes; action: transmit

exceeded 86934 packets, 44162472 bytes; action: drop

current burst: -38400 ns


1.3.3 Configure GTS

Network Requirements

l The aggregation router Device2 is down-linked to the site router Device1 via the MSTP line of the carrier. The physical bandwidth of the MSTP line is 4M.

l On the carrier MSTP device interface connected to the site router, configure GTS; shape the traffic to the network node.

l Adjust the method of the device QoS calculating the bandwidth to make it close to the carrier.

Network Topology

Figure ‎1‑7 Networking of configuring GTS

Configuration Steps

Step 1: | Configure the IP address and configuration route of the interface. (omitted)
Step 2: | Configure GTS on the interface of the router Device1 connecting the MSTP device interface.

Device1#configure terminal

Device1(config)#interface vlan100.1

Device1(config-if-vlan100)#traffic-shape 4000000 100000

Device1(config-if-vlan100)#exit

Step 3:

Configure the QoS packet calculation to add 20 bytes, making it close to the line transmission cost of the carrier, and modify the logical bandwidth of the interface to be consistent with the line bandwidth.

Device1(config)#interface vlan100

Device1(config-if-vlan100)#qos account output length add 20

Device1(config-if-vlan100)#bandwidth 4000

Device1(config-if-vlan100)#exit

Step 4: | The configuration of the uplink interfaces of the router Device2 and Device3 is similar to Device1.
Step 5: | Check the result.

#The traffic sent by the interface does not exceed the value configured by the traffic shaping.

l The device QoS calculation is processed by adding the length of the data part of the link layer to the header of the link layer, while the MSTP line provided by the carrier is realized by binding one to multiple 2M channels and there is internal transmission cost. According to the actual application experience, the cost of each packet is about 20 bytes, so we need to configure qos account output length add 20, making each packet be added with 20 bytes when the device performs the bandwidth calculation. This complies with the actuality of the carrier MSTP line and ensures that the packets are not lost when being transmitted on the carrier MSTP line.

l The command bandwidth 4000 is to modify the logical bandwidth of the interface to be consistent with the actual leased line bandwidth. The PQ and CBWFQ queues calculate the bandwidth guarantee based on this and also can use the qos max-bandwidth command to modify the QoS used bandwidth.


1.3.4 Configure PQ

Network Requirements

l There is authentication server, video server and several terminals in the network; the intranet bandwidth is 100M and the egress bandwidth is 20M.

l It is required to ensure the traffic of the authentication server first, then ensure the video traffic, and at last, the terminal traffic.

Network Topology

Figure ‎1‑8 Networking of configuring PQ

Configuration Steps

Step 1: | Configure the IP address and configuration route of the interface. (omitted)
Step 2: | Configure the ACL rule list matching the video server and data server traffic.

Device1#configure terminal

Device1(config)#ip access-list extended aaa

Device1(config-ext-nacl)#10 permit ip host 100.0.0.1 any

Device1(config-ext-nacl)#exit

Device1(config)#ip access-list extended video

Device1(config-ext-nacl)#10 permit ip host 100.0.0.2 any

Device1(config-ext-nacl)#exit

Step 3:

Configure the PQ rule 1.

#Configure the authentication server traffic to enter the high-priority queue of PQ.

Device1(config)#priority-list 1 protocol ip high list aaa

#Configure the video server traffic to enter the medium-priority queue of PQ.

Device1(config)#priority-list 1 protocol ip medium list video

#Configure other traffic to enter the normal-priority queue of PQ by default (the default is normal, which cannot be configured).

Device1(config)#priority-list 1 default normal

Step 4:

Apply PQ rule 1 on the interface and configure GTS and interface bandwidth.

Device1(config)#interface vlan100

Device1(config-if-vlan100)#priority-group 1

Device1(config-if-vlan100)#traffic-shape 20000000 500000

Device1(config-if-vlan100)#bandwidth 20000

l If the actual leased line bandwidth is not consistent with the physical bandwidth of the interface, we need to configure GTS on the interface. Otherwise, the packets may be dropped on the carrier line and the QoS control on the device does not take effect. If the actual leased line bandwidth is not consistent with the bandwidth configured on the interface, we also need to modify the bandwidth or qos max-bandwidth of the interface. If the 1000M Ethernet is connected to 20M carrier MSTP line, we need to configure 20M GTS at the egress direction of the interface and modify the bandwidth of the interface to 20M.

l The device QoS calculation is processed by adding the length of the data part of the link layer to the header of the link layer, while the MSTP line provided by the carrier is realized by binding one to multiple 2M channels and there is internal transmission cost. According to the actual application experience, the cost of each packet is about 20 bytes, so if connecting the MSTP line of the carrier, we also need to configure qos account output length add 20, making each packet be added with 20 bytes when the device performs the bandwidth calculation. This complies with the actuality of the carrier MSTP line and ensures that the packets are not lost when being transmitted on the carrier MSTP line.

Step 5:

Check the result.

#Check the status of the packet entering the queue.

Device1#show priority queue

Queue of vlan100 priority-group 1

----------------------------------------------------------------------------------------------------

QID DEPTH(packets) HOLD(bytes/pkts) INPUT(bytes/pkts) OUTPUT(bytes/pkts) DROP(bytes/pkts)

1(high) 256 0 /0 42515 /55 42515 /55 0 /0

2(medium) 256 0 /0 743712 /1464 743712 /1464 0 /0

3(normal) 256 0 /0 544464 /684 544464 /684 0 /0

4(low) 256 0 /0 0 /0 0 /0 0 /0

DEPTH is the length of the PQ queue. HOLD is the current cached packet bytes of the queue; INPUT and OUTPUT are the statistics of the in-queue and out-queue packets respectively; DROP is the statistics of the dropped packets of the PQ queue.


1.3.5 Configure FQ

Network Requirements

l PC initiates various service traffics, the egress bandwidth is 2M and the intranet bandwidth is 100M.

l On Device1, enable FQ to make different kinds of traffics be sent fairly during congestion.

Network Topology

Figure ‎1‑9 Networking of configuring FQ

Configuration Steps

Step 1: | Configure the IP address and configuration route of the interface. (omitted)
Step 2: | The egress interface enables FQ.

Device1#configure terminal

Device1(config)#interface vlan200

Device1(config-if-vlan200)#fair-queue

Step 3:

Check the result.

#View the information about the FQ queue packets entering the queue and the sending status.

Device1#show wfq

Interface vlan200

-----------------------------------------------------------------------------------------

--QID----QUEUE LENGTH----HoldPkts------SendPkts--------DropPkts-----

0 256 53 218 1739

1 256 61 207 1742

2 256 61 207 1742

3 256 61 207 1742

4 256 61 207 1744

5 256 61 207 1743

6 256 61 207 1744

7 256 61 207 1744

8 256 61 208 1745

9 256 61 207 1744

10 256 61 207 1744

11 256 61 207 1744

12 256 61 207 1744

13 256 61 207 1744

14 256 61 207 1744

15 256 61 207 1742

16 256 61 207 1770

17 256 61 207 1767

18 256 61 215 1763

19 256 61 219 1762

20 256 61 219 1762

21 256 61 219 1762

22 256 61 219 1762

23 256 61 219 1762

24 256 61 219 1762

25 256 61 219 1762

26 256 61 219 1762

27 256 61 219 1762

28 256 61 219 1762

29 256 61 219 1762

30 256 59 219 1764

31 256 56 219 1767

----------------------------------------------------------------------------------------


1.3.6 Configure CBWFQ

Network Requirements

l The data flow is sent from Device1, Device2, and Device3 to the network after Device5 via Device4; the link bandwidth between Device4 and Device5 is 50M;

l On Device1, mark the DSCP domain of the traffic sent from Device1 as AF41; on Device2, mark the DSCP domain of the traffic sent from Device2 as AF42; on Device3, mark the DSCP domain of the traffic sent from Device3 as AF43.

l On Device4, configure QoS to guarantee the protocol packets. For the traffic with the DSCP domain AF41 and AF42 sent to Device5, guarantee 60% low-delay bandwidth; guarantee 30% bandwidth for the traffic with DSCP domain AF43, but the highest occupied bandwidth does not exceed 40%.

Network Topology

Figure ‎1‑10 Networking of configuring CBWFQ

Configuration Steps

Step 1: | Configure the IP address and configuration route of the interface. (omitted)
Step 2: | On Device1, Device2 and Device3, configure CBWFQ to mark the packet DSCP.

#On Device1, mark the DSCP domain of all packets going out from the interface gi0 as AF41.

Device1#configure terminal

Device1(config)#policy-map set_dscp

Device1(config-pmap)#class class-default

Device1(config-pmap-c)#set ip dscp af41

Device1(config-pmap-c)#exit

Device1(config-pmap)#exit

Device1(config)#interface vlan100

Device1(config-if-vlan100)#service-policy output set_dscp

Device1(config-if-vlan100)#exit

#On Device2, mark the DSCP domain of all packets going out from the interface gi0 as AF42.

Device2#configure terminal

Device2(config)#policy-map set_dscp

Device2(config-pmap)#class class-default

Device2(config-pmap-c)#set ip dscp af42

Device2(config-pmap-c)#exit

Device2(config-pmap)#exit

Device2(config)#interface vlan100

Device2(config-if-vlan100)#service-policy output set_dscp

Device2(config-if-vlan100)#exit

#On Device3, mark the DSCP domain of all packets going out from the interface gi0 as AF43.

Device3#configure terminal

Device3(config)#policy-map set_dscp

Device3(config-pmap)#class class-default

Device3(config-pmap-c)#set ip dscp af43

Device3(config-pmap-c)#exit

Device3(config-pmap)#exit

Device3(config)#interface vlan100

Device3(config-if-vlan100)#service-policy output set_dscp

Device3(config-if-vlan100)#exit

Step 3:

On Device4, configure the classes matching the traffics.

#Configure the class matching the protocol packet.

Device4#configure terminal

Device4(config)#class-map protocol

Device4(config-cmap)#match protocol-class

Device4(config-cmap)#exit

Match protocol-class is to match all routing protocol (unicast, multicast, MPLS) packets sent out from the local device.

#Configure the class matching the DSCP domain AF41 and AF42.

Device4(config)#class-map match-any af4142

Device4(config-cmap)#match ip dscp af41

Device4(config-cmap)#match ip dscp af42

Device4(config-cmap)#exit

#Configure the class matching the DSCP domain AF43.

Device4(config)#class-map match-all af43

Device4(config-cmap)#match ip dscp af43

Device4(config-cmap)#exit

Step 4:

Configure the CBWFQ policy on Device4.

Device4(config)#policy-map qos

Device4(config-pmap)#class protocol

Device4(config-pmap-c)#priority 100

Device4(config-pmap-c)#exit

Device4(config-pmap)#class af4142

Device4(config-pmap-c)#priority percent 60

Device4(config-pmap-c)#exit

Device4(config-pmap)#class af43

Device4(config-pmap-c)#bandwidth percent 30

Device4(config-pmap-c)#shape average percent 40

Device4(config-pmap-c)#exit

Device4(config-pmap)#exit

The step of configuring the bandwidth guarantee also can use the absolute value.

#Check the configured policy.

Device4#show policy-map user-config qos

Policy-map: qos

class protocol

priority 100

class af4142

priority percent 60

class af43

bandwidth percent 30

shape average percent 40

Step 5:

Configure GTS, interface bandwidth and the policy of applying the configuration at the egress direction of the interface on Device4.

Device4#configure terminal

Device4(config)#interface vlan100

Device4(config-if-vlan100)#traffic-shape 50000000 1250000

Device4(config-if-vlan100)#bandwidth 50000

Device4(config-if-vlan100)#service-policy output qos

Device4(config-if-vlan100)#exit

l If the actual leased line bandwidth is not consistent with the physical bandwidth of the interface, we need to configure GTS on the interface. Otherwise, the packets may be dropped on the carrier line and the QoS control on the device does not take effect. If the actual leased line bandwidth is not consistent with the bandwidth configured on the interface, we also need to modify the bandwidth or qos max-bandwidth of the interface. If the 1000M Ethernet is connected to 20M carrier MSTP line, we need to configure 20M GTS at the egress direction of the interface and modify the bandwidth of the interface to 20M.

l The device QoS calculation is processed by adding the length of the data part of the link layer to the header of the link layer, while the MSTP line provided by the carrier is realized by binding one to multiple 2M channels and there is internal transmission cost. According to the actual application experience, the cost of each packet is about 20 bytes, so if connecting the MSTP line of the carrier, we also need to configure qos account output length add 20, making each packet be added with 20 bytes when the device performs the bandwidth calculation. This complies with the actuality of the carrier MSTP line and ensures that the packets are not lost when being transmitted on the carrier MSTP line.

Step 6:

Check the result.

#View the statistics information of the packets entering the queue.

Device4#show policy-map interface vlan100

interface vlan100

Service-policy output: qos

Class-map: protocol (match-all)

49 packets 3170 bytes

5 minute offered rate 128 bps

match protocol-class

Queueing

queue limit 256 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 49/3170

Priority: 100 Kbps , burst bytes 2500, b/w exceed drops: 0

Class-map: af4142 (match-any)

58 packets 44834 bytes

5 minute offered rate 3624 bps

match ip dscp af41

match ip dscp af42

Queueing

queue limit 256 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 58/44834

Priority: 60% (30000 Kbps) , burst bytes 625000, b/w exceed drops: 0

Class-map: af43 (match-all)

1260 packets 640080 bytes

5 minute offered rate 51720 bps

match ip dscp af43

Queueing

queue limit 256 packets

(queue depth/total drops) 1/0

(packets output/bytes output) 1259/639572

Bandwidth: 30% (15000 Kbps)

Shaping

shape (average) cir 20000000, bc 4000000

Class-map: class-default (match-any)

0 packets 0 bytes

5 minute offered rate 0 bps

Queueing

queue limit 256 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 0/0

match any

From the above information, we can see the basic configuration information, the absolute value converted from the bandwidth guarantee, the statistics of each kind of matched packets and 5-minute traffic statistics, as well as the packet stacking of the current QoS queue. We can simply judge whether the configuration is correct and effective.


1.3.7 Configure HQoS

Network Requirements

l There is video service, voice service and data service in the network; the video service includes class-1 video, class-2 video and class-3 video.

l Configure QoS to guarantee the protocol packets, ensuring that the video service occupies 30% bandwidth, voice service occupies 30% low-delay bandwidth, and the data service is scheduled fairly; for class-1 video in the video service, ensure 40% low-delay bandwidth; for class-2 video, ensure 30% bandwidth; for class-3 video, ensure 29% bandwidth.

Network Topology

Figure ‎1‑11 Networking of configuring HQoS

Configuration Steps

Step 1: | Configure the IP address and configuration route of the interface. (omitted)
Step 2: | On Device1, configure the ACL rule list matching the services.

#Configure the ACL rule list matching the video service.

Device1#configure terminal

Device1(config)#ip access-list extended video

Device1(config-ext-nacl)#10 permit ip 100.0.0.0 0.0.0.255 any

Device1(config-ext-nacl)#exit

#Configure the ACL rule list matching the three sub services of the video.

Device1(config)#ip access-list extended video1

Device1(config-ext-nacl)#10 permit ip host 100.0.0.1 any

Device1(config-ext-nacl)#exit

Device1(config)#ip access-list extended video2

Device1(config-ext-nacl)#10 permit ip host 100.0.0.2 any

Device1(config-ext-nacl)#exit

Device1(config)#ip access-list extended video3

Device1(config-ext-nacl)#10 permit ip host 100.0.0.3 any

Device1(config-ext-nacl)#exit

#Configure the ACL rule list matching the voice service.

Device1(config)#ip access-list extended voice

Device1(config-ext-nacl)#10 permit ip host 101.0.0.1 any

Device1(config-ext-nacl)#exit

Step 3:

On Device1, configure the classes matching the services.

#Configure the class matching the protocol packets.

Device1#configure terminal

Device1(config)#class-map protocol

Device1(config-cmap)#match protocol-class

Device1(config-cmap)#exit

#Configure the class matching the video service.

Device1(config)#class-map video

Device1(config-cmap)#match access-group video

Device1(config-cmap)#exit

Device1(config)#class-map video1

Device1(config-cmap)#match access-group video1

Device1(config-cmap)#exit

Device1(config)#class-map video2

Device1(config-cmap)#match access-group video2

Device1(config-cmap)#exit

Device1(config)#class-map video3

Device1(config-cmap)#match access-group video3

Device1(config-cmap)#exit

#Configure the class matching the voice service.

Device1(config)#class-map voice

Device1(config-cmap)#match access-group voice

Device1(config-cmap)#exit

Step 4:

Configure the CBWFQ policy on Device1.

#Configure the CBWFQ sub policy of ensuring the video sub service.

Device1(config)#policy-map video

Device1(config-pmap)#class video1

Device1(config-pmap-c)#priority percent 40

Device1(config-pmap-c)#exit

Device1(config-pmap)#class video2

Device1(config-pmap-c)#bandwidth percent 30

Device1(config-pmap-c)#exit

Device1(config-pmap)#class video3

Device1(config-pmap-c)#bandwidth percent 29

Device1(config-pmap-c)#exit

Device1(config-pmap)#exit

#Configure the CBWFQ main policy of ensuring all services and nest the sub policy of ensuring the video sub service in the video class. The data service enters the default class-default queue.

Device1(config)#policy-map qos

Device1(config-pmap)#class video

Device1(config-pmap-c)#bandwidth percent 30

Device1(config-pmap-c)#service-policy video

Device1(config-pmap-c)#exit

Device1(config-pmap)#class voice

Device1(config-pmap-c)#priority percent 30

Device1(config-pmap-c)#exit

Device1(config-pmap)#class class-default

Device1(config-pmap-c)#fair-queue

Device1(config-pmap-c)#exit

Device1(config-pmap)#exit

Step 5:

Apply the configured policy at the egress direction of the Device1 interface.

Device1(config)#interface vlan100

Device1(config-if-vlan100)#service-policy output qos

Device1(config-if-vlan100)#exit

l If the actual leased line bandwidth is not consistent with the physical bandwidth of the interface, we need to configure GTS on the interface. Otherwise, the packets may be dropped on the carrier line and the QoS control on the device does not take effect. If the actual leased line bandwidth is not consistent with the bandwidth configured on the interface, we also need to modify the bandwidth or qos max-bandwidth of the interface. If the 1000M Ethernet is connected to 20M carrier MSTP line, we need to configure 20M GTS at the egress direction of the interface and modify the bandwidth of the interface to 20M.

l The device QoS calculation is processed by adding the length of the data part of the link layer to the header of the link layer, while the MSTP line provided by the carrier is realized by binding one to multiple 2M channels and there is internal transmission cost. According to the actual application experience, the cost of each packet is about 20 bytes, so if connecting the MSTP line of the carrier, we also need to configure qos account output length add 20, making each packet be added with 20 bytes when the device performs the bandwidth calculation. This complies with the actuality of the carrier MSTP line and ensures that the packets are not lost when being transmitted on the carrier MSTP line.

Step 6:

Check the result.

#View the CBWFQ queue statistics information.

Device1#show policy-map interface vlan100

interface vlan100

Service-policy output: qos

Class-map: video (match-all)

26338 packets 11721879 bytes

5 minute offered rate 8525000 bps

match access-group video

Queueing

queue limit 1024 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 26336/11721098

Bandwidth: 30% (300000 Kbps)

Service-policy: video

Class-map: video1 (match-all)

7519 packets 2563979 bytes

5 minute offered rate 1864712 bps

match access-group video1

Queueing

queue limit 256 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 7518/2563638

Priority: 40% (120000 Kbps) , burst bytes 3000000, b/w exceed drops: 0

Class-map: video2 (match-all)

5914 packets 2602160 bytes

5 minute offered rate 1892480 bps

match access-group video2

Queueing

queue limit 256 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 5914/2602160

Bandwidth: 30% (90000 Kbps)

Class-map: video3 (match-all)

12906 packets 6556248 bytes

5 minute offered rate 4768184 bps

match access-group video3

Queueing

queue limit 256 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 12905/6555740

Bandwidth: 29% (87000 Kbps)

Class-map: class-default (match-any)

0 packets 0 bytes

5 minute offered rate 0 bps

Queueing

queue limit 256 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 0/0

match any

Class-map: voice (match-all)

13083 packets 6646164 bytes

5 minute offered rate 6646160 bps

match access-group voice

Queueing

queue limit 256 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 0/0

Priority: 30% (300000 Kbps) , burst bytes 7500000, b/w exceed drops: 0

Class-map: class-default (match-any)

202543 packets 68107754 bytes

5 minute offered rate 19459360 bps

match any

Queueing

queue limit 256 packets

(queue depth/total drops) 0/0

(packets output/bytes output) 1/78

Fair-queue 256: per-flow queue limit 64 Packets

From the above information, we can see the basic configuration information, the absolute value converted from the bandwidth guarantee, the statistics of each kind of matched packets and 5-minute traffic statistics, as well as the packet stacking of the current QoS queue. We can simply judge whether the configuration is correct and effective.


1.3.8 Configure WRED

Network Requirements

l Lots of terminals download files from the FTP server.

l On Device, enable WRED to prevent TCP global synchronization.

l Modify the minimum drop threshold of the packet queue with WRED IP priority 2 to 20% of the average queue depth, the maximum drop threshold to 90% of the average queue depth, and the maximum threshold to 50.

Network Topology

Figure ‎1‑14 Networking of configuring the WRED

Configuration Steps

Step 1: | Configure the IP address and configuration route of the interface. (omitted)
Step 2: | The interface enables the priority-based WRED.

Device#configure terminal

Device(config)#interface vlan100

Device(config-if-vlan100)#random-detect prec-based

Step 3:

Modify the minimum drop threshold of the packet queue with IP priority 2 to 20% of the average queue depth, the maximum drop threshold to 90% of the average queue depth, and the drop probability to 20%.

Device(config-if-vlan100)#random-detect precedence 2 20 90 20

Step 4:

Check the result.

#View the WRED configuration information.

Device#show wred

Vlan100

Queueing strategy: random early detection (WRED)

Exp-weight-constant: 9

Class MinThre MaxThre DiscardP

0 30% 100% 10 %

1 30% 100% 10 %

2 20% 90% 20%

3 30% 100% 10 %

4 30% 100% 10 %

5 30% 100% 10 %

6 30% 100% 10 %

7 30% 100% 10 %

#When the network is congested, multiple concurrent TCP connections will not generate the global synchronization phenomenon.


1 CPU Protection


1.1 Overview

Maipu router software system has two planes. One is the data plane and the other is control plane. The data plane is located at the bottom layer and mainly completes the fast forwarding of the packets; the control plane is located at the top layer and mainly controls and manages the running of various network protocols. CPU protection function is to protect the two planes, making the CPU resources be utilized reasonably and high-efficiently and ensuring the stable running of the devices in the complicated environment.

The CPU protection function is realized by CPU Packet and CPU Guard.

When the router is running, the packets are first sent to the data plane from the hardware. If it is the common packet, it is directly forwarded fast at the data plane; if it is the protocol packet, it needs to be sent to the control plane from the data plane.

On the switching panel, when lots of packets are sent to the data plane from the ASIC hardware, classify the packets via the CPU Packet function, ensuring that the priority of the protocol packet is higher than the common packet and preventing lots of common packets from flooding the protocol packets. The different protocol packets have different priorities and we need to ensure that the basic protocol with high real-time requirement (such as STP protocol) first gets the CPU resources.

The protocol packets are sent to the control plane for processing via the data plane at last (such as OSPF protocol packets and Telnet packets). Most of the common packets are directly forwarded at the data plane, but maybe the remaining few of common packets need to be sent to the control plane for processing. When the packets enter the control plane from the data plane, we need to classify various packets via the CPU Guard function and set different priorities, ensuring the normal running of various network protocols.

Overview of CPU Packet

There are lots of protocol packets in the device that need to be sent to CPU for processing and we need to specify the queue for each kind of protocol packets. The CPU protection function classifies the protocol packets sent to CPU and the packets enter different CPU queues according to the different protocol priorities. We can set the rate limitation of each queue.

The device totally has eight queues, numbering from 0 to 7. They adopt the strict priorities. The smaller the number is, the lower the priority is. The packets enter the following queues according to the priorities:

1. Queue 0: low-priority queue, such as lookup-miss, ipv6-all, udp-broadcast packets;

2. Queue 1: arp, ip6-solicited-node, host-group, router-group packets;

3. Queue 2: lldp, dot1x, dhcp, svi-ip packets;

4. Queue 3: pim, igmp-dvmrp, ip4-reserved-multicast packets;

5. Queue 4: ospf, irmp, rip, is-is packets;

6. Queue 5: gvrp, l2pt, ethernet-cfm, ethernet-lmi packets;

7. Queue 6: High-priority queue, such as loopback-detect, stp-bpdu, slow-protocols packets;

8. Queue 7: Highest-priority queue, such as EIPS, ULPP packets;

That is to say, the priority of queue 0 is the lowest and the priority of queue 7 is the highest. The packets in the queue with the high priority are earlier sent to the CPU for processing that the packets in the queue with low priority. We can specify them to different priorities of queues according to the importance of each kind of packets, ensuring that the important packets are first sent to the CPU for processing.

Meanwhile, the device can perform the rate limitation for the packets entering each CPU queue, preventing the vicious protocol packet attack in the network from causing the too high CPU utilization of the device and resulting in the abnormal running of the device.

Overview of CPU Guard

CPU Guard (CPU protection) provides the protection function of the control plane. The controlling functions include calculating route, processing user commands, maintaining protocol running and so on.

CPU Guard provides two kinds of protection modes:

l The packets are classified and enter the queues: The packets sent from the data plane to the control plane are classified by CPU Guard. According to the classification result, the packets enter the following three queues:

1. Queue 0 (link packet queue), link protocol packets, such as PPP packets, ARP packets, HDLC packets, enter the queue.

2. Queue 1 (protocol packet queue): Important protocol packets, such as TELNET packet, OSPF packet, and SNMP packet, enter the queue.

3. Queue 2 (common packet queue).

The priorities of the above three queues decrease progressively. The packets entering the high-priority queue leave the queue first. This mode ensures that the important control packets are processed first.

l Limitation for the packets leaving the queue: When lots of packets impact the control plane, we can configure the queue-leaving speed of the three queues to reduce the system load.


1.2 CPU Protection Function Configuration

Table 1‑1 The configuration list of the CPU protection function

Configuration Task
Configure CPU Packet function | Configure the CPU queue of the protocol packet
 | Configure the rate limitation of the CPU queue
 | Enable the unicast route protocol packet to CPU
 | Enable the multicast route protocol packet to CPU
 | Configure the matching rule of the customized protocol packet to CPU
 | Configure the mode of the customized protocol packet to CPU
Configure CPU Guard function | Configure IPv6 packet priority
 | Configure link analysis trigger packet priority
 | Configure packets of triggering creating session priority
 | Configure TCP/UDP packets priority
 | Configure IP packets priority
 | Configure the speed limitation of packets leaving queue
 | Configure CPU limitation of common packets leaving queue


1.2.1 Configure CPU Packet Function

Configuration Condition

None

Configure CPU Queue of Protocol Packets

The CPU port totally has eight queues and the user can configure different protocol packets to enter different queues. The device sends the protocol packets to the CPU for processing in order from high priority queue to low priority queue according to the user configuration. If the protocol packets are in the queue with high priority, they first get the CPU processing. Besides, the user also can specify the important packet to enter the high priority queue, ensuring that the important packets are first sent to the CPU for processing. By default, different protocol packets enter the default CPU queue. Besides, we also can use the command to modify the packet to enter the specified CPU queue.

Table 1‑2 Configure the CPU queue of the protocol packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the CPU queue the protocol packets enter | cpu-packet protocol cos cos-value | Mandatory By default, different protocol packets enter the default CPU queue.


1.2.2 Configure CPU Guard Function

Configuration Condition

None

Configure IPv6 Packet Priority

By default, IPv6 packets enter the common packet queue and we can configure this kind of packets to enter the protocol queue.

Table 1‑3Configure IPv6 packet priority

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure IPv6 packet priority | ip data-guard aware ipv6 | Mandatory By default, IPv6 packets enter the common packet queue.

Configure Link Analysis Trigger Packet Priority

By default, the common packet of triggering the link analysis (such as triggering ARP analysis) enters the common packet queue. We can configure this kind of packets to enter the protocol queue.

Table 1‑4Configure link analysis trigger packet priority

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure link analysis trigger packet priority | ip data-guard aware link-resolve-trigger | Mandatory By default, this kind of packets enters the common packet queue.

Configure Packets of Triggering Creating Session Priority

By default, the packets of triggering creating the session (such as creating the NAT converting records) enter the common packet queue. We can configure this kind of packets to enter the protocol queue.

Table 1‑5 Configure packets of triggering creating session priority

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure packets of triggering creating session priority | ip data-guard aware new-session | Mandatory By default, this kind of packets enters the common packet queue.

Configure TCP/UDP Packets Priority

Except for the TCP/UDP packets of some well-known protocol, most of packets belong to the common packets. To improve the sending efficiency and reliability of the unknown protocol, we can configure the TCP/UDP protocol packets of the specified port to enter the protocol packet queue.

Table 1‑6Configure TCP/UDP packets priority

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure TCP/UDP packets priority | ip data-guard protocol { tcp | udp } port [ description ] | Mandatory By default, except for a few of well-known protocols, the others enter the common packet queue. We can use the command show ip data-guard priority protocol to view the features of the TCP/UDP packets of entering the protocol packet queue.

Configure IP Packets Priority

Except for the IP packets of some well-known protocol, most of packets belong to the common packets. To improve the sending efficiency and reliability of the unknown protocol, we can configure the IP protocol packets of the specified port to enter the protocol packet queue.

Table 1‑7 Configure IP packets priority

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure IP packets priority | ip data-guard protocol protocol [ description ] | Mandatory By default, except for a few of well-known protocols, the others enter the common packet queue. We can use the command show ip data-guard priority protocol to view the features of the IP packets of entering the protocol packet queue.

Configure Speed Limitation of Packets Leaving Queue

The speed control of the packets leaving the queue can ensure the reliable sending of the packets, avoiding the impact of the packet burst and balancing the running requirements in different scenarios. The network manager can adjust the speed of the packets leaving the queue according to the actual network status in real time.

Table 1‑8 Configure the speed limitation of packets leaving the queue

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the speed limitation of packets leaving the queue | ip data-guard rate-limit queue-id max-rate burst-size | Mandatory By default, do not configure speed limitation of packets leaving queue.

Configure CPU Limitation of Common Packets Leaving Queue

To ensure that there are CPU resources to process the packets of the high-priority queue in time, we can limit the CPU occupation of the common packets leaving the queue.

Table 1‑9 Configure the CPU limitation of common packets leaving the queue

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the CPU limitation of common packets leaving the queue | ip data-guard scheduler default-queue percent | Mandatory By default, do not configure CPU limitation of common packets leaving queue.


1.2.3 Monitoring and Maintaining of CPU Protection

Table 1‑10 Monitoring and maintaining of the CPU protection

Command | Description
show cpu-packet cos | Display the current and default queue information of the protocol packets to CPU
show cpu-packet mac-table | Display the MAC entry information delivered via the CPU Packet
show ip data-guard priority protocol | Display the features of the IP/TCP/UD packets entering the protocol packet queue


1.3 Typical Configuration Example of CPU Protection


1.3.1 Configure Basic Functions of CPU Protection

Network Requirement

l PC is connected to IP network via Device.

l On Device, configure the LLDP packet into queue 5.

Network Topology

Figure 1-1 Networking of configuring the basic functions of the CPU protection

Configuration Steps

Step 1: | Configure VLAN, and add the port to the corresponding VLAN. (omitted)
Step 2: | Configure the IP address of the interface (omitted).
Step 3: | Configure the CPU queue of the LLDP packet, and the LLDP packet is measured in exception.

#On Device, configure the LLDP packet to queue 5, and the LLDP packet is measured in exception.

Device#configure terminal

Device(config)#cpu-packet exception cos 5

Step 4:

Check the result.

#On Device, view the CPU queue of the protocol packet.

18x-40E#show cpu-packet cos

Type Current-CoS [Default-CoS]

-------------------------------------------------------

mirroring 0 [0]

saLearning 0 [0]

switching 1 [1]

protoSnoop 2 [2]

exception 5 [2]

protoTerm 3 [3]

is-is 3 [3]

loopback-detect 3 [3]

You can see that the CPU queue of the LLDP packet on Device is adjusted from default queue 2 to queue 5 in exception.


2 Port Security


2.1.1 Overview of Port Security

Port security is the security mechanism of controlling the devices connected to the network. It is applied to the access layer and can limit the hosts of using the device port, permitting some specified hosts to access the network, while the other hosts cannot access the network.

The port security function can bind the user MAC address, IP address, VLAN ID and port number, preventing the invalid user from accessing the network, so as to ensure the security of the network data and the valid user can get the enough bandwidth.


2.1.2 Port Security Rule

The port security rule is divided to four kinds:

MAC rule: Control whether the host can communicate according to the MAC address of the host. The binding mode of the MAC rule contains MAC binding, MAC+VLAN binding, and MAC+IP binding.

IP rule: Control whether the host can communicate according to the IP address of the host. The IP rule can be for the binding of a single IP address and also can be for the binding of the IP address segment.

MAX rule: Limit the number of the MAC addresses that can be learned by the port freely to control the host communication. The number of the MAC address entries does not contain the valid MAC address entries generated by the MAC rule and IP rule.

STICKY rule: Control whether the host can communicate according to the MAC address of the host. The binding mode of the STICKY rule contains the MAC binding, MAC+VLAN binding, and MAC+IP binding. The STICKY rule can automatically learn and also can configure manually, and is saved in the running configuration. If saving the running configuration before the device restarts, do not need to configure again after the device restarts and the STICKY rule automatically takes effect. When enabling the STICKY function in the port and the STICKY learn node is MAC mode, convert the dynamic MAC entry learned by the MAX rule to the STICKY rule and save in the running configuration.


2.1.3 Work Principle of Port Security

If only enabling the port security, the port security drops all packets received on the port. The rules of the port security rely on the ARP packets and IP packets of the device to trigger. When the device receives the ARP packet and IP packet, the port security extracts various packet information and matches with the configured rule. The matching order is first match the MAC rule, secondly match the STICKY rule, then match the IP rule and at last match the MAX rule, and control the L2 forwarding table of the port according to the matching result, so as to control the forwarding action of the port for the packet. The valid packet matching the MAX rule or STICKY rule is forwarded. For the packet matching the MAC rule or IP rule, if the action of the rule for the packet is permit, the packet belongs to the valid packet and is forwarded. Otherwise, the packet is invalid and dropped.

The action is the permitted MAC rule and IP rule. After taking effect, write the MAC address of the rule to the L2 forwarding table so that the L2 forwarding can be performed for the packets matching the rule. If the action is the refused Mac rule and IP rule, the corresponding MAC is not written to the L2 forwarding table and the packet needs to be dropped via the port security.

After MAC rule and STICKY rule take effect, write to the MAC address entries to form the effective entries, making the packet perform the L2 forwarding.


2.2 Port Security Function Configuration

Table 2‑1 Basic function configuration list of the port security

Configuration Task
Configure the basic functions of the port security | Enable the port security function
Configure the port security rule | Configure the MAC rule
 | Configure the IP rule
 | Configure the MAX rule
 | Configure the STICKY rule
Configure the STICKY rule learn mode | Configure the STICKY rule learn mode
Configure the aging function of the static MAC address | Enable the aging function of the static MAC address
 | Configure the age time of the static MAC address
Configure the processing mode when receiving the invalid packet | Configure the processing mode when receiving the invalid packet
Configure the interval of sending the log when receiving the invalid packet | Configure the interval of sending the log when receiving the invalid packet


2.2.1 Configure Basic Functions of Port Security

In the configuration tasks of the port security, you should first enable the port security so that the configuration of the other functions can take effect.

Configuration Condition

None

Enable Port Security Function

After enabling the port security and if not configuring any port security rule, the port cannot learn the MAC address.

Table 2‑2 Configure the basic functions of the port security

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port.
Enable the port security function | port-security enable | Mandatory By default, the port security function is not enabled.

l The port security and 802.1x function cannot be used on one port at the same time.

l The port security and DAI (Dynamic ARP Inspection) cannot be used on one port at the same time.


2.2.2 Configure Port Security Rule

Configuration Condition

Before configuring the port security rule, first complete the following task:

l Enable the port security function

Configure MAC Rule

If hoping to control whether the terminal can communicate via the MAC address, the user can adopt the MAC rule. The permit packet can be forwarded and the refuse packet is dropped.

Table 2‑3 Configure the MAC rule

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port.
Configure the MAC rule whose action is permit | port-security permit mac-address mac-address-value [ desc security-rule-description | ip-address ip-address-value [ desc security-rule-description ] | vlan-id vlan-id [ desc security-rule-description ] ] | Either By default, the MAC rule is not configured in the port.
Configure the action as the refused MAC rule | port-security deny mac-address mac-address-value [ ip-address ip-address-value | vlan-id vlan-id ]

Configure IP Rule

If hoping to control whether the terminal can communicate via the IP address, the user can use the IP rule and the packets whose matching action is the permit rule can be forwarded. The packets whose matching action is the refuse rule are dropped.

Table 2‑4 Configure the IP rule

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port.
Configure the IP rule whose action is permit | port-security permit ip-address ip-address-value [ to ip-address-value ] | Either By default, the IP rule is not configured in the port.
Configure the IP rule whose action is refuse | port-security deny ip-address ip-address-value [ to ip-address-value ]

l The port security serves as the role of the security access at the data link layer. For the current supported rules involving IP, such as MAC+IP, and IP, once the effective entry is generated, the subsequent packet can be forwarded normally as long as matching the generated MAC+VLAN entry, and do not check the IP address.

Configure MAX Rule

In the port enabled with the port security function, if hoping that the connected terminal not matching the MAC rule or IP rule also can communicate, the user can configure the MAX rule, the rule limits the number of the permitted access terminals.

Table 2‑5 Configure the MAX rule

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port.
Configure the MAX rule | port-security maximum maximum-number | Mandatory By default, the number of the MAC addresses permitted to be learned by the MAX rule is 0.

l The number of the dynamic addresses actually learned by the MAX rule is limited by the port, VLAN and the number of the system MAC addresses.

Configure STICKY Rule

If hoping that the MAC address and the VLAN information of the terminal permitted by the MAX rule can be saved in the configuration, the user can enable the STICKY function on the device so that the entries learned by the device via the MAX rule can be converted to the STICKY rule. After converting, the user can adjust the MAX rule quantity via the number of the current STICKY rules so that only the terminals matching the STICKY rule can communicate. In this way, the device can automatically learn the MAC address of the access terminal, convert to the STICKY rule, and save in the configuration, avoiding the operation of configuring the MAC rule manually.

Table 2‑6 Configure the STICKY rule

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port.
Configure the MAX rule | port-security maximum maximum-number | Mandatory By default, the number of the dynamic MAC addresses permitted to be learned by the MAX rule is 0. The STICKY rule can be configured only after configuring the number of the MAX rules.
Enable the STICKY function | port-security permit mac-address sticky | Mandatory By default, the STICKY function is disabled. The STICKY rule can be configured only after enabling the STICKY function.
Configure the STICKY rule | port-security permit mac-address sticky [ mac-address-value[ desc security-rule-description | vlan-id vlan-id [ desc security-rule-description ] ] ] | Mandatory By default, the STICKY rule is not configured in the port.


2.2.3 Configure STICKY Rule Learning Mode

Configuration Condition

Before configuring the STICKY rule learning mode, first complete the following task:

l Enable the port security function

Configure STICKY Rule Learning Mode

If hoping to perform the STICKY learning by MAC or MAC+VLAN, the user can configure the STICKY rule learning mode to MAC mode. If hoping to perform the STOCKY rule learning by MAC+IP, the user can configure the STICKY rule learning mode to MAC+IP mode.

Table 2‑7 Configure the STICKY rule learning mode

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port.
Configure the STICKY rule learning mode | port-security permit mac-address sticky mode { mac | mac-ip } | Mandatory By default, the STICKY rule learning mode is MAC mode.


2.2.4 Configure Aging Function of Static MAC Address

Configuration Condition

Before configuring the aging function of the static MAC address, first complete the following task:

l Enable the port security function

Enable Aging Function of Static MAC Address

To detect whether the terminal of the effective entry of the MAC rule or IP rule is online, the user can enable the aging function of the static MAC address. After the aging function of the static MAC address and if it is detected that the terminal is offline, the effective entry of the terminal is deleted so that the chip resources can be released.

Table 2‑8 Enable the aging function of the static MAC address

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port.
Enable the aging function of the static MAC address | port-security aging static | Mandatory By default, the aging function of the static MAC address is disabled.

Configure Age Time of Static MAC Address

The user can configure the reasonable age time according to the actual network environment configuration. In the general application, just keep the default value.

Table 2‑9 Configure the age time of the static MAC address

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port.
Configure the age time of the static MAC address | port-security aging time time-value | Mandatory By default, the age time of the static MAC address is 1 minute.


2.2.5 Configure Processing Mode when Receiving Invalid Packet

Configuration Condition

Before configuring the processing mode when receiving the invalid packet, first complete the following task:

l Enable the port security function

Configure Processing Mode when Receiving Invalid Packet

The port security provides three kinds of processing modes for the invalid packet, that is, protect, restrict and shutdown. The user can select according to the security requirement. The specific functions of the three processing modes are as follows:

l protect: After receiving the invalid packet, drop the packet.

l restrict: After receiving the invalid packet, drop the packet and trap the information to the NMS.

l shutdown: After receiving the invalid packet, drop the packet, disable the port receiving the packet and trap the information to the NMS.

Table 2‑10 Configure the processing mode when receiving the invalid packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port.
Configure the processing mode of the invalid packet | port-security violation { protect | restrict | shutdown } | Mandatory By default, the processing mode when the port security receives the invalid packet is protect.


2.2.6 Configure the Interval of Sending the Log When Receiving Invalid Packet

Configuration Condition

Before configuring the interval of sending the log when receiving the invalid packet, first complete the following task:

l Enable the interface security function.

Configure the Interval of Sending the Log When Receiving Invalid Packet

The user can configure the interval of sending the log based on the actually received invalid packet. In the general application, just reserve the default value.

Table 2‑11 Configure the the interval of sending the log when receiving the invalid packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the interval of sending the log when receiving the invalid packet | port-security violation log-interval log-interval-value | Mandatory By default, the interval of sending the log when the interface receives the invalid packet securely is 5s.


2.2.7 Monitoring and Maintaining of Port Security

Table 2‑12 Monitoring and maintaining of the port security

Command | Description
clear port-security statistics | Clear the statistics information of the sent and received packets
show port-security | Display the summary information of the port configured with the port security
show port-security ip-address | Display the configured IP rule
show port-security mac-address | Display the configured MAC rule and STICKY rule
show port-security active-address | Display the information of all effective entries
show port-security detect-mac | Display the current detected new MAC entry
show port-security violation log-interval | Display the period of printing the log when detecting the invalid MAC entry
show port-security violation-mac | Display the detected invalid MAC entry
show port-security statistics | Display the statistics information of the received and sent packets


2.3 Typical Configuration Example of Port Security


2.3.1 Configure MAC and IP Rule of Port Security

Network Requirements

l PC1, PC2 and the network printer are connected to the server via Device.

l Configure the port security function on Device, permitting PC1 to pass and refusing PC2 to pass; permit the network printer to execute the printing tasks delivered by the server and PC1 user.

Network Topology

Figure 2–1 Networking of configuring port security MAC and IP rule

Configuration Steps

Step 1:

Configure VLAN.

#Create VLAN.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

#Configure the port link type on gigabitethernet0/1-gigabitethernet0/3 of Device as Access, permitting the services of VLAN2 to pass.

Device(config)#interface gigabitethernet 0/1-0/3

Device(config-if-range)#switchport mode access

Device(config-if-range)#switchport access vlan 2

Device(config-if-range)#exit

Step 2:

Configure the port security function.

#Configure the MAC+IP rule on gigabitethernet0/1 of Device, permitting PC1 to pass; configure the IP rule, refusing PC2 to pass.

Device#config terminal

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#port-security enable

Device(config-if-gigabitethernet0/1)#port-security permit mac-address 3883.45ef.7984 ip-address 199.0.0.1

Device(config-if-gigabitethernet0/1)#port-security deny ip-address 199.0.0.2

Device(config-if-gigabitethernet0/1)#exit

#Configure the MAC rule on gigabitethernet0/2 of Device, permitting the network printer to access the network.

Device(config)#interface gigabitethernet 0/2

Device(config-if-gigabitethernet0/2)#port-security enable

Device(config-if-gigabitethernet0/2)#port-security permit mac-address 3883.45ef.f395

Device(config-if-gigabitethernet0/2)#exit

Step 3:

Check the result.

#View the effective entries of the port security on Device. The user can see that the MACs of PC1 and the network printer are written to the effective entries of the port security.

Device#show port-security active-address

-----------------------------------------------------------------------------------------

Entry Interface MAC address VID IP Addr Derivation Age(Sec)

-----------------------------------------------------------------------------------------

1 gi0/1 38:83:45:EF:79:84 2 199.0.0.1 MAC+IP 0

2 gi0/2 38:83:45:EF:F3:95 2 199.0.0.3 MAC 0

#With the detection, we can see that PC1 can access the server and the network printer can execute the printing task delivered by PC1 and the server.

#With the detection, we can see that PC2 cannot ping the server or the network printer.


2.3.2 Configure MAC Rule of Port Security

Network Requirements

l PC1, PC2, and PC3 are connected to the server via Device; PC and the server are in the same LAN.

l Configure the port security rule on Device, permitting PC1 and PC2 to access the server and refusing PC3 to access the server.

Network Topology

Figure 2–2 Networking of configuring the MAX rule of the port security

Configuration Steps

Step 1:

Configure VLAN.

#Create VLAN.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

#Configure the port link type on gigabitethernet0/1-gigabitethernet0/2 of Device as Access, permitting the services of VLAN2 to pass.

Device(config)#interface gigabitethernet 0/1-0/2

Device(config-if-range)#switchport mode access

Device(config-if-range)#switchport access vlan 2

Device(config-if-range)#exit

Step 2:

Configure the port security rule on Device.

#Configure the MAX rule on gigabitethernet0/1 of Device. The maximum number of the MAC rules is 2.

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#port-security enable

Device(config-if-gigabitethernet0/1)#port-security maximum 2

Device(config-if-gigabitethernet0/1)exit

Step 3:

Check the result.

#PC1 and PC2 first communicate with the server, and both can access the server normally. PC3 cannot access the server any more. View the security effective entries of Device port gigabitethernet0/1, and you can see that the MAC addresses of PC1 and PC2 are written into the port security effective entries.

Device#show port-security active-address

-----------------------------------------------------------------------------------------

Entry Interface MAC address VID IP Addr Derivation Age(Sec)

-----------------------------------------------------------------------------------------

1 gi0/1 00:50:ba:0c:89:a3 2 --- FREE 0

2 gi0/1 38:83:45:EF:79:84 2 --- FREE 0

Total Mac Addresses for this criterion: 2


2.3.3 Configure STICKY Rule of Port Security

Network Requirements

l PC1, PC2 and PC3 are connected to the server via Device; they are in the same LAN as the server.

l Configure the port security rule on Device, permitting two PCs to pass.

l After saving the configuration and restarting Device, the STICKY rule can take effect at once.

Network Topology

Figure 2-3 Networking of configuring the STICKY rule of the port security

Configuration Steps

Step 1:

Configure VLAN.

#Create VLAN.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

#Configure the port link type on gigabitethernet0/1-gigabitethernet0/2 of Device as Access, permitting the services of VLAN2 to pass.

Device(config)#interface gigabitethernet 0/1-0/2

Device(config-if-range)#switchport mode access

Device(config-if-range)#switchport access vlan 2

Device(config-if-range)#exit

Step 2:

Configure the MAX rule of the port security on Device.

#Configure the MAX rule on gigabitethernet0/1 of Device. The maximum number of the MAX rules is 2.

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#port-security enable

Device(config-if-gigabitethernet0/1)#port-security maximum 2

Device(config-if-gigabitethernet0/1)exit

Step 3:

Configure the STICKY rule of the port security on Device.

#Enable the STICKY function on gigabitethernet0/1 of Device.

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#port-security permit mac-address sticky

Device(config-if-gigabitethernet0/1)#exit

Step 4:

Check the result.

#PC1, PC2 and PC3 try to communicate with the server. View the effective entries of the port security on gigabitethernet0/1 of Device and you can see that the rule type on gigabitethernet0/1 is STICKY.

Device#show port-security active-address

-----------------------------------------------------------------------------------------

Entry Interface MAC address VID IP Addr Derivation Age(Sec)

-----------------------------------------------------------------------------------------

1 gi0/1 38:83:45:EF:79:84 2 199.0.0.1 STICKY 0

2 gi0/1 38:83:45:EF:F3:95 2 199.0.0.3 STICKY 0

Total Mac Addresses for this criterion: 2

#After saving the configuration and restarting the device, the STICKY rule exists and takes effect.

Device#show port-security active-address

-----------------------------------------------------------------------------------------

Entry Interface MAC address VID IP Addr Derivation Age(Sec)

-----------------------------------------------------------------------------------------

1 gi0/1 38:83:45:EF:79:84 2 199.0.0.1 STICKY 0

2 gi0/1 38:83:45:EF:F3:95 2 199.0.0.3 STICKY 0

Total Mac Addresses for this criterion: 2


3 AAA


3.1 Overview

AAA refers to Authentication, Authorization, and Accounting. Since the network appeared, Authentication, Authorization, and Accounting mechanism has become the basis of the network operation. The using of the resources in the network needs to be managed by Authentication, Authorization, and Accounting. AAA adopts the client/server architecture. The client runs on NAS (Network Access Server) and the server manages the user information in a centralized manner. For the user, NAS is the server; for the server, NAS is the client.

Authentication means to authenticate the user when using the resources in the network system. During the process, get the ID information by interacting with the user and then submit to the authentication server; the latter checks and processes the ID information with the user information saved in the database, and then confirm whether the user ID is correct according to the processing result. Authorization means that the authorized user of the network system uses its resources by the specified mode. The process specifies the services and authorities that the authenticated user can use and own after being connected to the network, such as the authorized IP address. Accounting means that the network system collects and records the using of the user for the network resources, so as to charge the user for the network using fees, or used for auditing.

RADIUS is one protocol of the C/S architecture. Its client is the NAS server at first. RADIUS protocol authentication mechanism is flexible and can adopt PAP, CHAP or Unix login authentication mode. RADIUS is one expansible protocol and all its work is based on the vector of Attribute-Length-Value. The basic work principle of RADIUS is: The user is connected to NAS; NAS uses Access-Require packet to submit the user information to the RADIUS server, including user name, password, and so on. The user password is encrypted via MD5. The two parties use the share key, which is not spread via the network. RADIUS server checks the validity of the user name and password and provides one Challenge if necessary, requiring the further authentication for the user. We also can perform the similar authentication for NAS. If valid, return the Access-Accept packet to NAS, permitting the user to perform the next work. Otherwise, return the Access-Reject packet, refusing the user access. If permitting the access, NAS initiates the statistics request Account-Require to the RADIUS server. RADIUS server replies Account-Accept, beginning the statistics for the user. Meanwhile, the user can perform its own operations.

TACACS is one old authentication protocol for the Unix network. It permits the remote access server to transit the user login password to the authentication server. The authentication server decides whether the user can log in to the system. TACACS is one encryption protocol, but its security is poorer that TACACS+ and RADIUS. In fact, TACACS+ is one new protocol. TACACS+ and RADIUS replaces the earlier protocol in the present network. TACACS+ uses TCP, while RADIUS uses UDP. RADIUS combines the authentication and authorization from the user aspect, while TACACS+ separates the two operations.


3.2 AAA Function Configuration

Table 3‑1 The configuration list of the AAA function

Configuration Task
Configure the AAA basic functions | Enable the AAA function
Configure the maximum concurrent requests of AAA | Configure the maximum concurrent requests of AAA
Configure the detection function of the AAA server | Configure the detection function of the AAA server
Configure the AAA authentication function | Configure the login authentication prompt information
 | Configure the login authentication method list
 | Configure the authentication method list in privileged mode
 | Configure the PPP authentication method list
 | Configure the connection authentication method list
 | Configure the XAUTH authentication method list
Configure the AAA authorization function | Configure the command authorization method list
 | Configure the SHELL authorization method list
 | Configure the network service authorization method list
 | Configure enabling the Console authorization
Configure the AAA statistics function | Configure the command statistics method list
 | Configure the SHELL statistics method list
 | Configure the network service statistics method list
 | Configure the system event statistics method list
 | Configure the connection statistics method list
 | Configure disabling the null user name statistics
 | Configure sending the statistics update packet
Configure the RADIUS scheme | Configure the RADIUS server
 | Configure the RADIUS server group
Configure the TACACS scheme | Configure the TACACS server
 | Configure the TACACS server group


3.2.1 Configure AAA Basic Functions

In the configuration tasks of AAA, you should first enable the AAA function so that the other functions can be configured.

Configuration Condition

None

Enable AAA Function

Enable the AAA function. Enable the AAA configuration command.

Table 3‑2 Enable the AAA function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enable the AAA function | aaa new-model | Mandatory By default, the AAA function is not enabled.


3.2.2 Configure Maximum Concurrent Requests of AAA

Configuration Condition

Before configuring the maximum concurrent requests of AAA, first complete the following configuration:

l Enable the AAA function

Configure Max. Concurrent Requests of AAA

Configure the maximum concurrent processed requests of AAA and the processing mode of AAA is concurrent processing. There may be multiple requests being processed at the same time. Specify the maximum number of the requests being processed at the same time via the configuration.

Table 3‑3 Configure the maximum concurrent requests of AAA

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the maximum concurrent requests of AAA | aaa concurrent con-num | Optional By default, the number of the maximum concurrent AAA requests is 600.


3.2.3 Configure the Detection Function of the AAA Server

Configuration Condition

Before configuring the AAA server detection function, first complete the following configuration:

l Enable the AAA function

Configure the AAA Server Detection Function

To configure the detection function for the RADIUS server, permit the NAS device to send the detection packet to the RADIUS server periodically.

Table 3‑4 Configure the AAA server detection function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the AAA server detection function | aaa server detect periodic periodic-interval | Optional By default, do not enable the function.

l Configuring the AAA server detection function only supports detecting the RADIUS server.


3.2.4 Configure AAA Authentication Function

AAA provides a series of authentication modes to ensure the security of the device and network services. For example, authenticate the user login, preventing the invalid user from operating the device; authenticate the user entering the privilege mode, limiting the using authority of the user for the device; authenticate the PPP session connection, limiting the setup of the invalid connection.

Configuration Condition

To configure the AAA authentication function, first complete the following configuration:

l Enable the AAA function

Configure Login Authentication Prompt Information

The login authentication prompt information includes the welcome information displayed by the device, authentication failure prompt information, and the prompt information of the user inputting user name and password.

Table 3‑5 Configure the login authentication prompt information

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the login welcome information | aaa authentication banner banner | Optional By default, the displayed login welcome information is User Access Verification.
Configure the login failure prompt information | aaa authentication fail-message fail-message | Optional By default, The login failure prompt information is “Access denied!”
Configure the prompt information when inputting the user name | aaa authentication username-prompt username-prompt | Optional By default, the prompt information when inputting the user name is “login:”
Configure the prompt information when inputting the password | aaa authentication password-prompt password-prompt | Optional By default, the prompt information when inputting the password is “password:”.

l When logging in to the device, the displayed welcome information and login failure prompt information adopt the same characters as the head and end indicating characters. For example, if hoping that the output welcome information displays as “welcome”, the input banner is “^welcome^”. “^” is the head and end indicting character.

Configure Login Authentication Method List

When the user logs in to the device, the device prompts the user to input the user name and password. AAA can use aaa authentication loginto authenticate the user ID.

Table 3‑6 Configure the login authentication method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the login authentication method list | aaa authentication login { default | list-name } { none / enable / local / line / radius / tacacs / group-name } | Optional By default, the login authentication method list is not configured.

l When using, it is necessary to use with the login authenticationcommand in the line configuration mode, making the method list be used for the user login and ID authentication.

l It is suggested that the user configures multiple methods to authenticate and the last one uses the none method. This can ensure that the user still can log in to the device after all methods become invalid.

Configure Privileged Authentication Method List

After the user logs in to the device successfully, AAA can authenticate the user that inputs the enable command to enter the privileged mode, preventing the un-authenticated user from entering the privileged mode.

Table 3‑7 Configure the privileged authentication method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the privileged authentication method list | aaa authentication enable default { none / enable / line / radius / tacacs / group-name } | Optional By default, the privileged authentication method list is not configured.

l When using the RADIUS authentication method, use the password in the $enabLEVEL$ format as the authentication password. LEVEL indicates the user level the current user enters. The value range is 0-15 and 15 is the highest level.

Configure PPP Authentication Method List

In the PPP environment, when the PPP user wants to set up the session with the peer, the peer can authenticate the connection request of the PPP user via the specified authentication method.

Table 3‑8 Configure the PPP authentication method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the PPP authentication method list | aaa authentication ppp { default | list-name } { none / local / radius / tacacs / group-name } | Optional By default, the PPP authentication method list is not configured.

l When using, it is necessary to configure the ppp authenticationcommand in the PPP interface to reference the method list. For the configuration, refer to the PPP configuration manual.

Configure Connection Authentication Method List

In the 802.1x environment, when the 802.1x user wants to set up the session with the peer, the peer can authenticate the connection request of the 802.1x user via the specified authentication method.

Table 3‑9 Configure the connection authentication method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the connection authentication method list | aaa authentication connection { default | list-name } { none / local / radius / tacacs / group-name } | Optional By default, the connection authentication method list is not configured.

Configure XAUTH Authentication Method List

The user can authenticate the IKE connection by configuring the authentication method list.

Table 3‑10 Configure the XAUTH authentication method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the XAUTH authentication method list | aaa authentication xauth { default | list-name } { none / local / radius / tacacs / group-name } | Optional By default, do not configure the XAUTH authentication method list.


3.2.5 Configure AAA Authorization Function

After authenticating successfully, the AAA authorization function can control the access of the user for the network resources, limiting the user from accessing the un-authorized network resources.

Configuration Condition

To configure the AAA authorization function, first complete the following configuration:

l Enable the AAA function

Configure Command Authorization Method List

The device has the commands of 0-15 levels. The command authorization is to confirm the command level used by the user via the authorization method, limiting the user from using the command higher than the current level.

Table 3‑11Configure the command authorization method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the command authorization method list | aaa authorization commands cmd-lvl { default | list-name } { if-authenticated / local / none / radius / tacacs / group-name } | Mandatory By default, the command authorization method list is not configured.
Enable the command authorization | aaa authorization config-commands | Mandatory By default, the command authorization function is disabled.

l When using, it is necessary to use with the authorization command in the line configuration mode, making the method list be used for the user login and ID authentication.

l The configurations of the command aaa authorization commands and aaa authorization config-commands has no order.

Configure SHELL Authorization Method List

After the user logs in to the device, authorize the current user, including the user level, SHELL timeout, the command of level-1 user, and so on.

Table 3‑12 Configure the SHELL authorization method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the SHELL authorization command method list | aaa authorization exec { default | list-name } { if-authenticated / local / none / radius / tacacs / group-name } | Mandatory By default, the SHELL authorization command method list is not configured.

l When using, it is necessary to use with the authorization command in the line configuration mode, making the authorization method list be used for the user login and ID authentication.

Configure Network Service Authorization Method List

After configuring the network service authorization method list and when the user runs the network service, perform the authorization to decide the authority of the user using the network service.

Table 3‑13 Configure the network service authorization method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the network service authorization method list | aaa authorization network { default | list-name } { if-authenticated / local / none / radius / tacacs / group-name } | Mandatory By default, the network service authorization method list is not configured.

l When using, it is necessary to reference the authorization method list in the specified network service. Currently, support the PPP and other network protocols.

Configure Enabling Console Authorization

If it is necessary to perform the access limitation for the Console port, we can enable the Console port authorization and then the device uses the SHELL authorization method lost to authorize.

Table 3‑14 Configure enabling the Console authorization

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure enabling the Console authorization | aaa authorization console | Mandatory By default, the Console authorization is not enabled.


3.2.6 Configure AAA Statistics Function

We can adopt the customized method to measure the information about the user using the command on the device, login session, network service status, and system event. The statistics result can serve as the basis of the user accounting.

Configuration Condition

To configure the AAA statistics function, first complete the following configuration:

l Enable the AAA function

Configure Command Statistics Method List

When the user logs in to the device and operates the command, we can measure the executed commands by configuring the command statistics method list.

Table 3‑15 Configure the command statistics method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the command statistics method list | aaa accounting commands cmd-lvl { default | list-name } { none | { start-stop [ broadcast ] { tacacs / group-name } } } | Mandatory By default, the command statistics method list is not configured.

l When using, it is necessary to use with the accounting commands command in the line configuration mode, making the statistics method be applied to the terminal the user logs in.

l Only the TACACS method supports the command statistics.

Configure SHELL Statistics Method List

After logging in to the device, the user can configure the SHELL statistics method to measure the user login information.

Table 3‑16 Configure the SHELL statistics method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the SHELL statistics method list | aaa accounting exec { default | list-name } { none | { start-stop | stop-only | wait-start [ broadcast ] { radius / tacacs / group-name } } } | Mandatory By default, the SHELL statistics method list is not configured.

l To perform the statistics work as little as possible, you can use the key word stop-only, sending the stop statistics packet only when the requested user session ends.

l To understand more detailed statistics information, you can use the key word start-stop so that the device uses RADIUS or TACACS to send the statistics packet when the requested session starts and the end packet when the session ends.

l To get larger control authority for the statistics, you can use wait-start to ensure that the user session request can get permission only after the RADIUS or TACACS server receives the start packet.

l When using, it need to use with the command accounting exec in the line configuration mode, making the statistics method list be applied to the terminal the user logs in to.

Configure Network Service Statistics Method List

After logging in to the device, the user can configure the network service statistics method list to measure the network services used by the user (such as PPP).

Table 3‑17 Configure the network service statistics method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the network service statistics method list | aaa accounting network { default | list-name } { none | { start-stop | stop-only | wait-start [ broadcast ] { radius / tacacs / group-name } } } | Mandatory By default, do not measure the network services.

l In the PPP environment, it is necessary to use with the ppp accounting command in the PPP interface, making the statistics method list be applied to the specified PPP connection.

Configure System Event Statistics Method List

The user can send the system starting and restarting events to the server for statistics by configuring the system event statistics method list.

Table 3‑18 Configure the system event statistics method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the system event statistics method list | aaa accounting system default { none | { start-stop [ broadcast ] { tacacs / group-name } } } | Mandatory By default, do not measure the system events.

l The system event statistics only supports the TACACS protocol, but does not support the RADIUS protocol.

Configure Connection Statistics Method List

The user can send the 802.1x event to the server for statistics by configuring the connection statistics method list.

Table 3‑19 Configure the connection statistics method list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the connection statistics method list | aaa accounting connection default { none | { start-stop | stop-only | wait-start [ broadcast ] { radius / tacacs / group-name } } } | Mandatory By default, do not measure the connections.

Configure Disabling Null User Name Statistics

The user can disable the enabled function of measuring the users with null user names by configuring the aaa accounting suppress null-usernamecommand.

Table 3‑20 Configure disabling the null user name statistics

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure disabling the null user name statistics | aaa accounting suppress null-username | Mandatory By default, enable the statistics for the null user names

Configure Sending Statistics Update Packets

The user can configure the mode of sending the statistics update packets, including the real-time sending and periodical sending.

Table 3‑21 Configure sending statistics update packets

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure sending the statistics update packets | aaa accounting update { newinfo | periodic interval } | Mandatory By default, do not send the statistics update packet.


3.2.7 Configure RADIUS Scheme

To configure the RADIUS scheme, you need to complete the configuration of the key parameters of the server/server group.

Configuration Condition

To configure the RADIUS scheme, first complete the following configuration:

l Enable the AAA function

Configure RADIUS Server

When AAA needs to use RADIUS to perform the authentication, authorization, and statistics, it is necessary to configure the RADIUS server parameters, including server IP address, authentication/authorization port, statistics port, shared key, and so on.

Table 3‑22 Configure the RADIUS server

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the RADIUS server | radius-server host ip-address [ acc-port acc-port-num ] [ auth-port auth-port-num ] [ priority priority ] [ key [ 0 | 7 ] key ] | Mandatory By default, the RADIUS server is not configured.
Configure the RADIUS dead time | radius-server dead-time dead-time | Optional By default, the dead time of the RADIUS server is 0.
Configure the RADIUS shared key | radius-server key [ 0 | 7 ] key | Optional By default, the RADIUS encrypted key is not configured.
Configure the maximum re-transmission times of RADIUS | radius-server retransmit retries | Optional By default, the maximum times of re-transmitting to the RADIUS server is 3.
Configure the response timeout of the RADIUS server | radius-server timeout timeout | Optional By default, the timeout of waiting for the RADIUS server response is 5s.
Configure the selected interface of the RADIUS source address | ip radius source-interface interface-name [ vrf vrf-name ] | Optional By default, the source interface of interacting with the RADIUS server is not configured.
Configure not to check the tag identifier when parsing the tunnel property sent by the RADIUS server | radius-server tunnel without-tag | Optional By default, the tag identifier is required when parsing the tunnel property sent by the RADIUS server.
Configure the value of the service-type property in the login authentication RADIUS packet | radius login service-type attr-value | Optional By default the service-type value in the RADIUS packet is 7.
Configure the maximum concurrent packets of the NAS device and RADIUS server | radius control-speed pck-num | Optional By default, the number of the maximum concurrent packets of the NAS device and RADIUS server is 100.
Configure the session association field of the session between the NAS device and RADIUS server as state | radius session state | Optional By default, the session association field of the session between the NAS device and RADIUS server is session-id.
Configure the communication between the NAS device and the RADIUS server to use the fixed source port | radius source-port fixed | Optional By default, the communication between the NAS device and the RADIUS server uses the random port.

l We can execute the radius-server host command for many times to configure multiple RADIUS servers. The device selects the server to authenticate according to the configuration order. After one server fails, the device automatically selects the next server.

l The device selects the order of using the RADIUS server according to the configured priority value.

l The dead time means: The device remarks the RADIUS server that does not answer the authentication request as unavailable and does not send request during the dead time.

l The configured share keys on the device and the RADIUS server should be consistent.

Configure RADIUS Server Group

Configure the RADIUS server group. When configuring the method list, reference the server group name and then you can use the RADIUS server group to authenticate, authorize and measure the user.

Table 3‑23 Configure the RADIUS server group

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the RADIUS server group name | aaa group server radius group-name | Mandatory By default, the RADIUS server group name is not configured.
Configure adding the global server to the server group | server ip-address [ auth-port auth-port-num ] [ acct-port acct-port-num ] | Optional By default, the global server is not added to the server group.
Configure the private RADIUS server | server-private ip-address [ acc-port acc-port-num ] [ auth-port auth-port-num ] [ key [ 0 | 7 ] key ] [ priority priority ] | Optional By default, the private RADIUS server is not configured.
Configure the VRF attribute of the RADIUS server group | ip vrf forwarding vrf-name | Optional By default, the VRF attribute of the RADIUS server group is not configured.

l When configuring the RADIUS server group name, there should be as clear meaning as possible and avoid using the key words that may cause confusion. For example, tac, rad, and loc may be confused with tacacs, radius, and local when configuring the method list.

l The private server is completely independent from the global configured server, so it can be the same as the global configured server.

l Select at least one of private server and global server to configure.


3.2.8 Configure TACACS Scheme

To configure the TACACS scheme, we need to configure the key parameters of the server/server group.

Configuration Condition

To configure the TACACS scheme, first complete the following configuration:

l Enable the AAA function

Configure TACACS Server

After configuring the TACACS server and if AAA needs to use the TACACS method to authenticate, authorize, and measure, we need to configure the parameters of the TACACS server, including the server IP address, share key, server port number and so on.

Table 3‑24 Configure the TACACS server

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the TACACS server | tacacs-server host ip-address [ key [ 0 | 7 ] key ] [ priority priority ] [ port port-num ] [ timeout timeout ] | Mandatory By default, the TACACS server is not configured.
Configure the TACACS share key | tacacs-server key [ 0 | 7 ] key | Optional By default, the TACACS share key is not configured.
Configure the timeout of the TACACS server response | tacacs-server timeout timeout | Optional By default, the timeout of waiting for the answer of the TACACS server is 5s.
Configure the interface selected by the TACACS source address | ip tacacs source-interface interface-name [ vrf vrf-name ] | Optional By default, the source interface interacting with the TACACS server is not configured.

l We can execute the tacacs-server host command for many times to configure multiple TACACS servers. The device selects the server to authenticate according to the configuration order. After one server fails, the device automatically selects the next server.

l The configured share keys on the device and the TACACS server should be consistent.

Configure TACACS Server Group

Configure the TACACS server group. When configuring the method list, reference the server group name and then you can use the TACACS server group to authenticate, authorize and measure the user.

Table 3‑25 Configure the TACACS server group

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the TACACS server group name | aaa group server tacacs group-name | Mandatory By default, the TACACS server group name is not configured.
Configure adding the global server to the server group | server ip-address | Optional By default, the TACACS server group member is not configured.
Configure the private TACACS server | server-private ip-address [ timeout timeout ] [ port port-num ] [ key [ 0 | 7 ] key ] [ priority priority ] | Optional By default, the private TACACS server is not configured.
Configure the VRF attribute of the TACACS server group | ip vrf forwarding vrf-name | Optional By default, the VRF attribute of the TACACS server group is not configured.

l When configuring the TACACS server group name, there should be as clear meaning as possible and avoid using the key words that may cause confusion. For example, tac, rad, and loc may be confused with tacacs, radius, and local when configuring the method list.

l The private server is completely independent from the global configured server, so it can be the same as the global configured server.

l Select at least one of private server and global server to configure.


3.2.9 AAA Monitoring and Maintaining

Table 3‑26 AAA monitoring and maintaining

Command | Description
show aaa | Display the AAA basic information
show aaa configure | Display the AAA configuration information
show aaa module | Display the AAA function module and the result of the module operating AAA at last
show aaa server [ radius | tacacs ] | Display the RADIUS/TACACS server configuration of AAA
show aaa session | Display the AAA statistics session
show aaa source-address | Display the source address used by AAA


3.3 AAA Typical Configuration Example


3.3.1 Configure Telnet User Login to Use Local Authentication

Network Requirement

Configure Device to use local authentication for Telnet user login

Network Topology

Figure 3-1 Networking of configuring Telnet user login to use local authentication

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Configure Device.

#Configure the user name as admin and password as admin.

Device#configure terminal

Device(config)#user admin password 0 admin

#Configure the AAA authentication as local authentication.

Device(config)#aaa new-model

Device(config)#aaa authentication login default local

#Configure the Telnet session and enable the AAA local authentication.

Device(config)#line vty 0 15

Device(config-line)#login authentication default

Device(config-line)#exit

Step 3:

Check the result.

When Telnet client logs in to Device, input the user name admin and password admin according to the prompt, and then log in to the Shell user interface of Device successfully.

Figure 3-2 Use the local authentication login


3.3.2 Configure Telnet User Login to Use RADIUS Authentication/Authorization and Statistics

Network Requirements

1. Device is connected to the Telnet and RADIUS server and the IP route is available.

2. The IP address of the RADIUS server is 2.0.0.2/24, the authentication/authorization port is 1812, the statistics port is 1813, and the share key is admin.

3. When Telnet user logs into Device, it is required to authenticate/authorize and measure via the RADIUS server.

4. When the RADIUS server fails, use the local authentication and authorization.

Network Topology

Figure 3-3 Networking of configuring Telnet user login to use RADIUS authentication/authorization and statistics

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Configure Device.

#Configure AAA and use the RADIUS authentication/authorization and statistics.

l Authentication and authorization first use the first method in the method list ; when the server fails, use the second method to authenticate and authorize.

Device#configure terminal

Device(config)#aaa new-model

Device(config)#aaa authentication login authen-list radius local

Device(config)#aaa authorization exec author-list radius local

Device(config)#aaa accounting exec account-list start-stop radius

#Configure RADIUS server, authentication port as 1812, statistics port as 1813 and share key as admin.

Device(config)#radius-server host 2.0.0.2 auth-port 1812 acct-port 1813 key admin

#Configure the Telnet session and enable the RADIUS authentication/authorization and statistics.

Device(config)#line vty 0 15

Device(config-line)#login authentication authen-list

Device(config-line)#authorization exec author-list

Device(config-line)#accounting exec account-list

Device(config-line)#exit

Step 3:

Configure the RADIUS server.

For the interface setting of the RADIUS server, refer to the help document of the server. The following lists the main steps.

#Add the user admin on the RADIUS server, set the password as admin and configure the user label as 15.

#Set the IP address of the server as 2.0.0.2, share key as admin, authentication/authorization port as 1812 and statistics port as 1813.

#Set the IP address of the client as 2.0.0.1 and the share key as admin.

Step 4:

Check the result, and verify the authentication/authorization and statistics.

#After Telnet user logs in to Device, authorize successfully, and use the show privilege command to view the user priority 15.

Figure 3-4Authorize the user priority as 15

#We can view the login and disconnection statistics information on the RADIUS server.


3.3.3 Configure Telnet User Level Switching to Use RADIUS Authentication

Network Requirements

1. Device is connected to the Telnet and RADIUS server and the IP route is available.

2. The IP address of the RADIUS server is 2.0.0.2/24, the authentication/authorization port is 1812, and the share key is admin.

3. When the user level switches from 1 to 3 after Telnet user logs in to Device, it is required to authenticate via RADIUS server.

Network Topology

Figure 3-5 Networking of configuring Telnet user level switching to use RADIUS authentication

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Configure Device.

#Configure the user level switching to use the RADIUS authentication.

Device#configure terminal

Device(config)#aaa new-model

Device(config)#aaa authentication enable default radius

#Configure the RADIUS server, authentication port as 1812 and share key as admin.

Device(config)#radius-server host 2.0.0.2 auth-port 1812 acct-port 1813 key admin

Step 3:

Configure the RADIUS server.

For the interface setting of the RADIUS server, refer to the help document of the server. The following lists the main steps.

#Add the user name $enab3$ with user level 3 and set the password as admin.

l User level switching is fixed to use the user name in the format of $enabLEVEL$ for authentication. LEVEL is the level that the user wants to switch to.

l When the user level is reduced, do not need authentication.

Step 4:

Check the result.

After Telnet user inputs the user name and password to log in according to the prompt, the user level is 1 by default. After executing the command enable 3, input the password admin. After being authenticated by RADIUS server successfully, the user level is switched to 3.

Figure 3–5 Switch Telnet user level from 1 to 3


3.3.4 Configure PPP User to Use RADIUS Authentication/Authorization/Accounting

Network Requirements

l Device2 is connected with the RADIUS server and connected to Device1 via the PDH network, and the IP route is reachable;

l The IP address of the RADIUS server is 2.0.0.2/24; the authentication/authorization port is 1812; the statistics port is 1813; the share key is admin;

l Device1 serves as the PPP client and authenticates, authorizes and gets the IP address via the RADIUS server when setting the PPP session connection with Device2;

l It is required that the setup and disconnection of the PPP session can be measured on the RADIUS server.

Network Topology

Figure 3-6 Networking of configuring the PPP user to use the RADIUS authentication/authorization and accounting

Configuration Steps

Step 1:

Configure Device1.

#Configure the interface encapsulation protocol as PPP and the IP address is negotiated automatically.

Device1#configure terminal

Device1(config)#interface serial1/0

Device1(config-if-serial1/0)#encapsulation ppp

Device1(config-if-serial1/0)#ip address negotiated

#Configure the PPP authentication user name as admin and the password as admin.

Device1(config-if-serial1/0)#ppp chap hostname admin

Device1(config-if-serial1/0)#ppp chap password admin

Device1(config-if-serial1/0)#exit

Step 2:

Configure Device2.

#Configure the PPP user to use the RADIUS authentication/authorization and accounting.

Device2#configure terminal

Device2(config)#aaa new-model

Device2(config)#aaa authentication ppp ppp-authen radius

Device2(config)#aaa authorization network ppp-author radius

Device2(config)#aaa accounting network ppp-accounting start-stop radius

#Configure the RADIUS server: the authentication/authorization port is 1812 ; the accounting port is 1813 and the share key is admin.

Device2(config)#radius-server host 2.0.0.2 auth-port 1812 acct-port 1813 key admin

#Configure the interface IP address. (omitted)

#Configure the encapsulation protocol of serial1/0 interface as PPP and provide the clock for the peer.

Device2(config)#interface serial1/0

Device2(config-if-serial1/0)#encapsulation ppp

Device2(config-if-serial1/0)#clock source internal

#Configure the serial1/0 interface to enable the RADIUS authentication/authorization and accounting.

Device2(config-if-serial1/0)#ppp authentication chap ppp-authen

Device2(config-if-serial1/0)#ppp authorization ppp-author

Device2(config-if-serial1/0)#ppp accounting ppp-accounting

Device2(config-if-serial1/0)#exit

Step 3:

Configure the RADIUS server.

For the interface setting of the RADIUS server, refer to the help document of the server. The following lists the main steps.

#Add the user name admin and the password is admin.

#Configure the IP address pool ppp-pool; the start and end IP addresses of the address pool are 1.0.0.2.

#Bind the IP address pool ppp-pool for the PPP user admin or the belonging user group.

Step 4:

Check the result.

#View the protocol status as UP on Device1 and get the IP address 1.0.0.2/32.

Device1#show interface serial1/0

serial1/0:

line protocol is up

Flags: (0x80080f1) POINT-TO-POINT MULTICAST RUNNING

Type: PPP

Internet address: 1.0.0.2/32

Destination Internet address: 1.0.0.1

Metric: 0, MTU: 1500, BW: 155000 Kbps, DLY: 20000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters never

input peak rate 575 bits/sec, 1 hour 21 minutes 47 seconds ago

output peak rate 188 bits/sec, 0 hour 3 minutes 26 seconds ago

5 minutes input rate 22 bits/sec, 0 packet/sec

5 minutes output rate 15 bits/sec, 0 packet/sec

5116 packets received; 1892 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

LCP:OPENED

IPCP:OPENED NDSPCP:OPENED

encap-type: simply PPP

rxFrames: 533634, rxChars 22001403

txFrames: 530195, txChars 21737969

rxNoOctet 0, rxAbtErrs 0, rxCrcErrs 0

rxOverrun 0, rxLenErrs 0, txUnderrun 0

DCD: UP

rate=2048000 bps

#On the RADIUS server, we can see the statistics information after the PPP session is set up and disconnected.


3.3.5 Configure TACACS Authorization and Statistics of Shell Command

Network Requirements

1. Device is connected to the Telnet and RADIUS server and the IP route is available.

2. The IP address of the RADIUS server is 2.0.0.2/24, the service port is 49, and the share key is admin.

3. After Telnet client logs in to Device, the operated shell command with user level 15 is required to be authorized via TACACS server and record the shell command to the TACACS server.

Network Topology

Figure 3–7 Networking of configuring the TACACS authorization and accounting of the Shell command

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Configure Device.

#Configure the TACACS command authorization and statistics.

l Before authorization and statistics, the authentication should be successful.

Device#configure terminal

Device(config)#aaa new-model

Device(config)#aaa authentication login shell tacacs

Device(config)#aaa authorization commands 15 cmd-author tacacs

Device(config)#aaa authorization config-commands

Device(config)#aaa accounting commands 15 cmd-accounting start-stop tacacs

#Configure the TACACS server, the service port is 49, and the share key is admin.

Device(config)#tacacs-server host 2.0.0.2 port 49 key admin

#Configure the Telnet session and enable the TACACS authorization and statistics.

Device(config)#line vty 0 15

Device(config-line)#login authentication shell

Device(config-line)#authorization commands 15 cmd-author

Device(config-line)#accounting commands 15 cmd-accounting

Device(config-line)#exit

Step 3:

Configure the TACACS server.

For the interface setting of the TACACS server, refer to the help document of the server. The following lists the main steps.

#Add the client 2.0.0.1 on the server, the share key is admin, and select “TACACS+(Cisco IOS)” authentication.

#Set the Shell command authorization for Telnet user admin. Permit the commands configure terminal, router ospf and router rip, and refuse the other commands.

Step 4:

Check the result.

#After Telnet user logs in to Device, execute the Shell command. The authorized command can be executed successfully and the un-authorized command authorization failed.

Device#configure terminal

% Enter configuration commands, one per line. End with CNTL+Z.

Device(config)#router ospf 100

Device(config-ospf)#exit

Device(config)#router rip

Device(config-rip)#exit

Device(config)#interface gigabitethernet 0/1

Command authorization failed

Device(config)#router bgp 100

Command authorization failed

#View the Shell command statistics information.

On the TACACS server, we can see the statistics information of the Shell command.


3.3.6 Configure RADIUS Server Group Service

Network Requirements

l Device is connected to the Telnet and RADIUS server and the IP route is available.

l The IP address of RADIUS 1 server is 2.0.0.2/24, the IP address of RADIUS 2 server is 2.0.0.3/24, the authentication/authorization port is 1812; the accounting port is 1813 and the share key is admin.

l The PPP user is connected to Device2 via the PDH network. When setting up the PPP connection, it is required to perform the authentication/authorization and accounting via the RADIUS 1 server; when the Telnet user logs into Device2, it is required to perform the authentication/authorization and accounting via the RADIUS 2 server.

Network Topology

Figure 3-8 Networking of configuring the RADIUS server group service

Configuration Steps

Step 1:

Configure the IP address of the device interface and the related parameters.

#Configure the encapsulation protocol of the serial1/0 interface of Device1 as PPP and the IP address is negotiated automatically.

Device1#configure terminal

Device1(config)#interface serial1/0

Device1(config-if-serial1/0)#encapsulation ppp

Device1(config-if-serial1/0)#ip address negotiated

#Configure the chap authentication of Device1.

Device1(config-if-serial1/0)#ppp chap hostname admin

Device1(config-if-serial1/0)#ppp chap password admin

Device1(config-if-serial1/0)#exit

#Configure the IP address of the interfaces on Device2 (omitted).

#Configure the encapsulation protocol of the serial1/0 interface of Device2 as ppp.

Device2#configure terminal

Device2(config)#interface serial1/0

Device2(config-if-serial1/0)#encapsulation ppp

Device2(config-if-serial1/0)#clock source internal

Device2(config-if-serial1/0)#exit

Step 2:

Configure the RADIUS commands on Device2.

#Configure the RADIUS server RADIUS 1 and RADIUS 2; the authentication port is 1812; the accounting port is 1813; the share key is admin.

Device2(config)#aaa new-model

Device2(config)#radius-server host 2.0.0.2 auth-port 1812 acct-port 1813 key admin

Device2(config)#radius-server host 2.0.0.3 auth-port 1812 acct-port 1813 key admin

#Configure RADIUS 1 to belong to the “aaa-ppp” server group and RADIUS 2 to belong to “aaa-telnet” server group.

Device2(config)#aaa group server radius aaa-ppp

Device2(config-sg-radius)#server 2.0.0.2 auth-port 1812 acct-port 1813

Device2(config-sg-radius)#exit

Device2(config)#aaa group server radius aaa-telnet

Device2(config-sg-radius)#server 2.0.0.3 auth-port 1812 acct-port 1813

Device2(config-sg-radius)#exit

#Configure the method of the “aaa-ppp” server group serving as the PPP authentication/authorization and accounting.

Device2(config)#aaa new-model

Device2(config)#aaa authentication ppp ppp-authen aaa-ppp

Device2(config)#aaa authorization network ppp-author aaa-ppp

Device2(config)#aaa accounting network ppp-accounting start-stop aaa-ppp

#Configure the method of the “aaa-telnet” server group serving as the Telnet authentication/authorization and accounting.

Device2(config)#aaa authentication login authen-list aaa-telnet

Device2(config)#aaa authorization exec author-list aaa-telnet

Device2(config)#aaa accounting exec account-list start-stop aaa-telnet

Step 3:

Configure the PPP session and Telnet login to enable the RADIUS authentication/authorization, accounting.

#Configure the PPP session to use the “aaa-ppp” server group to perform the authentication/authorization and accounting.

Device2(config)#interface serial1/0

Device2(config-if-serial1/0)#ppp authentication chap ppp-authen

Device2(config-if-serial1/0)#ppp authorization ppp-author

Device2(config-if-serial1/0)# ppp accounting ppp-accounting

Device2(config-if-serial1/0)#exit

#Configure the Telnet login to use the “aaa-telnet” server group to perform the authentication/authorization and accounting.

Device2(config)#line vty 0 15

Device2(config-line)#login authentication authen-list

Device2(config-line)#authorization exec author-list

Device2(config-line)#accounting exec account-list

Device2(config-line)#exit

Step 4:

Check the result.

#When the PPP user initiates the PPP connection to Device2, perform the authentication/authorization and accounting via the server RADIUS 1. We can view the accounting information on RADIUS1.

#When the Telnet user initiates the PPP connection to Device2, perform the authentication/authorization and accounting via the server RADIUS 2. We can view the accounting information on RADIUS2.


4 802.1X


4.1 Overview


4.1.1 802.1X

802.1X is a broadband access authentication solution put forward by IEEE in June, 2001. It defines the Port-Based Network Access Control. By utilizing LAN’s physical access features of IEEE 802 LAN, 802.1X provides a set of methods for authenticating and authorizing devices access connected to LAN ports via point-to-point.

The 802.1X system is the typical client/server structure, as shown in the following figure, including three entities: Supplicant system (client), Authentication system (authentication device), and Authentication server system (authentication server).

Figure 4-1 802.1X system architecture

l The client installation supports the client software of the 802.1X authentication, sending the authentication request to the authentication device. If authenticating successfully, connect to the network normally.

l The authentication device is between the client and the authentication server, controlling the network access of the client by interacting with the server.

l Usually, the authentication server is the RADIUS (Remote Authentication Dial-In User Service) server, used to verify the validity of the client and inform the authentication result to the authentication device. The authentication device controls the network access of the client according to the authentication result.

EAP (Extensible Authentication Protocol) used by the 802.1X authentication is one general protocol of the PPP authentication, used to interact the authentication information among the client, authentication device and authentication server. The 802.1X protocol uses EAPOL (EAP Over LAN) frame encapsulation format to encapsulate the EAP packet, realizing the interacting between the client and the authentication device. According to the different application scenarios, the 802.1X protocol encapsulates the EAP packet in the different frame formats, realizing the interacting between the authentication device and the authentication server. In the relay authentication mode, the EAP packet is encapsulated in the EAPOR (EAP Over RADIUS) frame format; in the terminating authentication mode, the EAP packet is encapsulated in the standard RADIUS frame format.

The 802.1X authentication mode includes relay authentication mode and terminating authentication mode.

The relay authentication flow is as follows:

Figure 4–2 802.1X relay authentication flow

The relay authentication flow is as follows:

l When the user has the network access requirement, enable the 802.1X client program, input the valid user name and password registered on the authentication server, and initiate the authentication request (EAPOL-Start packet). Here, the client program sends the request authentication packet to the authentication device and starts one authentication process.

l After the authentication device receives the data frame of requesting authentication, send one request frame (EAP-Request/Identity packet) to request the user client program to send the input user name.

l The client program answers the request sent by the authentication device, sending the user name information to the authentication device via the data frame (EAP-Response/Identity packet). The authentication device encapsulates the data frame sent by the client in the packet (RADIUS Access-Request packet) and sends to the authentication server for processing.

l After the RADIUS server receives the user name information forwarded by the authentication device, compare the information with the user name table in the database, find the corresponding information of the user name, and use one randomly-generated encrypting word to encrypt it. Meanwhile, send the encrypted word to the authentication device via the RADIUS Access-Challenge packet; the authentication device forwards it to the client program.

l After the client program receives the encrypted word forwarded by the authentication device (EAP-Request/MD5 Challenge packet), use the encrypted word to encrypt the password (the encryption algorithm is irreversible, generating the EAP-Response/MD5 Challenge packet), and forward to the authentication server via the authentication device.

l RADIUS authentication server compares the received encrypted password information (RADIUS Access-Request packet) with the local encrypted password information. If they are the same, regard the user as valid user and feed back the message of passing the authentication (RADIUS Access-Accept packet and EAP-Success packet);

l After the authentication device receives the message of passing the authentication, change the port to the authorized state, permitting the user to access the network via the port.

l The client also can send the EAPOL-Logoff packet to the authentication device, actively requesting offline. The authentication device changes the port status from authorized to un-authorized, and sends the EAP-Failure packet to the client.

The authentication needs the authentication device and authentication server to support the EAP protocol.

The terminating authentication flow is as follows:

Figure 4-3 802.1X terminating authentication flow

l The difference between the terminating authentication mode and relay authentication mode is: The random encrypting word used to encrypt the user password information is generated by the authentication device. And the authentication device sends the user name, random-encrypting word and password information encrypted by the client to the RADIUS server for authentication.

The terminating authentication mode is used by the authentication server that is deployed earlier and does not support the EAP protocol.

The authentication device supports two access control modes:

l Port-based access control mode (Portbased): After the first user in the port is authenticated successfully, the other access users can access the network without authentication, but after the first user gets offline, the other users also are refused to access the network.

l User-based access control mode (Macbased): All access users in the port need to be authenticated separately. After one user gets offline, only the user cannot access the network and the other users still can access the network.

Auto VLAN is also called Assigned VLAN. When the client passes the server authentication, the server delivers the authorized VLAN information to the authentication device. If the delivered VLAN exists on the authentication device and is valid, the authentication port is added to the delivered VLAN. After the client gets offline, the port restores to the un-authorized state. The port is deleted from the Auto VLAN and the default VLAN of the port restores to the previous configured VLAN.

After enabling Guest VLAN, the user also can and only can access the resources in the VLAN without authentication. After the user is authenticated successfully, the port leaves Guest VLAN and the user can access other network resources. Usually, the user can get the 802.1X client software in Guest VLAN to upgrade the client, or execute other application program (such as anti-virus software, operation system patch) upgrade. After enabling the 802.1X authentication and configuring Guest VLAN correctly, the port is added to Guest VLAN in Untagged mode. Here, the user in the port of Guest VLAN initiates authentication. If the authentication fails, the port is still in Guest VLAN; if the authentication succeeded, there are two cases:

l If the authentication server delivers one VLAN, the port leaves Guest VLAN and is added to the delivered VLAN. After the user gets offline, the port returns to Guest VLAN.

l If the authentication server does not deliver VLAN, the port leaves Guest VLAN and is added to the configured Config VLAN in the authentication device. After the user gets offline, the port returns to Guest VLAN.


4.1.2 Secure Channel Authentication

Based on the 802.1X authentication function, the secure channel authentication function can achieve both the 802.1X authentication and pioneer a secure channel for the specified end users. Thus, the end user can visit the resources in the specified network in the unauthentication mode or specify an end user to visit the network resources without authentication.


4.1.3 MAC Address Authentication

In the actual network, besides lots of terminal users, there may be some network terminals (such as network printer). The terminals do not carry or cannot install the 802.1X authentication client software and can use the free-client authentication mode to access the network. The authentication method does not need the user to install any 802.1X authentication client software. After the authentication device detects the MAC address of the user for the first time, the authentication device uses the configured user name and password or the user MAC address as the user name and password to send to the authentication server for authentication.

The user name and password format used by the MAC address authentication has two cases:

The MAC address serves as user name and password: Use the MAC address of the authenticated user as the user name and password;

Fixed user name and password: Use the configured user name and password on the authentication device.


4.2 802.1X Function Configuration

Table 4–1 802.1X function configuration list

Configuration Task
Configure the 802.1X authentication | Enable the 802.1X authentication
Configure the secure channel authentication | Enable the secure channel authentication function
 | Configure and apply the secure channel
Configure the 802.1X authentication and secure channel authentication | Configure the port authentication mode
 | Configure the multicast triggering function
 | Configure the re-authentication function
 | Configure the maximum authentication failure times of the port
 | Configure the function of omitting the IP field function in the user name
 | Configure the packet transparent-transmission function
 | Configure the keepalive function
 | Configure the EAPOU function
 | Configure the function of not waiting for the server response
 | Configure the domain name delimiter
 | Configure the format of the authentication user name
Configure the MAC address authentication | Enable the MAC address authentication function
 | Configure the MAC address authentication user name format
Configure the public attributes | Configure the controlled direction
 | Configure the authenticatable host list
 | Configure the IP authorization function
 | Configure the maximum sending times of the authentication request packet
 | Configure the maximum sending times of the authentication packet
 | Configure the authentication failure recording log function
 | Configure the ARP keepalive function
 | Configure the maximum users of the port
 | Configure the IP ACL prefix name
 | Configure the default valid VLAN
 | Configure the unauthenticated user to communicate in the VLAN which the PVID locates in
 | Configure the port access control mode
 | Configure Guest VLAN
 | Configure Guest ACL
 | Configure Critical VLAN
 | Configure the timer parameters
 | Restore the default configuration of the port
 | Configure the log recording step


4.2.1 Configure 802.1X Authentication Function

The 802.1X authentication and the MAC address authentication are allowed to be configured simultaneously on the same interface.

l If the authentication is successful when the end user first performs the MAC address authentication, the 802.1X authentication initiated by the end user will not be processed. Otherwise, the 802.1X authentication initiated by the end user will be processed normally.

l When the end user first initiates the 802.1X authentication, do not perform the MAC address authentication any more.

Configuration Condition

None

Enable 802.1X Authentication

To enable the 802.1X authentication function, the terminal user needs to install the client software with the 802.1X authentication function.

When configuring the 802.1X authentication parameters in the authentication device port and if the port does not enable the 802.1X authentication function, the configured function cannot take effect.

Table 4–2 Enable 802.1X

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enable the global 802.1X authentication | dot1x { enable | disable } | Optional By default, the global 802.1X authentication function is enabled.
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Enable the 802.1X authentication | dot1x port-control { enable | disable } | Mandatory By default, the 802.1X authentication function in the port is disabled.

l Do not enable the 802.1X authentication function and secure cahnnel authentication function simultaneously on one interface.

l The 802.1X authentication function and port security function can be enabled on one port at the same time, but it has the following restriction: The port cannot be configured with the IP rule and MAX rule of the port security.


4.2.2 Configure Secure Channel Authentication

Configuration Condition

None

Enable Secure Channel Authentication

Based on the 802.1X authentication function, the secure channel authentication function can achieve both the 802.1X authentication and pioneer a secure channel for the specified end users. Thus, the end user can visit the resources in the specified network in the unauthentication mode or specify an end user to visit the network resources without authentication.

Table 4–3 Enable the secure channel authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration can only take effect on the current interface. After entering the aggregation group configuration mode, the subsequent configuration can only take effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Enable the secure channel authentication | dot1x free-ip | Mandatory By default, the secure channel authentication function under the interface is disabled.

l Do not enable the secure channel authentication function and port security function simultaneously on one interface.

l Do not enable the 802.1X authentication function and secure channel authentication function simultaneously on one interface.

l Do not enable the MAC address authentication function and the secure channel authentication function simultaneously on one interface.

l When the secure channel authentication function is enabled under the interface but the secure channel rule is not applied or the secure channle rule is not configured, the secure channel authentication function adn the 802.1X authentication function is identical.

l During the secure channel authentication, when the user authentication succeeds, it will occupy the chip resources. If the chip resources are insufficient, it will cause user authentication failure.

Configure and Apply Secure Channel

After the secure channel authentication is enabled under the interface, it is hoped that the end user can visit the resources in the specified network when the end user is not authenticated or specify an end user to visit the network resources without authentication. In this case, configure and apply the secure channel.

Rules for configuring the secure channel can be classified into the following types:

l Configure to allow the end user to visit the specified network resources.

l Configure the specified end user to visit the network resources.

Table 4‑4 Apply secure channel

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the secure channel | hybrid access-list advanced { access-list-number | access-list-name } | Mandatory By default, the secure channel is not configured on the device.
Configure the secure channel rule | [ sequence ] permit protocol { any | source-ip-addr source-wildcard | host source-ip-addr } { any | source-mac-addr source-wildcard | host source-mac-addr } { any | destination-ip-addr destination-wildcard | host destination-ip-addr } { any | destination-mac-addr destination-wildcard | host destination-mac-addr } | Mandatory By default, the secure channel rule is not configured in the secure channel.
Apply the secure channel | global security access-group { access-group-number | access-group-name } | Mandatory By default, no any secure channel is applied in the system.

l The device can be configured with multiple secure channels. A secure channel can be configured with multiple secure channel rules.

l The secure channel type can only be the hybrid advanced ACL. Only one secure channel is allowed to be applied to the device.


4.2.3 Configure 802.1X Authentication and Secure Channel Authentication Property

If the 802.1X authentication function or the secure channel authentication function is not enabled on the interface, then the conifgured related property does not take effect.

Configuration Condition

None

Configure Port Authentication Mode

802.1X authentication mode includes relay authentication mode and terminating authentication mode.

802.1X authentication system comprises client, authentication device and authentication server. The standard 802.1X protocol defines that the client and authentication server interact via the EAP packet. The authentication device plays as the “relay” role during the interacting. The authentication device encapsulates the EAP data sent by the client in the other protocol, such as the RADIUS protocol, and send to the authentication server. Similarly, the authentication device encapsulates the EAP data sent by the authentication server in the EAPOL packet and forwards to the client. The interacting mode is called relay authentication mode. The relay authentication mode requires that the authentication server supports the EAP protocol. Configuring the authentication mechanism supported by the EAP relay authentication mode depends on the client and authentication server.

The earlier deployed authentication server may not support the EAP protocol and needs to be configured as the terminating authentication mode. The EAP packet of the client is not directly sent to the authentication server, but the authentication device completes the EAP packet interacting with the client. After getting the enough user authentication information, the authentication device sends the authentication information to the authentication server for authentication.

EAP terminating authentication mode supports PAP (Password Authentication Protocol) authentication and CHAP (Challenge Handshake Authentication Protocol) authentication.

Table 4-5 Configure the port authentication mode

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the port authentication mode | dot1x eap-relay { enable | disable } | Mandatory By default, the authentication mode in the port is the terminating authentication mode.

l Configuring terminating authentication mode only supports the MD5-based (Message Digest Algorithm) EAP authentication. The 802.1x authentication function and secure channel authentication function support the relay and terminating authentication mode.

l When the client adopts the certificate authentication, the authentication port needs to be configured as the relay authentication mode.

l The MAC address authentication can only support the terminating authentication mode.

Configure Multicast Triggering Function

Some terminal is installed with the 802.1X authentication client, but the client does not actively initiates the authentication. The authentication process can only depend on the authentication device to trigger. The authentication device periodically sends the multicast packet requesting the user name to the port configured with the multicast triggering. After receiving the packet, the client answers the authentication request of the authentication device and starts the 802.1X authentication.

Table 4–6 Configure the multicast triggering function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Enable the 802.1X multicast trigger | dot1x multicast-trigger | Mandatory By default, the multicast trigger function in the port is disabled.
Configure the multicast triggering period | dot1x multicast-period multicast-period-value | Optional By default, the multicast trigger time in the port is 15s.

l If the client does not support the multicast trigger function, the adapter display of the client may be abnormal. Meanwhile, it may cause the re-authentication failure.

Configure Re-authentication Function

To check whether the client is online, avoid the abnormal crashing of the client affecting the correctness of the user accounting, and prevent the client from being used by others, the authentication device periodically initiates the re-authentication request to the client. During the process, the user does not need to input the user name or password again.

Table 4-7 Configure the re-authentication function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the 802.1X re-authentication | dot1x reauthentication | Mandatory By default, the re-authentication function is enabled in the port.

Configure Maximum Authentication Failure Times of the Port

After the client authentication failure times reaches the threshold, the client enters the dead state. During the dead time, the authentication device does not answer the authentication request initiated by the client any more.

Table 4–8 Configure the maximum authentication failure times

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the maximum port authentication failure times | dot1x max-authfail max-authfail-value | Mandatory By default, the maximum authentication failure times of the port is 1.

Configure to Omit IP Field in User Name

Some 802.1X authentication clients can configure to upload the IP address property and load the IP address before the user name and then send them to the server for authentication. When the IP address of the end user contains 0, for example, the user IP address 192.168.0.1, it may cause authentication failure. In this case, you can configure to omit the IP field in the user name to avoid such problem. After this function is configured, when the user name in the authentication packet carries the IP address which contains 0, the device will omit the IP address contained in the user name of the packet to ensure normal authentication.

Table 4‑9 Configure to omit the IP filed in the user name

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure to omit the IP field in the user name | dot1x ignore user-name-ip | Mandatory By default, the function of omitting the IP field in the user name is disabled.

Configure Packet Transparent Transmission Function

In the actual application environment, the authentication terminal and authentication device may cross the intermediate device. If the intermediate device cannot transmit the EAPOL packet transparently, the authentication cannot be performed normally. To make the authentication be done normally, we need to enable the function of transmitting the EAPOL packet transparently on the port of the intermediate device receiving the EAPOL packet and configure one uplink port for the port. If the port enabled with the function of transmitting the EAPOL packet transparently receives the EAPOL packet, send the packet from the configured uplink port. If the device directly connected to the uplink port is authentication device, the authentication device processes after receiving the EAPOL packet.

Table 4–10 Configure the packet transparent transmission function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the packet transparent transmission function | dot1x eapol-relay { enable | disble } | Mandatory By default, the function of transmitting the packet transparently in the port is disabled.
Configure the uplink port | dot1x eapol-relay uplink { interface interface-name | link-aggregation link-aggregation-id } | Mandatory By default, the port is not configured with the uplink port.

l The uplink port does not support forwarding the received multicast packet to the other ports, so the multicast packet entering from the uplink port does not trigger the 802.1X client software on other ports, but can only initiate the authentication request via the client software to start the 802.1X authentication.

Configure Keepalive Function

To detect whether the client is online, the authentication device periodically sends the EAP-Request/Identity packet to the client. If receiving the EAP-Response/Identity packet from the client, send the EAP-Request/MD5 Challenge packet to the client. If the authentication system receives the EAP-Response/MD5 Challenge packet, confirm that the client is online normally and send the EAP-Success packet to inform the client of keepalive success.

Table 4–11 Configure the keepalive function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the keepalive function | dot1x keepalive { enable | disable } | Mandatory By default, the keepalive function in the port is disabled.
Configure the keepalive time | dot1x keepalive period period-value | Optional By default, the keepalive period in the port is 60s.
Configure the times of re-transmitting the keepalive packet | dot1x keepalive retries retries-value | Optional By default, the maximum keepalive times in the port is 3.

l The keepalive function needs to be supported by the 802.1X authentication client software (such as Maipu TC client). If the client does not support, it may result in the keepalive failure and the user gets offline.

Configure EAPOU Function

EAPOU is the EAP Over UDP protocol. In the standard 802.1X function, the client and authentication device interact with each other via the EAPOL (EAP Over LAN) packet. In the actual application environment, because of the network complexity, the terminal to be authenticated (client) and the authentication device may cross the intermediate device. If the intermediate device does not transmit the EAPOL packet transparently, the authentication cannot be performed normally. Enabling the EAPOU function can make the authentication packet (EAP packet) cross the intermediate device, the EAPOU packet is not limited by the intermediate device, and the intermediate device forwards the packet as the general packet, realizing the across-device authentication.

To enable the EAPOU function, we need to configure one interface address on the authentication device, used to receive the EAPOU packet sent by the client. Before sending the EAPOU packet, the client needs to specify the interface address of the authentication device so that the EAPOU packet can be forwarded to the authentication device correctly; after the authentication device receives the EAPOU packet, extract the EAP content from the packet, and then encapsulate as the EAPOR packet and send to the authentication server for authentication. The subsequent process is consistent with the EAPOL authentication mode.

Table 4-12 Configure the EAPOU function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the EAPOU function | dot1x eapou layer2 | Mandatory By default, the EAPOU function in the port is disabled.
Configure the UDP port used by the EAPOU function | dot1x eapou udp-port udp-port-value | Optional By default, the UDP protocol port number used by the EAPOU function is 5651.

l To configure the EAPOU function, both the client and authentication device need to support the EAPOU protocol.

Configure Not Waiting for Server Response

In the relay authentication mode, the client may send some packets that the server does not answer. The packets make the session channel between the authentication device and the authentication server be occupied and as a result, the subsequent client authentication fails. We can enable the function of not waiting for the server response in the port to avoid the problem.

Table 4-13 Configure the function of not waiting for the server response

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the function of not waiting for the server response | dot1x nowait-result | Mandatory By default, the function of not waiting for the server response is disabled.

Configure Domain Name Delimiter

The authentication device can manage the user based on the domain. If the authentication user name carries the domain name, the device uses the server in the AAA server group to authenticate, authorize and account the user. If the authentication user name does not carry the domain name, use the default configured authentication server in the system to authenticate. Therefore, the authentication device needs to parse the user name and domain name correctly, playing the decisive function for the user to provide the authentication service. Different clients support different user name and domain name delimiters. To manage and control the user access of different user name formats better, it is necessary to specify the supported domain name delimiter on the authentication device.

Currently, the supported domain name delimiters include @, /, and \.

When the domain name delimiter is @, the authenticated user name format is username@domain.

When the domain name delimiter is /, the authenticated user name format is username/domain.

When the domain name delimiter is \, the authenticated user name format is domain\username.

Here, username is the pure user name, and domain is the domain name. If the user name contains multiple domain name delimiters, the authentication device only identifies the first domain name delimiter as the actual used domain name delimiter and the other characters as one part of the domain name.

Table 4-14 Configure the domain name delimiter

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the domain name delimiter | dot1x domain-delimiter domain-delimiter-type | Mandatory By default, the domain name delimiter in the port is @.

l When using the user name with the domain name to authenticate, it is necessary to configure the corresponding authentication server group on the authentication device.

Configure Authentication User Name Format

The authentication user is named by the format of username@domain. The domain name is behind the domain name delimiter @. The authentication device decides which authentication server group authenticates the user by parsing the domain name. The early server cannot accept the user name with the domain name, so the authentication device needs to delete the domain name carried in the user name and just send the authentication user name to the server. You can select whether the authentication user name sent to the authentication device carries the domain name by configuring the format of the authentication user name.

Currently, the supported domain name delimiter includes @, \, /.

Table 4-15 Configure the authentication user name format

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the format of the authentication user name | dot1x user-name-format { with-domain | without-domain } | Mandatory By default, send the authentication user name with the domain name to the authentication server.

l Configure the port of sending the authentication user name without domain name to the authentication server not to support the certificate authentication.


4.2.4 Configure MAC Address Authentication

The 802.1X authentication and MAC address authentication are allowed to be configured simultaneously on the same interface.

l If the authentication is successful when the end user first performs the MAC address authentication, the 802.1X authentication initiated by the end user will not be processed. Otherwise, the 802.1X authentication initiated by the end user will be processed normally.

l When the end user first initiates the 802.1X authentication, then do not perform the MAC address authentication any more.

Configuration Condition

None

Enable MAC Address Authentication Function

The MAC address authentication is also called free-client authentication. The authentication mode is applicable to the terminal that cannot install the client software for authentication, and also applicable to the terminal user that does not install client software, but can authenticate without inputting the user name and password.

When configuring the parameters of the MAC address authentication in the authentication device port and if the port does not enable the MAC address authentication function, the configured function does not take effect.

Table 4-16 Enable the MAC address authentication function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Enable the MAC address authentication function | dot1x mac-authentication { enable | disable } | Mandatory By default, the MAC address authentication function in the port is disabled.

l The MAC address authentication function and port security function can be enabled on one port at the same time, but it has the following restriction: The port cannot be configured with the IP rule and MAX rule of the port security.

l Do not enable the MAC address authentication function and secure cahnnel authentication function simultaneously on one interface.

Configure MAC Address Authentication User Name Format

The user name and password format used by the MAC address authentication includes two cases: fixed user name and password format and MAC address user name and password format.

Fixed user name and password format: When receiving the packets of the terminal user, the authentication device sends the configured user name and password to the authentication server for authentication.

MAC address user name and password format: The authentication device takes the MAC address of the terminal user as the user name and password. The MAC address format as the user name and password includes two cases: One is with the hyphen, such as 00-01-7a-00-00-01; the other is not with hyphen, such as 00017a000001.

Table 4–17 Configure the MAC address authentication user name format

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the MAC address authentication user name format | dot1x mac-authentication user-name-format { fixed account account-value password password-value | mac-address [ with-hyphen | without-hyphen ] } | Mandatory By default, the MAC address authentication adopts the MAC address with hyphen as the user name and password.


4.2.5 Configure Public Attributes

When configuring the public attribute parameters and if the 802.1X authentication function, secure channel authentication, or MAC address authentication function is not enabled in the port, the configured function does not take effect.

Configuration Condition

When configuring the IP authorization function in the port, it is necessary to configure the ARP keepalive function at the same time.

Configure Control Direction

The control direction of the port includes the bi-directional control and uni-directional control.

l Bi-directional control indicates that the port cannot receive or send the packet.

l Uni-directional control indicates that the port cannot receive the packet of the client, but can forward the packet to the client.

The function can be used with the WOL (Wake On Lan) function. Some terminal is in the dormant state, but its network card still can process some special packets, such as WOL packet. After the network card receives the WOL packet, enable the terminal device and enter the working state.

When the access port of the dormant terminal enables the authentication function, you can configure the port as the uni-directional control, ensuring that it can normally send the WOL packet to the terminal. After the terminal starts, initiate the authentication, and after passing the authentication, it can access the network resources normally.

When sending the WOL packet across the segment, it is necessary to configure the ARP forwarding entry on the authentication device.

Table 4–18 Configure the control direction

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Configure the control direction | dot1x control-direction { both | in } | Mandatory By default, the port is controlled bi-directionally.

Configure Authenticatable Host List

After enabling the authenticatable host list function, only permit the user whose MAC address is in the authenticatable host list to authenticate and the authentication initiated by other user is refused.

Table 4–19 Configure the authenticatable host list

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id |
Configure the authenticatable host list | dot1x auth-address { enable | disable | mac-address} | Mandatory By default, the authenticatable host list in the port is disabled.

Configure IP Authorization Function

In the port, enable the IP authorization function. If it is detected that the IP address of the authenticated user changes, force the user to get offline. It can be divided to the following several modes:

Disable: In the mode, do not detect the IP address of the user.

dhcp-server: When configuring the mode, it is necessary to configure the DHCP Snooping function on the device. After the authenticated user gets the IP address from the DHCP server, record the binding relation of the authenticated user and IP address on the device. If it is detected that the user IP address changes, force the user offline.

radius-server: The RADIUS Server encapsulates in the RADIUS packet, encapsulating the IP address used by the authenticated user in the Frame-IP-Address field and recording the binding relation of the user and IP address on the authenticated user. If it is detected that the user IP address changes, force the user offline.

Supplicant: After the user passes the authentication for the first time, record the binding relation of the authenticated user and IP address on the device. If it is detected that the user IP address changes, force the user offline.

Table 4–20 Configure IP authorization function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure IP authorization function | dot1x authorization ip-auth-mode { disable | dhcp-server | radius-server | supplicant } | Mandatory By default, the IP authorization function in the port is disabled.

Configure Max. Sending Times of Authentication Request Packet

After the authenticated device receives the EAPOL-Start packet, send the authentication request EAP-Request/Identity packet to the client. If the authentication device does not receive the response packet, re-transmit the packet. The function is used to configure the maximum sending times of the EAP-Request/Identity packet. If the sending times exceeds the configured maximum threshold, the authentication device judges that the client is disconnected and ends the authentication.

The process of re-transmitting the EAP-Request/Identity packet is shown in the following figure:

Figure 4–4 The process of re-transmitting the EAP-Request/identity packet

Table 4–21 Configure the maximum sending times of the authentication request packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id |
Configure the maximum sending times of the authentication request packet | dot1x max-reauth count | Mandatory By default, the maximum sending times of the authentication request packet is 3.

Configure Max. Sending Times of Authentication Packet

During authentication, the authentication device will send the other EAP-Request packet (except for EAP-Request/Identity) to the client, such as EAP-Request/MD5 challenge packet. If the authentication device does not receive the response packet, re-transmit the packet. The function is used to configure the maximum sending times of this kind of packet. If the sending times exceeds the configured maximum threshold, the authentication device judges that the client failed to authenticate.

The process of re-transmitting the EAP-Request packet is shown in the following figure:

Figure 4–5 The process of re-transmitting the EAP-Request packet

Table 4–22 Configure the maximum sending times of the authentication packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id |
Configure the maximum sending times of the authentication packet | dot1x max-req count | Mandatory By default, the maximum sending times of the authentication packet in the port is 2.

Configure Authentication Failure Record Log Function

After enabling the authentication failure record log function, the authentication device will record the information about the authentication failure, so as to detect the fault reason.

Table 4-23 Configure the authentication failure record log function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current interface. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the log function of recording the authentication failure | dot1x syslog { enable | disable } | Mandatory By default, the authentication failure record log function in the port is disabled.

Configure ARP Keepalive Function

To detect whether the user is online after the terminal user passes the authentication, the authentication device sends the ARP request packet to the authenticated user. The authentication device determines whether the user is online by whether the ARP response packet of the user is received.

Table 4-24 Configure the ARP keepalive function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current interface. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id |
Configure the ARP keepalive function | dot1x client-probe { enable | disable } | Mandatory By default, the ARP keepalive function in the port is disabled.

l The authentication device can trigger the ARP keepalive function normally after getting the IP address of the authenticated user. If not receiving the ARP response packet of the authentication device during the protection period, force the user offline.

Configure Maximum Users of a Port

After the number of the authenticated users in the port reaches the configured threshold, the authentication system does not answer the new authentication request initiated by the user.

Table 4–25 Configure the maximum users of the port

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the maximum users of the port | dot1x port-control max-user-num max-uer-num-value | Mandatory By default, the maximum number of the users permitted to be connected in the port is 256.

l The port needs to be configured as the user-based access control mode (Macbased). Otherwise, the configured access users cannot take effect.

Configure IP ACL Prefix Name

After the end user authentication is successful, when the server sends the IP ACL with the number greater than 2000, it is required to configure the IP ACL with the name as "IP ACL prefix name+ACL number" on the device. For example, the server sends the ACL with the number as 2001 and then configure the IP ACL with the name as "assignacl-2001" on the device.

Table 4‑26 Configure the IP ACL prefix name

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the IP ACL prefix name | dot1x number-acl-prefix number-acl-prefix-name | Mandatory By default, the IP ACL prefix name is "assignacl-".

l When the access control mode is configured to portbased multi-hosts, the function of delivering ACL does not take effect.

Configure Default Valid VLAN

When the interface control mode is the user-based access control mode and the server does not send the VLAN (Auto VLAN), this configuration can be used to specify the VLAN if the authenticated users are expected to communicated in the specified VLAN.

Table 4‑27 Configure the default valid VLAN

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the default valid VLAN | dot1x default-active-vlan default-active-vlan-id | Mandatory By default, the default valid VLAN is not configured.

l When the user-based access control mode (Macbased) is configured on the interface,the priority of the binding relationship after the user authentication is in the following order: server sending the VLAN, default valid VLAN, VLAN which the PVID of the interface locates in.

Configure to Allow Unauthenticated User to Communicate in VLAN which PVID Locates in

When multiple interfaces access to the interface, each terminal needs to perform the access control. Some terminals that cannot initiate the 802.1X authentication also hopes to visit the network resources and you can enable the command. After the function is enabled, the unauthenticated end user can normally communicate in the VLAN which the PVID locates in.

This function must meet the following functions to ensure normal running.

l Enable the 802.1X authentication or MAC address authentication on the interface.

l The access control mode of the interface is the user-based access control mode (Macbased).

l The VLAN mode of the interface is the Hybrid mode.

l The function of only receiving the Untag packet needs to be enabled on the interface.

Table 4‑28 Configure to allow the unauthenticated user to communicate in the VLAN which the PVID locates in

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure to allow the unauthenticated user to communicate in the VLAN which the PVID locates in | dot1x native-vlan-free | Mandatory By default, the function of allowing the unauthenticated user to communicate in the VLAN which the PVID locates in is disabled,

l After the function is enabled on the interface, the function of only receicing the untage packet needs to be enabled on the interface by configuring the switchport accept frame-type untag command on the interface to ensure that the packet sent by the unauthenticated user can only be forwarded in the VLAN which the PVID locates in.

l It is recommended that this function be used together with the VLAN sent by the server or the default valid VLAN.

l The function does not support the secure channel authentication.

Configure Port Access Control Mode

There are two kinds of port access control modes: port-based access control mode and user-based access control authentication mode.

Port-based access control mode (Portbased): In the port, only permit one user authentication to pass;

User-based access control mode (Macbased): In the port, permit multi-user authentication to pass. The users in the port need to pass the authentication respectively so that they can access the network.

Port-based access control mode includes two kinds: multi-host mode and single-host mode.

Multi-host mode (Multi-hosts): After one user in the port passes the authentication, the other users in the port can access the network without authentication.

Single-host mode (Single-host): In the port, only permit one user to pass the authentication and access the network; the other users cannot access the network and also cannot pass the authentication.

Table 4-29 Configure the port access control mode

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the access control mode | dot1x port-method { macbased | portbased } | Mandatory By default, enable the user authentication mode in the port.
Configure the port-based access control mode | dot1x port-method portbased host-mode { multi-hosts | single-host } | Optional By default, enable the multi-host authentication mode in the port.

l When configuring the host mode of the port-based access control mode, we need to ensure that the access control mode is configured as the port-based access control mode (Portbased).

Configure Guest VLAN

The user can get the 802.1X client software in Guest VLAN to upgrade the client, or execute other application program (such as anti-virus software and operation system patch) upgrade.

Table 4-30 Configure Guest VLAN

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure Guest VLAN | dot1x guest-vlan guest-vlan-id | Mandatory By default, Guest VLAN is not configured in the port; the value range is 1-4094.

l Guest VLAN of the port cannot be applied to the dynamic VLAN. If VLAN ID specified by Guest VLAN is the VLAN automatically created by GVRP, Guest VLAN can be configured successfully, but cannot take effect.

l To ensure that the functions can be used normally, please distribute different VLAN IDs for Voice VLAN, Private VLAN, and Guest VLAN.

Configure Guest ACL

If the user is not authenticated or does not pass the authentication, we can configure Guest ACL in the port to limit the resources accessed by the user in Guest VLAN.

Table 4-31 Configure Guest ACL

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure Guest ACL | dot1x guest-acl guest-acl-name | Mandatory By default, Guest ACL is not configured in the port.

l If Guest VLAN is not configured in the port, the configured Guest ACL does not take effect.

l Guest ACL can take effect only in the macbased mode.

l The ACL rule is configured in the authentication device.

Configure Critical VLAN

When the user adopts the RADIUS authentication, the authentication server is unavailable and as a result, the authentication fails and the user is permitted to access the resources in the specified VLAN. The VLAN is called Critical VLAN.

When the port is configured to the port-based access control mode and the port has the user to authenticate, but all authentication servers are unavailable, the port will be added to Critical VLAN and all users in the port can access the resources in the Critical VLAN.

When the port is configured to user-based access control mode and the port has the user to authenticate, but all authentication servers are unavailable, the user is only permitted to the resources in the Critical VLAN.

To be configured to the user-based access control mode, the port needs to meet the following conditions so that it can run normally:

l The port VLAN mode is Hybrid.

The port enables the MAC VLAN function. The user in the Critical VLAN initiates the authentication. If the authentication server is still unavailable, the user is still in the Critical VLAN. If the authentication server is available, the user exits Critical VLAN with the authentication result.

Table 4-32 Configure Critical VLAN

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure Critical VLAN | dot1x critical-vlan critical-vlan-id | Mandatory By default, do not configure Critical VLAN in the port and the value range is 1-4094.

l The function only supports the RADIUS authentication.

l If the radius and escape function are configured on the device, that is, aaa authentication connection default radius none and critical vlan are configured, and when the user authenticates and the authentication server is available, the user enters the Critical VLAN. If only the escape function is configured, that is, aaa authentication connection default none and critical vlan are configured, and when the user authenticates, the authentication server is unavailable, the escape function takes effect.

l When only Guest VLAN function is configured in the port, the authentication failed users are all in Guest VLAN. When both Guest VLAN and Critical VLAN are confiogured in the port at the same time, the authentication server is unavailable and as a result, the user fails to authenticate and will enter Critical VLAN. If the user fails to authenticate because of other reasons, it will enter Guest VLAN.

Configure User Authentication Migration Function

The user authentication migration function is applicable to the scenario that one user (distinguish based on the terminal MAC address) migrates from one authentication pory to another authentication port of one device. When disabling the user authentication migration function, the user cannot initiate the authenticaton on another authentication port of the device after being authenticated on one port of the device; when enabling the user authentication migration function and after being authenticated on one port and detecting that the user migrates to another authentication port, the device first deletes the authentication information on the previous port, and then permits the user to initiate the authentication on the new authentication port.

No matter whether to enable the user authentication migration function, the devide will record the log after detecting that the user is migrated between the authentication ports.

Table 4-33 Configure the user authentication migration function

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the user authentication migration function | dot1x station-move { enable | disable } | Mandatory By default, the user authentication migration function is disabled.

Configure Timer Parameters

The timer parameters in the port contain: re-authentication timer, quiet timer, server timeout timer, client timeout timer, MAC authentication user offline check timer.

Re-authentication timer (re-authperiod): After configuring the re-authentication function in the port, the authentication device regularly initiates the re-authentication request to the client, applicable to the 802.1X authentication.

Quiet timer (quiet-period): When the client reaches the maximum authentication failure times, the authentication device can answer the client authentication request again after the quiet time times out, applicable to the 802.1X authentication and MAC address authentication.

Server timeout timer (server-timeout): If the authentication device does not receive the response packet of the server within the specified time, it is regarded to be disconnected with the server, applicable to the 802.1X authentication and MAC address authentication.

Client timeout timer (supp-timeout): If the authentication device does not receive the response packet of the 802.1X client within the specified time, it is regarded to be disconnected with the user, applicable to the 802.1X authentication.

MAC address authentication user offline check timer (offline-detect): After enabling the MAC address authentication, the port periodically detects whether the user is online, applicable to the MAC address authentication.

Table 4-34 Configure the timer parameters

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the timer parameters | dot1x timeout { re-authperiod re-authperiod-value | quiet-period quiet-period-value | server-timeout server-timeout-value | supp-timeout supp-timeout-value | offline-detect offline-detect-value } | Mandatory By default, the re-authentication time in the port is 3600s; the value range is 5-65535; The quiet time is 60s; the value range is 1-65535; The timeout of the server is 30s; the value range is 5-3600; The timeout of the client is 30s; the value range is 5-3600; The offline check time of the client is 30s; the value range is 5-3600;

Restore Port Default Configuration

Restore the default configuration of the 802.1X authentication and MAC address authentication in the port.

Table 4–35 Restore the default configuration of the port

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the L2 Ethernet interface configuration mode | interface interface-name | Either After entering the L2 Ethernet interface configuration mode, the subsequent configuration just takes effect on the current port. After entering the aggregation group configuration mode, the subsequent configuration just takes effect on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Restore the default configuration of the port | dot1x default | Mandatory In the port, disable the 802.1X authentication and MAC address authentication function; the related configuration parameters are restored to the default values and the default configuration parameters do not take effect.

l The command show dot1x is used to view the detailed authentication default configuration parameters.

Configure Log Record Step

When the user authentication failure times reaches the step value, the device records the authentication failure information to the logs.

Table 4-36 Configure the log record step

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the log record step | dot1x auth-fail-count history auth-fail-history-step | Mandatory By default, the log record step is 3.


4.2.6 802.1X Monitoring and Maintaining

Table 4-37 802.1X monitoring and maintaining

Command | Description
clear dot1x statistic [ interface interface-name | link-aggregation link-aggregation-id | mac { mac-address | all } ] | Clear the authentication statistics information
clear dot1x auth-fail-user history [ mac mac-address ] | Clear the authentication failure record information
show dot1x | Display the default configuration information of the authentication
show dot1x auth-fail-user history [ recent | mac mac-address ] | Display the authentication failure information
show dot1x auth-address [ mac-address | interface interface-name | link-aggregation link-aggregation-id ] | Configure the authenticatable host list information
show dot1x config [ interface interface-name | link-aggregation link-aggregation-id] | Display the configuration information of the authentication
show dot1x free-ip | Display secure channel configuration information
show dot1x global config | Display the global configuration information
show dot1x statistic [ interface interface-name | link-aggregation link-aggregation-id | mac { mac-address | all } ] | Display the authentication statistics information
show dot1x user [ interface interface-name | link-aggregation link-aggregation-id | summary] | Display the user information


4.3 802.1X Typical Configuration Example


4.3.1 Configure 802.1X Portbased Authentication

Network Requirements

1. The user PC1 and PC2 on one VLAN are connected to IP Network via Device. On Device, enable the 802.1X access control;

2. The authentication mode adopts the RADIUS authentication;

3. When the user does not pass the authentication, only permit accessing Update Server; after the user passes the authentication, permit accessing IP Network;

4. After one user on LAN passes authentication, the other users on the VLAN can access IP Network without authentication.

Network Topology

Figure 4–6 Networking of configuring 802.1X Portbased authentication

Configuration Steps

Step 1:

Configure VLAN.

#Create VLAN2 on Device, configure the port link type on gigabitethernet0/2 as Access, and permit the services of VLAN2 to pass.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

Device(config)#interface gigabitethernet 0/2

Device(config-if-gigabitethernet0/2)#switchport mode access

Device(config-if-gigabitethernet0/2)#switchport access vlan 2

Device(config-if-gigabitethernet0/2)#exit

#Configure the port link type on gigabitethernet0/3~gigabitethernet0/4 of Device as Access, permitting the services of VLAN3-VLAN4 to pass respectively. (Omitted)

Step 2:

Configure the interface IP address of Device.

#Create VLAN5 and add gigabitethernet0/1 to the corresponding VLAN.

Device(config)#vlan 5

Device(config-vlan5)#exit

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#switchport mode access

Device(config-if-gigabitethernet0/1)#switchport access vlan 5

Device(config-if-gigabitethernet0/1)#exit

#Configure the IP address of VLAN5 as 130.255.167.1/24.

Device(config)#interface vlan 5

Device(config-if-vlan5)#ip address 130.255.167.1 255.255.255.0

Device(config-if-vlan5)#exit

Step 3:

Configure the AAA authentication.

#Enable the AAA authentication on Device, and adopt the RADIUS authentication mode. The server key is admin, the priority is 1, and the RADIUS server address is 130.255.167.167/24.

Device(config)#aaa new-model

Device(config)#aaa authentication connection default radius

Device(config)#radius-server host 130.255.167.167 priority 1 key admin

Device(config)#exit

Step 4:

Configure the AAA server.

#Configure the user name, password and key as admin on the AAA server. (Omitted)

#On the AAA server, configure RADIUS to deliver the three attributes of Auto VLAN: 64 is VLAN, 65 is 802, and 81 is VLAN3. (Omitted)

Step 5:

Configure the port 802.1X authentication.

#Enable the 802.1X authentication on the port and the authentication mode is Portbased.

Device(config)#interface gigabitethernet 0/2

Device(config-if-gigabitethernet0/2)#dot1x port-control enable

Device(config-if-gigabitethernet0/2)#dot1x port-method portbased

Device(config-if-gigabitethernet0/2)#exit

#Configure Guest VLAN of the port as VLAN4.

Device(config)#interface gigabitethernet 0/2

Device(config-if-gigabitethernet0/2)#dot1x guest-vlan 4

Device(config-if-gigabitethernet0/2)#exit

Step 6:

Check the result.

#Before passing the authentication, gigabitethernet0/2 is added to Guest VLAN. Here, PC1 and PC2 users are in VLAN4 and permit accessing Update Server.

Device#show vlan 4

---- ---- -------------------------------- ------- --------- -----------------------------

NO. VID VLAN-Name Owner Mode Interface

---- ---- -------------------------------- ------- --------- -----------------------------

1 4 VLAN0004 static Untagged gi0/2 gi0/4

#Verify that PC1 can pass the authentication; the authentication server delivers VLAN3. Here, PC1 and PC2 users are in VLAN3 and can access IP Network.

Device#show dot1x user

--------------------

NO 1 : MAC_ADDRESS= 3883.45ef.7984 STATUS= Authorized USER_NAME= admin

VLAN= 3 IP_ADDRESS= Unknown INTERFACE= gi0/2

AUTH_STATE= AUTHENTICATED BACK_STATE= IDLE USER_TYPE= DOT1X

Online time: 0 week 0 day 0 hours 0 minute 51 seconds

Total: 1 Authorized: 1 Unauthorized/guest/critical: 0/0/0 Unknown: 0


4.3.2 Configure 802.1X Transparent Transmission Mode

Network Requirements

1. PC is connected to Device2 enabled with the 802.1X access control via Device1 and connected to IP Network.

2. Device1 enables the transparent transmission function; Device2 uses the RADIUS authentication mode.

3. After passing authentication, PC can access IP Network.

Network Topology

Figure 4-7 Networking of configuring the 802.1X transparent transmission mode

Configuration Steps

Step 1:

Configure port VLAN of Device2.

#Create VLAN2 on Device2, configure the port link type on gigabitethernet0/1 as Access, and permit the services of VLAN2 to pass.

Device2#configure terminal

Device2(config)#vlan 2

Device2(config-vlan2)#exit

Device2(config)#interface gigabitethernet 0/1

Device2(config-if-gigabitethernet0/1)#switchport mode access

Device2(config-if-gigabitethernet0/1)#switchport access vlan 2

Device2(config-if-gigabitethernet0/1)#exit

#Configure the port link type on gigabitethernet0/2 of Device2 as Access, permitting the services of VLAN2 to pass. (Omitted)

Step 2:

Configure the interface IP address of Device2.

#Create VLAN3 and add gigabitethernet0/3 to the corresponding VLAN.

Device2(config)#interface gigabitethernet 0/3

Device2(config-if-gigabitethernet0/3)#switchport mode access

Device2(config-if-gigabitethernet0/3)#switchport access vlan 3

Device2(config-if-gigabitethernet0/3)#exit

#Configure the IP address of VLAN5 as 130.255.167.1/24.

Device2(config)#interface vlan 3

Device2(config-if-vlan3)#ip address 130.255.167.1 255.255.255.0

Device2(config-if-vlan3)#exit

Step 3:

Configure the AAA authentication.

#Enable the AAA authentication on Device2, and adopt the RADIUS authentication mode. The server key is admin, the priority is 1, and the RADIUS server address is 130.255.167.167/24.

Device2(config)#aaa new-model

Device2(config)#aaa authentication connection default radius

Device2(config)#radius-server host 130.255.167.167 priority 1 key admin

Device2(config)#exit

Step 4:

Configure the AAA server.

#Configure the user name, password, and key as admin on the AAA server. (Omitted)

Step 5:

Configure the port VLAN of Device1.

#Configure the port link type on gigabitethernet0/1-gigabitethernet0/2 of Device1 as Access, permitting the services of VLAN2 to pass. (Omitted)

Step 6:

Enable the 802.1X transparent transmission function on Device1.

#Configure the 802.1X transparent transmission mode on gigabitethernet0/1 of Device1 and the uplink port is gigabitethernet0/2.

Device1(config)#interface gigabitethernet 0/1

Device1(config-if-gigabitethernet0/1)#dot1x eapol-relay enable

Device1(config-if-gigabitethernet0/1)#dot1x eapol-relay uplink interface gigabitethernet 0/2

Device1(config-if-gigabitethernet0/1)#exit

Step 7:

Configure the 802.1X authentication mode on Device2.

#Enable the 802.1X authentication of gigabitethernet0/1 and the port authentication mode is Portbased.

Device2(config)#interface gigabitethernet 0/1

Device2(config-if-gigabitethernet0/1)#dot1x port-control enable

Device2(config-if-gigabitethernet0/1)#dot1x port-method portbased

Device2(config-if-gigabitethernet0/1)#exit

Step 8:

Check the result.

#PC user can be authenticated successfully and can access IP Network.

Device2#show dot1x user

--------------------

NO 1 : MAC_ADDRESS= 3883.45ef.7984 STATUS= Authorized USER_NAME= admin

VLAN= 2 IP_ADDRESS= Unknown INTERFACE= gi0/2

AUTH_STATE= AUTHENTICATED BACK_STATE= IDLE USER_TYPE= DOT1X

Online time: 0 week 0 day 0 hours 0 minute 51 seconds

Total: 1 Authorized: 1 Unauthorized/guest/critical: 0/0/0 Unknown: 0


4.3.3 Configure 802.1X Free-Client Authentication

Network Requirements

1. The network printer is connected to IP Network via Device; Device adopts the 802.1X access control;

2. Device regularly performs the offline detection for the network printer.

3. Use the RADIUS authentication mode.

4. After passing the authentication, the network printer can execute the printing task from IP Network.

Network Topology

Figure 4-8 Networking of configuring the 802.1X free-client authentication

Configuration Steps

Step 1:

Configure the port VLAN.

#Create VLAN2 on Device2, configure the port link type on gigabitethernet0/1 as Access, and permit the services of VLAN2 to pass.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#switchport mode access

Device(config-if-gigabitethernet0/1)#switchport access vlan 2

Device(config-if-gigabitethernet0/1)#exit

#Configure the port link type on gigabitethernet0/2 of Device as Access, permitting the services of VLAN2 to pass. (Omitted)

Step 2:

Configure the interface IP address of Device.

#Configure VLAN3 and add gigabitethernet0/3 to the corresponding VLAN.

Device(config)#interface gigabitethernet 0/3

Device(config-if-gigabitethernet0/3)#switchport mode access

Device(config-if-gigabitethernet0/3)#switchport access vlan 3

Device(config-if-gigabitethernet0/3)#exit

#Configure the IP address of VLAN3 as 130.255.167.1/24.

Device(config)#interface vlan 3

Device(config-if-vlan3)#ip address 130.255.167.1 255.255.255.0

Device(config-if-vlan3)#exit

Step 3:

Configure the AAA authentication.

#Enable the AAA authentication on Device2, and adopt the RADIUS authentication mode. The server key is admin, the priority is 1, and the RADIUS server address is 130.255.167.167/24.

Device(config)#aaa new-model

Device(config)#aaa authentication connection default radius

Device(config)#radius-server host 130.255.167.167 priority 1 key admin

Step 4:

Configure the AAA server.

#Configure the user name, password, and key as admin on the AAA server. (Omitted)

Step 5:

Configure the 802.1X authentication.

#Configure the 802.1X free-client authentication mode, and use the MAC address of the network printer as user name and password.

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#dot1x mac-authentication enable

Device(config-if-gigabitethernet0/1)#exit

#Configure Device to perform the offline detection for the printer every 120s.

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#dot1x timeout offline-detect 120

Device(config-if-gigabitethernet0/1)#exit

Step 6:

Check the result.

#The network printer can pass the authentication and can execute the printing task from IP Network.

Device#show dot1x user

--------------------

NO 1 : MAC_ADDRESS= 3883.45ef.f395 STATUS= Authorized USER_NAME= 38-83-45-ef-f3-95

VLAN= 2 IP_ADDRESS= 199.0.0.3 INTERFACE= gi0/2

AUTH_STATE= AUTHENTICATED BACK_STATE= IDLE USER_TYPE= MAC

Online time: 0 week 0 day 0 hours 1 minutes 6 seconds

Total: 1 Authorized: 1 Unauthorized/guest/critical: 0/0/0 Unknown: 0


4.3.4 Configure Secure Channel

Network Requirements

l User PC1 and PC2 on the same VLAN access the IP network through Device. Enable the secure channel access control on Device.

l Authentication adopts the RADIUS authentication.

l PC1 is allowed to visit Update Server before authentication success and is allowed to visit Update Server and IP Network after authentication success.

l PC2 is allowed to visit Update Server and IP Network without authentication.

Network Topology

Figure 4-9 Networking of configuring secure channel

Configuration Steps

Step 1:

Configure the link type of the VLAN and interface on the interface.

#Create VLAN2 and VLAN5 on Device.

Device#configure terminal

Device(config)#vlan 2,5

Device(config)#exit

#Configure the link type of interface gigabitethernet0/2 as Access, permitting services of VLAN2 to pass.

Device#configure terminal

Device(config)#interface gigabitethernet 0/2

Device(config-if-gigabitethernet0/2)# switchport mode access

Device(config-if-gigabitethernet0/2)# switchport access vlan 2

Device(config-if-gigabitethernet0/2)#end

#Configure link type of interface gigabitethernet 0/3–gigabitethernet 0/4 as Access on Device, permitting services of VLAN2 to pass. Configure the link type of interface gigabitethernet 0/5 as Access, permitting services of VLAN5 to pass. (Omitted)

Step 2:

Configure the interface IP address of Device.

#Configure the IP address of VLAN5 as 130.255.167.1/24.

Device#configure terminal

Device(config)#interface vlan 5

Device(config-if-vlan5)#ip address 130.255.167.1 255.255.255.0

Device(config-if-vlan5)#exit

Step 3:

Configure AAA authentication.

#Enable AAA authentication on Device and adopt the RADIUS authentication mode. Configure the server key as admin, priority as 1, and IP address of RADIUS server as 130.255.167.167/24.

Device#configure terminal

Device(config)#aaa new-model

Device(config)#aaa authentication connection default radius

Device(config)#radius-server host 130.255.167.167 priority 1 key admin

Step 4:

Configure AAA server.

#Configure the user name, password, and key value on the AAA server as admin. (Omitted)

Step 5:

Configure secure channel.

#Enable the secure channel.

Device#configure terminal

Device(config)#dot1x free-ip

199.0.0.10 24

Step 6:

Check the result.

#PC1 can visit the Update Server and cannot visit other network resources before the authentication success.

#View the user authentication information after user PC1 initiates the authentication and authentication succeeds.

Device#show dot1x user

--------------------

NO 1 : MAC_ADDRESS= 3883.45ef.7984 STATUS= Authorized USER_NAME= admin

VLAN= 2 IP_ADDRESS= 199.0.0.1 INTERFACE= gi0/2

AUTH_STATE= AUTHENTICATED BACK_STATE= IDLE USER_TYPE= DOT1X

Online time: 0 week 0 day 0 hours 0 minute 51 seconds

Total: 1 Authorized: 1 Unauthorized/guest: 0/0 Unknown: 0

It can be viewed that user PC1 has passed the authentication and then PC1 can visit Update Server and IP Network.

#PC2 can visit Update Server and IP Network without authentication.


4.3.5 Configure IP Authorizing DHCP Server Mode

Network Requirements

l PC is connected IP Network via Device; Device enables the 802.1X access control.

l Authentication adopts the RADIUS authentication.

l PC1 can access IP Network after getting the IP address via the specified DHCP Server.

l PC2 cannot access IP Network after being configured to carry the static IP address authentication.

Network Topology

Figure 4-10 Networking of configuring 802.1X IP authorizing DHCP Server mode

Configuration Steps

Step 1:

Configure the link type of the VLAN and port on the Device.

#Create VLAN 2 and VLAN4 on Device, configure the port link type on gigabitethernet0/2 as Hybrid, permitting the services of VLAN2 to pass, and configure the PVID as 2.

Device#configure terminal

Device(config)#vlan 2,4

Device(config)#intergice gigabitethernet 0/2

Device(config-if- gigabitethernet0/2)#switchport mode hybrid

Device(config-if- gigabitethernet0/2)#switchport hybrid untagged vlan 2

Device(config-if- gigabitethernet0/2)#switchport hybrid pvid vlan 2

Device(config-if- gigabitethernet0/2)#exit

#On gigabitethernet0/1 of Device, configure the port link type as Access and permit the services of VLAN2 to pass (omitted).

#On gigabitethernet0/4 of Device, configure the port link type as Access and permit the services of VLAN4 to pass (omitted).

Step 2:

Configure the interface IP address of Device.

# Configure the IP address of VLAN4 as 130.255.167.1/24.

Device(config)#intergice vlan 4

Device(config-if-vlan4)#ip address 130.255.167.1 255.255.255.0

Device(config-if-vlan4)#exit

Step 3:

Configure AAA authentication.

# Enable AAA authentication on Device and adopt the RADIUS authentication mode. Configure the server key as admin, priority as 1, and IP address of RADIUS server as 130.255.167.167/24.

Device(config)#aaa new-model

Device(config)#aaa authentication connection degiult radius

Device(config)#radius-server host 130.255.167.167 priority 1 key admin

Device(config)#exit

Step 4:

Configure AAA server.

#Configure the user name, password, and key value on the AAA server as admin. (Omitted)

Step 5:

Configure the DHCP server.

#On the DHCP server, configure distributing the IP address segment 199.0.0.2-199.0.0.10 and subnet mask 255.255.255.0 (omitted).

Step 6: | On Device, enable the DHCP Snooping function and configure port gigabitethernet0/1 of Device to trust port. Device(config)#dhcp-snooping Device(config)#intergice gigabitethernet 0/1 Device(config-if- gigabitethernet0/5)#dhcp-snooping trust Device(config-if- gigabitethernet0/5)#exit
Step 7: | On Device, configute 802.1X authentication.

#Enable the 802.1X authentication of gigabitethernet0/2.

Device(config)#intergice gigabitethernet 0/2

Device(config-if- gigabitethernet0/2)#dot1x port-control enable

Device(config-if- gigabitethernet0/2)#exit

# Confgure the IP authorization of gigabitethernet0/2 as DHCP Server mode.

Device(config)#intergice gigabitethernet 0/2

Device(config-if- gigabitethernet0/2)#dot1x authorization ip-auth-mode dhcp-server

Device(config-if- gigabitethernet0/2)#exit

# Enable the ARP keepalive of gigabitethernet0/2.

Device(config)#intergice gigabitethernet 0/2

Device(config-if- gigabitethernet0/2)#dot1x client-probe enable

Device(config-if- gigabitethernet0/2)#exit

Step 8:

Check the result.

# PC1 user can be authenticated successfully and can get IP address from the DHCP server and access IP Network.

Device#show dot1x user

--------------------

NO 1 : MAC_ADDRESS= 3883.45ef.7984 STATUS= Authorized USER_NAME= admin

VLAN= 2 IP_ADDRESS= 199.0.0.3 INTERGICE= gi0/2

AUTH_STATE= AUTHENTICATED BACK_STATE= IDLE USER_TYPE= DOT1X

Online time: 0 week 0 day 0 hours 0 minutes 36 seconds

Total: 1 Authorized: 1 Unauthorized/guest/critical: 0/0/0 Unknown: 0

#After being authenticated, PC2 user is in the GET-IP state and cannot get the IP address.

NO 1 : MAC_ADDRESS= 3883.45ef.f381 STATUS= Authorized USER_NAME= admin

VLAN= 2 IP_ADDRESS= Unknown INTERGICE= gi0/2

AUTH_STATE= GET_IP BACK_STATE= IDLE USER_TYPE= DOT1X

Online time: 0 week 0 day 0 hour 0 minute 34 seconds

Total: 1 Authorized: 1 Unauthorized/guest/critical: 0/0/0 Unknown: 0

#After checking, PC2 cannot access IP Network.


4.3.6 Configure 802.1x and Port Security Share

Network Requirements

l PC accesses IP Network via Device; Device enables the 802.1X access control and port security.

l Authentication adopts the RADIUS authentication.

l Configure the port security rule of not matching the MAC address of PC1, and PC1 can access IP Network via authentication.

l Configure the port security deny rule of matching the MAC address of PC2, and PC2 cannot be authenticated.

Network Topology

Figure 4-11Networking of configuring 802.1X and port security share

Configuration Steps

Step 1:

Configure the link type of the VLAN and port on the Device.

#Create VLAN 2 and VLAN4 on Device, configure the port link type on gigabitethernet0/2 as Hybrid, permitting the services of VLAN2 to pass, and configure the PVID as 2.

Device#configure terminal

Device(config)#vlan 2,4

Device(config)#intergice gigabitethernet0/2

Device(config-if- gigabitethernet0/2)#switchport mode hybrid

Device(config-if- gigabitethernet0/2)#switchport hybrid untagged vlan 2

Device(config-if- gigabitethernet0/2)#switchport hybrid pvid vlan 2

Device(config-if- gigabitethernet0/2)#exit

#On gigabitethernet0/4 of Device, configure the port link type as Access and permit the services of VLAN4 to pass (omitted).

Step 2:

Configure the interface IP address of Device.

# Configure the IP address of VLAN4 as 130.255.167.1/24.

Device(config)#intergice vlan 4

Device(config-if-vlan4)#ip address 130.255.167.1 255.255.255.0

Device(config-if-vlan4)#exit

Step 3:

Configure AAA authentication.

#Enable AAA authentication on Device and adopt the RADIUS authentication mode. Configure the server key as admin, priority as 1, and IP address of RADIUS server as 130.255.167.167/24.

Device(config)#aaa new-model

Device(config)#aaa authentication connection degiult radius

Device(config)#radius-server host 130.255.167.167 priority 1 key admin

Device(config)#exit

Step 4:

Configure AAA server.

#Configure the user name, password, and key value on the AAA server as admin. (Omitted)

Step 5:

Configure the 802.1X authentication on Device.

#Enable the 802.1X authentication of gigabitethernet0/2.

Device(config)#intergice gigabitethernet0/2

Device(config-if- gigabitethernet0/2)#dot1x port-control enable

Device(config-if- gigabitethernet0/2)#exit

Step 6: | Configure the port security on Device. #Enable the port security on port gigabitethernet0/2. Device(config)#intergice gigabitethernet0/2 Device(config-if- gigabitethernet0/2)#port-security enable Device(config-if- gigabitethernet0/2)exit #Configure the port security rule on port gigabitethernet0/2. Device(config)#intergice gigabitethernet 0/2 Device(config-if-gigabitethernet0/2)#port-security deny mac-address 3883.45EF.7984 Device(config-if-gigabitethernet0/2)exit
Step 7: | Check the result.

#PC1 user can be authenticated successfully and then can access IP Network.

Device#show dot1x user

--------------------

NO 1 : MAC_ADDRESS= 3883.45EF.7984 STATUS= Authorized USER_NAME= admin

VLAN= 2 IP_ADDRESS= Unknown INTERGICE= gi0/2

AUTH_STATE= AUTHENTICATED BACK_STATE= IDLE USER_TYPE= DOT1X

Online time: 0 week 0 day 0 hour 0 minute 1 second

Total: 1 Authorized: 1 Unauthorized/guest/critical: 0/0/0 Unknown: 0

#PC2 user cannot be authenticated successfully and cannot access the network.


5 PKI


5.1 Overview

PKI (Public Key Infrastructure) is one key management platform of complying with the established standard and one system of comprising hardware, software, policy and people. It is the security infrastructure of using the public key concept and technology to carry out and provide the security services, such as reality, confidentiality, integrity, and accountability. KPI overcomes the problems of the using the traditional symmetric cryptography, such as complicated key management, low security and hard to expand the network capacity.

PKI components mainly include CA (Certification Authorities), RA (Registration Authorities), Endpoint Entities and so on. The PKI of this configuration manual refers to the related functions of the terminal entity and can be used with Maipu CMS (Certificate Manage Server), Windows Server 2000 CA, Windows Server 2003 CA, Windows Server 2008 CA, Cisco CA and China Telecom CA, realizing the high-strength authentication for the terminal entity via the digital certificate. PKI can provide the certificate management mechanism for IPSec (IP Security), SSL (Secure Sockets Layer), security HTTP (Hypertext Transport (or Transfer) Protocol) and so on.

PKI is mainly to check the validity of the certificate applied by the terminal entity from CA. The typical work process of PKI: The terminal entity sends the DN (Distinguished Name) and public key to CA in the digital signature mode; CA audits the terminal entity ID, checks the digital signature, agrees the application of the terminal entity, and issues the certificate; the terminal entity gets the certificate and makes use of the certificate to use the encryption and digital signature to perform the security communication with other terminals; when the terminal entity hopes to cancel its own certificate, submit the application to CA and the CA agrees the terminal entity to cancel the certificate and updates the CRL (Certificate Revocation List). Canceling the certificate also can be initiated by CA actively.


5.2 PKI Function Configuration

Table 5‑1 PKI function configuration list

Configuration Task
Configure trust domain | Configure the trust domain
 | Configure the CA address
 | Configure the CA type
 | Configure the terminal entity DN
 | Configure the HTTP user name and password
 | Configure the hash algorithm
 | Configure the source interface or source IP address
Configure certificate authentication | Configure getting and authenticating CA certificate
 | Configure getting and authenticating CRL list
 | Configure the policy of checking certificate canceling
 | Configure the policy of checking the valid period of the certificate
 | Configure forcing to set the certificate trust status
Configure certificate application and getting | Configure the certificate application
 | Configure getting successful-issued certificate
 | Configure certificate importing
Configure deleting certificate | Configure deleting certificate


5.2.1 Configure Trust Domain

Before applying for the digital certificate, the terminal entity needs to configure some registration information to help complete the application. The set of the information is the trust domain of one terminal entity. One trust domain corresponds o one certificate trust chain. The trust chain can comprise multi-level CAs and also can have only one root CA. The configuration parameters of one trust domain include the address of accessing CA, the policy of checking the certificate in the domain and so on. The device supports creating 10 trust domains at the same time.

The trust domain is one local concept. Creating the trust domain is to facilitate the certificate management and let other applications, such as IKE (Internet Key Exchange) and SSL, use the certificate safely. The trust domain configured on one device is invisible for the CA and other devices. Each trust domain has the separate domain parameter configuration.

Configuration Condition

None

Configure Trust Domain

The trust domain name can be configured by the user according to the readability and other requirements. If CA has the special requirement for the trust domain name, we should configure according to the requirement of the CA.

Table 5‑2 Configure trust domain

Step | Command | Description
Enter the global configuration mode | config terminal | -
Create one trust domain and enter the trust domain configuration mode | crypto ca identity ca-name | Mandatory By default, do not configure trust domain.

l The device permits creating 10 trust domains at most.

l Some CA limits that the trust domain name is consistent with the CN (Common Name) in the CA self-signature certificate DN. Otherwise, it cannot get the CA certificate. For example, if the CN of Kaiyuan EJBCA (Enterprise Java Bean CA, the CA server developed by the commercial application component technology in JAVA) is AdminCA1, the trust domain name should be configured as crypto ca identify AdminCA1. The CA server of Cisco and Microsoft does not have the limitation. Before configuration, we should get to know whether the CA server have the related limitation.

Configure CA Address

If adopting the function of applying for and getting the certificate online, we need to use the command to configure the IP address or domain name of the CA. If adopting the mode of applying for the certificate offline, do not need to configure the item.

Table 5‑3 Configure the CA address

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure the IP address of the CA server | enrollment address ip-address | Either By default, do not configure the address of the CA server.
Configure URL of the CA server | enrollment url url-string

l The address format of each CA server is different and we need to get the correct address from the maintaining staff of the CA server and then configure. For example, the address format of Kaiyuan EJBCA is enrollment url 192.168.1.1:8080/ejbca/publicweb/apply/scep/pkiclient.exe, while the CA servers of Cisco and Microsoft just need to specify the IP address, such as enrollment address 192.168.1.1.

Configure CA Type

If using the function of applying for and getting the certificate online, the device needs to adopt different protocol standard to communicate according to different CA type, so it is necessary to configure the CA type; if adopting the mode of applying for the certificate offline, we also need to configure the item and the device needs to generate different contents of PKCS #10 according to different CA types (Public-Key Cryptography Standards, Certification Request Syntax Standard) certificate requests.

Currently, the device supports the following CA types that can be applied for online:

l ctca (China Telecom Certificate Authority): Adopt China Telecom private protocol to apply for the certificate online or offline, support China Telecom CA;

l other: Other types of CA; currently, the configuration can only be used for the offline certificate application. The generated PKCS #10 content of the device in the configuration is the same as the generated PKCS #10 content when the CA type is scep;

l scep (Simple Certificate Enrollment Protocol): Adopt Cisco certificate registration protocol to apply for the certificate online or offline; support using the CA of the SCEP protocol;

l windows: Adopt Microsoft private protocol to apply for the certificate online or offline; support Windows Server 2000 CA, Windows Server 2003 CA, Windows Server 2008 CA.

Table 5‑4 Configure the CA type

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure the CA type | ca type { other | scep | ctca | windows [ renewal renewal-number ] } | Optional By default, the CA type is scep.

l After renewing the CA certificate on windows CA server, the new, old CA certificates and CRL list all exist, and the CA certificate and CRL list serial numbers increase by degrees from 0. Therefore, when the CA type is windows, we can configure the renewal parameter to get the CA certificate and CRL list of the specified renewal-number.

Configure Terminal Entity DN

One digital certificate is the binding of one public key and one identity, while the identity should be associated with one specified terminal entity. DN (Distinguished Name) is the identity information of the terminal entity. CA uniquely identifies the certificate applicant according to the identity information provided by the terminal entity.

The common parameters of the terminal entity DN include:

l Locality name: L for short, indicating the name of the located geographical area;

l Country name: C for short, indicating the code of the belonging country, expressed by the standard two-character code. For example, “CN” is the valid country vode of China;

l State or province name: ST for short, indicating the name of the located state or province;

l Organization name: O for short, indicating the name of the located organization;

l Organizational Unit Name: OU for short, indicating the name of the located department;

l Email address: E for short, indicating the email address;

l Common name: CN for short, indicating the name;

During the configuration, use the abbreviation. For example, one DN indicating Zhangsan is C=CN, ST= Sichuan, O=China Telecom, OU=Technical office, OU=operation, maintenance and management, CN=Zhangsan, E=zs@ctca.com.cn .

Table 5‑5 Configure the terminal entity DN

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Create the DN and enter the DN configuration mode | subject-name subject-name | Mandatory By default, do not configure the topic name.
Configure the key type and length | key-type { rsa { key-size {1024 | 2048 | 512 } } | sm2 } | Optional By default, the key type is RSA and the key length is 512 bits.
Configure the password | password password | Optional By default, DN is not configured with password; when configuring the CA type as scep, we need to configure the password.
Configure the auto registration | auto-enroll | Optional By default, do not apply for the terminal entity certificate automatically. After configuring auto application, the device will apply for the certificate automatically; if application fails, the device will re-try until the certificate is applied successfully; if applying for the certificate manually and automatically is configured at the same time and when the applying for the certificate manually fails, the device will re-try until the certificate is applied successfully.

l In one trust domain, we can configure multiple different terminal entity DNs, that is, there can be the terminal entity digital certificate with multiple different DNs.

l The format content of the DN takes the requirements of the CA server as reference. For example, some CA server requires that there should be CN; the CA server of Microsoft has the limitation for the DN length;

l The content of DN is specified by the user or pre-distributed by the CA server. For example, some CA server binds the distributed DN with the password. When the terminal entity applies for the certificate, it should configure the specified DN and carry the matching password. Otherwise, the certificate cannot be applied successfully.

Configure HTTP User Name and Password

The packets of applying for and getting the online certificate need the security guarantee. This can ensure the security and reliability of the certificate better. There can be various modes, such as adopting the SSL protocol protection, or enabling the HTTP authentication mode to protect.

When configuring the CA type as windows and Microsoft CA server enables the HTTP integrating Windows ID authentication and adopts NTLM (WindowsNT LAN Manager Challenge/Response) mode and basic ID authentication (sending password by the plaintext mode), the user needs to provide the authentication user name and password for the authentication and interaction of the HTTP protocol packets, completing the application and getting of the online certificate.

Table 5‑6 Configure the HTTP user name and password

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure the HTTP user name and password | ca username username password password | Mandatory By default, do not configure the authentication user name or password; do not encapsulate the authentication information for the HTTP request packet. The specific user name and password are got from the system administrator of the CA server.

Configure Hash Algorithm

When the terminal entity applies for the certificate, it is necessary to adopt the specified hash algorithm for the signature of the self-signature certificate. Currently, the device mainly supports configuring sha1 (Secure Hash Algorithm) and country commercial password hash algorithm sm3.

Table 5‑7 Configure the hash algorithm

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure the hash algorithm | hash { sha1 | sm3 } | Optional By default, the self-signature certificate of the device uses the secure hash algorithm sha1.

Configure Source Interface or Source IP Address

In the specified environment, if the source addresses for the online certificate application packets are limited, we can configure the source interface or source IP address of the packet sent by the device, avoiding the failure of the certificate application. Please configure the item according to the actual environment requirement.

Table 5‑8 Configure the source interface or source IP address

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure the source interface or source IP address | local { address ip-address | interface interface-name } | Mandatory By default, the source IP address of the online certificate application packet is the IP address of the egress interface of the route to the CA server.


5.2.2 Configure Certificate Authentication

The validity of the digital certificate mainly includes three parts: the correctness of the CA digital signature (that is, the authenticity of the digital certificate), whether the digital certificate is canceled, and whether the digital certificate is in the validity. The premise of using the digital certificate is that it is valid. Therefore, we should check the validity of the used digital certificate first.

l The core of the digital certificate authentication is to check the signature of the CA on the digital certificate. Therefore, before authenticating the digital certificate, first get the CA certificate;

l When configuring the certificate authentication, we can set whether to check the CRL canceling list;

l When configuring the certificate authentication, we can set whether to check the validity. If setting to check, ensure that the system clock of the device is synchronized with the system clock of the CA server. The validity check contains the valid start date of the digital certificate and the valid end date of the digital certificate;

l The user can force to set the certificate trust status as trust (forced to be valid), un-trust (forced to be invalid) or auto trust (that is, check the validity by the above certificate authentication modes).

Configuration Condition

When configuring the certificate authentication, first complete the following task:

l Configure one trust domain

l To get the CA certificate or CRL list online, we need to ensure that the network between the device and CA is reachable.

Configure Getting and Authenticating CA Certificate

The CA certificate is the certificate identifying the CA itself. If there are multiple CAs in the PKI system, form one CA hierarchy. The top CA is the root CA and it has one CA “self-signature” certificate. The root CA is the starting point of the trust and its lower layer may be the sub CA, or RA, or the root CA directly faces the terminal entity.

CA is the core of PKI and the importance of its certificate goes without saying. The concern of the terminal entity is how to get the CA certificate and validate its validity, so as to prepare for the trust chain for authenticating the CRL list and terminal entity certificate later (certificate chain).

Besides the above mentioned, the validity authentication of the CA certificate also needs to appraise that the CA certificate is really from the specified CA, because maybe the CA certificate is replaced by one hacker. If we do not appraise the CA certificate, the later security actions are wasted, because the starting point of the trust has problems. One common appraising mode is to check the fingerprint of the CA certificate. It needs one secure mode to get the fingerprint of its certificate from the CA and calculates the fingerprint after the device gets the CA certificate. Compare the two. If consistent, it indicates that the source of the CA certificate is reliable. The fingerprint can be got offline or online based on the security, such as SSL.

Table 5‑9 Configure getting and authenticating CA certificate

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure getting and authenticating the CA certificate automatically | auto-authenticate [ fingerprint fingerprint-string ] | Optional By default, do not get the CA certificate automatically. After automatically applying for and authenticating the certificate, the device will automatically apply for the certificate. If applying fails, the device will re-try until the certificate is applied successfully; if applying for the certificate manually and automatically is configured at the same time and when the applying for the certificate manually fails, the device will re-try until the certificate is applied successfully.
Return to the global configuration mode | exit | -
Configure getting and authenticating the CA certificate manually | crypto ca authenticate ca-name [ no-confirm ] | Optional By default, do not get the CA certificate manually. If not configuring no-confirm and not configuring getting and authenticating the CA certificate automatically, display the fingerprint of the CA certificate and prompt the user to confirm whether to accept the got CA certificate.
Configure offline importing and authenticating the CA certificate | crypto ca import certificate [ file-name [ to ca-name ] | to ca-name ] | Optional By default, the device does not import the CA certificate manually. The importing format supports DER (Distinguished Encoding Rules), Base64 (a commonly-used encoding standard of converting hexadecimal data into visible character) and PKCS # 7 (Cryptographic Message Syntax Standard).

l If there is the root CA certificate in the specified trust domain, do not permit to re-execute the operation of getting the root CA certificate. To re-get, first delete the root CA certificate and then re-execute the operation of getting the root CA certificate.

l To ensure that the existing certificate on the device (including CA certificate, terminal entity certificate, CRL list) is available, please ensure that the current system time of the device is in the validity of the certificate and had better be synchronous with the system time of the CA server.

Configure Getting and Authenticating CRL List

The structure of the CRL list is similar to the digital certificate. After one digital certificate is canceled, CA will add the certificate to the cancel list and then issues the digital signature to the list, so as to create one valid X.509 v2 CRL list. CA publishes the CRL list to one public repository and the terminal entity can search the repository. When the terminal entity receives one digital certificate, first search CRL according to the policy and judge whether the certificate is canceled. The largest trouble of using the CRL list is to shorten the interval between cancelling the certificate and the terminal entity knowing the message.

The device supports updating the CRL list automatically and the auto update frequency depends on two factors, that is, the CRL next releasing time set by CA policy and the updating period configured by the device.

Table 5‑10 Configure getting and authenticating CRL list

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure updating and getting the CRL list automatically | crl autorenew period period-value | Optional By default, do not update the CRL list automatically.
Return to the global configuration mode | exit | -
Configure getting the CRL list manually | crypto ca crl request ca-name | Optional By default, the device does not get the CRL list manually.
Configure importing the CRL list offline | crypto ca import CRL [ file-name [ to ca-name ] | to ca-name ] | Optional By default, the device does not import the CRL list manually. The importing format supports DER and Base64.

l CRL auto update period refers to the interval of the device downloading the CRL list from the CRL storing server. Compare the manual configured CRL update period plus the current system clock with the update time specified in the CRL list and take the smaller one as the time of updating and getting the CRL list next time.

l CRL auto update function needs to ensure that the system clock of the device is correct and keep synchronous with the system clock of the CA server. We can consider using the NTP (network time protocol) to synchronize the clock. If the system is not correct, or modifying the system clock manually, it may result in the abnormality of CRL updating action.

Configure Policy of Checking Certificate Canceling

The configuration decides whether to check whether the certificate is canceled strictly when authenticating the certificate.

If the configuration is enabled, strictly check the certificate canceling. If we cannot get the valid CRL list, it is regarded that the certificate authentication fails. Ensure the maximum security, but it will reduce the availability.

Usually, the probability of canceling the certificate caused by the leakage of the certificate private key is low and we can control the access for the certificate user, so it is not suggested to enable the option, but ensure the maximum service availability. (By default, check the certificate canceling when the system has the CRL list. Otherwise, omit)

Table 5‑11 Configure the policy of checking certificate canceling

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure the policy of checking certificate canceling | revoke check { off | on } | Optional By default, the function of checking whether the certificate is canceled strictly via the CRL list is disabled.

Configure Policy of Checking Valid Period of Certificate

The configuration decides whether to check the valid period of the certificate strictly when authenticating the certificate validity.

Different system times may cause the mistake of checking the valid period of the certificate and result in the authentication failure, so usually we can omit the check item. The certificate security is high and according to the present technology, it is nearly impossible to decode the private key of the certificate with a long time, so omitting the check item will not affect the certificate security greatly.

Table 5‑12 Configure the policy of checking the valid period of the certificate

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure the policy of checking certificate validity | time check { off | on } | Optional By default, the function of checking the valid period of the certificate is disabled.

l If selecting to check the valid period of the certificate, we should configure and synchronize the system time of the device and the CA server correctly. Otherwise, it may result in the failure of checking the valid period of the certificate.

Configure Forcing to Set Certificate Trust Status

Forcing to set the certificate trust status means to set the certificate status as auto check or always trust or never trust. For example, after some certificate passes the validity check and when being used to perform the invalid access, the administrator can contact the system CA administrator and set the trust status of the certificate as never trust.

Table 5‑13 Configure forcing to set the certificate trust status

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enter the trust domain configuration mode | crypto ca identity ca-name | -
Configure forcing to set the certificate trust status | crypto ca certificate { trust | autotrust | untrust } ca-name { name subject-name | sn sn-string } | Optional By default, judge the certificate validity automatically according to the policy of checking the certificate.


5.2.3 Configure Certificate Application and Getting

Certificate application means the terminal entity introduces the process of binding with DN to CA. The terminal entity provides the ID information (DN) for CA and the corresponding public key. The information becomes the important part of the certificate issued to the terminal entity.

Configuration Condition

Before configuring the certificate application and getting, first complete the following task:

l Configure one trust domain and configure the environment for checking the certificate;

l To apply for and get the terminal entity certificate online, ensure the network between the device and CA is reachable.

Configure Certificate Application

The terminal entity puts forward the certificate application to CA and gets the issued certificate. There are two modes, online and offline. In the offline application mode, CA permits the applicant to provide the application information for CA via the out-band mode (such as telephone, disk and email) and get the issued certificate; in the online application mode, the terminal entity interacts with CA via the online protocol to complete the certificate application and getting according to the CA type.

Table 5‑14 Configure the certificate application

Step

Command

Description

Enter the global configuration mode

config terminal

-

Configure the online certificate application

crypto ca enroll ca-name { rsa { 512 | 1024 | 2048 } | sm2 | subject-name } subject-name

Optional

By default, the device does not apply for the certificate online manually.

subject-name is the configured terminal entity DN in the trust domain configuration. If auto-enroll is configured in DN, the device re-tries automatically when executing the command fails.

If not specifying subject-name or subject-name does not configure the password and when the CA type is scep, the user needs to input the password after configuring the command.

Configure the offline certificate application

crypto ca pkcs10-enroll ca-name { rsa { 512 | 1024 | 2048 } | sm2 } subject-name

Optional

By default, the device will not apply for the certificate offline.

Offline certificate application uses the PKCS #10 format and can support any third-party CA.

l Auto certificate application is configured when configuring the terminal entity DN.

l In one trust domain, do not permit two certificates with the same DN.

l If checking the valid period of the certificate is configured, ensure that the system clock of the device is synchronous with the system time of CA. Otherwise, the valid period of the applied certificate will become abnormal.

Configure Getting Successful-Issued Certificate

There are two modes for CA to audit the issued certificate. One is to audit and issue the terminal entity certificate automatically according to the policy; the other is that the CA system administrator audits and manually issues the terminal entity certificate. The former is convenient when the terminal entity certificate is updated automatically, but the security and controllability are poor; the latter first needs to confirm whether the certificate is issued after the terminal entity issues the certificate application. If the certificate is issued, get the certificate to the local. The mode is not flexible enough, but the security is relatively strong.

Table 5‑15 Configure getting successful-issued certificate

Step | Command | Description
Enter the global configuration mode | config terminal | -
Configure getting successful-issued certificate | crypto ca retrive ca-name [ subject-name ] | Optional By default, the device does not get the certificate issued by CA manually. When configuring the command of the terminal entity auto-enroll, the device automatically queries the current certificate status and gets back the issued certificate.

l Getting the issued certificate is just for the online certificate application. Offline certificate application needs to get the issued certificate via the importing mode.

l If checking the valid period of the certificate is configured, ensure that the system time of the device is synchronous with the CA clock. Otherwise, the valid period of the got certificate will become abnormal.

Configure Certificate Importing

There are several kinds of certificates imported via configuration: One is the certificate issued successfully after PKCS #10 request; the second is the certificate of other terminal entity; the third is the terminal entity certificate imported via PKCS #12 (Personal Information Exchange Syntax Standard) format.

Table 5‑16 Configure the certificate importing

Step | Command | Description
Enter the global configuration mode | config terminal | -
Configure importing the certificate without private key | crypto ca import certificate [ file-name [ to ca-name ] | to ca-name ] | Optional By default, the device does not import the certificate manually. The importing format supports DER, Base64, and PKCS #7.
Configure importing the certificate with private key | crypto ca import pkcs12 { file-name [ pkcs12-password [ to ca-name ] | to ca-name ] | ftp ip-address username ftp-password file-name [ pkcs12-password [ to ca-name ] | to ca-name ] | inputs [ pkcs12-password [ to ca-name ] | to ca-name ] | tftp ip-address file-name [ pkcs12-password [ to ca-name ] | to ca-name ] } | Optional By default, the device does not import the pkcs12 certificate manually. The importing format supports PKCS #12.

l If checking the valid period of the certificate is configured, ensure that the system clock of the device is synchronous with the CA clock. Otherwise, the valid period of the imported certificate will become abnormal.


5.2.4 Configure Deleting Certificate

Unless the certificate has expired, or has been archived, or do not recommend the user to delete the local saved certificate, especially the certificate of the local device. Once being deleted, we can only re-apply for the new certificate from CA.

Configuration Condition

None

Configure Deleting Certificate

Table 5‑17 Configure deleting certificate

Step | Command | Description
Enter the global configuration mode | config terminal | -
Configure deleting certificate | no crypto ca certificate ca-name { name subject-name | sn sn-string | type { all | crl | my | remote | requesting | root } } | Mandatory By default, do not delete the certificate. The types of the certificates that can be deleted include CA certificate, terminal entity certificate, CRL list, self-signature certificate in the request state.


5.2.5 PKI Monitoring and Maintaining

Table 5‑18 PKI monitoring and maintaining

Command | Description
show crypto ca identity | Display the trust domain information
show crypto ca version | Display the PKI version information
show crypto ca remotepubkey der [ name subject-name ] | Display the local saved remote public key information
show crypto ca mypubkey der [ name subject-name ] | Display the public key information saved at the local
show crypto ca certificates der [ ca-name [ name subject-name | sn sn-string ] | name subject-name | sn sn-string ] | Display the certificate information in the hex DER code format according to the certificate domain, certificate domain plus certificate topic or certificate serial number, or directly display the certificate information according to the certificate topic or certificate serial number
show crypto ca certificates general [ ca-name [ name subject-name | sn sn-string ] | name subject-name | sn sn-string ] | Display the certificate information in the general format according to the certificate domain, certificate domain plus certificate topic or certificate serial number, or directly display the certificate information according to the certificate topic or certificate serial number
show crypto ca certificates list | Display all certificate information on the device in the general format
show crypto ca certificates pem [ ca-name [ name subject-name | sn sn-string ] | name subject-name | sn sn-string ] | Display the certificate information in the PEM format according to the certificate domain, certificate domain plus certificate topic or certificate serial number, or directly display the certificate information according to the certificate topic or certificate serial number
show crypto ca ca-certificates [ der | general | pem ] | Display the CA certificate information
show crypto ca my-certificates [ der | general | pem ] | Display the local certificate information
show crypto ca remote-certificates [ der | general | pem ] | Display the remote certificate information
show crypto ca crls [ der | general | pem ] | Display the certificate canceling list information
show crypto ca pkcs10 [ ca-name [ subject-name ] ] | Display the PKCS10 offline certificate application information


5.3 PKI Typical Coniguration Example


5.3.1 Configure Online Applying for Certificate

Network Requirements

l Device1 and Devices set up the IPsec tunnel by the pre-share key mode; Device applies for the certificate online from the CMS server via the IPsec tunnel; Device2 applies for the certificate online from CMS;

l After Device1 and Device2 apply for the certificate, set up the IPsec tunnel by the digital signature authentication mode, protecting the data communication of the network where PC1 and PC2 are located;

l IPsec proposal security protocol adopts ESP, IKE proposal and IPsec proposal encryption algorithm adopts 3DES and the authentication algorithm adopts MD5.

Network Topology

Figure 5‑1Networking of configuring the online applying for certificate

Configuration Steps

Step 1: | Configure the IP address and route of the interface. (omitted)
Step 2: | Configure the CMS server.

#For the configuration of the CMS server, refer to the CMS chapter of the configuration manual.

#On CMS server, register two users; the user DNs are CN=Device1, C=CN and CN=Device2, C=CN respectively; the user passwords are both set as admin.

Step 3:

Configure trust domain.

#On Device1, configure trust domain myca, configure the address of the CA server as 101.0.0.3, and the source address of the applied certificate is 100.0.0.1.

Device1#configure terminal

Device1(config)#crypto ca identity myca

Device1(ca-identity)#enrollment address 101.0.0.3

Device1(ca-identity)#ca type scep

Device1(ca-identity)#local address 100.0.0.1

Device1(ca-identity)#exit

#On Device2, configure trust domain myca and configure the address of the CA server as 101.0.0.3.

Device2#configure terminal

Device2(config)#crypto ca identity myca

Device2(ca-identity)#enrollment address 101.0.0.3

Device2(ca-identity)#ca type scep

Device2(ca-identity)#exit

Step 4:

Configure the IKE and IPSec proposal.

#On Device1, configure the IKE proposal ikepro, use the encryption algorithm 3DES, authentication algorithm MD5; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES, and authentication algorithm MD5.

Device1(config)#crypto ike proposal ikepro

Device1(config-ike-prop)#encryption 3des

Device1(config-ike-prop)#integrity md5

Device1(config-ike-prop)#exit

Device1(config)#crypto ipsec proposal ippro

Device1(config-ipsec-prop)#esp 3des md5

Device1(config-ipsec-prop)#exit

#On Device2, configure the IKE proposal ikepro, use the encryption algorithm 3DES, authentication algorithm MD5; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES, and authentication algorithm MD5.

Device2(config)#crypto ike proposal ikepro

Device2(config-ike-prop)#encryption 3des

Device2(config-ike-prop)#integrity md5

Device2(config-ike-prop)#exit

Device2(config)#crypto ipsec proposal ippro

Device2(config-ipsec-prop)#esp 3des md5

Device2(config-ipsec-prop)#exit

Step 5:

Configure the pre-share key.

#On Device1, configure the pre-share key, key is admin and permit all peers to use the key.

Device1(config)#crypto ike key admin any

#On Device2, configure the pre-share key, key is admin and permit all peers to use the key.

Device2(config)#crypto ike key admin any

Step 6:

Configure the IPSec tunnel.

#On Device1, configure the tunnel tun, use gigabitethernet0 interface as the local interface of the tunnel, configure the peer address of the tunnel as 151.255.24.24, the IKE proposal uses ikepro, IPsec proposal uses ippro, and enable the auto initiating negotiation.

Device1(config)#crypto tunnel tun

Device1(config-tunnel)#local interface gigabitethernet 0

Device1(config-tunnel)#peer address 151.255.24.24

Device1(config-tunnel)#set ike proposal ikepro

Device1(config-tunnel)#set ipsec proposal ippro

Device1(config-tunnel)#set auto-up

Device1(config-tunnel)#exit

#On Device2, configure the tunnel tun, use gigabitethernet0 interface as the local interface of the tunnel, configure the peer of the tunnel as any, the IKE proposal uses ikepro, and IPsec proposal uses ippro.

Device2(config)#crypto tunnel tun

Device2(config-tunnel)#local interface gigabitethernet 0

Device2(config-tunnel)#peer any

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#exit

l When not specifying the authentication mode, first use the digital signature authentication; if no certificate, adopt the pre-share key authentication.

Step 7:

Configure the IPSec security policy.

#On Device1, configure the security policy policy1, protect the IP communication from network 100.0.0.0/24 to network 101.0.0.0/24, and associate the tunnel tun.

Device1(config)#crypto policy policy1

Device1(config-policy)#flow 100.0.0.0 255.255.255.0 101.0.0.0 255.255.255.0 ip tunnel tun

Device1(config-policy)#exit

#On Device2, configure the security policy policy1, protect the IP communication from network 100.0.0.0/24 to network 101.0.0.0/24, and associate the tunnel tun.

Device2(config)#crypto policy policy1

Device2(config-policy)#flow 101.0.0.0 255.255.255.0 100.0.0.0 255.255.255.0 ip tunnel tun

Device2(config-policy)#exit

Step 8:

Configure getting the CA certificate and CRL online and applying for and getting the user certificate online.

#On Device1, get the CA certificate and CRL tunnel online, and apply for and get the user certificate via the IPsec online; the user certificate DN is CN=Device1, C=CN, and the password is admin.

Device1(config)#crypto ca authenticate myca

% The Root CA Certificate has the following attributes:

Serial Number: 179dd41c4574f7e15351

Subject: CN=root, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:23:51

End date: 2028-03-27 06:23:51

Usage: Sign

Fingerprint(sha1):7e4b7407cc705a8a66642d00cea139edfd273400

% Do you accept this certificate?[yes]/[no]:

% PKI: Get CA certificate success.

Device1(config)#crypto ca crl request myca

% PKI: Get CRL success.

Device1(config)#crypto ca enroll myca rsa 1024 CN=Device1,C=CN

% Please input request password:*****

% The Certificate DN will be: CN=Device1,C=CN

% Waiting,Generate 1024 bit RSA keys!

% Generating .

% PKI: Certificate enroll success.

#On Device2, get the CA certificate and CRL tunnel online, and apply for and get the user certificate online; the user certificate DN is CN=Device2, C=CN, and the password is admin.

Device2(config)#crypto ca authenticate myca

% The Root CA Certificate has the following attributes:

Serial Number: 179dd41c4574f7e15351

Subject: CN=root, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:23:51

End date: 2028-03-27 06:23:51

Usage: Sign

Fingerprint(sha1):7e4b7407cc705a8a66642d00cea139edfd273400

% Do you accept this certificate?[yes]/[no]:

% PKI: Get CA certificate success.

Device2(config)#crypto ca crl request myca

% PKI: Get CRL success.

Device2(config)#crypto ca enroll myca rsa 1024 CN=Device2,C=CN

% Please input request password:*****

% The Certificate DN will be: CN=Device2,C=CN

% Waiting,Generate 1024 bit RSA keys!

% Generating

% PKI: Certificate enroll success.

Step 9:

Check the result.

#On Device1, view the tunnel information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

34 STATE_QUICK_I2 129.255.24.25 151.255.24.24 151.255.24.24

33 STATE_MAIN_I4 129.255.24.25 151.255.24.24 151.255.24.24

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 100.0.0.0/24 101.0.0.0/24 ip any any

local tunnel endpoint : 129.255.24.25 remote tunnel endpoint : 151.255.24.24

the pairs of ESP ipsec sa : id : 34, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0x6dc22061(1841438817) crypto context : 0x3937f40

current input 33 packets, 7 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28036/4294967287

uptime is 0 hour 12 minute 44 second

outbound esp ipsec sa : spi : 0x4fc11055(1338052693) crypto context : 0x3924d60

current output 29 packets, 5 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28036/4294967289

uptime is 0 hour 12 minute 44 second

total sa and sa group is 1

We can see that Device1 and Device2 set up the IPsec tunnel successfully; the source and destination of the applied certificate are the network protected by the IPsec tunnel.

#On Device1, view the online got CA certificate, user certificate, and CRL information.

Device1#show crypto ca certificates

Root CA Certificate:

Status: Valid

Serial Number: 179dd41c4574f7e15351

Subject: CN=root, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:23:51

End date: 2028-03-27 06:23:51

Key Type: RSA(1024 bit)

Usage: Sign

Fingerprint(sha1):7e4b7407cc705a8a66642d00cea139edfd273400

Associated Identity: myca

index: 10

My Certificate:

Status: Valid

Serial Number: ccca972bfc9a4c755551

Subject: CN=Device1, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-29 11:04:44

End date: 2014-03-28 11:04:44

Key Type: RSA(1024 bit)

Usage: Sign

Fingerprint(sha1):7808a39ddb643361a625a07bbc6f86ae35c5f628

Associated Identity: myca

index: 11

Device1#show crypto ca crls

Certificate Revocation List (CRL):

Issuer : CN=root, C=CN

This Update: 2013-03-29 11:01:46

Next Update: 2013-04-01 11:01:46

Revoted Certificate count: 9

Associated Identity: myca

We can see that getting CA certificate, user certificate, and CRL online succeeds on Device1.

#On Device2, view the online got CA certificate, user certificate, and CRL information.

Device2#show crypto ca certificates

Root CA Certificate:

Status: Valid

Serial Number: 179dd41c4574f7e15351

Subject: CN=root, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:23:51

End date: 2028-03-27 06:23:51

Key Type: RSA(1024 bit)

Usage: Sign

Fingerprint(sha1):7e4b7407cc705a8a66642d00cea139edfd273400

Associated Identity: myca

index: 4

My Certificate:

Status: Valid

Serial Number: 441f99bf2a71b2615551

Subject: CN=Device2, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-29 09:41:06

End date: 2016-03-28 09:41:06

Key Type: RSA(1023 bit)

Usage: Sign

Fingerprint(sha1):5d4e2f0128fccc8f970cb9038d7abaaa8ed70b9e

Associated Identity: myca

index: 5

Device2#show crypto ca crls

Certificate Revocation List (CRL):

Issuer : CN=root, C=CN

This Update: 2013-03-29 09:35:22

Next Update: 2013-04-01 09:35:22

Revoted Certificate count: 8

Associated Identity: myca

We can see that getting CA certificate, user certificate, and CRL online succeeds on Device2.

#On Device1, use the command clear crypto sa to clear the tunnel, re-negotiate the tunnel by the digital signature mode, and view the tunnel information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

36 STATE_QUICK_I2 129.255.24.25 151.255.24.24 CN=Device2, C=CN

35 STATE_MAIN_I4 129.255.24.25 151.255.24.24 CN=Device2, C=CN

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 100.0.0.0/24 101.0.0.0/24 ip any any

local tunnel endpoint : 129.255.24.25 remote tunnel endpoint : 151.255.24.24

the pairs of ESP ipsec sa : id : 36, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0x78412062(2017534050) crypto context : 0x39370c0

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28618/4294967295

uptime is 0 hour 3 minute 2 second

outbound esp ipsec sa : spi : 0x14ff1056(352260182) crypto context : 0x395d6a0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28618/4294967295

uptime is 0 hour 3 minute 2 second

total sa and sa group is 1

We can see that Device1 sets up the IPsec tunnel with Device2 successfully by the digital signature mode.

#On Device1, view the remote got certificate information.

Device1# show crypto ca remote-certificates

Remote Certificate:

Status: Valid

Serial Number: 441f99bf2a71b2615551

Subject: CN=Device2, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-29 09:41:06

End date: 2016-03-28 09:41:06

Key Type: RSA(1023 bit)

Usage: Sign

Fingerprint(sha1):5d4e2f0128fccc8f970cb9038d7abaaa8ed70b9e

Associated Identity: myca

index: 12

We can see that Device1 gets the certificate of Device2 CN=Device2, C=CN successfully.

#On Device2, view the tunnel information.

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

30 STATE_QUICK_R2 151.255.24.24 129.255.24.25 CN=Device1, C=CN

29 STATE_MAIN_R3 151.255.24.24 129.255.24.25 CN=Device1, C=CN

Device2#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

policy name : subflow-1610612749, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

local tunnel endpoint : 151.255.24.24 remote tunnel endpoint : 129.255.24.25

the pairs of ESP ipsec sa : id : 30, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0x14ff1056(352260182) crypto m_context(s_context) : 0x67bce60 / 0x67bcc60

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28492/4294967295

uptime is 0 hour 5 minute 8 second

outbound esp ipsec sa : spi : 0x78412062(2017534050) crypto m_context(s_context) : 0x6e7e8a0 / 0x67bcce0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28492/4294967295

uptime is 0 hour 5 minute 8 second

total sa and sa group is 1

We can see that Device2 sets up the IPsec tunnel with Device1successfully by the digital signature mode.

#On Device2, view the remote got certificate information.

Device2#show crypto ca remote-certificates

Remote Certificate:

Status: Valid

Serial Number: ccca972bfc9a4c755551

Subject: CN=Device1, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-29 11:04:44

End date: 2014-03-28 11:04:44

Key Type: RSA(1024 bit)

Usage: Sign

Fingerprint(sha1):7808a39ddb643361a625a07bbc6f86ae35c5f628

Associated Identity: myca

index: 7

We can see that Device2 gets the certificate of Device1 CN=Device1, C=CN successfully.

# PC1 can ping PC2 via the IPsec tunnel between Device1 and Device2; the packet is protected by the IPsec tunnel.


5.3.2 Configure Offline Getting Certificate

Network Requirements

l Import the CA certificate, user certificate, and CRL to Device1 and Device2 via the offline mode.

l After Device1 and Device2 get the certificate, set up the IPsec tunnel by the digital signature mode, protecting the data communication of the network where PC1 and PC2 are located;

l IPsec proposal security protocol adopts ESP, encryption algorithm adopts 3DES, authentication algorithm adopts SHA1, IKE proposal encryption algorithm adopts AES128 and the authentication algorithm adopts SHA1.

Network Topology

Figure 5‑2 Networking of configuring offline getting the certificate

Configuration Steps

Step 1: | Configure the IP address and route of the interface. (omitted)
Step 2: | Configure the CMS server and download the certificate.

#For the initializing of the CMS server and the generating of the root certificate and administrator, refer to the CMS chapter of the configuration manual.

#Download the CA certificate and CRL from the CMS server.

#On the CMS server, register two users; the user DNs are CN=Device1, C=CN and CN=Device2, C=CN, and then apply for the certificate and save as the certificate file in the PKCS#12 code format; the exporting password of the certificate is admin. Refer to the CMS chapter of the configuration manual.

Register two users on the CMS server,

Step 3:

Configure trust domain.

#On Device1, configure trust domain myca.

Device1#configure terminal

Device1(config)#crypto ca identity myca

Device1(ca-identity)#ca type scep

Device1(ca-identity)#exit

#On Device2, configure trust domain myca.

Device2#configure terminal

Device2(config)#crypto ca identity myca

Device2(ca-identity)#ca type scep

Device2(ca-identity)#exit

Step 4:

Configure importing the CA certificate, user certificate and CRL offline.

#On Device1, import the CA certificate offline. First open the certificate by the notepad, and then copy the content; on Shell, input the crypto ca import certificate to myca command and operate according to the prompt and import the CA certificate to the trust domain myca.

Device1(config)#crypto ca import certificate to myca

% Input the certificate data, press <Enter> twice to finish:

MIICSQYJKoZIhvcNAQcCoIICOjCCAjYCAQExADALBgkqhkiG9w0BBwGgggIeMIICG

jCCAYOgAwIBAgIKF53UHEV09+FTUTANBgkqhkiG9w0BAQUFADAcMQ0wCwYDVQQDEw

Ryb290MQswCQYDVQQGEwJDTjAeFw0xMzAzMjgwNjIzNTFaFw0yODAzMjcwNjIzNTF

aMBwxDTALBgNVBAMTBHJvb3QxCzAJBgNVBAYTAkNOMIGfMA0GCSqGSIb3DQEBAQUA

A4GNADCBiQKBgQCG31rAAqsZL2kjK+8dttVUyhUwx4BATMIGjD++KIwok6ZD1XP3z

KItRldk3EFgBD61AuGcTOjexLyWXtWrjEElpVdowerW3ZIeQ02fp7biLtDA6bdioz

Xp0JIHdlZpUmBo6ISLFcqtTGppx28iHxfPLZevE68veBpqVEQOOPkTvwIDAQABo2M

wYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUCVug

KxLpA7IZi26xYqMZNGhZwrcwHwYDVR0jBBgwFoAUCVugKxLpA7IZi26xYqMZNGhZw

rcwDQYJKoZIhvcNAQEFBQADgYEASXjJ0CtwnY6K8g8nxnhUOX9oo9LNnH3eWdFxTh

cVy12HEUAUOc7Bfd+ybmkpyO14TQPoQMFS7Y5ZZ/vJMkiVIoEGQTKPbTWpzh6pp4a

hZJEEzjVm7N2RvB2GPNylV67lmdUPNdyXRvPJCxGYqTMrQlE9zzHqmcGMW+HNK/XN

4tQxAH==

% The Root CA Certificate has the following attributes:

Serial Number: 179dd41c4574f7e15351

Subject: CN=root, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:23:51

End date: 2028-03-27 06:23:51

Usage: Sign

Fingerprint(sha1):7e4b7407cc705a8a66642d00cea139edfd273400

% Do you accept this root ca-certificate[yes]/[no]:

% PKI: Import Certificate success.

l The format of the CA certificate is BASE64 code.

#On Device1, import the user certificate offline, select the PKCS12 mode to download the certificate from PC1 via FTP; import the certificate to the trust domain myca and the password is admin; import CRL offline and download CRL to FLASH from PC1 via FTP, and then import CRL in FLASH to the trust domain myca.

Device1(config)#crypto ca import pkcs12 ftp 100.0.0.2 admin admin cn=Device1,c=CN.p12 admin to myca

Downloading###OK!

Import cert from pkcs12 success.

Device1(config-fs)#ftpcopy 100.0.0.2 admin admin CmsCrl0.crl /flash/CmsCrl0.crl

Downloading##OK!

Device1(config)#crypto ca import CRL CmsCrl0.crl to myca

% PKI: Import Certificate success.

#On Device2, import the CA certificate offline. First open the certificate by the notepad, and then copy the content; on Shell, input the crypto ca import certificate to myca command and operate according to the prompt and import the CA certificate to the trust domain myca.

Device2(config)#crypto ca import certificate to myca

% Input the certificate data, press <Enter> twice to finish:

MIICSQYJKoZIhvcNAQcCoIICOjCCAjYCAQExADALBgkqhkiG9w0BBwGgggIeMIICG

jCCAYOgAwIBAgIKF53UHEV09+FTUTANBgkqhkiG9w0BAQUFADAcMQ0wCwYDVQQDEw

Ryb290MQswCQYDVQQGEwJDTjAeFw0xMzAzMjgwNjIzNTFaFw0yODAzMjcwNjIzNTF

aMBwxDTALBgNVBAMTBHJvb3QxCzAJBgNVBAYTAkNOMIGfMA0GCSqGSIb3DQEBAQUA

A4GNADCBiQKBgQCG31rAAqsZL2kjK+8dttVUyhUwx4BATMIGjD++KIwok6ZD1XP3z

KItRldk3EFgBD61AuGcTOjexLyWXtWrjEElpVdowerW3ZIeQ02fp7biLtDA6bdioz

Xp0JIHdlZpUmBo6ISLFcqtTGppx28iHxfPLZevE68veBpqVEQOOPkTvwIDAQABo2M

wYTAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUCVug

KxLpA7IZi26xYqMZNGhZwrcwHwYDVR0jBBgwFoAUCVugKxLpA7IZi26xYqMZNGhZw

rcwDQYJKoZIhvcNAQEFBQADgYEASXjJ0CtwnY6K8g8nxnhUOX9oo9LNnH3eWdFxTh

cVy12HEUAUOc7Bfd+ybmkpyO14TQPoQMFS7Y5ZZ/vJMkiVIoEGQTKPbTWpzh6pp4a

hZJEEzjVm7N2RvB2GPNylV67lmdUPNdyXRvPJCxGYqTMrQlE9zzHqmcGMW+HNK/XN

4tQxAH==

% The Root CA Certificate has the following attributes:

Serial Number: 179dd41c4574f7e15351

Subject: CN=root, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:23:51

End date: 2028-03-27 06:23:51

Usage: Sign

Fingerprint(sha1):7e4b7407cc705a8a66642d00cea139edfd273400

% Do you accept this root ca-certificate[yes]/[no]:

% PKI: Import Certificate success.

#On Device2, import the user certificate offline, select the PKCS12 mode to download the certificate from PC2 via FTP; import the certificate to the trust domain myca and the password is admin; import CRL offline and download CRL to FLASH from PC2 via FTP, and then import CRL in FLASH to the trust domain myca.

Device2(config)#crypto ca import pkcs12 ftp 101.0.0.2 admin admin cn=Device2,c=CN.p12 admin to myca

Downloading###OK!

Import cert from pkcs12 success.

Device2(config-fs)#ftpcopy 101.0.0.2 admin admin CmsCrl0.crl /flash/CmsCrl0.crl

Downloading##OK!

Device2(config)#crypto ca import CRL CmsCrl0.crl to myca

% PKI: Import Certificate success.

#On Device1, view the CA certificate, user certificate, and CRL.

Device1#show crypto ca certificates

Root CA Certificate:

Status: Valid

Serial Number: 179dd41c4574f7e15351

Subject: CN=root, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:23:51

End date: 2028-03-27 06:23:51

Key Type: RSA(1024 bit)

Usage: Sign

Fingerprint(sha1):7e4b7407cc705a8a66642d00cea139edfd273400

Associated Identity: myca

index: 1

My Certificate:

Status: Valid

Serial Number: 34a9765647f716e65351

Subject: CN=Device1, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:41:26

End date: 2016-03-27 06:41:26

Key Type: RSA(511 bit)

Usage: Sign

Fingerprint(sha1):357462d37b911cba1ecddaa2e7a72019e0ca7014

Associated Identity: myca

index: 2

Device1#show crypto ca crls

Certificate Revocation List (CRL):

Issuer : CN=root, C=CN

This Update: 2013-03-28 06:44:55

Next Update: 2013-03-31 06:44:55

Revoted Certificate count: 1

Associated Identity: myca

We can see that getting the CA certificate, user certificate and CRL succeeds offline on Device1.

#On Device1, view the CA certificate, user certificate and CRL.

Device2#show crypto ca certificates

Root CA Certificate:

Status: Valid

Serial Number: 179dd41c4574f7e15351

Subject: CN=root, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:23:51

End date: 2028-03-27 06:23:51

Key Type: RSA(1024 bit)

Usage: Sign

Fingerprint(sha1):7e4b7407cc705a8a66642d00cea139edfd273400

Associated Identity: myca

index: 1

My Certificate:

Status: Valid

Serial Number: 34a9765647f785e65351

Subject: CN=Device2, C=CN

Issuer : CN=root, C=CN

Validity

Start date: 2013-03-28 06:43:17

End date: 2016-03-27 06:43:17

Key Type: RSA(511 bit)

Usage: Sign

Fingerprint(sha1):fc3606db8fe2fbd376ec94e7cccaa090ec128587

Associated Identity: myca

index: 2

Device2#show crypto ca crls

Certificate Revocation List (CRL):

Issuer : CN=root, C=CN

This Update: 2013-03-28 06:44:55

Next Update: 2013-03-31 06:44:55

Revoted Certificate count: 1

Associated Identity: myca

We can see that getting the CA certificate, user certificate and CRL succeeds offline on Device2.

Step 5:

Configure the IKE and IPSec proposal.

#On Device1, configure the IKE proposal ikepro, use the encryption algorithm AES128, authentication algorithm SHA1; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES, and authentication algorithm SHA1.

Device1(config)#crypto ike proposal ikepro

Device1(config-ike-prop)#encryption aes128

Device1(config-ike-prop)#integrity sha1

Device1(config-ike-prop)#exit

Device1(config)#crypto ipsec proposal ippro

Device1(config-ipsec-prop)#esp 3des sha1

Device1(config-ipsec-prop)#exit

#On Device2, configure the IKE proposal ikepro, use the encryption algorithm AES128, authentication algorithm SHA1; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES, and authentication algorithm SHA1.

Device2(config)#crypto ike proposal ikepro

Device2(config-ike-prop)#encryption aes128

Device2(config-ike-prop)#integrity sha1

Device2(config-ike-prop)#exit

Device2(config)#crypto ipsec proposal ippro

Device2(config-ipsec-prop)#esp 3des sha1

Device2(config-ipsec-prop)#exit

Step 6:

Configure the IPSec tunnel.

#On Device1, configure the tunnel tun, use gigabitethernet0 address as the local address of the tunnel, configure the peer address of the tunnel as 151.255.24.24, the IKE proposal uses ikepro, IPsec proposal uses ippro, and enable the auto initiating negotiation.

Device1(config)#crypto tunnel tun

Device1(config-tunnel)#local address 129.255.169.15

Device1(config-tunnel)#peer address 151.255.24.24

Device1(config-tunnel)#set ike proposal ikepro

Device1(config-tunnel)#set ipsec proposal ippro

Device1(config-tunnel)#set auto-up

Device1(config-tunnel)#exit

#On Device2, configure the tunnel tun, use gigabitethernet0 address as the local address of the tunnel, configure the peer of the tunnel as any, the IKE proposal uses ikepro, and IPsec proposal uses ippro.

Device2(config)#crypto tunnel tun

Device2(config-tunnel)#local address 151.255.24.24

Device2(config-tunnel)#peer any

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#exit

Step 7:

Configure the IPSec security policy.

#On Device1, configure the security policy policy1, protect the IP communication from network 100.0.0.0/24 to network 101.0.0.0/24, and associate the tunnel tun.

Device1(config)#crypto policy policy1

Device1(config-policy)#flow 100.0.0.0 255.255.255.0 101.0.0.0 255.255.255.0 ip tunnel tun

Device1(config-policy)#exit

#On Device2, configure the security policy policy1, protect the IP communication from network 101.0.0.0/24 to network 100.0.0.0/24, and associate the tunnel tun.

Device2(config)#crypto policy policy1

Device2(config-policy)#flow 101.0.0.0 255.255.255.0 100.0.0.0 255.255.255.0 ip tunnel tun

Device2(config-policy)#exit

Step 8:

Check the result.

#On Devie1, view the tunnel setup information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

6 STATE_QUICK_I2 129.255.169.15 151.255.24.24 CN=Device2, C=CN

5 STATE_MAIN_I4 129.255.169.15 151.255.24.24 CN=Device2, C=CN

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 100.0.0.0/24 101.0.0.0/24 ip any any

local tunnel endpoint : 129.255.169.15 remote tunnel endpoint : 151.255.24.24

the pairs of ESP ipsec sa : id : 6, algorithm : 3DES HMAC-SHA1-96

inbound esp ipsec sa : spi : 0xb788104b(3079147595) crypto m_context(s_context) : 0x2746b560 / 0x2746b4e0

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28178/4294967295

uptime is 0 hour 10 minute 22 second

outbound esp ipsec sa : spi : 0x9e00104b(2650804299) crypto m_context(s_context) : 0x2746b460 / 0x2746b3e0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28178/4294967295

uptime is 0 hour 10 minute 22 second

total sa and sa group is 1

We can see that Device1 sets up the tunnel with Device2 successfully by the digital signature mode.

#View the tunnel setup information on Device2.

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

22 STATE_QUICK_R2 151.255.24.24 129.255.169.15 CN=Device1, C=CN

21 STATE_MAIN_R3 151.255.24.24 129.255.169.15 CN=Device1, C=CN

Device2#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

policy name : subflow-1610612738, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

local tunnel endpoint : 151.255.24.24 remote tunnel endpoint : 129.255.169.15

the pairs of ESP ipsec sa : id : 22, algorithm : 3DES HMAC-SHA1-96

inbound esp ipsec sa : spi : 0x9e00104b(2650804299) crypto m_context(s_context) : 0x6e7e8a0 / 0x6e7eaa0

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28068/4294967295

uptime is 0 hour 12 minute 12 second

outbound esp ipsec sa : spi : 0xb788104b(3079147595) crypto m_context(s_context) : 0x6e7eb20 / 0x67ccf20

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28068/4294967295

uptime is 0 hour 12 minute 12 second

total sa and sa group is 1

We can see that Device2 sets up the tunnel with Device1 successfully by the digital signature mode.

# PC1 can ping PC2 via the IPsec tunnel between Device1 and Device2; the packet is protected by the IPsec tunnel.


6 IPsec


6.1 Overview

IPsec (IP Security) protocol standards provide the security of the IP layer in the TCP/IP network. It provides the high-quality, inter-operable and cryptography-based security guarantee for the data transmitted on Internet. It is one traditional security technology of realizing the L3 VPN (Virtual Private Network). The security services provided by IPsec include data confidentiality, data integrality, data source authentication, and anti-replay attack.

IPsec includes AH (Authentication Header) and ESP (Encapsulating Security Payload) protocol standards to protect the communication of the IP layer. The operation modes include transmission mode and tunnel mode. The data protected by the transmission mode is IP payload and the data protected by the tunnel mode is the whole IP packet. The function features of the two protocols are as follows:

1. The main functions provided by AH include data source authentication, data integrity checking, and anti-replay attack, while AH does not encrypt the protected packets;

2. Besides all functions of the AH protocol (the data integrity checking does not include IP header), ESP also provides the encryption function for the IP packet. Therefore, we usually use the ESP protocol.

IPsec VPN is mainly to construct the secure information transmission channel on the public network for the two parties of the communication, so as to provide the functions similar to the private network. The two parties of the IPsec communication perform the ID authentication via the key management protocol and sets up the SA for information encryption or integrity protect negotiation, ensuring the security of the information transmitted on the un-reliable public network.


6.2 IPsec Function Configuration

Table 6‑1 IPsec function configuration list

Configuration Task
Configure IPsec tunnel | Configure auto negotiated tunnel
 | Configure the manual tunnel
Configure the desired materials of the authentication | Configure the pre-share key
 | Configure the RSA/SM2 key pair
 | Configure the RSA/SM2 certificate
Configure security proposal | Configure the IKE proposal
 | Configure the IPsec proposal
 | Configure the security level
Configure security policy | Configure security policy
Configure extended authentication | Configure extended authentication mode
 | Configure the authorization mode
Configure initializing the tunnel | Configure initializing the tunnel


6.2.1 Configure IPsec Tunnel

IPsec provides the security communication of the IP layer. The two parties of the communication negotiate together to set up IPsec SA, that is, IPsec tunnel. There are two modes of setting up the IPsec tunnel: auto negotiation and manual configuration. The auto negotiation mode automatically creates and maintains IPsec SA via IKE (Internet Key Exchange) and can provide the flexible and convenient configuration and higher security. For example, perform the ID authentication based on the pre-share key or digital certificate. The mode of configuring the tunnel manually is complicated and all information needed by creating the IPsec SA needs to be specified manually and cannot support some advanced features. For example, do not support IPsec SA lifetime limitation and it cannot perform the valid management for the IPsec session key. The manual configuration is feasible for the small static network, but in the actual environment, the distribution, management, and maintenance of the key are hard, so it is not suggested to use the mode of configuring the tunnel manually.

Configuration Condition

Before configuring IPsec tunnel, first complete the following task:

1. Configure the security proposal referenced by tunnel

2. To specify the peer ID in the auto negotiation tunnel, we need to configure the peer ID alias or alias group of the tunnel

3. Before configuring the auto negotiated tunnel, we need to configure the authentication material of the authentication mode.

Configure Auto Negotiated Tunnel

To configure auto negotiated tunnel, we need to configure the local address or interface. When the tunnel peer is clear, we also need to set the peer address or name, so as to decide with which to set up IPsec. When the peer address or name cannot be confirmed in advance, it is not necessary to configure the peer address or name. It indicates that the local end does not initiate the IKE negotiation actively, but just accept the peer negotiation request. For the other configuration items, the system usually has the default values and we can decide whether to enable or modify according to the actuality.

Table 6‑2 Configure auto negotiated the tunnel

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create auto negotiated tunnel and enter the auto negotiated tunnel configuration mode | crypto tunnel tunnel-name | Mandatory By default, do not configure the auto negotiated tunnel. The auto negotiated tunnel and the manual tunnel cannot have the same name.
Configure the peer address | peer { address ip-address | hostname host-name | any } | Optional By default, respond to the negotiation request of any peer.
Configure the local address | local { address ip-address | interface interface-name | vrf vrf-name address ip-address } | Mandatory By default, do not configure the local address.
Configure the peer ID | set peer-id { peer-id | alias alias-name | group group-name } | Optional By default, the peer ID is the peer address.
Configure the local ID | set local-id local-id | Optional By default, for the pre-share key authentication mode, adopt the local IP address as the local ID; for the certificate authentication mode, select the first valid local certificate automatically and take the certificate subject name as the local ID.
Configure the IKE authentication mode | set authentication { preshared | rsa-sig | rsa-encr | rsa-encr-cisco | rsa-de | sm2-de | rsa-de-gongan } | Optional By default, the usable authentication modes include rsa-sig rsa-encr rsa-de sm2-de preshared. We can specify multiple authentication modes at the same time.
Configure the IKE phase-1 negotiation mode | set mode { aggressive | main } | Optional By default, the IKE negotiation mode is main.
Configure DPD (Dead Peer Detection) | set dpd idle-time delay-time retry-times | Optional By default, the idle time of the tunnel is 30s; after exceeding the idle time, send one DPD packet every 20s, and if the peer end does not answer, try again twice.
Specify the security level | set sec-level { basic | medium | high } | Optional By default, the tunnel uses the basic security level. The security level adopts the IKE proposal and pre-set proposal IPsec proposal.
Specify the IKE proposal | set ike proposal proposal-name [ proposal-name ] [ proposal-name ] [ proposal-name ] | Optional By default, use the corresponding IKE proposal of the security level.
Specify the IPsec proposal | set ipsec proposal proposal-name [ proposal-name ] [ proposal-name ] [ proposal-name ] | Optional By default, use the corresponding IPsec proposal of the security level.
Configure auto initiating tunnel negotiation | set auto-up | Optional By default, do not enable the function of initiating the tunnel negotiation automatically. If the corresponding interface of the tunnel is unavailable, even the function is enabled, it cannot initiate the tunnel negotiation.

l When adopting the certificate authentication, use the first valid certificate subject name as the local ID by default, so usually do not need to configure the local ID. Only when there are multiple valid local certificates and need to use different local certificates in different tunnels, we can configure the local ID according to the used certificate name, used to select the certificate used by the tunnel.

l When configuring multiple authentication modes at the same time, the selection of the authentication mode is not related with the configuration order. As the initiator, select by the order of rsa-sig, rsa-encr (or rsa-encr-cisco), rsa-de (or rsa-de-gongan), sm2-de, preshare from the configured authentication modes. As the responder, select the authentication mode the same as the initiator. rsa-encr and rsa-encr-cisco cannot exist at the same time; rsa-de and rsa-de-gongan cannot exist at the same time. rsa-de, sm2-de, and rsa-de-gongan all belong to the digital envelop authentication mode and when using the three authentication modes, the first phase of the IKE negotiation can only use the main mode, but cannot use the aggressive mode.

l When tunnel auto negotiation (set auto-up) is configured, the idle time limitation of the tunnel is invalid (set idletime). The idle time limitation will delete the tunnel when the time arrives. But if the tunnel auto negotiation is configured, re-negotiate the tunnel at once after the tunnel is deleted. In this way, the period from deleting the tunnel to re-negotiating thr tunnel may result in the packet loss and occupies the system resources.

Configure Manual Tunnel

To configure the manual tunnel, the two parties of the communication first need to get the information needed for setting up IPsec SA and then use the information to complete the tunnel configuration at the local. The setup of IPsec SA is not completed by the IKE negotiation.

Table 6‑3 Configure the manual tunnel

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the manual tunnel and enter the manual tunnel configuration | crypto tunnel tunnel-name manual | Mandatory By default, do not configure the manual tunnel.
Configure the peer address | peer ip-address | Mandatory By default, do not specify the peer address.
Configure the local address | local { interface interface-name | address ip-address } | Mandatory By default, do not configure the local address.
Specify the IPsec proposal | set ipsec proposal proposal-name | Mandatory By default, do not specify the IPsec proposal.
Configure the ingress IPsec SA attribute | set inbound { esp spi-value [ encryption key-value | authentication key-value ] | ah spi-value key-value | compression cpi-value } | Mandatory By default, do not configure the ingress IPsec SA attribute.
Configure the egress IPsec SA attribute | set outbound { esp spi-value [ encryption key-value | authentication key-value ] | ah spi-value key-value | compression cpi-value } | Mandatory By default, do not configure the egress IPsec SA attribute.


6.2.2 Configure Desired Materials of Authentication

The common authentication modes include pre-share key authentication, RSA public key encryption authentication, RSA digital signature authentication and RSA/SM2 digital envelop authentication. The chapter mainly describes how to configure the desired authentication materials for the four authentication modes.

Configuration Condition

None

Configure Pre-share Key

When the IKE phase-1 negotiation adopts the pre-share key authentication mode, we need to configure the pre-share key at the two sides of the tunnel.

Table 6‑4 Configure the pre-share key

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the pre-share key of the tunnel | crypto ike key key-string { address ip-address [ seed ] [temp { start start-time end end-time | end end-time start start-time } ] | identity identity-string [ seed ] [temp { start start-time end end-time | end end-time start start-time } ] | any [ seed ] } | Mandatory By default, do not configure the pre-share key of the tunnel.
Configure generating the pre-share key | crypto ike generate-key identity remote-id [ any | group-id ] | Optional By default, do not configure generating the pre-share key. According to the seed key remote-id, each ID in the specified group generates one pre-share key. The seed key is specified in the tunnel pre-share key.

Configure RSA/SM2 Key Pair

Configure the RSA/SM2 key pair at the two parties of the IPsec communication in advance. When the IKE phase-1 negotiation adopts the RAS public key encryption authentication, it is necessary to use the key pair; when the IKE phase-1 negotiation adopts the RSA digital signature authentication or RSA/SM2 digital envelop authentication, maybe use the key pair, too.

Table 6‑5 Configure the RSA/SM2 key pair

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the RSA/SM2 key pair | crypto key generate { rsa | sm2 } [ usage-keys ] | Mandatory By default, do not configure the RSA or SM2 key pair
Enter the RSA/SM2 public key chain configuration mode | crypto key pubkey-chain { rsa | sm2 } | Mandatory
Configure the named key | addressed-key ip-address [ encryption | signature ] | Either By default, do not configure any named key. When the peer IKE ID is the IP address or FQDN, we need to configure the named key and public key.
 | named-key key-id [ encryption | signature ]
Specify the peer IP address | address ip-address | Optional By default, do not specify the peer IP address. It is used only when the peer IKE ID is FQDN.
Configure the key | key-string [ help ] | Mandatory By default, do not configure the key.

Configure RSA/SM2 Certificate

When the IKE phase-1 negotiation authentication needs certificate, there should be valid certificate in the system. For the application and configuration of the certificate, refer to the PKI chapter of the configuration manual.

l RSA public key encryption authentication uses the RSA/SM2 key pair. RSA digital signature authentication and RSA/SM2 digital envelop authentication can use RSA/SM2 key or RSA/SM2 certificate. When the certificate and key pair exist at the same time, first select the certificate.


6.2.3 Configure Security Proposal

The security proposal is one component of the security policy and tunnel. It is used to customize the specified security protocol, encryption/authentication algorithm and encapsulating mode used by IPsec and provides various security parameters for the IPsec negotiation SA. The reference of the proposal can use the pre-set proposal of the system or use the customized proposal, also can use the security level directly. In the security level, the corresponding proposal is defined.

Configuration Condition

None

Configure IKE Proposal

Configuring the IKE proposal is mainly to configure the encryption algorithm, hash algorithm, Diffie-Hellman group ID used by the IKE negotiation, and SA life time of the IKE negotiation. The system pre-sets eight IKE proposals. When configuring the tunnel or security level, the user can use the customized proposal and also can directly select using some IKE proposal provided by the system. Their naming rule adopts the mode of group ID-encryption algorithm name-hash algorithm name, as shown in the following table:

Table 6‑6 The pre-set IKE proposal of the system

Name | Encryption Algorithm | Authentication Algorithm | Diffie-Hellman Group | Lifetime (s)
g1-des-sha1 | DES | SHA1 | 1 (768 -bit modulus) | 86400
g1-des-md5 | DES | MD5 | 1 (768 -bit modulus) | 86400
g2-3des-sha1 | 3DES | SHA1 | 2 (1024-bit modulus) | 86400
g2-3des-md5 | 3DES | MD5 | 2 (1024-bit modulus) | 86400
g2-aes128-sha1 | AES128 | SHA1 | 2 (1024-bit modulus) | 86400
g2-sm1-sha1 | SM1 | SHA1 | 2 (1024-bit modulus) | 86400
g5-3des-sha256 | 3DES | SHA2-256 | 5 (1536-bit modulus) | 86400
g5-aes256-sha256 | AES256 | SHA2-256 | 5 (1536-bit modulus) | 86400

Table 6‑7 Configure the IKE proposal

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the IKE proposal and enter the IKE proposal configuration mode | crypto ike proposal proposal-name | Mandatory By default, do not configure the IKE proposal proposal.
Configure the encryption algorithm used by IKE | encryption { 3des | des | aes128 | aes192 | aes256 | blowfish | cast | sm1 | sm4} | Optional By default, use the DES encryption algorithm.
Configure the hash algorithm used by IKE | integrity { md5 | sha1 | sha2-256 | sha2-512 | sm3 } | Optional By default, use the SHA1 hask algorithm.
Configure the modulus group used by the IKE Diffie-Hellman algorithm | group { group1 | group2 | group5 | group14 | group15 | group16 | group17 | group18 } | Optional By default, use group1 modulus group, that is, 768-bit modulus
Configure the lifetime set up by IKE | lifetime lifetime-value | Optional By default, the SA life time set up by IKE is 86400s.

Configure IPsec Proposal

IPsec proposal is the combination of the security protocol (AH or ESP) and algorithm accepted by the local end and the main referred security parameters include the authentication algorithm of the AH protocol, encryption algorithm and authentication algorithm of the ESP protocol, the compression algorithm and encapsulating mode of the IPComp (IP Compress) protocol. The system pre-sets eight proposals and the user can directly use during the tunnel configuration or security level configuration, also can use the customized IPsec proposal. The eight pre-set IPsec proposals are as shown in the following table. All pre-set proposals adopt the ESP protocol and tunnel mode to encapsulate, and the naming rule of “security protocol name- PFS (Perfect Forward Secrecy) group ID-encryption algorithm-authentication algorithm”.

Table 6‑8The pre-set IPsec proposal of the system

Name | PFS | Encryption Algorithm (ESP) | Authentication Algorithm (ESP)
esp-nopfs-des-sha1 | - | DES | SHA1
esp-nopfs-des-md5 | - | DES | MD5
esp-g2-3des-sha1 | group2 | 3DES | SHA1
esp-g2-3des-md5 | group2 | 3DES | MD5
esp-g2-aes128-sha1 | group2 | AES128 | SHA1
esp-g2-sm1-sha1 | group2 | SM1 | SHA1
esp-g5-3des-sha256 | group5 | 3DES | SHA2-256
esp-g5-aes256-sha256 | group5 | AES256 | SHA2-256

Table 6‑9 Configure the IPsec protocol

Step

Command

Description

Enter the global configuration mode

configure terminal

-

Create the IPsec proposal and enter the IPsec proposal configuration mode

crypto ipsec proposal proposal-name

Mandatory

By default, do not configure the IPsec proposal.

Configure the encryption and authentication algorithm used by ESP

esp { 3des | des | aes128 | aes192 | aes256 | blowfish | cast | serpent | twofish | serpent | sm1 | sm4 | null } [ md5 | sha1 | sha2-256 | sha2-512 | rmd160 | aes-mac | sm3 ]

Optional

By default, the encryption algorithm used by the ESP protocol is DES and the authentication algorithm is MD5.

The ESP authentication algorithm cannot be used separately, but should be used with the ESP encryption algorithm.

Configure the authentication algorithm used by AH

ah { md5 | sha1 | sha2-256 | sha2-512 | sm3 }

Optional

By default, do not use the AH protocol.

Configure the compression algorithm used by IPComp

compression { lzs | deflate }

Optional

By default, do not use the IPComp protocol.

Configure the encapsulation mode

mode { transport | tunnel }

Optional

By default, use the tunnel mode.

Configure PFS

pfs { group1 | group2 | group5 | group14 | group15 | group16 | group17 | group18 }

Optional

By default, do not configure PFS.

Configure the lifetime of IPsec SA

lifetime { seconds second-number | kbytes kbytes-number }

Optional

By default, the lifetime is 28800s.

l In the IPsec traversing NAT environment, do not use the AH protocol. The AH protocol checks the IP header of the packet, but NAT will change the IP header of the packet. The packet IP header after traversing NAT is not consistent with the IP header check of the original packet.

l When using the RSA/SM2 digital envelop authentication, do not support the Diffie-Hellman algorithm, so do not need to configure group or pfs.

Configure Security Level

The security level contains the IKE proposal and IPsec proposal. The user selects the corresponding security level according to the security requirement of the actual communication and does not need to configure the IKE proposal or IPsec proposal again.

Table 6‑10 Configure the security level

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the security level and enter the security level configuration mode | crypto sec-level custom { basic | medium | high } | Mandatory By default, the corresponding proposal of the security level keeps unchanged.
Configure the IKE proposal in the security level | ike proposal proposal-name [ proposal-name ] [ proposal-name ] [ proposal-name ] | Optional By default, the IKE proposal of the basic security level is g1-des-sha1 and g1-des-md5; the IKE proposal of the medium security level is g2-3des-sha1, g2-3des-md5, g2-aes128-sha1, g2-sm1-sha1; the IKE proposal of the high security level is g5-3des-sha256, g5-aes256-sha256.
Configure the IPsec proposal in the security level | ipsec proposal proposal-name [ proposal-name ] [ proposal-name ] [ proposal-name ] | Optional By default, the IPsec proposal of the basic security level is esp-nopfs-des-sha1, esp-nopfs-des-md5; the IPsec proposal of the medium security is esp-g2-3des-sha1, esp-g2-3des-md5, esp-g2-aes128-sha1, esp-g2-sm1-sha1; the IPsec proposal of the high security level is esp-g5-3des-sha256, esp-g5-aes256-sha256.

l In the security policy, tunnel, and security level, we can specify the proposal. When the proposal is specified in the security policy, the security policy does not use the proposal specified in the tunnel or security level. Similarly, when the proposal is specified in the tunnel, the tunnel does not use the proposal specified in the security level.


6.2.4 Configure Security Policy

The security policy is to specify the specified data flow to apply one specified action. The actions include permit, deny and apply IPsec (tunnel). Here, permit means to directly forward, but not use the IPsec when forwarding the matched data flow; deny means to directly drop the matched data flow, but do not forward; apply means to perform the specified IPsec tunnel processing when forwarding the matched data flow.

Configuration Condition

Before configuring the security policy, first complete the following task:

l Configure the tunnel used by the security policy.

Configure Security Policy

Table 6‑11 Configure security policy

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the security policy and enter the security policy configuration mode | crypto policy policy-name | Mandatory By default, do not configure security policy.
Configure the corresponding data flow of the security policy | flow [ vrf vrf-name ] { source-ip-address mask | any | host source-ip-address } { destination-ip-address mask | any | host destination -ip-address } protocol-name [source -port destination -port ] { permit | deny | tunnel tunnel-name [ tunnel-name ] [ tunnel-name ] [ tunnel-name ] [ bypass ] } | Mandatory By default, do not configure the corresponding data flow information of the security policy.
Configure the Ipsec proposal for the security policy | set ipsec proposal proposal-name | Optional By default, use the proposal specified in the tunnel.
Add the route to the peer protect network automatically | set reverse-route [ ipaddressdistance [tag value] | distance [tag value] | static ipaddressdistance [tag value]] | Optional By default, do not configure adding the route to the peer protect network.
Exit the security policy configuration mode | exit | -
Change the order of the security policies | crypto policy insert policy-name { before | after | head | tail } [ policy-name ] | Optional By default, the security policies are arranged by the order of creating the security policies. The securities are in order. When searching for the security policy for the packet, match the policy according to the order of the security policies.

l One policy can associate with 1-4 tunnels. When associating multiple tunnels, the subsequent tunnel serves as the tunnel backup or load balance. One tunnel cannot be bound to multiple policies with different VRF attributes at the same time.


6.2.5 Configure Extended Authentication

Extended authentication is to perform the user ID authentication via AAA (Authentication Authorization Accounting) based on the basic IKE tunnel negotiation. If passing the authentication, continue to perform the IKE negotiation; if not passing the authentication, the IKE negotiation fails.

Configuration Condition

Before configuring the extended authentication, first complete the following tasks:

l Configure the desired extended authentication and authorization method list in AAA

l Configure the related parameters of the AAA server

Configure Extended Authentication Mode

To configure the extended authentication, it is necessary to define the IKE ID alias and specify the extended authentication mode based on the alias.

Table 6‑12 Configure the extended authentication mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the alias of the specified IKE ID and enter the alias configuration mode | crypto ike id alias alias-name | Mandatory By default, do not configure the IKE ID alias.
Configure the corresponding IKE ID of the alias | id ike-id | Mandatory By default, match any ID.
Configure the AAA-based extended authentication | authentication { default | list-name } [ optional | user user-name [authen_systemid [ authen_imsi ] [ optional ] | authen_imsi [ authen_systemid ] [ optional ] | optional ] | user-group group-name [authen_systemid [ authen_imsi] [ optional ] | authen_imsi [ authen_systemid ] [ optional ] | [ optional ] ]] | Mandatory By default, do not configure extended authentication.

Configure Authorization Mode

To configure the authorization mode, it is necessary to define the IKE ID alias and specify the authorization mode based on the alias.

Table 6‑13 Configure the authorization mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the alias of the specified IKE ID and enter the alias configuration mode | crypto ike id alias alias-name | Mandatory By default, do not configure the IKE ID alias.
Configure the corresponding IKE ID of the alias | id ike-id | Mandatory By default, match any ID.
Configure the AAA-based authorization | authorization { default | list-name } [optional] | Mandatory By default, do not specify the authorization method list.

l The authorization attributes in the IKE ID alias takes effect only after passing the AAA authentication.

l Only when specifying using the local authorization in the authorization list, the remote-setting configuration can take effect.

Configure Accounting Mode

To configure the authorization mode, it is necessary to define the IKE ID alias and specify the authorizing mode based on the alias.

Table 6‑14 Configure the authorizing mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the alias of the specified IKE ID and enter the alias configuration mode | crypto ike id alias alias-name | Mandatory By default, do not configure IKE ID alias.
Configure the corresponding IKE ID of the alias | id ike-id | Mandatory By default, match any ID.
Configure the accounting based on AAA | accounting { default | list-name } | Mandatory By default, do not specify the accounting method list.

l The accounting attribute in the IKE ID alias can take effect only after passing the AAA authentication.


6.2.6 Configure Initializing Tunnel

When the device is powered on, it is necessary to download the device configuration from the network management server. The tunnel initializing sets up the IPsec tunnel between the device and the network management server, so as to ensure the transmission security of the configuration information.

Configuration Condition

Before configuring initializing tunnel, first complete the following tasks:

l Configure the static route or IGP protocol, ensuring the intercommunication between the device and the network management server at the network layer.

l Distribute the user name and password of logging in to the network management server for the device.

Configure Initializing Tunnel

Table 6‑15 Configure initializing the tunnel

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the initial configuration mode | crypto init-config | Mandatory
Configure the server address | server { address ip-address | hostname host-name } | Mandatory By default, do not specify the server address.
Configure the local egress | local { address ip-address | interface interface-name } | Optional By default, select the local interface according to the server address automatically.
Configure the user name | user-name user-name | Mandatory By default, do not configure the user name.
Configure the user password | password user-password | Mandatory By default, do not configure the user password.
Configure setting up the initialized tunnel automatically | auto-start | Optional By default, do not set up the initialized tunnel when the device is started.
Return to the privileged mode | end | -
Enable initializing the tunnel setup | start crypto init-config | Optional By default, do not trigger setting up the initialized tunnel manually.

l When the device needs to download the configuration again, first delete the two files in the file system, that is, initConf and startup, and restart the device. And then perform the configuration of the initialized tunnel and start downloading.

l If configuration downloading fails, it is necessary to re-download after removing the fault. We can first execute the clear crypto sa unrebuild operation and then execute the start crypto init-confit operation. This can enable the configuration downloading more quickly.

l The auto-start command and the start crypto init-config command cannot be used at the same time.


6.2.7 IPsec Monitoring and Maintaining

Table 6‑16 IPsec monitoring and maintaining command list

Command | Description
clear crypto sa { policy policy-name | tunnel tunnel-name } [ unrebuild ] | Clear and re-build IPsec SA
clear ip { ahstate | espstate | compstate | ipsecstate | ipipstate } | Clear the protocol statistics information
clear crypto ike logging | Clear the IKE log information
show crypto ike version | Display the IKE version information
show crypto ipsec version | Display the IPsec version information
show crypto key mypubkey rsa | Display the public key information of the local RSA key pair
show crypto key mypubkey sm2 | Display the public key information of the peer SM2 key pair
show crypto key pubkey-chain rsa [ named-key name | addressed-key ip-address ] | Display the public key information of the peer RSA key pair
show crypto key pubkey-chain sm2 [ named-key name | addressed-key ip-address ] | Display the public key information of the local SM2 key pair
show crypto ike sa [ tunnel tunnel-name [ detail ] | policy policy-name [ detail ] | detail | statistics ] | Display the IKE SA status information
show crypto ipsec sa [ policy policy-name | tunnel tunnel-name ] | Display the IPsec SA information
show crypto ike proposal [ proposal-name ] | Display the specified or all IKE proposal
show crypto ipsec proposal [ proposal-name ] | Display the specified or all IPsec proposal
show crypto sec-level | Display the current security level configuration
show crypto tunnel [ tunnel-name ] | Display the specified or all IPsec tunnel configuration information
show crypto policy [ policy-name ] | Display the specified or all IPsec security policy configuration information
show crypto ipsec state | Display the register status information of the IPsec function
show crypto bitmap | Display the IPsec SA utilization
show crypto ike id alias [ alias-name ] | Display the IKE alias information
show crypto ike id group [ group-name ] | Display the IKE alias group information
show crypto ipsec spd | Display the IPsec security policy base information
show ip ahstate | Display the AH protocol packet statistics information
show ip espstate | Display the ESP protocol packet statistics information
show ip compstate | Display the IP compression protocol packet statistics information
show ip ipsecstate | Display the IPsec packet statistics information
show crypto ike downloaded-script | Display the configuration information downloaded via the IKE tunnel
show crypto license | Display the VRC license information
show crypto software-vrc statistics | Display the VRC connection status statistics information
show crypto ike logging | Display the IKE log information


6.3 Ipsec Typical Configuration Example


6.3.1 Configure IPsec tunnel Mode

Network Requirements

1. Adopt the tunnel mode to set up the IPsec tunnel between Device1 and Device2, protecting the data communication of the network where PC1 and PC2 are located;

2. IPsec proposal security protocol adopts ESP; IKE proposal and IPsec proposal encryption adopts 3DES; the authentication algorithm adopts SHA1.

Network Topology

Figure 6‑1 Networking of configuring IPsec tunnel mode

Configuration Steps

Step 1: | Configure the IP address and route of the interface. (omitted)
Step 2: | Configure the IKE and IPSec proposal.

#On Device1, configure the IKE proposal ikepro, use the encryption algorithm 3DES, authentication algorithm SHA1; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES, and authentication algorithm SHA1.

Device1#configure terminal

Device1(config)#crypto ike proposal ikepro

Device1(config-ike-prop)#encryption 3des

Device1(config-ike-prop)#integrity sha1

Device1(config-ike-prop)#exit

Device1(config)#crypto ip proposal ippro

Device1(config-ipsec-prop)#esp 3des sha1

Device1(config-ipsec-prop)#exit

#On Device2, configure the IKE proposal ikepro, use the encryption algorithm 3DES, authentication algorithm SHA1; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES, and authentication algorithm SHA1.

Device2#configure terminal

Device2(config)#crypto ike proposal ikepro

Device2(config-ike-prop)#encryption 3des

Device2(config-ike-prop)#integrity sha1

Device2(config-ike-prop)#exit

Device2(config)#crypto ipsec proposal ippro

Device2(config-ipsec-prop)#esp 3des sha1

Device2(config-ipsec-prop)#exit

Step 3:

Configure the pre-share key.

#On Device1, configure the pre-share key, key is admin and permit all peers to use the key.

Device1(config)#crypto ike key admin any

#On Device2, configure the pre-share key, key is admin and permit all peers to use the key.

Device2(config)#crypto ike key admin any

l The peer of using the pre-share key also can be the specific IP address or identity.

Step 4:

Configure the IPSec tunnel.

#On Device1, configure the tunnel tun, use gigabitethernet0 address as the local address of the tunnel, configure the peer address of the tunnel as 151.255.24.24, configure the authentication mode as the pre-share key authentication, the IKE proposal uses ikepro, IPsec proposal uses ippro, and enable the auto initiating negotiation.

Device1(config)#crypto tunnel tun

Device1(config-tunnel)#local address 129.255.169.15

Device1(config-tunnel)#peer address 151.255.24.24

Device1(config-tunnel)#set authentication preshared

Device1(config-tunnel)#set ike proposal ikepro

Device1(config-tunnel)#set ipsec proposal ippro

Device1(config-tunnel)#set auto-up

Device1(config-tunnel)#exit

#On Device2, configure the tunnel tun, use gigabitethernet0 address as the local address of the tunnel, configure the peer of the tunnel as any, the IKE proposal uses ikepro, and IPsec proposal uses ippro.

Device2(config)#crypto tunnel tun

Device2(config-tunnel)#local address 151.255.24.24

Device2(config-tunnel)#peer any

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#exit

l If the address of the local interface of the tunnel is not fixed, we can adopt local interface to configure.

l IKE proposal and IPsec proposal are the optional configuration. If the proposal is not configured in the tunnel, IKE negotiation encryption algorithm uses des by default, authentication algorithm uses sha1 by default, IPsec tunnel security protocol uses esp by default, encryption algorithm uses des by default, and authentication algorithm uses md5 by default.

Step 5:

Configure the IPSec security policy.

#On Device1, configure the security policy policy1, protect the IP communication from network 100.0.0.0/24 to network 101.0.0.0/24, and associate the tunnel tun.

Device1(config)#crypto policy policy1

Device1(config-policy)#flow 100.0.0.0 255.255.255.0 101.0.0.0 255.255.255.0 ip tunnel tun

Device1(config-policy)#exit

#On Device2, configure the security policy policy1, protect the IP communication from network 101.0.0.0/24 to network 100.0.0.0/24, associate the tunnel tun, and add the route to the peer protect network automatically.

Device2(config)#crypto policy policy1

Device2(config-policy)#flow 101.0.0.0 255.255.255.0 100.0.0.0 255.255.255.0 ip tunnel tun

Device2(config-policy)#set reverse-route

Device2(config-policy)#exit

Step 6:

Check the result.

#On Devie1, view the tunnel setup information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

60 STATE_QUICK_I2 129.255.169.15 151.255.24.24 151.255.24.24

1 STATE_MAIN_I4 129.255.169.15 151.255.24.24 151.255.24.24

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 100.0.0.0/24 101.0.0.0/24 ip any any

local tunnel endpoint : 129.255.169.15 remote tunnel endpoint : 151.255.24.24

the pairs of ESP ipsec sa : id : 60, algorithm : 3DES HMAC-SHA1-96

inbound esp ipsec sa : spi : 0xa1ce1081(2714636417) crypto m_context(s_context) : 0x276324e0 / 0x27632460

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28496/4294967295

uptime is 0 hour 5 minute 4 second

outbound esp ipsec sa : spi : 0xb42f1047(3022983239) crypto m_context(s_context) : 0x67e3f20 / 0x67e3ea0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28496/4294967295

uptime is 0 hour 5 minute 4 second

total sa and sa group is 1

We can see that Device1 sets up the tunnel with Device2 successfully.

#View the tunnel setup information on Device2.

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

2 STATE_QUICK_R2 151.255.24.24 129.255.169.15 129.255.169.15

1 STATE_MAIN_R3 151.255.24.24 129.255.169.15 129.255.169.15

Device2#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

policy name : subflow-1610612736, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

local tunnel endpoint : 151.255.24.24 remote tunnel endpoint : 129.255.169.15

the pairs of ESP ipsec sa : id : 2, algorithm : 3DES HMAC-SHA1-96

inbound esp ipsec sa : spi : 0xb42f1047(3022983239) crypto m_context(s_context) : 0x61dc9a0 / 0x61dcb20

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28454/4294967295

uptime is 0 hour 5 minute 46 second

outbound esp ipsec sa : spi : 0xa1ce1081(2714636417) crypto m_context(s_context) : 0x61dcc20 / 0x67c2f40

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28454/4294967295

uptime is 0 hour 5 minute 46 second

total sa and sa group is 1

We can see that Device2 sets up the tunnel with Device1 successfully.

#On Device2, view the information of the route automatically added to the peer protect network.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 151.255.24.38 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 151.255.24.38, 00:00:21, gigabitethernet0

S 100.0.0.0/24 [1/10] via 129.255.169.15, 00:00:08, gigabitethernet0

C 101.0.0.0/24 is directly connected, 01:15:08, gigabitethernet1

C 127.0.0.0/8 is directly connected, 53:03:26, lo0

C 130.255.0.0/16 is directly connected, 53:02:26, gigabitethernet2

C 151.255.24.0/24 is directly connected, 01:15:21, gigabitethernet0

We can see that 100.0.0.0/24 is the static route automatically added for IPsec on Devcie2.

# PC1 can ping PC2 via the IPsec tunnel between Device1 and Device2; the packet is protected by the IPsec tunnel.


6.3.2 Configure Ipsec Transmission Mode

Network Requirements

1. Adopt the tunnel mode to set up the IPsec tunnel between Device1 and Device2, protecting the end-to-end data communication between Device1 and Device2.

2. IPsec proposal adopts the security protocol AH and ESP; the AH protocol authentication algorithm adopts MD5; ESP encryption algorithm adopts SM1; authentication algorithm adopts MD5; IKE proposal encryption algorithm adopts SM1; authentication algorithm adopts MD5.

Network Topology

Figure 6‑2 Networking of configuring the IPsec transmission mode

Configuration Steps

Step 1: | Configure the IP address and route of the interface. (omitted)
Step 2: | Configure the IKE and IPSec proposal.

#On Device1, configure the IKE proposal ikepro, use the encryption algorithm SM1, authentication algorithm MD5; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm SM1, and authentication algorithm MD5. Use the AH security protocol and authentication algorithm MD5; use the transmission mode.

Device1#configure terminal

Device1(config)#crypto ike proposal ikepro

Device1(config-ike-prop)#encryption sm1

Device1(config-ike-prop)#integrity md5

Device1(config-ike-prop)#exit

Device1(config)#crypto ipsec proposal ippro

Device1(config-ipsec-prop)#esp sm1 md5

Device1(config-ipsec-prop)#ah md5

Device1(config-ipsec-prop)#mode transport

Device1(config-ipsec-prop)#exit

#On Device2, configure the IKE proposal ikepro, use the encryption algorithm SM1, authentication algorithm MD5; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm SM1, and authentication algorithm MD5. Use the AH security protocol and authentication algorithm MD5; use the transmission mode.

Device2#configure terminal

Device2(config)#crypto ike proposal ikepro

Device2(config-ike-prop)#encryption sm1

Device2(config-ike-prop)#integrity md5

Device2(config-ike-prop)#exit

Device2(config)#crypto ipsec proposal ippro

Device2(config-ipsec-prop)#esp sm1 md5

Device2(config-ipsec-prop)#ah md5

Device2(config-ipsec-prop)#mode transport

Device2(config-ipsec-prop)#exit

l AH security protocol does not support the NAT traversing. If there is NAT traversing, it may result in the failure of the IKE negotiation.

l The AH security protocol can be used with ESP; we also can disable ESP (it is enabled by default) and just use AH.

Step 3:

Configure the pre-share key.

#On Device1, configure the pre-share key, key is admin and permit all peers to use the key.

Device1(config)#crypto ike key admin any

#On Device2, configure the pre-share key, key is admin and permit all peers to use the key.

Device2(config)#crypto ike key admin any

Step 4:

Configure the IPSec tunnel.

#On Device1, configure the tunnel tun, use gigabitethernet0 as the local interface of the tunnel, configure the peer address of the tunnel as 151.255.24.24, configure the authentication mode as the pre-share key authentication, the IKE proposal uses ikepro, IPsec proposal uses ippro, and enable the auto initiating negotiation.

Device1(config)#crypto tunnel tun

Device1(config-tunnel)#local interface gigabitethernet 0

Device1(config-tunnel)#peer address 151.255.24.24

Device1(config-tunnel)#set authentication preshared

Device1(config-tunnel)#set ike proposal ikepro

Device1(config-tunnel)#set ipsec proposal ippro

Device1(config-tunnel)#set auto-up

Device1(config-tunnel)#exit

#On Device2, configure the tunnel tun, use gigabitethernet0 as the local interface of the tunnel, configure the peer of the tunnel as any, the IKE proposal uses ikepro, IPsec proposal uses ippro.

Device2(config)#crypto tunnel tun

Device2(config-tunnel)#local interface gigabitethernet 0

Device2(config-tunnel)#peer any

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#exit

Step 5:

Configure the IPSec security policy.

#On Device1, configure the security policy policy1, protect the IP communication from host 129.255.169.15/32 to host 151.255.24.24/32, and associate the tunnel tun.

Device1(config)#crypto policy policy1

Device1(config-policy)#flow host 129.255.169.15 host 151.255.24.24 ip tunnel tun

Device1(config-policy)#exit

#On Device2, configure the security policy policy1, protect the IP communication from host 151.255.24.24/32 to host 129.255.169.15/32, and associate the tunnel tun.

Device2(config)#crypto policy policy1

Device2(config-policy)#flow host 151.255.24.24 host 129.255.169.15 ip tunnel tun

Device2(config-policy)#exit

Step 6:

Check the result.

#On Devie1, view the tunnel setup information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

2 STATE_QUICK_I2 129.255.169.15 151.255.24.24 151.255.24.24

1 STATE_MAIN_I4 129.255.169.15 151.255.24.24 151.255.24.24

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 129.255.169.15/32 151.255.24.24/32 ip any any

local tunnel endpoint : 129.255.169.15 remote tunnel endpoint : 151.255.24.24

the pairs of AH ipsec sa : id : 2, algorithm : HMAC-MD5-96

inbound ah ipsec sa : spi : 0xe9c21048(3921809480)

current input 0 packets, 0 kbytes

encapsulation mode : Transport

replay protection : ON

remaining lifetime (seconds/kbytes) : 28724/4294967295

uptime is 0 hour 1 minute 16 second

outbound ah ipsec sa : spi : 0x490b1047(1225461831)

current output 0 packets, 0 kbytes

encapsulation mode : Transport

replay protection : ON

remaining lifetime (seconds/kbytes) : 28724/4294967295

uptime is 0 hour 1 minute 16 second

local tunnel endpoint : 129.255.169.15 remote tunnel endpoint : 151.255.24.24

the pairs of ESP ipsec sa : id : 2, algorithm : SM1 HMAC-MD5-96

inbound esp ipsec sa : spi : 0xb92f1047(3106869319) crypto m_context(s_context) : 0x2746b560 / 0x2746b4e0

current input 0 packets, 0 kbytes

encapsulation mode : Transport

replay protection : ON

remaining lifetime (seconds/kbytes) : 28724/4294967295

uptime is 0 hour 1 minute 16 second

outbound esp ipsec sa : spi : 0xa2d61048(2731937864) crypto m_context(s_context) : 0x2746b460 / 0x2746b3e0

current output 0 packets, 0 kbytes

encapsulation mode : Transport

replay protection : ON

remaining lifetime (seconds/kbytes) : 28724/4294967295

uptime is 0 hour 1 minute 16 second

total sa and sa group is 1

We can see that Device1 sets up the tunnel with Device2 successfully.

#View the tunnel setup information on Device2.

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

18 STATE_QUICK_R2 151.255.24.24 129.255.169.15 129.255.169.15

17 STATE_MAIN_R3 151.255.24.24 129.255.169.15 129.255.169.15

Device2#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 151.255.24.24/32 129.255.169.15/32 ip any any

policy name : subflow-1610612736, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 151.255.24.24/32 129.255.169.15/32 ip any any

local tunnel endpoint : 151.255.24.24 remote tunnel endpoint : 129.255.169.15

the pairs of AH ipsec sa : id : 18, algorithm : HMAC-MD5-96

inbound ah ipsec sa : spi : 0x490b1047(1225461831)

current input 0 packets, 0 kbytes

encapsulation mode : Transport

replay protection : ON

remaining lifetime (seconds/kbytes) : 28695/4294967295

uptime is 0 hour 1 minute 45 second

outbound ah ipsec sa : spi : 0xe9c21048(3921809480)

current output 0 packets, 0 kbytes

encapsulation mode : Transport

replay protection : ON

remaining lifetime (seconds/kbytes) : 28695/4294967295

uptime is 0 hour 1 minute 45 second

local tunnel endpoint : 151.255.24.24 remote tunnel endpoint : 129.255.169.15

the pairs of ESP ipsec sa : id : 18, algorithm : SM1 HMAC-MD5-96

inbound esp ipsec sa : spi : 0xa2d61048(2731937864) crypto m_context(s_context) : 0x6e7eaa0 / 0x6e7ea20

current input 0 packets, 0 kbytes

encapsulation mode : Transport

replay protection : ON

remaining lifetime (seconds/kbytes) : 28695/4294967295

uptime is 0 hour 1 minute 45 second

outbound esp ipsec sa : spi : 0xb92f1047(3106869319) crypto m_context(s_context) : 0x6e7e8a0 / 0x9b79f40

current output 0 packets, 0 kbytes

encapsulation mode : Transport

replay protection : ON

remaining lifetime (seconds/kbytes) : 28695/4294967295

uptime is 0 hour 1 minute 45 second

total sa and sa group is 1

We can see that Device2 sets up the tunnel with Device1 successfully.

# PC1 can ping PC2 via the IPsec tunnel between Device1 and Device2; the packet is protected by the IPsec tunnel.

Device1#ping 151.255.24.24

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 151.255.24.24 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.


6.3.3 Configure Ipsec Load Balance

Network Requirements

1. Set up two IPsec tunnels between Device1 and Device2 and configure as the load balance; PC1 accesses PC2 and PC3 by the load balance mode via the IPsec tunnel of IP Network1 and IP Network2.

2. IPsec protocol security protocol adopts ESP; IKE proposal and IPsec proposal encryption algorithm adopts SM1; authentication algorithm adopts SHA1.

Network Topology

Figure 6‑3 Networking of configuring the IPsec load balance

Configuration Steps

Step 1: | Configure the IP address and route of the interface. (omitted)
Step 2: | Configure the IKE and IPSec proposal.

#On Device1, configure the IKE proposal ikepro, use the encryption algorithm SM1, authentication algorithm SHA1; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm SM1, and authentication algorithm SHA1.

Device1#configure terminal

Device1(config)#crypto ike proposal ikepro

Device1(config-ike-prop)#encryption sm1

Device1(config-ike-prop)#integrity sha1

Device1(config-ike-prop)#exit

Device1(config)#crypto ipsec proposal ippro

Device1(config-ipsec-prop)#esp sm1 sha1

Device1(config-ipsec-prop)#exit

#On Device2, configure the IKE proposal ikepro, use the encryption algorithm SM1, authentication algorithm SHA1; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm SM1, and authentication algorithm SHA1.

Device2#configure terminal

Device2(config)#crypto ike proposal ikepro

Device2(config-ike-prop)#encryption sm1

Device2(config-ike-prop)#integrity sha1

Device2(config-ike-prop)#exit

Device2(config)#crypto ipsec proposal ippro

Device2(config-ipsec-prop)#esp sm1 sha1

Device2(config-ipsec-prop)#exit

Step 3:

Configure the pre-share key.

#On Device1, configure the pre-share key, key is admin and permit all peers to use the key.

Device1(config)#crypto ike key admin any

#On Device2, configure the pre-share key, key is admin and permit all peers to use the key.

Device2(config)#crypto ike key admin any

Step 4:

Configure the IPSec tunnel.

#On Device1, configure the two tunnels tun1and tun2, use gigabitethernet0 and gigabitethernet2 as the local interfaces of the tunnels, configure the peer address of the tunnel as 151.255.24.24 and 150.255.24.29 respectively, configure the authentication mode as the pre-share key authentication, the IKE proposal uses ikepro, IPsec proposal uses ippro, and enable the auto initiating negotiation.

Device1(config)#crypto tunnel tun1

Device1(config-tunnel)#local interface gigabitethernet 0

Device1(config-tunnel)#peer address 151.255.24.24

Device1(config-tunnel)#set authentication preshared

Device1(config-tunnel)#set ike proposal ikepro

Device1(config-tunnel)#set ipsec proposal ippro

Device1(config-tunnel)#set auto-up

Device1(config-tunnel)#exit

Device1(config)#crypto tunnel tun2

Device1(config-tunnel)#local interface gigabitethernet 2

Device1(config-tunnel)#peer address 150.255.24.29

Device1(config-tunnel)#set authentication preshared

Device1(config-tunnel)#set ike proposal ikepro

Device1(config-tunnel)#set ipsec proposal ippro

Device1(config-tunnel)#set auto-up

Device1(config-tunnel)#exit

#On Device2, configure the two tunnels tun1and tun2, use gigabitethernet0 and gigabitethernet2 as the local interfaces of the tunnels, configure the peer of the tunnel as any, the IKE proposal uses ikepro, IPsec proposal uses ippro.

Device2(config)#crypto tunnel tun1

Device2(config-tunnel)#local interface gigabitethernet 0

Device2(config-tunnel)#peer any

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#exit

Device2(config)#crypto tunnel tun2

Device2(config-tunnel)#local interface gigabitethernet 2

Device2(config-tunnel)#peer any

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#exit

Step 5:

Configure the IPSec security policy.

#On Device1, configure security policypolicy1, protecting the IP communication from network 100.0.0.0/24 to network 101.0.0.0/24; associate the tunnel tun1 and tun2; configure the load balance and the route automatically added to the peer protect network.

Device1(config)#crypto policy policy1

Device1(config-policy)#flow 100.0.0.0 255.255.255.0 101.0.0.0 255.255.255.0 ip tunnel tun1 tun2

Device1(config-policy)#set payload-balance

Device1(config-policy)#set reverse-route

Device1(config-policy)#exit

#On Device2, configure security policypolicy1, protecting the IP communication from network 101.0.0.0/2 to network 100.0.0.0/24; associate the tunnel tun1 and tun2; configure the load balance and the route automatically added to the peer protect network.

Device2(config)#crypto policy policy1

Device2(config-policy)#flow 101.0.0.0 255.255.255.0 100.0.0.0 255.255.255.0 ip tunnel tun1 tun2

Device2(config-policy)#set payload-balance

Device2(config-policy)#set reverse-route

Device2(config-policy)#exit

l If IPsec is not configured with the load balance, it is backup by default, that is, the data communication is performed just via tun1; after tun1 is disconnected, communicate via tun2.

Step 6:

Check the result.

#On Devie1, view the tunnel setup information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

63 STATE_QUICK_I2 139.255.24.29 150.255.24.29 150.255.24.29

62 STATE_MAIN_I4 139.255.24.29 150.255.24.29 150.255.24.29

61 STATE_QUICK_I2 129.255.169.15 151.255.24.24 151.255.24.24

60 STATE_MAIN_I4 129.255.169.15 151.255.24.24 151.255.24.24

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 100.0.0.0/24 101.0.0.0/24 ip any any

local tunnel endpoint : 129.255.169.15 remote tunnel endpoint : 151.255.24.24

the pairs of ESP ipsec sa : id : 61, algorithm : SM1 HMAC-SHA1-96

inbound esp ipsec sa : spi : 0x6c911061(1821446241) crypto m_context(s_context) : 0x200eab60 / 0x200eaae0

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28700/4294967295

uptime is 0 hour 1 minute 40 second

outbound esp ipsec sa : spi : 0xb404106a(3020165226) crypto m_context(s_context) : 0x274673e0 / 0x27467460

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28700/4294967295

uptime is 0 hour 1 minute 40 second

local tunnel endpoint : 139.255.24.29 remote tunnel endpoint : 150.255.24.29

the pairs of ESP ipsec sa : id : 63, algorithm : SM1 HMAC-SHA1-96

inbound esp ipsec sa : spi : 0x903e1062(2419986530) crypto m_context(s_context) : 0x200ead60 / 0x27467260

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28710/4294967295

uptime is 0 hour 1 minute 30 second

outbound esp ipsec sa : spi : 0x8672106b(2255622251) crypto m_context(s_context) : 0x200ea960 / 0x200eace0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28710/4294967295

uptime is 0 hour 1 minute 30 second

total sa and sa group is 2

We can see that two IPsec tunnels are set up between Device1 and Device2.

#View the tunnel setup information on Device2.

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

70 STATE_QUICK_R2 150.255.24.29 139.255.24.29 139.255.24.29

69 STATE_MAIN_R3 150.255.24.29 139.255.24.29 139.255.24.29

68 STATE_QUICK_R2 151.255.24.24 129.255.169.15 129.255.169.15

67 STATE_MAIN_R3 151.255.24.24 129.255.169.15 129.255.169.15

Device2#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

policy name : subflow-1610612757, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

local tunnel endpoint : 151.255.24.24 remote tunnel endpoint : 129.255.169.15

the pairs of ESP ipsec sa : id : 68, algorithm : SM1 HMAC-SHA1-96

inbound esp ipsec sa : spi : 0xb404106a(3020165226) crypto m_context(s_context) : 0x67b8ba0 / 0x67b8d20

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28638/4294967295

uptime is 0 hour 2 minute 42 second

outbound esp ipsec sa : spi : 0x6c911061(1821446241) crypto m_context(s_context) : 0x6e7eb20 / 0x67b80a0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28638/4294967295

uptime is 0 hour 2 minute 42 second

local tunnel endpoint : 150.255.24.29 remote tunnel endpoint : 139.255.24.29

the pairs of ESP ipsec sa : id : 70, algorithm : SM1 HMAC-SHA1-96

inbound esp ipsec sa : spi : 0x8672106b(2255622251) crypto m_context(s_context) : 0x67b81a0 / 0x67b8c20

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28648/4294967295

uptime is 0 hour 2 minute 32 second

outbound esp ipsec sa : spi : 0x903e1062(2419986530) crypto m_context(s_context) : 0x67b8a20 / 0x6e7e920

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28648/4294967295

uptime is 0 hour 2 minute 32 second

total sa and sa group is 2

We can see that two IPsec tunnels are set up between Device2 and Device1.

#On Device1, view the information of the route automatically added to the peer protect network.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 100.0.0.0/24 is directly connected, 00:29:10, gigabitethernet1

S 101.0.0.0/24 [1/10] via 151.255.24.24, 00:05:59, gigabitethernet0

[1/10] via 150.255.24.29, 00:05:49, gigabitethernet2

C 127.0.0.0/8 is directly connected, 30:31:38, lo0

C 129.255.169.0/24 is directly connected, 30:30:31, gigabitethernet0

C 139.255.24.0/24 is directly connected, 05:23:17, gigabitethernet2

S 150.255.24.0/24 [1/10] via 139.255.24.38, 05:14:53, gigabitethernet2

S 151.255.24.0/24 [1/10] via 129.255.169.38, 00:08:28, gigabitethernet0

We can see that 101.0.0.0/24 is the static route automatically added for IPsec on Device1.

#On Device2, view the information of the route automatically added to the peer protect network.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

S 100.0.0.0/24 [1/10] via 129.255.169.15, 00:06:03, gigabitethernet0

[1/10] via 139.255.24.29, 00:05:52, gigabitethernet2

C 101.0.0.0/24 is directly connected, 00:29:11, gigabitethernet1

C 127.0.0.0/8 is directly connected, 44:01:05, lo0

S 129.255.255.0/24 [1/10] via 151.255.24.38, 00:09:04, gigabitethernet0

S 139.255.24.0/24 [1/10] via 150.255.24.38, 05:14:39, gigabitethernet2

C 150.255.24.0/24 is directly connected, 05:22:59, gigabitethernet2

C 151.255.24.0/24 is directly connected, 01:18:52, gigabitethernet0

We can see that 100.0.0.0/24 is the static route automatically added for IPsec on Device2.

#PC1 can communicate with PC2 and PC3 normally via the two IPsec tunnels between Device1 and Device2; the packet is protected by two IPsec tunnels tun1 and tun2.


6.3.4 Configure Ipsec Backup Gateway

Network Requirements

1. gigabitethernet0 of Device2 and Device3 are added to VRRP group1; Device1 sets up the IPsec tunnel with the virtual address of VRRP, protecting the data communication of the network where PC1 and PC2 are located.

2. gigabitethernet1 of Device2 and Device3 are added to VRRP group2; the gateway of PC2 points to the virtual address of VRRP2.

3. IPsec proposal security protocol adopts ESP; IKE proposal and IPsec proposal encryption algorithm adopts 3DES; authentication algorithm adopts MD5.

Network Topology

Figure 6‑4 Networking of configuring the IPsec backup gateway

Configuration Steps

Step 1: | Configure the IP address and route of the interface. (omitted)
Step 2: | Configure the VRRP group.

#On Device2, add VRRP group 1; add gigabitethernet0 to VRRP group 1; the virtual address of VRRP group1 is 151.255.24.29 and the priority is 110.

Device2#configure terminal

Device2(config)#interface gigabitethernet 0

Device2(config-if-gigabitethernet0)#vrrp 1 ip 151.255.24.29

Device2(config-if-gigabitethernet0)#vrrp 1 priority 110

Device2(config-if-gigabitethernet0)#exit

#On Device2, add VRRP group 2; add gigabitethernet1 to VRRP group 2; the virtual address of VRRP group2 is 101.0.0.1 and the priority is 110. Configure Track on VRRP group 2, monitor the interface gigabitethernet0 and configure the priority to reduce by 20.

Device2(config)#interface gigabitethernet 1

Device2(config-if-gigabitethernet1)#vrrp 2 ip 101.0.0.1

Device2(config-if-gigabitethernet1)#vrrp 2 priority 110

Device2(config-if-gigabitethernet1)#vrrp 2 track gigabitethernet 0 20

Device2(config-if-gigabitethernet1)#exit

#On Device3, add VRRP group 1; add gigabitethernet0 to VRRP group 1; the virtual address of VRRP group1 is 151.255.24.29.

Device3#configure terminal

Device3(config)#interface gigabitethernet 0

Device3(config-if-gigabitethernet0)#vrrp 1 ip 151.255.24.29

Device3(config-if-gigabitethernet0)#exit

#On Device3, add VRRP group 2; add gigabitethernet1 to VRRP group 2; the virtual address of VRRP group2 is 101.0.0.1.

Device3(config)#interface gigabitethernet 1

Device3(config-if-gigabitethernet1)#vrrp 2 ip 101.0.0.1

Device3(config-if-gigabitethernet1)#exit

Step 3:

Configure the IKE and IPSec proposal.

#On Device1, configure the IKE proposal ikepro, use the encryption algorithm 3DES, authentication algorithm MD5; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES, and authentication algorithm MD5.

Device1#configure terminal

Device1(config)#crypto ike proposal ikepro

Device1(config-ike-prop)#encryption 3des

Device1(config-ike-prop)#integrity md5

Device1(config-ike-prop)#exit

Device1(config)#crypto ipsec proposal ippro

Device1(config-ipsec-prop)#esp 3des md5

Device1(config-ipsec-prop)#exit

#On Device2, configure the IKE proposal ikepro, use the encryption algorithm 3DES, authentication algorithm MD5; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES, and authentication algorithm MD5.

Device2(config)#crypto ike proposal ikepro

Device2(config-ike-prop)#encryption 3des

Device2(config-ike-prop)#integrity md5

Device2(config-ike-prop)#exit

Device2(config)#crypto ipsec proposal ippro

Device2(config-ipsec-prop)#esp 3des md5

Device2(config-ipsec-prop)#exit

#On Device3, configure the IKE proposal ikepro, use the encryption algorithm 3DES, authentication algorithm MD5; configure IPsec proposal ippro, use the ESP security protocol, use the encryption algorithm 3DES, and authentication algorithm MD5.

Device3(config)#crypto ike proposal ikepro

Device3(config-ike-prop)#encryption 3des

Device3(config-ike-prop)#integrity md5

Device3(config-ike-prop)#exit

Device3(config)#crypto ipsec proposal ippro

Device3(config-ipsec-prop)#esp 3des md5

Device3(config-ipsec-prop)#exit

Step 4:

Configure the pre-share key.

#On Device1, configure the pre-share key, key is admin and permit all peers to use the key.

Device1(config)#crypto ike key admin any

#On Device2, configure the pre-share key, key is admin and permit all peers to use the key.

Device2(config)#crypto ike key admin any

#On Device3, configure the pre-share key, key is admin and permit all peers to use the key.

Device3(config)#crypto ike key admin any

Step 5:

Configure the IPSec tunnel.

#On Device1, configure the tunnel tun; use the address of gigabitethernet0 as the local address of the tunnel; configure the peer address of the tunnel as the virtual address of the VRRP group 1 as 151.255.24.29; configure the authentication mode as the pre-share key authentication; the IKE proposal uses ikepro; the IPsec proposal uses ippro; enable the auto initiating negotiation.

Device1(config)#crypto tunnel tun

Device1(config-tunnel)#local add 129.255.169.15

Device1(config-tunnel)#peer address 151.255.24.29

Device1(config-tunnel)#set authentication preshared

Device1(config-tunnel)#set ike proposal ikepro

Device1(config-tunnel)#set ipsec proposal ippro

Device1(config-tunnel)#set auto-up

Device1(config-tunnel)#exit

#On Device2, configure the tunnel tun; use the virtual address of VRRP group 1 as the local address of the tunnel; configure the peer of the tunnel as any; the IKE proposal uses ikepro; the IPsec proposal uses ippro.

Device2(config)#crypto tunnel tun

Device2(config-tunnel)#local address 151.255.24.29

Device2(config-tunnel)#peer any

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#exit

#On Device3, configure the tunnel tun; use the virtual address of VRRP group 1 as the local address of the tunnel; configure the peer of the tunnel as any; the IKE proposal uses ikepro; the IPsec proposal uses ippro.

Device3(config)#crypto tunnel tun

Device3(config-tunnel)#local address 151.255.24.29

Device3(config-tunnel)#peer any

Device3(config-tunnel)#set ike proposal ikepro

Device3(config-tunnel)#set ipsec proposal ippro

Device3(config-tunnel)#exit

Step 6:

Configure the IPSec security policy.

#On Device1, configure security policypolicy1, protecting the IP communication from network 100.0.0.0/24 to network 101.0.0.0/24; associate the tunnel tun; add the route to the peer protect network automatically.

Device1(config)#crypto policy policy1

Device1(config-policy)#flow 100.0.0.0 255.255.255.0 101.0.0.0 255.255.255.0 ip tunnel tun

Device1(config-policy)#set reverse-route

Device1(config-policy)#exit

#On Device2, configure security policypolicy1, protecting the IP communication from network 101.0.0.0/24 to network 100.0.0.0/24; associate the tunnel tun; add the route to the peer protect network automatically.

Device2(config)#crypto policy policy1

Device2(config-policy)#flow 101.0.0.0 255.255.255.0 100.0.0.0 255.255.255.0 ip tunnel tun

Device2(config-policy)#set reverse-route

Device2(config-policy)#exit

#On Device3, configure security policypolicy1, protecting the IP communication from network 101.0.0.0/24 to network 100.0.0.0/24; associate the tunnel tun; add the route to the peer protect network automatically.

Device3(config)#crypto policy policy1

Device3(config-policy)#flow 101.0.0.0 255.255.255.0 100.0.0.0 255.255.255.0 ip tunnel tun

Device3(config-policy)#set reverse-route

Device3(config-policy)#exit

Step 7:

Check the result.

#On Devie1, view the tunnel setup information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

101 STATE_QUICK_I2 129.255.169.15 151.255.24.29 151.255.24.29

100 STATE_MAIN_I4 129.255.169.15 151.255.24.29 151.255.24.29

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 100.0.0.0/24 101.0.0.0/24 ip any any

local tunnel endpoint : 129.255.169.15 remote tunnel endpoint : 151.255.24.29

the pairs of ESP ipsec sa : id : 101, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0x6b5a106e(1801064558) crypto m_context(s_context) : 0x27f41f20 / 0x274672e0

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28543/4294967295

uptime is 0 hour 4 minute 17 second

outbound esp ipsec sa : spi : 0x12931077(311627895) crypto m_context(s_context) : 0x274671e0 / 0x274670e0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28543/4294967295

uptime is 0 hour 4 minute 17 second

total sa and sa group is 1

We can see that Device1 sets up the tunnel with Device2 successfully.

#On Device2, execute the show vrrp command to view that the status of VRRP group 1 and VRRP group 2 as Master; view the tunnel setup information.

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

88 STATE_QUICK_R2 151.255.24.29 129.255.169.15 129.255.169.15

87 STATE_MAIN_R3 151.255.24.29 129.255.169.15 129.255.169.15

Device2#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

policy name : subflow-1610612761, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

local tunnel endpoint : 151.255.24.29 remote tunnel endpoint : 129.255.169.15

the pairs of ESP ipsec sa : id : 88, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0x12931077(311627895) crypto m_context(s_context) : 0x6e7eaa0 / 0x6e7ea20

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28465/4294967295

uptime is 0 hour 5 minute 35 second

outbound esp ipsec sa : spi : 0x6b5a106e(1801064558) crypto m_context(s_context) : 0x6e7eb20 / 0x6e7eba0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28465/4294967295

uptime is 0 hour 5 minute 35 second

total sa and sa group is 1

We can see that Device2 sets up the tunnel with Device1 successfully.

#On Device1, view the information of the route automatically added to the peer protect network.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 129.255.24.38 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 129.255.169.38, 03:34:03, gigabitethernet0

C 100.0.0.0/24 is directly connected, 00:10:07, gigabitethernet1

S 101.0.0.0/24 [1/10] via 151.255.24.29, 00:07:47, gigabitethernet0

C 127.0.0.0/8 is directly connected, 76:28:40, lo0

C 129.255.169.0/16 is directly connected, 03:40:50, gigabitethernet0

We can see that 101.0.0.0/24 on Device1 is the static route automatically added for IPsec.

#On Device2, view the information of the route automatically added to the peer protect network.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 151.255.24.38 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 151.255.24.38, 00:10:46, gigabitethernet0

S 100.0.0.0/24 [1/10] via 129.255.169.15, 00:08:43, gigabitethernet0

C 101.0.0.0/24 is directly connected, 00:10:09, gigabitethernet1

C 127.0.0.0/8 is directly connected, 89:59:00, lo0

C 151.255.24.0/24 is directly connected, 00:10:46, gigabitethernet0

We can see that 100.0.0.0/24 on Device2 is the static route automatically added for IPsec.

#PC1 can ping PC2 via the IPsec tunnel between Device1 and Device2 and the packet is protected by the IPsec tunnel.

#gigabitethernet0 on Device2 fails. On Device3, execute the show vrrp command to view that the status of the VRRP group 1 and VRRP group 2 are switched to Master; The tunnel of Device1 with Device2 is disconnected via the DPD detection; Device1 and Device3 set up the IPsec tunnel; on Device3, view the tunnel setup information.

Device3#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

40 STATE_QUICK_R2 151.255.24.29 129.255.169.15 129.255.169.15

39 STATE_MAIN_R3 151.255.24.29 129.255.169.15 129.255.169.15

Device3#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

policy name : subflow-1610612736, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

local tunnel endpoint : 151.255.24.29 remote tunnel endpoint : 129.255.169.15

the pairs of ESP ipsec sa : id : 40, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0xb1852065(2978291813) crypto context : 0x3937dc0

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28603/4294967295

uptime is 0 hour 3 minute 17 second

outbound esp ipsec sa : spi : 0xc842106f(3359772783) crypto context : 0x395d4a0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28603/4294967295

uptime is 0 hour 3 minute 17 second

total sa and sa group is 1

We can see that Device3 and Device2 set up the Ipsec tunnel successfully.

#On Device1, view the tunnel setup information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

103 STATE_QUICK_I2 129.255.169.15 151.255.24.29 151.255.24.29

102 STATE_MAIN_I4 129.255.169.15 151.255.24.29 151.255.24.29

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 100.0.0.0/24 101.0.0.0/24 ip any any

local tunnel endpoint : 129.255.169.15 remote tunnel endpoint : 151.255.24.29

the pairs of ESP ipsec sa : id : 103, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0xc842106f(3359772783) crypto m_context(s_context) : 0x27f41d20 / 0x27f41ea0

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28681/4294967295

uptime is 0 hour 1 minute 59 second

outbound esp ipsec sa : spi : 0xb1852065(2978291813) crypto m_context(s_context) : 0x274673e0 / 0x27f41da0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28681/4294967295

uptime is 0 hour 1 minute 59 second

total sa and sa group is 1

We can see that Device1 and Device3 set up the Ipsec tunnel successfully.

#On Device1, view the information of the route automatically added to the peer protect network.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 129.255.24.38 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 129.255.169.38, 04:00:23, gigabitethernet0

C 100.0.0.0/24 is directly connected, 00:19:04, gigabitethernet1

S 101.0.0.0/24 [1/10] via 151.255.24.29, 00:05:29, gigabitethernet0

C 127.0.0.0/8 is directly connected, 76:55:00, lo0

C 129.255.169.0/24 is directly connected, 04:07:10, gigabitethernet0

We can see that 101.0.0.0/24 on Device1 is the static route automatically added for IPsec.

#On Device31, view the information of the route automatically added to the peer protect network.

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 151.255.24.38 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 151.255.24.38, 00:37:02, gigabitethernet0

S 100.0.0.0/24 [1/10] via 129.255.169.15, 00:06:31, gigabitethernet0

C 101.0.0.0/24 is directly connected, 00:12:05, gigabitethernet1

C 127.0.0.0/8 is directly connected, 70:25:17, lo0

C 151.255.24.0/24 is directly connected, 00:37:02, gigabitethernet0

We can see that 100.0.0.0/24 on Device3 is the static route automatically added for IPsec.

# PC1 can ping PC2 via the IPsec tunnel between Device1 and Device3 and the packet is protected by the IPsec tunnel.

# gigabitethernet0 on Device2 restores the connection; on Device2, execute the show vrrp command to view that the status of VRRP group1 and VRRP group 2 is switched to Master; the tunnel of Device1 with Device3 is disconnected via the DPD detection; Device1 and Device2 set up the IPsec tunnel; View the tunnel setup information on Device2.

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

90 STATE_QUICK_R2 151.255.24.29 129.255.169.15 129.255.169.15

89 STATE_MAIN_R3 151.255.24.29 129.255.169.15 129.255.169.15

Device2#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

policy name : subflow-1610612762, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 101.0.0.0/24 100.0.0.0/24 ip any any

local tunnel endpoint : 151.255.24.29 remote tunnel endpoint : 129.255.169.15

the pairs of ESP ipsec sa : id : 90, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0xe6331078(3862106232) crypto m_context(s_context) : 0x6e7e9a0 / 0x6e7e920

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 27188/4294967295

uptime is 0 hour 26 minute 52 second

outbound esp ipsec sa : spi : 0x1c3b1070(473632880) crypto m_context(s_context) : 0x6e7eb20 / 0x67b6f60

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 27188/4294967295

uptime is 0 hour 26 minute 52 second

total sa and sa group is 1

We can see that Device2 sets up the tunnel with Device1 successfully.

#On Devie1, view the tunnel setup information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

105 STATE_QUICK_I2 129.255.169.15 151.255.24.29 151.255.24.29

104 STATE_MAIN_I4 129.255.169.15 151.255.24.29 151.255.24.29

Device1#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 100.0.0.0/24 101.0.0.0/24 ip any any

local tunnel endpoint : 129.255.169.15 remote tunnel endpoint : 151.255.24.29

the pairs of ESP ipsec sa : id : 105, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0x1c3b1070(473632880) crypto m_context(s_context) : 0x27467360 / 0x274672e0

current input 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28546/4294967295

uptime is 0 hour 4 minute 14 second

outbound esp ipsec sa : spi : 0xe6331078(3862106232) crypto m_context(s_context) : 0x27f41f20 / 0x274670e0

current output 0 packets, 0 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28546/4294967295

uptime is 0 hour 4 minute 14 second

total sa and sa group is 1

We can see that Device1 sets up the tunnel with Device2 successfully.

#PC1 can ping PC2 via the IPsec tunnel between Device1 and Device2 and the packet is protected by the IPsec tunnel.


6.3.5 Configure GRE OVER IPsec

Network Requirements

1. Device1 and Device2 first set up the IPsec tunnel and then set up the GRE tunnel; the GRE tunnel is protected by IPsec;

2. Device1 and Device2 enable OSPF and can learn the OSPF route advertised by the peer;

3. IPsec proposal security protocol adopts ESP; IKE proposal and IPsec proposal emcryption algorithm adopts 3DES and the authentication algorithm adopts MD5.

Network Topology

Figure 6‑5 Networking of configuring GRE OVER IPsec

Device | Interface | IP address | Device | Interface | IP address
Device1 | Gi0 | 129.255.169.15/24 | Device2 | Gi0 | 151.255.24.24/24
 | Gi1 | 100.0.0.1/24 |  | Gi1 | 101.0.0.1/24
 | Loopback0 | 102.0.0.1/24 |  | Loopback0 | 103.0.0.1/24
 | Tunnel1 | 10.0.0.1/24 |  | Tunnel1 | 10.0.0.2/24

Configuration Steps

Step 1: | Configure the IP address and route of the interface. (omitted)
Step 2: | Configure OSPF.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 100.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 101.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

Step 3:

Configure the IKE and IPSec proposal.

#On Device1, configure the IKE proposal ikepro, use the encryption algorithm 3DES, authentication algorithm MD5; configure IPsec proposal ippro, use the encryption algorithm 3DES, and authentication algorithm MD5.

Device1(config)#crypto ike proposal ikepro

Device1(config-ike-prop)#encryption 3des

Device1(config-ike-prop)#integrity md5

Device1(config-ike-prop)#exit

Device1(config)#crypto ip proposal ippro

Device1(config-ipsec-prop)#esp 3des md5

Device1(config-ipsec-prop)#exit

#On Device2, configure the IKE proposal ikepro, use the encryption algorithm 3DES, authentication algorithm MD5; configure IPsec proposal ippro, use the encryption algorithm 3DES, and authentication algorithm MD5.

Device2(config)#crypto ike proposal ikepro

Device2(config-ike-prop)#encryption 3des

Device2(config-ike-prop)#integrity md5

Device2(config-ike-prop)#exit

Device2(config)#crypto ipsec proposal ippro

Device2(config-ipsec-prop)#esp 3des md5

Device2(config-ipsec-prop)#exit

Step 4:

Configure the pre-share key.

#On Device1, configure the pre-share key, key is admin and permit all peers to use the key.

Device1(config)#crypto ike key admin any

#On Device2, configure the pre-share key, key is admin and permit all peers to use the key.

Device2(config)#crypto ike key admin any

Step 5:

Configure the IPSec tunnel.

#On Device1, configure the tunnel tun; use the address of gigabitethernet0 as the local address of the tunnel; configure the peer address of the tunnel as 151.255.24.24; configure the authentication mode as the pre-share key authentication; the IKE proposal uses ikepro; the IPsec proposal uses ippro; enable the auto initiating negotiation.

Device1(config)#crypto tunnel tun

Device1(config-tunnel)#local address 129.255.169.15

Device1(config-tunnel)#peer address 151.255.24.24

Device1(config-tunnel)#set authentication preshared

Device1(config-tunnel)#set ike proposal ikepro

Device1(config-tunnel)#set ipsec proposal ippro

Device1(config-tunnel)#set auto-up

Device1(config-tunnel)#exit

#On Device2, configure the tunnel tun; use the address of gigabitethernet0 as the local address of the tunnel; configure the peer address of the tunnel as any; the IKE proposal uses ikepro; the IPsec proposal uses ippro.

Device2(config)#crypto tunnel tun

Device2(config-tunnel)#local address 151.255.24.24

Device2(config-tunnel)#peer any

Device2(config-tunnel)#set ike proposal ikepro

Device2(config-tunnel)#set ipsec proposal ippro

Device2(config-tunnel)#exit

Step 6:

Configure the IPSec security policy.

#On Device1, configure security policypolicy1, protecting the IP communication from network 102.0.0.0/24 to network 103.0.0.0/24; associate the tunnel tun.

Device1(config)#crypto policy policy1

Device1(config-policy)#flow 102.0.0.0 255.255.255.0 103.0.0.0 255.255.255.0 ip tunnel tun

Device1(config-policy)#exit

#On Device2 configure security policypolicy1, protecting the IP communication from network 1030.0.0/24 to network 1020.0.0/24; associate the tunnel tun.

Device2(config)#crypto policy policy1

Device2(config-policy)#flow 103.0.0.0 255.255.255.0 102.0.0.0 255.255.255.0 ip tunnel tun

Device2(config-policy)#exit

Step 7:

Configure the GRE tunnel.

#On Device1, configure the GRE tunnel, the source address is 102.0.0.1, the destination address is 103.0.0.1, and the IP address is 10.0.0.1.

Device1(config)#interface tunnel 1

Device1(config-if-tunnel1)#tunnel source 102.0.0.1

Device1(config-if-tunnel1)#tunnel destination 103.0.0.1

Device1(config-if-tunnel1)#ip address 10.0.0.1 255.255.255.0

Device1(config-if-tunnel1)#exit

#On Device2 configure the GRE tunnel, the source address is 1030.0.1, the destination address is 1020.0.1, and the IP address is 10.0.0.2

Device2(config)#interface tunnel 1

Device2(config-if-tunnel1)#tunnel source 103.0.0.1

Device2(config-if-tunnel1)#tunnel destination 102.0.0.1

Device2(config-if-tunnel1)#ip address 10.0.0.2 255.255.255.0

Device2(config-if-tunnel1)#exit

Step 8:

Check the result.

#On Device1, view the GRE tunnel information.

Device1#show gre kernel

Protocol Information:

Family = 0x2, off = 4, len = 4, delivery = 0x316778

GTL_TABLE:

GRE Tunnel Interface 1 (0x404):

Tunnel mode is Point to Point

Destination address is 103.0.0.1

Source address is 102.0.0.1

Source interface is loopback0 (0x403)

Packet checksum validation is disabled

Security validation key is not set

Time To Live (TTL) is 255

Type Of Service (TOS) is not set

GRE header length is 4

VRF is global (0x0)

Keepalive is disabled

Tunnel state is active/up

Flags is 0x230000

Qid is 0x27506300

GTL_INDEX:

GRE Tunnel Interface 1 (0x404):

Tunnel mode is Point to Point

Destination address is 103.0.0.1

Source address is 102.0.0.1

Source interface is loopback0 (0x403)

Packet checksum validation is disabled

Security validation key is not set

Time To Live (TTL) is 255

Type Of Service (TOS) is not set

GRE header length is 4

VRF is global (0x0)

Keepalive is disabled

Tunnel state is active/up

Flags is 0x230000

Qid is 0x27506300

We can see that the tunnel status is UP on Device1.

#On Device2, view the GRE tunnel information.

Device2#show gre kernel

Protocol Information:

Family = 0x2, off = 4, len = 4, delivery = 0x316718

GTL_TABLE:

GRE Tunnel Interface 1 (0xc):

Tunnel mode is Point to Point

Destination address is 102.0.0.1

Source address is 103.0.0.1

Source interface is loopback0 (0xb)

Packet checksum validation is disabled

Security validation key is not set

Time To Live (TTL) is 255

Type Of Service (TOS) is not set

GRE header length is 4

VRF is global (0x0)

Keepalive is disabled

Tunnel state is active/up

Flags is 0x230000

Qid is 0x6d77080

GTL_INDEX:

GRE Tunnel Interface 1 (0xc):

Tunnel mode is Point to Point

Destination address is 102.0.0.1

Source address is 103.0.0.1

Source interface is loopback0 (0xb)

Packet checksum validation is disabled

Security validation key is not set

Time To Live (TTL) is 255

Type Of Service (TOS) is not set

GRE header length is 4

VRF is global (0x0)

Keepalive is disabled

Tunnel state is active/up

Flags is 0x230000

Qid is 0x6d77080

We can see that the tunnel status is UP on Device2

#On Device1, view the IPsec tunnel setup information.

Device1#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

546 STATE_QUICK_I2 129.255.169.15 151.255.24.24 151.255.24.24

545 STATE_MAIN_I4 129.255.169.15 151.255.24.24 151.255.24.24

Device1#sh crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 102.0.0.0/24 103.0.0.0/24 ip any any

local tunnel endpoint : 129.255.169.15 remote tunnel endpoint : 151.255.24.24

the pairs of ESP ipsec sa : id : 546, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0x5eb6107a(1588990074) crypto m_context(s_context) : 0x2752f920 / 0x2752faa0

current input 16 packets, 1 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28636/4294967293

uptime is 0 hour 2 minute 44 second

outbound esp ipsec sa : spi : 0x29831048(696455240) crypto m_context(s_context) : 0x2752fa20 / 0x2752fba0

current output 16 packets, 1 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28636/4294967293

uptime is 0 hour 2 minute 44 second

total sa and sa group is 1

We can see that Device1 sets up the tunnel with Device2 successfully.

#On Device2, view the IPsec tunnel setup information

Device2#show crypto ike sa

sa-id negotiation-state localaddr peeraddr peer-identity

4 STATE_QUICK_R2 151.255.24.24 129.255.169.15 129.255.169.15

3 STATE_MAIN_R3 151.255.24.24 129.255.169.15 129.255.169.15

Device2#show crypto ipsec sa

policy name : policy1

f (src, dst, protocol, src port, dst port) : 103.0.0.0/24 102.0.0.0/24 ip any any

policy name : subflow-1610612737, the parent policy name : policy1

f (src, dst, protocol, src port, dst port) : 103.0.0.0/24 102.0.0.0/24 ip any any

local tunnel endpoint : 151.255.24.24 remote tunnel endpoint : 129.255.169.15

the pairs of ESP ipsec sa : id : 4, algorithm : 3DES HMAC-MD5-96

inbound esp ipsec sa : spi : 0x29831048(696455240) crypto m_context(s_context) : 0x67fc140 / 0x67fc1c0

current input 16 packets, 1 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28643/4294967293

uptime is 0 hour 2 minute 37 second

outbound esp ipsec sa : spi : 0x5eb6107a(1588990074) crypto m_context(s_context) : 0x67fc340 / 0x67fc3c0

current output 16 packets, 1 kbytes

encapsulation mode : Tunnel

replay protection : ON

remaining lifetime (seconds/kbytes) : 28643/4294967293

uptime is 0 hour 2 minute 37 second

total sa and sa group is 1

We can see that Device2 sets up the tunnel with Device1 successfully.

#View the route table on Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 129.255.24.38 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 129.255.169.38, 48:42:54, gigabitethernet0

C 10.0.0.0/24 is directly connected, 00:31:41, tunnel1

C 100.0.0.0/24 is directly connected, 16:30:29, gigabitethernet1

O 101.0.0.0/24 [110/11112] via 10.0.0.2, 00:29:55, tunnel1

C 102.0.0.0/24 is directly connected, 02:03:16, loopback0

C 127.0.0.0/8 is directly connected, 121:37:32, lo0

C 129.255.169.0/24 is directly connected, 48:49:41, gigabitethernet0

We can see that Device1 learns the OPSF route 101.0.0.0/24 advertised by the peer.

#On Device2, view the route table.

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is 151.255.24.38 to network 0.0.0.0

S 0.0.0.0/0 [1/10] via 151.255.24.38, 02:36:59, gigabitethernet0

C 10.0.0.0/24 is directly connected, 00:29:59, tunnel1

O 100.0.0.0/24 [110/11112] via 10.0.0.1, 00:29:48, tunnel1

C 101.0.0.0/24 is directly connected, 15:25:33, gigabitethernet1

C 103.0.0.0/24 is directly connected, 01:58:29, loopback0

C 127.0.0.0/8 is directly connected, 15:26:28, lo0

C 151.255.24.0/24 is directly connected, 02:36:59, gigabitethernet0

We can see that Device2 learns the OSPF route 100.0.0.0/24 advertised by the peer.


7 ACL Configuration


7.1 Overview


7.1.1 Overview of ACL

One ACL (Access Control List) comprises a series of rules. Each rule is one permit, refuse or remark sentence, stating the corresponding matching condition and action. The ACL rule filters the packets by matching some field in the packet.

ACL can comprise multiple rules. The matching content specified by each rule is different and the matching contents in different rules may overlap or conflict. ACL rule matching strictly complies with the order of the sequence from small to large. The rule with smaller sequence takes effect earlier. Sequence means the order number of the rule in the while ACL.

There is one rule of refusing all packets hidden after the last rule of the ACL and the sequence is larger than all the other rules in the ACL. The hidden rule is invisible and it drops the packets that do not match the previous rules, that is, when the packet does not match with the previous rules, it matches the default rule and is dropped.

According to the ACL usage, we can divide ACL to five kinds, that is, IP standard ACL, IP extended ACL, MAC standard ACL, MAC extended ACL, and Ethernet protocol ACL. ACL name can use the number and also can use the customized character string. When ACL name uses the number, the corresponding ACL type and number value range are as follows:

l IP standard ACL: 1-1000;

l IP extended ACL: 1001-2000;

l MAC standard ACL: 2001-3000;

l MAC extended ACL: 3001-4000;

l Ethernet protocol ACL: 4001-5000;

When the ACL name adopts the customized character string, all ACLs share one name space, that is, if IP standard ACL uses one name, the other ACL types cannot use the name.

ACL also can execute the corresponding action group according to the matching. For details, refer to “QoS Configuration Manual”.


7.1.2 Overview of Time Domain

The time domain is the set of the time segments. One time domain can contain zero to multiple time segments. The time range of the time domain is the union of the time segments.

The time segment has the following two kinds:

l Periodical time segment: Periodical time segment means to select one day or several days from Monday to Sunday, and the start time point to the end time point as the time segment, taking effect every week repeatedly.

l Absolute time segment: The absolute time segment means to take effect within the specified date and time range

The user usually has the following demands:

The PC of one network segment can access the server only in the work time of the work day (except for all holidays); in the afternoon of Saturday, permit all PCs to communicate with the external Internet.

The communication control demands based on the time can be met by binding time domain in the ACL or ACL rule.


7.2 ACL Function Configuration

Table 7-1 ACL function configuration list

Configuration Task
Configure the IP standard ACL | Configure the IP standard ACL
 | Configure the IP standard ACL named by numbers
Configure the IP extended ACL | Configure the IP extended ACL
 | Configure the IP extended ACL named by numbers
Configure the MAC standard ACL | Configure the MAC standard ACL
 | Configure the MAC standard ACL named by numbers
Configure the MAC extended ACL | Configure the MAC extended ACL
 | Configure the MAC extended ACL named by numbers
Configure the Ethernet protocol ACL | Configure the Ethernet protocol ACL
 | Configure the Ethernet protocol ACL named by numbers
Configure the quantity limitation of the ACL rules | Configure the quantity limitation of the ACL rules
Configure the reflexive access control list | Configure defining the reflexive access control list
 | Configure referencing the reflexive access control list
 | Configure the global age time of the reflexive rule
Configure the ACL logs | Configure the ACL logs
 | Configure the ACL log level
Configure the ACL compiling | Configure the ACL compiling
 | Configure ACL to prohibit compiling
 | Configure the percentage of the system memory permitted to be occupied by the ACL compiling
Configure the time domain | Configure the time domain
 | Configure the periodical time segment
 | Configure the absolute time segment
 | Configure the refresh period
 | Configure the maximum time offset
 | Configure the time domain to be bound with the ACL rule
 | Configure the time domain to be bound with the ACL
Configure the ACL application | Configure IP ACL to be applied to the interface
 | Configure MAC ACL to be applied to the interface
 | Configure Ethernet protocol ACL to be applied to the bridge group


7.2.1 Configure IP Standard ACL

IP standard ACL makes the rules according to the source IP address to filter the packets and generate logs.

Configuration Condition

None

Configure IP Standard ACL

IP standard ACL name can use the number and also can use the customized character string. If the IP standard ACL name adopts the numbers, we can configure the maximum quantity limitation of ACL; if adopting the customized character string, there is no limitation for the maximum quantity of ACL. The user can select the ACL name as desired.

Table 7‑2 Configure the IP standard ACL

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the IP standard ACL | ip access-list standard { access-list-number | access-list-name } | Mandatory By default, the IP standard ACL is not configured. The number range of the IP standard ACL is 1-1000.
Configure the permit rule of ACL | [ sequence ] permit { any | source-addr source-wildcard | host source-addr } [ time-range time-range-name ] [ log ] | Optional By default, the ACL permit rule is not configured.
Configure the refuse rule of ACL | [ sequence ] deny { any | source-addr source-wildcard | host source-addr } [ time-range time-range-name ] [ log ] | Optional By default, the refuse rule of ACL is not configured.
Configure the ACL remarks | [ sequence ] remark comment | Optional By default, the remarks of the ACL rule are not configured.

l When using the ip access-list standardcommand to create the IP standard ACL, the ACL can be created only after configuring the rules in the IP standard ACL configuration mode.

l Sequence means the order number of the rule in the ACL. ACL matches and filters the packet strictly according to the order from small sequence to large sequence. The rule with the small sequence first takes effect. When all rules do not match, execute the default drop action, that is, all the packets not permitted to pass are dropped.

Configure IP Standard ACL Named by Numbers

The IP standard ACL named by numbers can let the user identify the type of the ACL quickly. However, the IP standard ACL named by numbers has some limitations. For example, the ACL quantity is limited.

Table 7‑3Configure the IP standard ACL named by numbers

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the IP standard ACL named by numbers | access-list access-list-number { permit | deny } { any | source-addr source-wildcard | host source-addr } [ time-range time-range-name ] [ log ] | Mandatory By default, the IP standard ACL named by numbers is not configured. The sequence range of the IP standard ACL is 1-1000.
Configure the remarks of the IP standard ACL named by numbers | access-list access-list-number remark comment | Optional By default, the remarks of the IP standard ACL named by numbers are not configured.

l If the ACL with the specified sequence does not exist, create one new ACL and add new rules. If the ACL with the specified number exists, just add new rules.


7.2.2 Configure IP Extended ACL

IP extended ACL can make the classification rule according to the IP protocol number, source IP address, destination IP address, source TCP/UDP port number, destination TCP/UDP port number, packet priority, fragment tag, and TCP tag, so as to filter the packets, generate logs and reflexive list.

Configuration Condition

None

Configure IP Extended ACL

IP extended ACL name can use the number and also can use the customized character string. If the IP extended ACL name adopts the numbers, we can configure the maximum quantity limitation of ACL; if adopting the customized character string, there is no limitation for the maximum quantity of ACL. The user can select the ACL name as desired. IP extended ACL is richer, more correct, and more flexible than the contents defined by IP standard ACL.

Table 7‑4 Configure the IP extended ACL

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the IP extended ACL | ip access-list extended { access-list-number | access-list-name } | Mandatory By default, IP extended ACL is not configured. The sequence range of the IP extended ACL is 1001-2000.
Configure the permit rule of ACL | [ sequence ] permit protocol { any | source-addr source-wildcard | host source-addr } [ operator source-port ] { any | destination-addr destination-wildcard | host destination-addr } [ operator destination-port ] [ icmp-type ] [ icmp-code ] [ igmp-type ] [ ack / fin / established / psh / rst / syn / urg ] [ precedence precedence ] [ tos tos ] [ dscp dscp ] [ fragments ] [ ttl ttl-value ] [ log ] [ time-range time-range-name ] [ reflect reflect-list-name [ timeout reflect-timeout-value ] ] | Optional By default, the permit rule of ACL is not configured.
Configure the refuse rule of ACL | [ sequence ] deny protocol { any | source-addr source-wildcard | host source-addr } [ operator source-port ] { any | destination-addr destination-wildcard | host destination-addr } [ operator destination-port ] [ icmp-type ] [ icmp-code ] [ igmp-type ] [ ack / fin / established / psh / rst / syn / urg ] [ precedence precedence ] [ tos tos ] [ dscp dscp ] [ fragments ] [ ttl ttl-value ] [ log ] [ time-range time-range-name ] reflect reflect-list-name [ timeout reflect-timeout-value ] ] | Optional By default, the refuse rule of ACL is not configured.
Configure the ACL remarks | [ sequence ] remark comment | Optional By default, the remarks of the ACL are not configured.
Configure ACL to reference the reflexive list | [ sequence ] evaluate reflect-list-name | Optional By default, do not configure the ACL to reference reflexive list.

l When using the ip access-list extendedcommand to create the IP extended ACL, the ACL can be created only after configuring the rules in the IP extended ACL configuration mode.

l Sequence means the order number of the rule in the ACL. ACL matches and filters the packet strictly according to the order from small sequence to large sequence. The rule with the small sequence first takes effect. When all rules do not match, execute the default drop action, that is, all the packets not permitted to pass are dropped.

l Only permit rule can use the reflect parameter to create the reflexive ACL.

Configure IP Extended ACL Named by Numbers

The IP extended ACL named by numbers can let the user identify the type of the ACL quickly. However, the IP extended ACL named by numbers has some limitations. For example, the ACL quantity is limited. IP extended ACL is richer, more correct, and more flexible than the contents defined by IP standard ACL.

Table 7‑5Configure the IP extended ACL named by numbers

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the IP extended ACL named by numbers | access-list access-list-number { permit | deny } protocol { any | source-addr source-wildcard | host source-addr } [ operator source-port ] { any | destination-addr destination-wildcard | host destination-addr } [ operator destination-port ] [ icmp-type ] [ icmp-code ] [ igmp-type ] [ ack / established / fin / psh / rst / syn / urg] [ precedence precedence ] [ tos tos ] [ dscp dscp ] [ fragments ] [ ttl ttl-value ] [ log ] [ time-range time-range-name ] reflect reflect-list-name [ timeout reflect-timeout-value ] ] | Mandatory By default, the IP extended ACL named by numbers is not configured. The sequence range of the IP extended ACL is 1001-2000.
Configure the remarks of the IP extended ACL named by numbers | access-list access-list-number remark comment | Optional By default, the remarks of the IP extended ACL named by numbers are not configured.
Configure the ACL to reference the reflexive list | access-list access-list-number evaluate reflect-list-name | Optional By default, do not configure the ACL to reference the reflexive list rule.

l If the ACL with the specified sequence does not exist, create one new ACL and add new rules. If the ACL with the specified number exists, just add new rules.

l Only permit rule can use the reflect parameter to create the reflexive ACL.


7.2.3 Configure IPv6 Extended ACL

IPv6 extended ACL can make the classification rule according to the IPv6 protocol number, source IPv6 address, destination IPv6 address, source TCP/UDP port number, destination TCP/UDP port number, packet priority, fragment tag, and TCP tag, so as to match and process the packets.

Configuration Condition

None

Configure IPv6 Extended ACL

Table 7‑6 Configure the IPv6 extended ACL

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the IPv6 extended ACL | ipv6 access-list extended { access-list-number | access-list-name } | Mandatory The value range of access-list-number is 7001-8000.
Configure the permit rule of ACL | [sequence] permit protocol { any | source-addr source-prefix | host source-addr } [ operator source-port ] { any | destination-addr destination-prefix | host destination-addr } [icmp-type ][icmp-code ] [igmp-type] [operator destination-port][ flow-label flow-label value] [ ack / fin / psh / rst / syn / urg ] [ precedence precedence ][ dscp dscp ] [ fragments ] [ time-range time-range-name ] | Optional Configure the permit rule to analyze and process the packet.
Configure the refuse rule of ACL | [sequence ] deny protocol { any | source-addr source-prefix | host source-addr } [operator source-port ] { any | destination-addr destination-prefix | host destination-addr} [ icmp-type] [icmp-code] [ igmp-type] [operator destination-port] [ flow-label flow-label value ] [ ack / fin / psh / rst / syn / urg ] [ precedence precedence ][ dscp dscp ] [ fragments ] [ time-range time-range-name ] | Optional Configure the refuse rule to analyze and process the packet.
Configure the ACL remarks | [ sequence ] remark comment | Optional Configure one remark. The remark does not take part in the matching of the packet, bu just plays the role of remarking and isolating.

l When using the ipv6 access-list extendedcommand to create the IPv6 extended ACL, the ACL can be created only after configuring the rules in the IPv6 extended ACL configuration mode.

l deny rule: By default, the IPv6 extended ACL permits the icmpv6 neighbor entry query packet to pass; for the IPv6 extended ACL rule, be careful to configure the rules, like deny ipv6 any any. If the user configured rule can deny icmpv6 neighbor entry query packet, the default rule cannot process the icmpv6 neighbor entry query packet, and icmpv6 neighbor entry query cannot succeed.

Configure IPv6 Extended ACL Named by Numbers

Table 7‑7 Configure the IPv6 extended ACL named by numbers

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the IPv6 extended ACL named by numbers | access-list access-list-number { permit | deny } protocol { any | source-addr source-prefix | host source-addr } [ operator source-port ] { any | destination-addr destination-prefix | host destination-addr } [ icmp-type ] [ icmp-code ] [ igmp-type ] [ operator destination-port ] [ flow-label flow-label value ] [ ack / fin / psh / rst / syn / urg ] [ precedence precedence ] [ dscp dscp ] [ fragments ] [ time-range time-range-name ] | Mandatory The value range of access-list-number is 7001-8000.
Configure the remarks of the IPv6 extended ACL named by numbers | access-list access-list-number remark comment | Optional The remark does not take part in the matching of the packet, bu just plays the role of remarking and isolating.

l If the ACL with the specified sequence does not exist, create one new ACL and add new rules. If the ACL with the specified number exists, just add new rules.

l deny rule: By default, the IPv6 extended ACL permits the icmpv6 neighbor entry query packet to pass; for the IPv6 extended ACL rule, be careful to configure the rules, like deny ipv6 any any. If the user configured rule can deny icmpv6 neighbor entry query packet, the default rule cannot process the icmpv6 neighbor entry query packet, and icmpv6 neighbor entry query cannot succeed.


7.2.4 Configure MAC Standard ACL

MAC standard ACL makes the rules according to the source MAC address to filter the packets.

Configuration Condition

None

Configure MAC Standard ACL

MAC standard ACL name can use the number and also can use the customized character string. If the MAC standard ACL name adopts the numbers, we can configure the maximum quantity limitation of ACL; if adopting the customized character string, there is no limitation for the maximum quantity of ACL. The user can select the ACL name as desired.

Table 7‑8 Configure the MAC standard ACL

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the MAC standard ACL | mac access-list standard { access-list-number | access-list-name } | Mandatory By default, the MAC standard ACL is not configured. The sequence range of the MAC standard ACL is 2001-3000.
Configure the permit rule of ACL | [ sequence ] permit { any | source-addr source-wildcard | host source-addr } [ time-range time-range-name ] | Optional By default, the permit rule of ACL is not configured.
Configure the refuse rule of ACL | [ sequence ] deny { any | source-addr source-wildcard | host source-addr } [ time-range time-range-name ] | Optional By default, the refuse rule of ACL is not configured.
Configure the ACL remarks | [ sequence ] remark comment | Optional By default, the remarks of ACL are not configured.

l When using the mac access-list standard command to create the MAC standard ACL, the ACL can be created only after configuring the rules in the MAC standard ACL configuration mode.

l Sequence means the order number of the rule in the ACL. ACL matches and filters the packet strictly according to the order from small sequence to large sequence. The rule with the small sequence first takes effect. When all rules do not match, execute the default drop action, that is, all the packets not permitted to pass are dropped.

Configure MAC Standard ACL Named by Numbers

The MAC standard ACL named by numbers can let the user identify the type of the ACL quickly. However, the MAC standard ACL named by numbers has some limitations. For example, the ACL quantity is limited.

Table 7‑9Configure the MAC standard ACL named by numbers

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the MAC standard ACL named by numbers | access-list access-list-number { permit | deny } { any | source-addr source-wildcard | host source-addr } [ time-range time-range-name ] | Mandatory By default, the MAC standard ACL named by numbers is not configured. The sequence range of the MAC standard ACL is 2001-3000.
Configure the remarks of the MAC standard ACL named by numbers | access-list access-list-number remark comment | Optional By default, the remarks of the MAC standard ACL named by numbers are not configured.

l If the ACL with the specified sequence does not exist, create one new ACL and add new rules. If the ACL with the specified number exists, just add new rules.


7.2.5 Configure MAC Extended ACL

MAC extended ACL can make the classification rule according to the Ethernet protocol type, source MAC address, destination MAC address, VLAN ID, and 802.1p priority, so as to filter the packets.

Configuration Condition

None

Configure MAC Extended ACL

MAC extended ACL name can use the number and also can use the customized character string. If the MAC extended ACL name adopts the numbers, we can configure the maximum quantity limitation of ACL; if adopting the customized character string, there is no limitation for the maximum quantity of ACL. The user can select the ACL name as desired. MAC extended ACL is richer, more correct, and more flexible than the contents defined by MAC standard ACL.

Table 7‑10 Configure the MAC extended ACL

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the MAC extended ACL | mac access-list extended { access-list-number | access-list-name } | Mandatory By default, MAC extended ACL is not configured. The sequence range of the MAC extended ACL is 3001-4000.
Configure the permit rule of ACL | [ sequence ] permit { any | source-addr source-wildcard | host source-addr } { any | destination-addr destination-wildcard | host destination-addr } [ ether-type type ] [ cos cos ] [ vlan-id vlan ] [ time-range time-range-name ] | Optional By default, the permit rule of ACL is not configured.
Configure the refuse rule of ACL | [ sequence ] deny { any | source-addr source-wildcard | host source-addr } { any | destination-addr destination-wildcard | host destination-addr } [ ether-type type ] [ cos cos ] [ vlan-id vlan ] [ time-range time-range-name ] | Optional By default, the refuse rule of ACL is not configured.
Configure the ACL remarks | [ sequence ] remark comment | Optional By default, the remarks of ACL are not configured.

l When using the mac access-list extendedcommand to create the MAC extended ACL, the ACL can be created only after configuring the rules in the MAC extended ACL configuration mode.

l Sequence means the order number of the rule in the ACL. ACL matches and filters the packet strictly according to the order from small sequence to large sequence. The rule with the small sequence first takes effect. When all rules do not match, execute the default drop action, that is, all the packets not permitted to pass are dropped.

Configure MAC Extended ACL Named by Numbers

The MAC extended ACL named by numbers can let the user identify the type of the ACL quickly. However, the MAC extended ACL named by numbers has some limitations. For example, the ACL quantity is limited. MAC extended ACL is richer, more correct, and more flexible than the contents defined by MAC standard ACL.

Table 7‑11 Configure the MAC extended ACL named by numbers

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the MAC extended ACL named by numbers | access-list access-list-number { permit | deny } { any | source-addr source-wildcard | host source-addr } { any | destination-addr destination-wildcard | host destination-addr } [ ether-type type ] [ cos cos ] [ vlan-id vlan ] [ time-range time-range-name ] | Mandatory By default, the MAC extended ACL named by numbers is not configured. The sequence range of the MAC extended ACL is 3001-4000.
Configure the remarks of the MAC extended ACL named by numbers | access-list access-list-number remark comment | Optional By default, the remarks of the MAC extended ACL named by numbers are not configured.

l If the ACL with the specified sequence does not exist, create one new ACL and add new rules. If the ACL with the specified number exists, just add new rules.


7.2.6 Configure Ethernet protocol ACL

Configuration Condition

None

Configure the Ethernet protocol ACL

Ethernet protocol ACL makes the rule only according to the Ethernet protocol type, so as to filter the packets.

Table 7‑12 Configure the Ethernet protocol ACL

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the Ethernet protocol ACL | protocol access-list standard { access-list-number } | Mandatory By default, do not configure the Ethernet protocol ACL. The number range of the Ethernet protocol ACL is 4001-5000.
Configure the ACL permit rule | [ sequence ] permit type-code [ type-wildcard ] | Optional By default, do not configure the ACL permit rule.
Configure the ACL refuse rule | [ sequence ] deny type-code [ type-wildcard ] | Optional By default, do not configure ACL refuse rule.
Configure the ACL remarks | [ sequence ] remark comment | Optional By default, do not configure the ACL rule remarks.

l When using the protocol access-list standard command to create the Ethernet protocol ACL, the ACL can be created only after configuring the rules in the Ethernet protocol ACL configuration mode.

l Sequence means the order number of the rule in the ACL. ACL matches and filters the packet strictly according to the order from small sequence to large sequence. The rule with the small sequence first takes effect. When all rules do not match, execute the default drop action, that is, all the packets not permitted to pass are dropped.

l Ethernet protocol ACL can only be applied by the bridge module and cannot be applied to the L3 interface via the access-group command. For the bridge configuration, refer to “Bridge Configuration Manual”.

Configure Ethernet Protocol ACL Named by Numbers

The Ethernet protocol ACL rule named by numbers can let the user fast identify the type of the rule ACL.

Table 7‑13 Configure Ethernet protocol ACL named by numbers

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure Ethernet protocol ACL named by numbers | access-list access-list-number { permit | deny } type-code [ type-wildcard ] | Mandatory By default, do not configure the Ethernet protocol ACL named by numbers. The number range of the Ethernet protocol ACL is 4001-5000.
Configure the remarks of the Ethernet protocol ACL named by numbers | access-list access-list-number remark comment | Optional By default, do not configure the remarks of the Ethernet protocol ACL named by numbers.

l If the ACL with the specified sequence does not exist, create one new ACL and add new rules. If the ACL with the specified number exists, just add new rules.

l Ethernet protocol ACL can only be applied by the bridge module and cannot be applied to the L3 interface via the access-group command. For the bridge configuration, refer to “Bridge Configuration Manual”.


7.2.7 Configure ACL Rule Quantity Limitation

Configuration Condition

Before configuring the time domain function, first complete the following task:

l Configure ACL

Configure ACL Rule Quantity Limitation

After enabling the ACL rule quantity limitation, the maximum number of the rules that can be configured in one ACL is 1024.

Table 7‑14 Configure the ACL rule quantity limitation

Step | Command | Description
Enter global configuration mode | configure terminal | -
Disable/enable the ACL rule quantity limitation | access-list rule-limit { enable | disable } | Mandatory By default, it is enabled, that is, the maximum number of the rules that can be configured in one ACL is 1024.


7.2.8 Configure Reflexive ACL

To ensure the network security, we can configure the reflexive ACL function to filter the IP packets based on the session. Only the response packets of the request packets initiated by the internal network can enter the internal network, while the request packets initiated by the external network cannot enter the internal network.

Configuration Condition

None

Define Reflexive ACL

Add the reflect option in the IP extended ACL rule to define the reflexive ACL.

Table 7‑15 Define the reflexive ACL

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IP extended ACL configuration mode | ip access-list extended { access-list-number | access-list-name } | Mandatory Enter the IP extended ACL configuration mode
Configure the ACL rule to define the reflexive ACL | [ sequence ] permit protocol { any | source-addr source-wildcard | host source-addr } [ operator source-port ] { any | destination-addr destination-wildcard | host destination-addr } [ operator destination-port ] [ icmp-type ] [ icmp-code ] [ igmp-type ] [ ack / fin / established / psh / rst / syn / urg ] [ precedence precedence ] [ tos tos ] [ dscp dscp ] [ fragments ] [ ttl ttl-value ] [ log ] [ time-range time-range-name ] [reflect reflect-list-name [ timeout reflect-timeout-value ] ] | Mandatory By default, do not define any reflexive ACL. The rule should carry the reflect option.

Configure Referencing Reflexive ACL

In the IP extended ACL rule, reference the reflexive ACL via the evaluate command.

Table 7‑16 Configure referencing the reflexive ACL

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IP extended ACL configuration mode | ip access-list extended { access-list-number | access-list-name } | Mandatory Enter the IP extended ACL configuration mode
Configure referencing the reflexive ACL | [ sequence ] evaluate reflect-list-name | Mandatory By default, do not reference the reflexive ACL.

Configure Global Age Time of Reflexive Rule

The generated reflexive ACL rule can be aged within the set time by configuring the global age time of the reflexive rule.

Table 7‑17 Configure the global age time of the reflexive rule

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the global age time of the reflexive rule | ip reflexive-list timeout live-time | Mandatory By default, the global age time of the reflexive rule is 300s. The value range of the age time of the reflexive rule is 5-2147483647 and the unit is second.

l If the global age time of the reflexive rule and the age time of the single reflexive rule are configured at the same time, the age time of the single reflexive rule has higher priority.


7.2.9 Configure ACL Logs

In the configuration of the IP ACL, add the log option in the rule to record the log for the matching packets.

Configuration Condition

None

Configure ACL Logs

The contents of the log record includes the IP ACL name, the packet passed or dropped, IP protocol type, source/destination IP address, source/destination port number, and the number of the packets in the log recording period.

Table 7‑18 Configure the ACL logs

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the IP ACL configuration mode | ip access-list { extended | standard } { access-list-number | access-list-name } | Mandatory Enter the IP ACL configuration mode
Configure the ACL logs | [ sequence ] { permit | deny } protocol { any | source-addr source-wildcard | host source-addr } [ operator source-port ] { any | destination-addr destination-wildcard | host destination-addr } [ operator destination-port ] [ icmp-type ] [ icmp-code ] [ igmp-type ] [ ack / established / fin / psh / rst / syn / urg] [ precedence precedence ] [ tos tos ] [ dscp dscp ] [ fragments ] [ ttl ttl-value ] [ log ] [ time-range time-range-name ] [reflect reflect-list-name [ timeout timeout-value ] ] | Mandatory By default, do not configure the ACL logs. The former command is the configuration of the IP extended ACL rule; the latter is the configuration of the IP standard ACL rule. The rule should carry the log option.
 | [ sequence ] { permit | deny } { any | source-addr source-wildcard | host source-addr } [ time-range time-range-name ] [log ]

Configure ACL Log Level

The ACL log level decides to which terminal the ACL log is output and is affected by the whole system log setting.

Table 7‑19 Configure the ACL log level

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the ACL log level | access-list logging-level { logging-level-value | console-only | file-only | trap-only } | Mandatory By default, the ACL log level is 6. The value range of the ACL log level: 1-7: The basic log level; for the log level, refer to “System Log Configuration Manual”. console-only: Specify the ACL log to be output to the console port and the log level is set to 10. file-only: Specify the ACL log to be output to the flash file, and the log level is set to 9. trap-only: Specify the ACL log to be output to the log server, and the log level is set to 11.

Configure the Printing Interval of the ACL Log

The command is used to set the interval of printing the switch ACL log.

Table 7‑20 Configure the interval of printing the ACL log

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the interval of printing the ACL log | acl log interval minutes | minutes : the minutes of the printing interval (1-1040); the default value is 10 minutes.

The interval of printing the current route ACL log is the fixed 60s.


7.2.10 Configure ACL Compiling

Usually, the ACL packet matches the rules one by one until finding one matching rule. With the increasing complexity of the network application environment, the configured rules in the ACL are becoming more. ACL adopts the mode of matching by order and lots of rules increase the delay of the packet forwarding. As a result, the forwarding performance of the device is reduced. ACL compiling solves the problem, speeding up the matching speed of the ACL packet and improving the ACL performance.

Configuration Condition

Before configuring the ACL compiling function, first complete the following task:

l Configure ACL.

Configure ACL Compiling

After configuring the ACL compiling, the matching time of the packet is fixed. No matter which rule in the ACL the packet matches with, the processing cost keeps constant. Therefore, when there are lots of ACL rules, compiling ACL can ensure the correct transmission time and small delay and jitter, maintaining the network stability.

Table 7‑21 Configure the ACL compiling

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the ACL compiling | access-list compile [ access-list-number | access-list-name ] [part] | Mandatory By default, do not enable the ACL complete or part compiling for any IP ACL. The number range of IP ACL is 1-2000.

l The ACL compiling function only takes effect for the IP ACL. The part compiling is just applicable to the IP extended ACL. When there are many complicated ACE items, it is suggested to use the part compiling, and the compiling time is less than the complete compiling.

l The ACL complete compiling function compiles all ACEs in the ACL, and generates one compiling result. The ACL part compiling function compiles every 500 ACEs in the ACL and generates one compiling result. If there are no 500 ACEs, also compile once and generate one compiling result, and you can compile for eight times at most (There can be 4000 ACEs in one IP extended ACL at most).

l Compiling ACL needs several seconds to several minutes according to the ACL complexity and rule quantity. Compiling ACL needs large memory space. For the device whose memory is smaller than 128M, it is suggested not to use to the ACL compiling function.

l Considering the features of compiling ACL and system memory, it is suggested to enable the ACL compiling only for the ACL with more than 25 rules; for the ACL with less than 25 rules, do not need to enable the ACL compiling.

l We can use the ACL compiling function only for IP ACL. Usually, it is suggested to enable the ACL compiling for the specified IP ACL. It is not suggested to use the compiling command for all IP ACLs.

l If the IP ACL rules contain the following cases, the compiling cannot succeed:

l The wildcard mask of the source/destination IP address in the rule and the wildcard mask of the source/destination port are the irregular mask (that is, 1 in the mask are not successive).

l The rules contain the reference for the reflexive list.

l If the rule does not contain any one element of seven elements (source-addr, destination-addr, source-port, destination-port, protocol, fragments, tcp-flag), it cannot be compiled.

l The rule is bound with the time domain and the time domain status is Inactive.

l If the rule contains the remark rule, it also cannot be compiled.

Configure Forbidding ACL Compiling

If the global ACL compiling is enabled and when configuring new IP ACL, perform the compiling automatically. We can configure forbidding the ACL compiling for one ACL, avoiding the compiling for the IP ACL.

Table 7‑22 Configure forbidding ACL compiling

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure forbidding ACL compiling | access-list forbid-compile { access-list-number | access-list-name } | Mandatory By default, do not forbid the ACL compiling for any IP ACL. The number range of IP ACL is 1-2000.

l Forbidding the ACL compiling function takes effect only for IP ACL.

Configure Percentage of System Memory Occupied by ACL Compiling

By default, the memory space occupied by compiling ACL cannot exceed 15% of the system memory. The percentage can be adjusted by the command. The memory percentage is one limitation, but not guarantee, that is, the memory occupied by compiling ACL cannot exceed 15% of the system memory, but if the memory occupied by the other modules and the reserved memory of the system already occupy more than 85% of the system memory, compiling ACL cannot get 15%.

Table 7‑23 Configure the percentage of the system memory occupied by the ACL compiling

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the percentage of the system memory occupied by the ACL compiling | access-list compile-memory limit-percent limit-percent-value | Mandatory By default, the ACL compiling is permitted to occupy 15% of the system memory. The value range of the memory percentage occupied by the ACL compiling is 1-100.


7.2.11 Configure Time Domain

The time domain is the set of the time segments. One time domain can contain zero to multiple time segments. The time range of the time domain is the union of the time segments. The time domain can be bound with ACL or ACL rule, as the condition of whether ACL or ACL rule takes effect.

Configuration Condition

Before configuring the time domain function, first complete the following task:

l Configure ACL

Configure Time Domain

Configure whether the application object of the time domain is limited by the time domain. When it is enabled, the application object is limited by the time domain. On the contrary, it is not limited by the time domain.

Table 7‑24 Configure the time domain

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure disabling/enabling the time domain | set time-range { disable | enable } | Mandatory By default, it is enabled.

Configure Periodical Time Segment

Periodical time segment: Periodical time segment means to select one day or several days from Monday to Sunday, and the start time point to the end time point as the time segment, taking effect every week repeatedly.

Table 7‑25 Configure the periodical time segment

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the time domain | time-range time-range-name | Mandatory By default, do not configure the time domain.
Configure the periodical time segment | [ sequence ] periodic [ { day-of-the-week / hh:mm [ :ss ] } [ to { day-of-the-week / hh:mm [ :ss ] } ] ] | Either By default, do not configure periodical time segment. The former command can specify the time range as one day (such as Monday) or several days (such as Monday,Friday). The latter command can specify the time range as every day, weekend, or workday.
 | [ sequence ] periodic [ [ weekdays | weekend | daily ] [ hh:mm [ :ss ] ] to [ hh:mm [ :ss ] ] ]

l If only inputting periodic, it indicates 00:00 to 23:59 from Monday to Friday.

Configure Absolute Time Segment

The absolute time segment means to take effect within the specified date and time range.

Table 7‑26 Configure the absolute time segment

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the time domain | time-range time-range-name | Mandatory By default, do not configure the time domain.
Configure the absolute time segment of the time domain | [ sequence ] absolute start hh: mm [ : ss ] [ day [ month [ year ] ] ] end hh: mm [ : ss ] [ day [ month [ year ] ] ] | Mandatory By default, do not configure the absolute time segment of the time domain.

Configure Refresh Period

The status of time domain includes effective and ineffective. The status refresh period of the time domain is 1 minute by default. Automatically refresh according to the current system time. Therefore, when refreshing the status, there may be 0-60s delay compared with the system time.

Table 7‑27 Configure the refresh period

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the refresh period of the time domain | set time-range frequency frequency-number | Mandatory The default value is 1. The refresh period is the interval between two refreshes and the unit is minute.

Configure Maximum Time Offset

The maximum offset means the maximum offset between accumulation time of the counter and the system time. Once the time statistics exceeds the offset, re-judge the status of the time domain and update during the next refreshing so that the time statistics is more correct.

Table 7‑28 Configure the maximum time offset

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the maximum time offset of the time domain | set time-range max-offset max-offset-number | Mandatory The default value is 100. The unit of the time offset is second and the value range is 1-300.

Configure Time Domain and ACL Rule Binding

When it is necessary to control one user to access the network resources within the specified time segment, we can set the ACL rule based on the time domain to filter the packets. Whether the time domain takes effect directly affects the associated ACL rule.

Table 7‑29 Configure the time domain to be bound with the ACL rule

Step | Command | Description
Configure the binding with IP standard ACL rule | Refer to “Configure IP Standard ACL” | -
Configure the binding with IP extended ACL rule | Refer to “Configure IP Extended ACL” | -
Configure the binding with MAC standard ACL rule | Refer to “Configure MAC Standard ACL” | -
Configure the binding with MAC extended ACL rule | Refer to “Configure MAC Extended ACL” | -

l When the time domain bound with the ACL rule does not exist, the ACL rule is in the effective state.

Configure Time Domain and ACL Binding

When it is necessary to control one user to access the network resources within the specified time segment, we can set the ACL rule based on the time domain to filter the packets. Whether the time domain takes effect directly affects the rules contained in the whole ACL.

Table 7‑30 Configure the time domain and ACL binding

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the time domain to be bound with IP ACL | ip time-range time-range-name access-list { access-list-number | access-list-name } | Mandatory By default, do not configure the time domain to be bound with IP ACL.
Configure the time domain to be bound with MAC ACL | mac time-range time-range-name access-list { access-list-number | access-list-name } | Mandatory By default, do not configure the time domain to be bound with MAC ACL.

l When the time domain bound with the ACL rule does not exist, the ACL rule is in the effective state.


7.2.12 Configure ACL Application

IP ACL can be applied to the ingress and egress directions of the L3 interface; MAC ACL can be applied to the the ingress and egress directions of the L3 interface; Ethernet protocol ACL can only be applied by the bridge module. For details, refer to “Bridge Configuration Manual”.

If ACL is applied to the ingress direction of the L3 interface, filter the packets (containing multicast and broadcast packets) at the ingress direction of the L3 interfacewhose destination is the local device and the L3 forwarded packets, no influence for the L2 forwarded packets. If ACL is applied to the egress direction of the L3 interface, filter the packets at the egress direction of the L3 interface starting from the local device and the L3 forwarded packets, no influence for the L2 forwarded packets. If the applied ACL does not exist, all packets are permitted.

Configuration Condition

Before configuring the ACL application function, first complete the following task:

l Configure ACL

Configure IP ACL to Be Applied to Interface

If IP ACL is applied to the ingress direction of the L3 interface, filter the packets (containing multicast and broadcast packets) at the ingress direction of the L3 interface whose destination is the local device and the L3 forwarded packets, no influence for the L2 forwarded packets. If IP ACL is applied to the egress direction of the L3 interface, filter the packets at the egress direction of the L3 interface starting from the local device and the L3 forwarded packets, no influence for the L2 forwarded packets.

Table 7‑31 Configure IP ACL to be applied to the interface

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure IP ACL to be applied to the L3 interface | ip access-group { access-list-number | access-list-name } { in | out | self } | Mandatory By default, IP ACL is not applied to the L3 interface.

Configure MAC ACL to Be Applied to Interface

If MAC ACL is applied to the ingress direction of the L3 interface, filter the packets (containing multicast and broadcast packets) at the ingress direction of the L3 interface whose destination is the local device and the L3 forwarded packets, no influence for the L2 forwarded packets. If MAC ACL is applied to the egress direction of the L3 interface, filter the packets at the egress direction of the L3 interface starting from the local device and the L3 forwarded packets, no influence for the L2 forwarded packets.

Table 7‑32 Configure MAC ACL to be applied to the interface

Step | Command | Description
Enter global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure MAC ACL to be applied to the L3 interface | mac access-group { access-list-number | access-list-name } { in | out } | Mandatory By default, MAC ACL is not applied to the L3 interface.

Configure Ethernet Protocol ACL to Be Applied to Bridge Group

If the Ethernet protocol ACL is applied to the ingress direction of the L3 Ethernet interface of the bridge group, it will analyze and process all packets at the ingress direction of the interface. If the Ethernet protocol ACL is applied to the egress direction of the L3 interface of the bridge group, it will analyze and process the forwarded packets at the egress direction of the interface.

Table 7‑33 Configure the Ethernet protocol ACL to be applied to the bridge group

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Add the L3 interface to the bridge group | bridge-group group-number | Mandatory By default, L3 interface is not added to any bridge group.
Configure applying Ethernet protocol ACL to the L3 interface added to the bridge group | bridge-group group-number { input-type-list | output-type-list } access-list-number | Mandatory By default, the bridge interface is not configured with any Ethernet protocol ACL.


7.2.13 ACL Monitoring and Maintaining

Table 7‑34 ACL Monitoring and Maintaining

Command | Description
show access-list compile-memory | Display the information about the memory occupied by the ACL compiling
show access-list [ access-list-number | access-list-name ] | Display the ACL configuration information
show access-list-reflexive | Display the current reflexive ACL rules
show access-lists { interface [ [ interface-type ] / [in | out | self ] ] } | Display the ACL application information and the details of the ACL rules
show acl-log-count | Display the current generated ACL log quantity
show ip access-list [ access-list-number | access-list-name ] | Display the configuration information of IP ACL
show ip interface list | Display the information of the IP ACL applied to the interface
show mac access-list [ access-list-number | access-list-name ] | Configure the MAC ACL configuration information
show mac interface list | Display the information of the MAC ACL applied to the interface
show protocol access-list | Display the configuration information of Ethernet protocol ACL
show time-range [ time-range-name ] | Display the configuration and status information of the time domain


7.3 ACL Typical Configuration Example


7.3.1 Configure IP Standard ACL

Network Requirements

l The IP address of PC1 is 131.44.1.1/16; the IP address of PC2 is 131.44.2.1/16; the IP address of PC3 is 131.44.2.2/16;

l Configure the ACL rule on Device, permitting PC1 to access IP Network;

l Configure the ACL rule on Device, preventing the PCs of the segment 131.44.2.0/24 from accessing IP Network.

Network Topology

Figure 7–1 Networking of configuring IP standard ACL

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Configure ACL 1.

#Configure ACL 1 on Device.

Device#configure terminal

Device(config)#ip access-list standard 1

#Configure the rule, permitting PC1 to access IP Network.

Device(config-std-nacl)#permit host 131.44.1.1

#Configure the rule, preventing the network segment 131.44.2.0/24 from accessing IP Network.

Device(config-std-nacl)#deny 131.44.2.0 0.0.0.255

Device(config-std-nacl)#exit

#View the information of the ACL 1 on Device.

Device#show ip access-list 1

ip access-list standard 1

10 permit host 131.44.1.1

20 deny 131.44.2.0 0.0.0.255

Step 3:

Apply the configured ACL1 to the ingress direction of the interface vlan10.

#Configure Device.

Device(config)#interface vlan 10

Device(config-if-vlan10)ip access-group 1 in

Device(config-if-vlan10)exit

#View the information of the ACL applied to the interface on Device.

Device#show access-lists interface vlan 10

-----------Interface-----Bind-----Instance--------------

Interface----------------Direction----AclType----AclName

vlan 10 IN IP 1

detail:

ip access-list standard 1

10 permit host 131.44.1.1

20 deny 131.44.2.0 0.0.0.255

Step 4:

Check the result.

#PC1 can access IP Network; PC and PC3 cannot access IP Network.


7.3.2 Configure IP Extended ACL with Time Domain

Network Requirements

l The IP address of PC1 is 131.44.1.1/16; the IP address of PC2 is 131.44.1.2/16; the IP address of PC3 is 131.44.2.1/16;

l Configure the ACL rule on Device, permitting PC2 to access IP Network via FTP;

l Configure the ACL rule on Device, permitting PC1 to access IP Network in the specified time range;

l Configure the ACL rule on Device, preventing the PC of the segment 131.44.2.0/24 from accessing IP Network.

Network Topology

Figure 7-2 Networking of configuring IP extended ACL with time domain

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Configure the time domain time-range-work and the range of the time domain is 8:00 to 18:00 every day.

#Configure Device.

Device#configure terminal

Device(config)#time-range time-range-work

Device(config-time-range)#periodic daily 08:00 to 18:00

Device(config-time-range)#exit

#View the current system time on Device.

Device#show clock

UTC WED NOV 07 11:15:45 2012

#View the information of the defined time domain “time-range-work” on Device.

Device#show time-range time-range-work

Timerange name:time-range-work (STATE:active)

10 periodic daily 08:00 to 18:00 (active)

Step 3:

Configure the ACL 1001.

#Configure the ACL 1001 on Device.

Device(config)#ip access-list extended 1001

#Configure the rule, preventing the network segment 131.44.2.0/24 from accessing IP Network.

Device(config-ext-nacl)#deny ip 131.44.2.0 0.0.0.255 any

#Configure the rule, permitting PC2 to access IP Network via the FTP.

Device(config-ext-nacl)#permit tcp host 131.44.1.2 any eq ftp

Device(config-ext-nacl)#permit tcp host 131.44.1.2 any eq ftp-data

#Configure the rule, permitting PC1 to access IP Network in the defined time domain “time-range-work” range.

Device(config-ext-nacl)#permit ip host 131.44.1.1 any time-range time-range-work

Device(config-ext-nacl)#exit

#View the information of the ACL 1001 on Device.

Device#show ip access-list 1001

ip access-list extended 1001

10 deny ip 131.44.2.0 0.0.0.255 any 0 matches

20 permit tcp host 131.44.1.2 any eq ftp 0 matches

30 permit tcp host 131.44.1.2 any eq ftp-data 0 matches

40 permit ip host 131.44.1.1 any time-range time-range-work (active) 0 matches

Step 4:

Apply the configured ACL 1001 to the egress direction of the interface VLAN20.

#Configure Device.

Device(config)#interface vlan 20

Device(config-if-vlan20)#ip access-group 1001 out

#View the information of the ACL applied to the interface on Device.

Device#show access-lists interface gigabitethernet 1

-----------Interface-----Bind-----Instance--------------

Interface----------------Direction----AclType----AclName

vlan20 OUT IP 1001

detail:

ip access-list extended 1001

10 deny ip 131.44.2.0 0.0.0.255 any

20 permit tcp host 131.44.1.2 any eq ftp

30 permit tcp host 131.44.1.2 any eq ftp-data

40 permit ip host 131.44.1.1 any time-range time-range-work (active)

Step 6:

Check the result.

#PC1 can access IP Network from 08:00 to 18:00 of every day; PC2 can access IP Network via FTP; PC3 cannot access IP Network.


7.3.3 Configure IPv6 ACL

Network Requirements

l The IPv6 address of PC1 is 1000:100::1/32; the IPv6 address of PC2 is 1000:100::2/32; the IPv6 address of PC3 is 1000:100:1::3/32;

l Configure the ACL rule on Device, permitting PC1 to access Internet in the specified time range;

l Configure the ACL rule on Device, permitting PC2 to access Internet via TFTP;

l Configure the ACL rule on Device, preventing the PC of the segment 1000:100:1::/48 from accessing Internet.

Network Topology

Figure 7-3 Networking of configuring IPv6 ACL

Configuration Steps

Step 1: | Configure the IPv6 address of the interface. (omitted)
Step 2: | Configure the time domain time-range-work and the range of the time domain is 8:00 to 18:00 every day.

#Configure Device.

Device#configure terminal

Device(config)#time-range time-range-work

Device(config-time-range)#periodic daily 8:00 to 18:00

Device(config-time-range)#exit

#On Device, view the information of the defined time domain time-range-work.

Device#show time-range time-range-work

 Timerange name:time-range-work  (STATE:active)

  10  periodic daily 08:00 to 18:00 (active)

Step 3:

Configure the IPv6 ACL 7001.

#On Device, configure IPv6 ACL 7001.

Device(config)#ipv6 access-list extended 7001

#Configure the rule, permitting PC1 to access Internet in the defined time domain time-range-work.

Device(config-v6-list)#permit ipv6 host 1000:100::1 any time-range time-range-work

#Configure the rule, permitting PC2 to access Internet via TFTP.

Device(config-v6-list)#permit udp host 1000:100::2 any eq tftp

#Configure the rule, preventing the segment 1000:100:1::/48 from accessing Internet.

Device(config-v6-list)#deny ipv6 1000:100:1::/48 any

Device(config-v6-list)#exit

#On Device, view the information of IPv6 ACL rule 7001.

Device#show ipv6 access-list 7001

ipv6 access-list extended 7001

 10 permit ipv6 host 1000:100::1 any time-range time-range-work (active)     0 matches

 20 permit udp host 1000:100::2 any eq tftp     0 matches

 30 deny ipv6 1000:100:1::/48 any     0 matches

Step 4:

Configure IPv6 ACL 7001 to be applied to the ingress direction of the interface.

#Configure Device.

Device(config)#interface vlan 30

Device(config-if-vlan30)#ipv6 access-group 7001  in

Device(config-if-vlan30)#exit

#On Device, view the information of IPv6 ACL applied to the interface.

Device#show access-group bind interface

 Filter resource bind interface information

 ifName                           fwDirect bindType listName

 *******************************************************************************

 vlan30              IN       IPV6     7001

*******************************************************************************

Step 5:

Check the result.

#PC1 can access Internet from 08:00 to 18:00 of every day; PC2 can access Internet via TFTP; PC3 cannot access IP Network.


7.3.4 Configure MAC Extended ACL

Network Requirements

l PC1, PC2, and IP Phone are connected to IP Network via Device.

l Configure the MAC extended ACL rule on Device2, realizing that the user of VLAN2 cannot access IP Network, and except for the voice users, the other users of VLAN3 all can access IP Network.

Network Topology

Figure 7-4 Networking of configuring the MAC extended ACL

Configuration Steps

Step 1:

Configure the link type of VLAN and port on Device2.

#Create VLAN2-3.

Device2#configure terminal

Device2(config)#vlan 2-3

#Configure the link type of port gigabitethernet0/1 as Hybrid, permitting the services of VLAN2-3 to pass.

Device2(config)#interface gigabitethernet0/1

Device2(config-if-gigabitethernet0/1)#switchport mode hybrid

Device2(config-if-gigabitethernet0/1)#switchport hybrid tagged vlan 2-3

Device2(config-if-gigabitethernet0/1)#exit

Step 2: | Configure the corresponding VLAN interface and IP address on Device1 and Device2. (Omitted)
Step 3: | Configure Voice-VLAN to set the COS value of the packet from IP Phone as 7 on Device1. (Omitted)
Step 4: | Configure the MAC extended ACL.

#Configure the MAC extended ACL with serial number 3001 on Device2.

Device2(config)#mac access-list extended 3001

#Configure the rule, preventing the users in VLAN2 from accessing IP Network.

Devic2(config-ext-mac-nacl)#deny any any vlan-id 2

#Configure the rule, preventing the voice users in VLAN3 from accessing IP Network.

Device2(config-ext-mac-nacl)#deny any any cos 7 vlan-id 3

#Configure the rule, permitting the other users in VLAN3 to access IP Network.

Device2(config-ext-mac-nacl)#permit any any vlan-id 3

#View the information of the ACL with serial number 3001 on Device2.

Device2#show access-list 3001

mac access-list extended 3001

10 deny any any vlan-id 2

20 deny any any cos 7 vlan-id 3

30 permit any any vlan-id 3

Step 5:

Configure applying the MAC extended ACL.

#Apply the MAC extended ACL with serial number 3001 to the ingress of the port vlan10 on Device2.

Device2(config)#interface vlan 10

Device2(config-if-vlan10)#mac access-group 3001 in

Device2(config-if-vlan10)#exit

#View the information of the ACL applied to the port on Device2.

Device2#show acl-object interface

-----------Interface-----Bind-----Instance--------------

Interface----------------Direction----AclType----AclName

Vlan10 IN MAC 3001

Step 6:

Check the result.

#PC2 can access IP Network; PC1 and IP Phone cannot access IP Network.

l For the configuration of Voice-VLAN, refer to the Voice-VLAN chapter of the configuration manual.


7.3.5 Configure Hybrid Extended ACL

Network Requirements

l PC1, PC2, and PC3 are connected to IP Network via Device.

l Configure the Hybrid extended ACL rule, realizing that PC1 can access IP Network within the specified time, PC2 and PC3 cannot access IP Network.

Network Topology

Figure 7-5 Networking of configuring Hybrid extended ACL

Configuration Steps

Step 1:

Configure the link type of VLAN and port on Device.

#Create VLAN2.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

#Configure the link type of port gigabitethernet0/1 as Access, permitting the services of VLAN2 to pass.

Device(config)#interface gigabitethernet 0/1

Device(config-if-gigabitethernet0/1)#switchport mode access

Device(config-if-gigabitethernet0/1)#switchport access vlan 2

Device(config-if-gigabitethernet0/1)#exit

Step 2: | Configure the corresponding VLAN interface and IP address on Device. (Omitted)
Step 3: | Configure the time domain.

#Configure the time domain “time-range-work” on Device and the range is 08:00 to 18:00 every day.

Device(config)#time-range time-range-work

Device(config-time-range)#periodic daily 08:00 to 18:00

Device(config-time-range)#exit

#View the current system time on Device.

Device#show clock

UTC FRI APR 05 15:26:31 2013

#View the information of the defined time domain “time-range-work” on Device.

Device#show time-range time-range-work

Timerange name:time-range-work (STATE:active)

10 periodic daily 08:00 to 18:00 (active)

Step 4:

Configure the Hybrid extended ACL list.

#Configure the Hybrid extended ACL with serial number 5001 on Device.

Device(config)#hybrid access-list extended 5001

#Configure the rule, preventing the network segment 131.44.2.0/24 from accessing IP Network.

Device(config-hybrid-nacl)#deny ip 131.44.2.0 0.0.0.255 any

#Configure the rule, permitting PC1 to access IP Network in the defined time domain “time-range-work” range.

Device(config-hybrid-nacl)#permit ip any host 0001.0001.0001 time-range time-range-work

#Configure the rule, permitting all packets from IP Network to pass Device.

Device(config-hybrid-nacl)#permit ip any any

Device(config-hybrid-nacl)#exit

#View the information of the ACL with serial number 5001 on Device.

Device#show hybrid access-list 5001

hybrid access-list extended 5001

10 deny ip 131.44.2.0 0.0.0.255 any

20 permit ip any host 0001.0001.0001 time-range time-range-work (active)

30 permit ip any any

Step 5:

Configure applying Hybrid extended ACL.

#Apply the Hybrid extended ACL with serial number 5001 to the ingress globally.

Device(config)#global hybrid access-group 5001 in

#View the information of the ACL applied globally on Device.

Device#show acl-object global

----------------Global-----Bind-----Instance-----------

Global-------------------Direction----AclType----AclName

global IN HYBRID 5001

Step 6:

Check the result.

#PC1 can access IP Network from 08:00 to 18:00 every day; PC2 and PC3 cannot access IP Network.


8 URPF


8.1 Overview

On the current Internet, many network attacks make use of the false source IP address attack packet. On one hand, it can avoid own IP address from being tracked; on the other hand, the source IP address of the packet, like Land and Smurf attack, is the IP address of the attack object. To limit the damage caused by the false source address attack and track the attack source, put forward to filter the false source IP address traffic on ISP or edge network access device in rfc2827 and rfc3704, suppressing the attack at the source of generating the attack packet.

The main function of URPF (Unicast Reverse Path Forwarding) is to prevent the network attack action based on the false source address spoofing. During the packet forwarding, perform the reverse route table searching for the source address of the packet and judge whether to permit the packet to pass according to the searching result of the route table, so as to prevent the IP address spoofing, especially valid for the DoS (Denial of Service) attack of the false source address. The URPF check has two modes, that is, strict (rx) and loose (any).

The network attack already causes the serious threat for the network security. URPF filters the network attack packet of the false source IP address on the ISP or edge access device, so as to suppress the damage caused by the network attack packet. It is one valid method of preventing the network attack.


8.2 URPF Function Configuration

Table 8‑1 UPPF function configuration list

Configuration Task

Configure the URPF function

Configure the URPF check


8.2.1 Configure URPF Function

Configuration Condition

None

Configure URPF Check

Configuring the URPF check it to filter the attack packet based on the false source IP address at the receiving interface. URPF supports the strict (rx) and loose (any) modes. In the loose mode, URPF performs the route table searching for the source IP address of the received packet. If finding the route, permit the packet to pass, while in the strict mode, we not only need to find the route, but also the egress interface and the packet receiving interface need to be the same so that the packet can be permitted to pass.

In the two modes, we can flexibly configure two options according to different application environments:

l Permit matching the default route (allow-default)

l Bind the ACL

URPF processing flow is as follows:

Step 1: Check the validity of the source IP address.

l If the source IP address of the packet is the multicast address, broadcast address or loopback address, drop the packet;

l For the packet with the all-zero source IP address, if the destination IP is the broadcast packet, permit the packet to pass. Otherwise, drop the packet. (the packet with source IP 0.0.0.0 and the destination IP 255.255.255.255 may be the DHCP packet.)

l Enter Step 2 to process.

Step 2: Search for the route table according to the source IP address.

l If not finding the corresponding route of the source IP address in the route table, enter step 3 to process.

l If the found route is the default route and the allow-default option is not configured, enter step 3 to process.

l If the found route egress interface is different from the receiving interface of the packet and the URPF check mode is not the loose mode, process according to step 3.

l Permit the packet to pass and the processing flow ends.

Step 3: Match the ACL.

l If not binding the ACL, drop the packet.

l If the ACL is bound, but the matching result of the ACL does not pass, drop the packet.

l Permit the packet to pass and the processing flow ends.

Table 8‑2 Configure the URPF check

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the URPF check function | ip verify unicast source reachable-via { any | rx } [ allow-default ] [access-list-number ] [ log ] | Mandatory By default, do not enable the URPF check.


8.2.2 URPF Monitoring and Maintaining

Table 8‑3 URPF Monitoring and Maintaining

Command | Description
show ip urpf brief | Display the URPF configuration information
show ip urpf interface interface-name | Display the URPF configuration information in the specific interface and the statistics information of the processed packet


8.3 URPF Typical Configuration Example


8.3.1 Configure URPF Strict Mode

Network Requirements

l PC is connected to IP Network via Device;

l Configure the URPF strict mode on the interface gigabitethernet0 of Device.

l PC simulates the attacker to send the invalid packet with the false source address to access IP Network. The URPF function of Device drops the packet.

Network Topology

Figure 8–1 Networking of configuring the URPF strict mode

Configuration Steps

Step 1: | Configure the IP address and route of the interface; it is required that PC can access IP Network via Device. (Omitted)
Step 2: | Configure the URPF strict mode on the interface vlan2 of Device.

#Configure Device.

Device#configure terminal

Device(config)#interface vlan 2

Device(config-if-vlan2)#ip verify unicast source reachable-via rx

Device(config-if-vlan2)#exit

Device(config)#exit

Step 3:

Check the result.

#PC accesses IP Network via Device and the source address is 120.5.0.2.

There is the route to 120.5.0.2 to Device and the egress interface of the route is vlan2. The route egress interface to the source address and the interface for receiving the packet are the same interface vlan2. After passing the URPF strict check, the packet is forwarded by Device and PC1 can access Internet.

#PC1 simulates the attacker to send the invalid packet with the false source address; access IP Network via Device; the source address is 120.10.0.2.

There is no route to 120.10.0.2 on Device; URPF drops the packet and PC1 cannot access Internet.

URPF lost packet statistics is as follows:

Device#show ip urpf interface vlan 2

interface vlan14ifIndex : mode: rx

options: --- aclist: ---

2011 verify unicast RPF drops

0 access-list forced permits


8.3.2 Configure URPF Loose Mode

Network Requirements

l PC1 accesses PC2 via Device1, Device2, and Device3 in the network environment; the response packet of PC2 reaches PC1 via Device3 and Device1.

l Configure the URPF loose mode on the interface vlan2 of Device3.

l PC1 simulates the attacker to send the invalid packet with the false source address to access PC2. The URPF function of Device3 drops the packet.

Network Topology

Figure 8-2 Networking of configuring the URPF loose mode

Configuration Steps

Step 1: | Configure VLAN, and add the port to the corresponding VLAN.(Omitted)
Step 2: | Configure the static route in the network, making PC1 access PC2 via Device1, Device2, and Device3; the response packet of PC2 reaches PC1 via Device3 and Device1.

#Configure the static route of Device1, Device2, and Device3; construct the network environment in the network requirements.

Device1#configure terminal

Device1(config)#ip route 120.1.0.0 255.255.255.0 120.3.0.2

Device1(config)#ip route 120.2.0.0 255.255.255.0 120.3.0.2

Device1(config)#exit

Device2#configure terminal

Device2(config)#ip route 120.1.0.0 255.255.255.0 120.2.0.2

Device2(config)#exit

Device3#configure terminal

Device3(config)#ip route 120.5.0.0 255.255.255.0 120.4.0.1

Device3(config)#exit

#View the route tables of Device1, Device2, and Device3.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

S 120.1.0.0/24 [1/10] via 120.3.0.2, 00:10:49, vlan3

S 120.2.0.0/24 [1/10] via 120.3.0.2, 00:11:19, vlan3

C 120.3.0.0/24 is directly connected, 00:19:15, vlan3

C 120.4.0.0/24 is directly connected, 00:15:00, vlan4

C 120.5.0.0/24 is directly connected, 00:07:36, vlan2

C 127.0.0.0/8 is directly connected, 357:23:02, lo0

Device2#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

S 120.1.0.0/24 [1/10] via 120.2.0.2, 00:15:37, vlan3

C 120.2.0.0/24 is directly connected, 00:17:17, vlan3

C 120.3.0.0/24 is directly connected, 00:25:21, vlan2

C 127.0.0.0/8 is directly connected, 00:38:29, lo0

Device3#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 120.1.0.0/24 is directly connected, 00:17:01, vlan4

C 120.2.0.0/24 is directly connected, 00:19:13, vlan2

C 120.4.0.0/24 is directly connected, 00:18:50, vlan3

S 120.5.0.0/24 [1/10] via 120.4.0.1, 00:17:19, vlan3

C 127.0.0.0/8 is directly connected, 00:26:16, lo0

Step 3:

Configure the URPF loose mode on interface vlan2 of Device3.

#Configure Device3.

Device3#configure terminal

Device3#configure terminal

Device3(config)#interface vlan2

Device3(config-if-vlan2)#ip verify unicast source reachable-via any

Device3(config-if-vlan2)#exit

Device3(config)#exit

Step 4:

Check the result.

#PC1 ping PC2

The ping request packet of PC1 reaches PC2 via Device1, Device2, and Device3; the ping response packet of PC2 reaches PC1 via Device3 and Device1.

#PC1 accesses PC2 and the source address is 120.5.0.2.

There is the route to 120.5.0.2 on Device3 and the route egress interface is gigabitethernet1. The route egress interface to the source address gigabitethernet1 and the interface for receiving the packet gigabitethernet0 are not the same interface, but after the URPF loose check, the packet is forwarded by Device3, PC1 can access PC2 and the response packet of PC2 reaches PC1 via Device3 and Device1.

#PC1 simulates the attacker to send the invalid packet with the false source address to access PC2 and the source address is 120.10.0.2.

There is no route to 120.10.0.2 on Device3; URPF drops the packet; PC1 cannot access PC2. URPF lost packet statistics is as follows:

Device3#show ip urpf interface vlan2

interface vlan2ifIndex : 14mode: rx

options: --- aclist: ---

11 verify unicast RPF drops

0 access-list forced permits

l The difference of the URPF strict and loose modes: In the loose mode, URPF performs the route table searching for the source IP address of the received packet. If finding the route, permit the packet to pass, while in the strict mode, we not only need to find the route, but also the egress interface and the packet receiving interface need to be the same so that the packet can be permitted to pass.

l Usually apply the strict mode. The loose mode is applied to the network environment of the similar case “The coming route and the back route are inconsistent”.


9 Attack Detection


9.1 Overview

The attack detection is one important function of maintaining the network security. It analyzes the packet content processed by the device, judges whether the packet has the attack feature and executes some precautions for the packet with the attack feature according to the configuration, such as intercept the attack packet and record the attack packet log. Configuring the attack detection function on the device, on one hand, can avoid that the device becomes abnormal because of getting the network attack, improving the anti-attack capability of the device; on the other hand, it can intercept the attack traffic forwarded by the device, avoiding that the other devices on the network cannot work normally because of being attacked.


9.2 Attack Detection Function Configuration

Table 9‑1 The configuration list of the attack detection function

Configuration Task
Configure the software attack detection function | Configure intercepting the packet with too small IP length
 | Configure intercepting the unreasonable fragment packets
 | Configure intercepting the source route packet
 | Configure intercepting the record route packet
 | Configure intercepting the Land attack packet
 | Configure intercepting the Smurf attack packet
 | Configure intercepting the Fraggle attack packet
 | Configure intercepting the ICMP flood attack packet
 | Configure intercepting the TCP SYN flood attack packet
 | 配置拦截UDP洪水攻击报文
 | Configure the software attack detection log recording
Configure the hardware attack detection function | Configure intercepting the packet with the same source and destination IP
 | Configure intercepting the TCP packet with the same source and destination port
 | Configure intercepting the UDP packet with the same source and destination port
 | Configure intercepting the invalid ICMP packet

l The software attack detection function is valid only for the packet to the local device.


9.2.1 Configure Software Attack Detection Function

The software attack detection function is realize by adopting the software mode, performing the attack detection only for the packet with the destination address as the device itself, so as to prevent the device from getting the network attack.

Configuration Condition

Before configuring intercepting the Smurf, Fraggle, ICMP flood, and TCP SYN flood attack detection functions, first complete the following tasks:

l Configure ACL

Configure Intercepting Packet with Too Small IP Length

When the device receives the IP packet with the IP length (including the IP head and load) smaller than the configured length, drop the packet.

Table 9‑2 Configure intercepting the packet with too small IP length

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting the packet with too small IP length | ip intercept small-packet [ length ] | Mandatory By default, do not configure the function of intercepting the packet with too small IP length. After configuring the function and if not specifying the length, intercept the packet with the IP length smaller than 64 bytes by default.

Configure Intercepting Unreasonable Fragment Packet

When the device receives the IP fragment packet and the fragment offset plus its own load length exceeds the configured length, drop the packet.

Table 9‑3 Configure intercepting unreasonable fragment packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting unreasonable fragment packet | ip intercept fragment [ max-off length ] | Mandatory By default, do not configure the function of intercepting the unreasonable fragment packet. After configuring the function and if not specifying the length, intercept the fragment whose offset plus its own load length exceeds 65535 by default.

Configure Intercepting Source Route Packet

When the device receives the packet with the IP source route option in the IP header, drop the packet.

Table 9‑4 Configure intercepting the source route packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure intercepting the source route packet | ip intercept source-route | Mandatory By default, do not configure intercepting the IP packet with the IP source route option in the IP header.

Configure Intercepting Record Route Packet

When the device receives the packet with the IP record route option in the IP header, drop the packet.

Table 9‑5 Configure intercepting the record route packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure intercepting the record route packet | ip intercept record-route | Mandatory By default, do not configure intercepting the IP packet with the IP record route option in the IP header.

Configure Intercepting Land Attack Packet

Land attack adopts the same source and destination IP and port to send the TCP SYN packet to the target machine, making the target system with the hole create one TCP empty connection with itself, even resulting in the breakdown of the target system.

When the device receives the TCP SYN packet with the same source and destination IP and the same source and destination port, drop the packet.

Table 9‑6 Configure intercepting the Land attack packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting the Land attack packet | ip tcp intercept land | Mandatory By default, do not configure intercepting the Land attack packet.

Configure Intercepting Smurf Attack Packet

The Smurf attack sends the ICMP request packet to one network and the destination IP is the subnet broadcast address of the network. As a result, all hosts of the network answer the ICMP request. Therefore, the network of the source IP is blocked and the source IP host is busy with processing the ICMP responses.

When the device receives the ICMP packet and if the ICMP type is ICMP_ECHO, ICMP_TSAMP, ICMP_MASKREQ or ICMP_IREQ and the destination IP is the subnet broadcast address, the packet is regarded as the Smurf attack packet and is dropped.

Table 9‑7 Configure intercepting Smurf attack packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting Smurf attack packet | ip smurf intercept list { access-list-number | access-list-name } [ masklen length ] | Mandatory By default, do not configure the function of intercepting the Smurf attack packet. After configuring the function and if not specifying the mask length, the mask length is 24 by default.

l When configuring intercepting the Smurf attack packet, first need to create the ACL, used to specify the protected data flow. We check whether it is the Smurf attack packet only for the data flow permitted by the ACL. Otherwise, permit the packet to pass.

l masklen length in the configuration command is used to specify the mask length; when the last bit of the destination IP (32-mask length) is 1, it is regarded as the subnet broadcast address.

Configure Intercepting Fraggle Attack Packet

The Fraggle attack is similar to the Smurf attack and it makes use of the UDP packet to attack.

When the device receives the UDP packet and the destination IP is the subnet broadcast address, it is regarded as the Fraggle attack packet and is dropped.

Table 9‑8 Configure intercepting the Fraggle attack packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting the Fraggle attack packet | ip fraggle intercept list { access-list-number | access-list-name } [ masklen length ] | Mandatory By default, do not configure the function of intercepting the Fraggle attack packet. After configuring the function and if not specifying the mask length, the mask length is 24 by default.

l When configuring intercepting the fraggle attack packet, first need to create the ACL, used to specify the protected data flow. We check whether it is the fraggle attack packet only for the data flow permitted by the ACL. Otherwise, permit the packet to pass.

l masklen length in the configuration command is used to specify the mask length; when the last bit of the destination IP (32-mask length) is 1, it is regarded as the subnet broadcast address.

Configure Intercepting ICMP Flood Attack Packet

ICMP flood attack sends lots of ICMP response requests to the target host to make the network of the target host be blocked. The target host consumes lots of resources to answer and cannot provide services normally.

When the number of the ICMP packets with the same destination IP received by the device within one second exceeds the threshold, the packets exceeding the threshold are dropped.

Table 9‑9 Configure intercepting the ICMP flood attack packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting the ICMP flood attack packet | ip icmp intercept list { access-list-number | access-list-name } [ maxcount number ] | Mandatory By default, do not configure the function of intercepting the ICMP flood attack packet. After configuring the function and if not specifying the threshold, the default value is 500.

l When configuring intercepting the ICMP flood attack packet, first need to create the ACL, used to specify the protected data flow. We check whether it is the ICMP flood attack packet only for the data flow permitted by the ACL. Otherwise, permit the packet to pass.

Configure Intercepting TCP SYN Flood Attack Packet

TCP SYN Flood attack sends lots of TCP SYN requests to the target host, but does not answer the ACK message. As a result, the target host has lots of semi-connections waiting for receiving the ACK message of the requester, which occupy the available resources of the target host. As a result, the target host cannot provide the normal network services.

When the number of the TCP SYN packets with the same destination IP received by the device within one second exceeds the threshold, the packets exceeding the threshold are dropped.

Table 9‑10 Configure intercepting the TCP SYN flood attack packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting the TCP SYN flood attack packet | ip tcp intercept list { access-list-number | access-list-name } [ maxcount number ] | Mandatory By default, do not configure the function of intercepting the TCP SYN flood attack packet. After configuring the function and if not specifying the threshold, the default value is 500.

l When configuring intercepting the TCP SYN flood attack packet, first need to create the ACL, used to specify the protected data flow. We check whether it is the TCP SYN flood attack packet only for the data flow permitted by the ACL. Otherwise, permit the packet to pass.

Configure Intercepting the UDP Flood Attack Packet

UDP flood attack sends lots of UDP packets to the target host, and when the attacked host receives one UDP packet, it determines the waiting application program of the target port. When it discovers that the port does not have the waiting application program, it generates one ICMP packet with the destination address that cannot be connected to the forged source address. When enogh UDP packets are sent to the target attacked host, the system breaks down.

When the number of the UDP packets received by the device within one second exceeds the threshold, the packets exceeding the threshold are dropped.

Table 9‑11Configure intercepting the UDP flood attack packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure intercepting the UDP flood attack packet | ip udp intercept list { access-list-number | access-list-name } [ maxcount number ] | Mandatory By default, do not configure intercepting the UDP flood attack packet. After configuring the function and not specifying the threshold, the default value is 100 (the network of the matching destination address of the ACL)

l When configuring intercepting the UDP flood attack packet, first need to create the ACL, used to specify the protected data flow. We check whether it is the UDP flood attack packet only for the data flow permitted by the ACL. Otherwise, permit the packet to pass.

Configure Software Attack Detection Log Recording

When the device software attack detection intercepts the attack packet, record the log information.

Table 9‑12 Configure the software attack detection log recording

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure the software attack detection log recording | ip intercept log | Mandatory By default, do not configure the software attack detection log function.


9.2.2 Configure Hardware Atrtack Detection Function

Configuration Condition

None

Configure Intercepting Packet with Same Source and Destination IP

When the switching port of the device receives the packet with the same source and destination IP, drop the packet.

Table 9‑13 Configure intercepting the packet with the same source and destination IP

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting the packet with the same source and destination IP | ip intercept ipeq | Mandatory By default, do not configure the function of intercepting the IP packet with the same source and destination IP.

Configure Intercepting TCP Packet with Same Source and Destination Port

When the switching port of the device receives the TCP packet with the same source and destination port, drop the packet.

Table 9‑14 Configure intercepting the TCP packet with the same source and destination port

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting the TCP packet with the same source and destination port | ip tcp intercept porteq | Mandatory By default, do not configure the function of intercepting the TCP packet with the same source and destination port.

Configure Intercepting UDP Packet with Same Source and Destination Port

When the switching port of the device receives the UDP packet with the same source and destination port, drop the packet.

Table 9‑15 Configure intercepting the UDP packet with the same source and destination port

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting the UDP packet with the same source and destination port | ip udp intercept porteq | Mandatory By default, do not configure the function of intercepting the UDP packet with the same source and destination port.

Configure Intercepting Invalid ICMP Packet

When the switching port of the device receives the invalid ICMP packet, drop the packet.

The packet with any one of the following features is regarded as the invalid ICMP packet. The features are as follows:

1. The fragmented ICMP packet

2. ICMP ping packet, and the length exceeds the configured value.

Table 9‑16 Configure intercepting the invalid ICMP packet

Step | Command | Description
Enter global configuration mode | configure terminal | -
Configure intercepting the invalid ICMP packet | ip icmp intercept bad [ length value ] | Mandatory By default, do not configure the function of intercepting the invalid ICMP packet.


9.2.3 Monitoring and Maintaining of Attack Detection

Table 9‑17 Attack detection monitoring and maintaining

Step | Command
Clear the software attack detection statistics information | clear ip intercept statistic
Display the attack detection configuration information | show ip intercept config
Display the software attack detection statistics information | show ip intercept statistic


9.3 Typical Configuration Example of Attack Detection


9.3.1 Configure Anti-DDOS Attack Detection

Network Requirements

l Device is connected to IP Network via port vlan1000.

l Device configures the anti-DDOS attack detection function. When finding the attack packet, alarm and drop the attack packet, taking the common SYN Flood attack, Smurf attack, and Land attack as example.

Network Topology

Figure 9-1 Networking of configuring the anti-DDOS attack detection

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Configure the SYN Flood, Smurf, LAND attack detection function on Device and enable the log recording function.

#Configure the standard ACL rule, matching the Device address to be protected.

Device#configure terminal

Device(config)#ip access-list standard 1

Device(config-std-nacl)#permit host 100.0.0.1

Device(config-std-nacl)#exit

#Configure the SYN Flood attack detection.

Device(config)#ip tcp intercept list 1

#Configure the Smurf attack detection.

Device(config)#ip smurf intercept list 1

#Configure the LAND attack detection.

Device(config)#ip tcp intercept land

#On Device, enable the log recording function of the anti-DDOS attack detection.

Device(config)#ip intercept log

Step 3:

Check the result.

When there is attacker initiating the SYN Flood, Smurf, and LAND attacks to Device, view the log and statistics information on Device.

#When Device gets the SYN Flood attack, output the following log information:

%FIREWALL-FLOOD_WARN-4: SYN flood attack detected, destination IP 100.0.0.1, 1000 packets/second.

#When Device gets the Smurf attack, output the following log information:

%FIREWALL-SMURF_WARN-4: SMURF attack detected at vlan1000, source IP 100.0.0.1, destination IP 100.0.0.255, icmp type 8.

#When Device gets the Land attack, output the following log information:

%FIREWALL-LAND_WARN-4: LAND attack detected at vlan1000, source IP equal destination IP is 100.0.0.1, source port equal destination port is 1024.

#Execute the show ip intercept statisticcommand on Device and view the statistics information of the dropped attack packets.

Device#show ip intercept statistic

IP intercept Drops

-------------------- ----------

Small IP 0

Fragment 0

Source Route 0

Record Route 0

Land 16000

Smurf 73728

Fraggle 0

SYN Flood 57819

ICMP Flood 0UDP Flood 0

l The above detection function is valid only for the packets to be processed by CPU.


9.3.2 Configure Intercepting Attack with Same Source and Destination IP Address

Network Requirements

l The attacker and PC are connected to Device via the switching port.

l Configure Device to drop the received attack packet with the same source and destination IP.

Network Topology

Figure 9–2 Networking of configuring intercepting the attack with the same source and destination IP address

Configuration Steps

Step 1: | Configure VLAN and add the port to the corresponding VLAN. (Omitted)
Step 2: | Configure the IP address of the interface. (Omitted)
Step 3: | Configure Device to drop the attack packet with the same source and destination IP.

#Configure Device.

Device#configure terminal

Device(config)#ip intercept ipeq

Step 4:

Check the result.

#When the attacker initiates the packet attack with the same source and destination IP address to PC and if the function is not configured, we can capture the attack packet on PC. After configuring the function, we cannot capture the attack packet on PC.

l The detection function is valid only for the packet received by the switch port.

l The packet dropping generated by the detection does not generate the log and statistics information.


1 WLAN


1.1 Overview

The wired LAN taking the wired cable or optical fiber as transmission medium is widely applied, but the laying cost of the wired transmission medium is high, the location is fixed and the mobility is poor. With the increasing demand for network portability and mobility, the traditional wired network has been unable to meet the demand, and WLAN technology comes into being.

The WLAN technology is based on the 802.11 standard series, that is, wireless LAN using high-frequency signals (such as 2.4GHz or 5GHz) as transmission medium. 802.11 is the industrial standard of wireless network communication defined by IEEE in 1997 for WLAN. Since then, this standard has been constantly supplemented and improved to form the 802.11 standard series, such as 802.11, 802.11a, 802.11b, 802.11e, 802.11g, 802.11i, and 802.11n.

Work station STA (station): The terminal equipment supporting 802.11 standard, such as the computer with wireless network cards and the mobile phone supporting WLAN.

Radio frequency signal: The transmission medium providing the WLAN technology based on 802.11 standard, a high frequency electromagnetic wave with long distance transmission capability. The radio frequency signal referred to in this article is the electromagnetic wave in the 2.4G or 5G frequency band.

AP (Access Point): Provide the wireless access service based on the 802.11 standard for STA, playing the bridging role of wired network and wireless network.


1.2 WLAN Function Configuration

Table 1‑1 WLAN function configuration list

Configuration Task

Configure the WLAN work mode

Configure the WLAN work mode

Enable and disable WLAN


1.2.1 Configure WLAN Work Mode

Configuration Condition

None

Configure WLAN Work Mode

WLAN can work in the AP mode or STA mode. The AP mode and STA mode cannot be configured at the same time.

Table 1‑2 Configure the WLAN work mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the WLAN work mode | wlan mode {ap | sta} | By default, WLAN works in the AP mode.

Enable and Disable WLAN

You can enable or disable WLAN according to the demand of the customer.

Table 1‑3 Enable and disable WLAN

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable WLAN | wlan enable | By default, WLAN is enabled.
Disable WLAN | Wlan disable |


1.3 AP Function Configuration

Table 1‑4 AP function configuration list

Configuration Task
Configure the AP radio frequency | Configure the radio frequency type
 | Configure the channel
Configure the AP basic parameters | Create SSID
 | Configure the SSID name
 | Configure the SSID hiding
 | Configure SSID VLAN
 | Configure the SSID authentication mode
Configure the AP interface | Create the AP interface
 | Configure AP interface VLAN
 | Configure the AP interface bridge group
 | Configure 802.1X
Configure the bridge interface | Configure the bridge interface address
AP monitoring and maintaining |


1.3.1 Configure AP Radio Frequency

Radio frequency is a kind of high-frequency AC change electromagnetic wave, which represents the electromagnetic frequency with long distance transmission capability and radiation to space. WLAN is one of the wireless communication technologies for data transmission using radio frequency as transmission medium.

The frequency of radio frequency is between 300KHz and 300GHz, and the radio frequency range used by WLAN is 2.4GHz frequency band (2.4GHz to 2.4835GHz).

Configuration Condition

None

Configure Radio Frequency Type

Divide by the 802.11 wireless network communication standards defined by IEEE, and the radio frequency types mainly include 802.11b, 802.11g and 802.11n:

802.11b: The work frequency is 2.4GHz. Compared with 5GHz, it can provide longer transmission distance and the data transmission rate can reach 11Mbps. The early wireless communication is more in pursuit of transmission distance, so 802.11b is put into use earlier than 802.11a.

802.11g: The work frequency is 2.4GHz and can be compatible with 802.11b. 802.11g borrows the results of 802.11a, and adopts the OFDM technology in the 2.4GHz band, and the rate can reach 54Mbps.

802.11n: It can be compatible with the 802.11a/g standard. The data transmission rate of 802.11n reaches more than 100Mbps, and in theory, the maximum is up to 600Mbps, making WLAN be smoothly combined with the wired network and improving the throughput of the network.

Table 1‑5Configure the radio frequency type

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the dot11radio interface mode | interface dot11radio 0 | -
Configure the radio frequency type | radio-type {dot11b|dot11bg|dot11bgn} | By default, it is dot11bgn

Configure the Channel

Channel is a radio frequency with a certain bandwidth. In the WLAN standard protocol, the 2.4GHz band is divided to 13 mutually overlapping channels, the bandwidth of each channel is 20MHz, and the channel interval is 5MHz.

Table 1‑6 Configure the channel

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the dot11radio interface mode | interface dot11radio 0 | -
Configure the channel | radio-channel{20mhz | 40mhz}channel-number{channel-numbe |auto} | By default, it is 20mhz, auto mode.


1.3.2 Configure AP Basic Parameters

Each SSID corresponds to one separate AP, and each SSID have the separate parameter configuration. WLAN can be configured with four SSIDs at most.

Configuration Condition

None

Create SSID

Table 1‑7 Create SSID

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the dot11radio interface mode | interface dot11radio 0 | -
Create SSID | ssid ssidindex | Mandatory The range of ssidindex is 1-4

l WLAN can create four SSIDs at most, corresponding to four APs.

Configure SSID Name

Table 1‑8 Configure the SSID name

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the dot11radio interface mode | interface dot11radio 0 | -
Enter the SSID mode | ssid ssidindex | -
Configure the SSID name | ssid-name ssidname | The name is the character string, the length 1-32, case sensitive, and visible ASCII characters.

l In the AP mode, the default SSID name of the device is the last six bits of Maipu_+MAC address.

Configure SSID Hiding

SSID cannot broadcast the name of the SSID on the wireless side, and the terminal can only manually input the SSID name.

Table 1‑9 Configure the SSID hiding

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the dot11radio interface mode | interface dot11radio 0 | -
Enter the SSID mode | ssid ssidindex | -
Configure the SSID hiding | radio-hide | -

Configure SSID VLAN

Table 1‑10 Configure SSID VLAN

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the dot11radio interface mode | interface dot11radio 0 | -
Enter the SSID mode | ssid ssidindex | -
Configure SSID VLAN | radio-vlan vlanid | -

l Each SSID should be configured with different VLANs.

Configure SSID Authentication Mode

Open Open indicates not encrypting or authenticating.

WPA/WPA2 Wi-Fi Protected Access

WPA core encryption algorithm adopts RC4, and on the basis of WEP, puts forward the Temporal Key Integrity Protocol (TKIP) encryption algorithm. Subsequently, the 802.11i security standard puts forward WPA2, different from WPA. WPA2 adopts the 802.1X identifier authentication framework, supporting EAP-PEAP, EAP-TLS and other authentication methods. Adopt more secure block password chain - information authenticity check code CCMP Protocol (Counter Mode with CBC-MAC protocol) encryption algorithm.

WPA/WPA2-PSK: It does not require a dedicated authentication server and only requires a pre-shared key in advance for each WLAN node (WLAN server, wireless router, network card, etc.). As long as the key matches, the customer can get access to the WLAN. Since this key is only used for the authentication procedure and not for the encryption procedure, it does not cause serious security problems, such as using the WEP key for 802.11 shared authentication.

WPA/WPA2-802.1X: Use the RADIUS server and the extensible authentication protocol (EAP) for authentication. The user provides the credential needed for authentication, such as user name and password, and with the specific user authentication server (usually RADIUS server), realize the access authentication for the user.

Table 1‑11 Configure the SSID authentication mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the dot11radio interface mode | interface dot11radio 0 | -
Enter the SSID mode | ssid ssidindex | -
Configure the SSID authentication mode | radio-authentication { OPEN |WPA-WPA2authentication-method {PSK-CIPHER cipher-key-value | 802.1x}} | -

Enable the SSID Service

Table 1‑12 Enable the SSID service

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the dot11radio interface mode | interface dot11radio 0 | -
Enter the SSID mode | ssid ssidindex | -
Enable the SSID service | ssid service {enable | disable} |

l After modifying the basic parameters of SSID, you should enable the SSID service again so that the new parameters can take effect.


1.3.3 Configure the AP Interface

Configuration Condition

None

Create an AP Interface

WLAN supports four AP interfaces, corresponding to four SSIDs. SSID should be configured with the corresponding AP interface. Otherwise, SSID does not take effect.

Table 1‑13 Create an AP interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create an AP interface | interface dot11radio index | Index is 1-4

Configure AP Interface VLAN

Table 1‑14 Configure the AP interface VLAN

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the AP interface mode | interface dot11radio index | Index is 1-4
Configure the AP interface VLAN | encapsulation dot1q vlanid | Mandatory

l VLAN of the AP interface should be configured. Otherwise, the AP interface does not take effect.

l The VLAN of the AP interface should be consistent with the VLAN of the bound SSID. Otherwise, the AP interface does not take effect.

Configure AP Interface Bridge Group

Table 1‑15 Configure the AP interface bridge group

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the AP interface mode | interface dot11radio index | Index is 1-4
Configure the AP interface bridge group | bridge-group index | Mandatory

l The AP interface should be added to the bridge group. Otherwise, the SSID service of the AP interface cannot run normally.

Configure 802.1X

Table 1‑16 Configure 802.1X

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the AP interface mode | interface dot11radio index | Index is 1-4
Configure 802.1X | dot1x port-control {enable|disable} | By default, it is not configured. When the SSID of the AP interface is configured as 802.1X, it should be configured.


1.3.4 Configure AP Bridge Interface

Configuration Condition

None

Configure the Bridge Interface

Table 1‑17 Configure the bridge interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the bridge interface mode | interface bvi group | Mandatory
Configure the IP address of the bridge interface | ip address address/mask | Mandatory


1.3.5 AP Monitoring and Maintaining

Table 1‑18 AP monitoring and maintaining

Command | Description
showinterface interface-name | Used to view the interface information; the dot11radio 0 interface indicates the primary interface, and dot11radio 0.x indicates the sub interface.
showdot11radio 0 | Used by AP to query the SSID configuration information
showdot11radio ssid ssid-index | Used to query the SSID status
showwlan client list | Used to query the connected user information and quantity
showdot1x ap config | Used for the AP dot1x configuration
showdot1x ap user | Used to query the connected dot1x user information in the system


1.4 STA Function Configuration

Table 1‑19 STA function configuration list

Configuration task
Configure the STA basic parameters | Configure the STA connection hot spot
 | Configure the STA authentication mode
STA monitoring and maintaining | Configure the user name and password


1.4.1 Configure STA Basic Parameters

Configuration Condition

None

Configure the Hot Spot of STA Connection

Table 1‑20 Configure the hot spot of the STA connection

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the STA interface mode | interface dot11sta 0 | -
Configure the hot spot of the STA connection | ssid-name ssidname | Mandatory, The name is the character string, the length 1-32, case sensitive, and visible ASCII characters

Configure STA Authentication Mode

Table 1‑21 Configure the STA authentication mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the STA interface mode | interface dot11sta 0 | -
Configure the STA authentication mode | authentication {OPEN| WPA-WPA2 authentication-method{PSK-CIPHER cipher-key-value} | Mandatory


1.4.2 STA Monitoring and Maintaining

Table 1‑22 STA monitoring and maintaining

Command | Description
showdot11sta 0 | Used to query the configuration and physical status of the STA interface
show dot11sta external hotspot | Used to query the external available AP hot spot


1.5 WLAN Typical Configuration Example


1.5.1 AP WPA/WPA2 802.1X Typical Configuration Example

Network Requirements

l Device1 works in the AP mode and the authentication mode is WPA/WPA2 802.1X.

l Device is AAA Server, Device1 and Device2 use the wired connection, and communicate via radius.

l The terminal is the mobile device.

Network Topology

Figure 1‑1 AP typical networking

Device | Interface | IP Address | Device | Other information
Device1 | Gi0/0 | 192.168.102.102/24 | AP | Ssid name baiyun1_1
 | Bvi interface | 192.168.10.1/24 |  |
Device2 | Gi0 | 192.168.100.100/24 | AAA Server | The share key is admin The port is 1812

Configuration Steps

Step 1: | Configure the IP address and route of the interface.
 |  | #Configure Devie1, gigabitethernet0/0 is the access mode, and pvid is configured as 100. router(config)# configure terminal router(config)# interface gigabitethernet0/0 router(config-if-gigabitethernet0/0)#switchport mode access router(config-if-gigabitethernet0/0)#switchport access vlan 100 #Configure vlan100 interface, and the IP address is 192.168.102.102/24. router(config)# configure terminal router(config)# interface vlan 100 router(config-if-vlan100)#ip address192.168.102.102/24 #After configuration, you can ping AAA server address 192.168.100.100.
Step 2: | Configure the WLAN work mode.

#Configure Device1, open WLAN, and configure as the AP mode.

router(config)# configure terminal

router(config)#wlan mode ap

router(config)#wlan enable

Step 3:

Configure the AP radio frequency.

#The radio type is dot11bgn, bandwidth is 20mhz, and the channel is auto.

router(config)# configure terminal

router(config)# interface dot11radio0

router(config-if-dot11radio0)#radio-type dot11bgn

router(config-if-dot11radio0)#radio-channel 20mhz channel-number auto

Step 4:

Configure the AP basic parameters.

#On Device1, set up AP, ssid name is baiyun1_1, vlan is 100, and the authentication mode is 802.1x.

router(config)# configure terminal

router(config)# interface dot11radio0

router(config-if-dot11radio0)#ssid 1

router(config-dot11radio0-ssid-1)# ssid-name baiyun1_1

router(config-dot11radio0-ssid-1)# radio-vlan 100

router(config-dot11radio0-ssid-1)#radio-authentication WPA-WPA2 authentication-method 802.1x

router(config-dot11radio0-ssid-1)# ssid service enable

Step 5: | Configure the AP interface.
 | #On Device1, set up the AP interface dot11radio0.1. vlan is 100, bind ssid 1, add to the bridge group 1, and enable dot1x authentication. router(config)# configure terminal router(config)# interface dot11radio0.1 router(config-if-dot11radio0.1)#encapsulation dot1q 100 router(config-if-dot11radio0.1)#bridge-group 1 router(config-if-dot11radio0.1)#dot1x port-control enable
Step 6: | Configure the bridge interface.

#On Device1, set up the bridge interface with the IP address 192.168.10.1.

router(config)# configure terminal

router(config)# interface bvi1

router(config-if-bvi1)# ip address 192.168.10.1 255.255.255.0

Step 7:

Configure the DHCP address pool.

#Configure Device1, DHCP address pool, the segment is 192.168.10.0, mask is 255.255.255.0, and the gateway address is 192.168.10.1.

router(config)# configure terminal

router(config)# ip dhcp pool ssid1

router(dhcp-config)# network 192.168.10.0 255.255.255.0

router(dhcp-config)# default-router 192.168.10.1

Step 8:

Configure the AAA authentication.

#On Device1, enable the AAA authentication, adopt the RADIUS authentication mode. The server key is admin, the priority is 1, and the RADIUS server address is 192.168.102.100/24.

router(config)# configure terminal

router(config)# aaa new-model

router(config)# aaa authentication connection default radius

router(config)# radius-server host 192.168.102.100 auth-port 1812 acct-port 1813 priority 1 key 0admin

Step 9:

Check the result.

#On Device1, view that the AP interface is up, and the mobile phone is correctly connected with the AP and gets the address.

router#show interface dot11radio 0.1

dot11radio0.1:

line protocol is up

Flags: (0xc028163) BROADCAST MULTICAST PROMISCUOUS ARP RUNNING

Type: ETHERNET_CSMACD

Metric: 0, MTU: 1500, BW: 100000 Kbps, DLY: 100 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.7ae1.e2e5

Last clearing of "show interface" counters never

5 minutes input rate 0 bit/sec, 0 packet/sec, bandwidth utilization 0.00%

5 minutes output rate 0 bit/sec, 0 packet/sec, bandwidth utilization 0.00%

0 packets received; 0 packets sent

0 bytes received; 0 bytes sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

#On Device1, query that the MAC address of the mobile phone is already online.

router#show wlan client list

Wlan client information:

Ssid Index Client hardware address

-----------------------------------------------------------------

1 58:1f:28:fe:d0:96

-----------------------------------------------------------------

#On Device1, ping the mobile phone address.

router#ping 192.168.10.177

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 192.168.10.177 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 4/83/371 ms.


1 Interface Backup


1.1 Overview

To improve the network reliability, we can configure one standby interface for the interface on the device. Usually, the active interface is responsible for the service transmission and the standby interface is disabled. When the active interface fails and the services are interrupted, enable the standby interface to take over the service transmission of the active interface. When the traffic of the active interface exceeds the configured value, enable the standby interface to share the traffic of the active interface.

As shown in the following figure, S1/0 of Device serves as the active interface and S1/1 serves as the standby interface of S1/0. Usually, S1/0 is responsible for the service transmission and S1/1 is disabled. When S1/0 interface fails, enable the standby interface S1/1 to take over the service transmission of S1/0; when the traffic of S1/0 exceeds the configured value, enable the standby interface S1/1 to share the traffic of the active interface S1/0.

Figure 1‑1The interface backup diagram

The interface backup provides the following two functions.

l Active/standby backup

l Load balancing


1.1.1 Active/Standby Backup

When using the active/standby backup function, one interface is enabled and the other is disabled. Only the enabled interface can transmit the services.

When the active interface works normally, the active interface is responsible for the service transmission and the standby interface is disabled.

When the active interface fails, enable the standby interface to take over the service transmission of the active interface.

When the active interface recovers, the service transmission is switched to the active interface and the standby interface is disabled.


1.1.2 Load Balancing

When using the load balance function and the traffic of the active interface exceeds the configured upper threshold, the two interfaces are enabled at the same time and transmit the services via the load balance mode.

When the traffic of the active interface is lower than the configured upper threshold, the active interface is responsible for the service transmission and the standby interface is disabled.

When the traffic of the active interface exceeds the configured upper threshold, enable the standby interface, and the active interface and the standby interface transmit the services via the load balance mode.

When the total traffic of the active interface and the standby interface is lower than the configured lower threshold, disable the standby interface and the active interface transmits all services.

l If the user configures the upper threshold and lower threshold of the load balance, the active interface runs by the load balance mode. Otherwise, adopt the active/standby backup mode to run.


1.2 Interface Backup Function Configuration

Table 1‑1The interface backup function configuration list

Configuration Task
Configure the active/standby backup | Configure the active/standby backup
Configure the load balance | Configure the load balance


1.2.1 Configure Active/Standby Backup

Configuration Condition

Before configuring the active/standby backup function, first complete the following tasks:

l Configure the link layer protocol, IP address, and route of the active interface, making the active interface and the destination segment network layer reachable;

l Configure the link layer protocol, IP address, and route of the standby interface, making the standby interface and the destination segment network layer reachable.

Configure Active/Standby Backup

The active/standby backup means that two interfaces on one device form the backup relation. Multiple (four at most) interfaces serve as the active interface and another interface serves as the standby interface. Usually, the active interface transmits services and the standby interface is disabled. When the active interface fails, enable the standby interface to take over the service transmission of the active interface. When the active interface recovers, the service transmission is switched to the active interface.

When the interface status is not stable, the active and standby interfaces can switch over frequently. Here, we can configure the switching delay of the active/standby interface to reduce the switching frequency. When the active interface fails, the system switches to the standby interface after the configured delay timeout. If the active interface recovers before timeout, do not switch.

Table 1‑2 Configure active/standby backup

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the standby interface of the active interface | backup interface interface-name | Mandatory By default, do not configure the standby interface for the active interface.
Configure the delay of the active/standby interface switching | backup delay { enable-delay | never } { disable-delay | never } | Optional By default, the switching delay of the active and the standby interfaces are 5s and 25s respectively.


1.2.2 Configure Load Balancing

Configuration Condition

Before configuring the load balance function, first complete the following tasks:

l Configure the link layer protocol, IP address, and route of the active interface, making the active interface and the destination segment network layer reachable;

l Configure the link layer protocol, IP address, and route of the standby interface, making the standby interface and the destination segment network layer reachable.

Configure Load Balance

The load balance means that two interfaces on one device form the backup relation. One interface serves as the active interface and the other interface serves as the standby interface. Usually, the active interface transmits services and the standby interface is disabled. When the traffic of the active interface exceeds the configured upper threshold, enable the standby interface, and the active interface and the standby interface transmit services via the load balance mode.

Table 1‑3 Configure the load balance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the standby interface of the active interface | backup interface interface-name | Mandatory By default, do not configure the standby interface for the active interface.
Configure the load balance threshold | backup load { enable-threshold | never } { disable-threshold | never } | Mandatory By default, do not configure the load balance threshold.


1.2.3 Monitoring and Maintaining of Interface Backup

None


1.3 Typical Configuration Example of Interface Backup


1.3.1 Configure Active/Standby Backup

Network Requirement

On Device1, configure vlan10 as the active interface and vlan20 as the standby interface. After the configuration is complete and when the active interface vlan10 fails, enable the standby interface vlan20; when the active interface vlan10 recovers, disable the standby interface. This saves the cost and ensures the stable running of the services.

Network Topology

Figure 1‑2 Networking of configuring the active/standby backup

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Specify the active and standby interfaces.

#Configure vlan10 of Device1 as the active interface and vlan20 as the standby interface.

Device1#configure terminal

Device1(config)#interface vlan10

Device1(config-if-gigabitethernet0)#backup interface vlan20

#Configure Device1. When the active interface vlan10 fails, enable the standby interface vlan20 after 5s; when the active interface vlan10 recovers, disable the standby interface vlan20 after 10s.

Device1(config-if-vlan10)#backup delay 5 10

Device1(config-if-vlan10)#exit

Strep 3:

Check the result.

#View Device1. When the active interface vlan10 fails, enable the standby interface vlan20.

Device1#show interface vlan10

Vlan10:

line protocol is down

Flags: (0x8062) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 1.1.1.1/24

Broadcast address: 1.1.1.255

Metric: 0, MTU: 1500, BW: 1000000 Kbps, DLY: 10 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.0203.0406

Last clearing of "show interface" counters at: 2 hours 46 minutes 43 seconds

input rate 0 bit/sec, 0 packet/sec

output rate 0 bit/sec, 0 packet/sec

0 packets received; 0 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

line status down: speed auto, duplex auto

rxframes:0, rxOctets:0, rxBroadcast:0, rxMulticast:0, rxPause:0

txframes:0, txOctets:0, txBroadcast:0, txMulticast:0, txPause:0

rxCrcErr:0, rxLenErr:0, rxCodeErr:0, rxOverflow:0, rxBad:0

txUnderrun:0, txCarrierSenceErr:0, singleColl:0 multipleColl:0

Device1#show interface vlan20

Vlan20:

line protocol is up

Flags: (0xc0080f1) POINT-TO-POINT MULTICAST RUNNING

Type: HDLC

Internet address: 2.2.2.1/24

Destination Internet address: 2.2.2.2

Metric: 0, MTU: 1500, BW: 2048 Kbps, DLY: 20000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters at: 0 hour 35 minutes 8 seconds

10 seconds input rate 0 bit/sec, 0 packet/sec

10 seconds output rate 0 bit/sec, 0 packet/sec

7 packets received; 7 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

hdlc version: 3.5

rxFrames 7, rxChars 458

txFrames 7, txChars 458

rxNoOctet 0, rxAbtErrs 0, rxCrcErrs 0

rxOverrun 0, rxLenErrs 0, txUnderrun 0

DCD=up

rate=2048000 bps

We can see that after the active interface vlan10 fails, the status of the active interface vlan10 is down and the status of the standby interface vlan20 is up.

#View the route table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 127.0.0.0/8 is directly connected, 03:03:56, lo0

C 2.2.2.0/24 is directly connected, 00:02:25, vlan20

C 2.2.2.2/32 is directly connected, 00:02:25, vlan20

We can see that the egress interface of the direct-connected route in the route table of Device1 is the standby interface vlan20.

#View Device1. When the active interface vlan10 recovers, disable the standby interface vlan20.

Device1#show interface vlan 10

Vlan 10:

line protocol is up

Flags: (0xc008063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 1.1.1.1/24

Broadcast address: 1.1.1.255

Metric: 0, MTU: 1500, BW: 1000000 Kbps, DLY: 10 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.0203.0406

Last clearing of "show interface" counters at: 0 hour 32 minutes 1 second

10 seconds input rate 0 bit/sec, 0 packet/sec

10 seconds output rate 0 bit/sec, 0 packet/sec

5 packets received; 5 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

line status up: speed 100M, duplex full

rxframes:5, rxOctets:470, rxBroadcast:0, rxMulticast:0, rxPause:0

txframes:5, txOctets:470, txBroadcast:0, txMulticast:0, txPause:0

rxCrcErr:0, rxLenErr:0, rxCodeErr:0, rxOverflow:0, rxBad:0

txUnderrun:0, txCarrierSenceErr:0, singleColl:0 multipleColl:0

Device1#show interface vlan 20

Vlan 20:

line protocol is down

Flags: (0x80f0) POINT-TO-POINT MULTICAST RUNNING

Type: HDLC

Internet address: 2.2.2.1/24

Destination Internet address: 0.0.0.0

Metric: 0, MTU: 1500, BW: 2048 Kbps, DLY: 20000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters at: 0 hour 32 minutes 40 seconds

input rate 0 bit/sec, 0 packet/sec

output rate 0 bit/sec, 0 packet/sec

0 packets received; 0 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

hdlc version: 3.5

shutdown

rxFrames 0, rxChars 0

txFrames 0, txChars 0

rxNoOctet 0, rxAbtErrs 0, rxCrcErrs 0

rxOverrun 0, rxLenErrs 0, txUnderrun 0

DCD=up

rate=2048000 bps

We can see that when the active interface vlan10 recovers, the status of the active interface vlan10 is up and the status of the standby interface vlan20 is down.

#View the route table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 127.0.0.0/8 is directly connected, 03:03:56, lo0

C 1.1.1.0/24 is directly connected, 00:23:27, vlan10

We can see that the egress interface of the direct-connected route in Device1 is vlan10.


1.3.2 Configure one Standby for Multiple Active

Network Requirement

On Device, configure vlan10 and vlan20 as the active interface and vlan30 as the standby interface. After configuration, when the active interface vlan10 and vlan20 fail, enable the standby interface serial1/0; when the active interface vlan10 or vlan20 recovers normally, disable the standby interface, so as to save the cost and ensure the stable running of the service.

Network Topology

Figure 1‑3 Networking for configuring one standby for multiple active

Configuration Steps

Step 1: Configure the IP address of the interface. (Omitted)

Step 2: Specify the active and standby interfaces.

#Configure Device1, vlan10 as the active interface and vlan30 as standby interface.

Device1#configure terminal

Device1(config)#interface vlan 10

Device1(config-if-vlan10)#backup interface vlan 30

#Configure Device1, gigabitethernet20 as the active interface and vlan30 as standby interface.

Device1#configure terminal

Device1(config)#interface vlan 20

Device1(config-if-vlan20)#backup interface vlan30

#Configure Device1. When the active interface vlan10 fails, enable the standby interface vlan30 after 5s; when the active interface vlan10 recovers normally, disable the standby interface vlan30 after 10s.

Device1(config-if-vlan10)#backup delay 5 10

Device1(config-if-vlan10)#exit

#Configure Device1. When the active interface vlan20 fails, enable the standby interface vlan30 after 5s; when the active interface vlan20 recovers normally, disable the standby interface vlan30 after 10s.

Device1(config-if-vlan20)#backup delay 5 10

Device1(config-if-vlan20)#exit

Step 3: Check the result.

#View Device1. When the active interface vlan10 and vlan20 fail, enable the standby interface vlan30.

Device1#show interface vlan10

Vlan10:

line protocol is down

Flags: (0x8062) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 1.1.1.1/24

Broadcast address: 1.1.1.255

Metric: 0, MTU: 1500, BW: 1000000 Kbps, DLY: 10 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.0203.0406

Last clearing of "show interface" counters at: 2 hours 46 minutes 43 seconds

input rate 0 bit/sec, 0 packet/sec

output rate 0 bit/sec, 0 packet/sec

0 packets received; 0 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

line status down: speed auto, duplex auto

rxframes:0, rxOctets:0, rxBroadcast:0, rxMulticast:0, rxPause:0

txframes:0, txOctets:0, txBroadcast:0, txMulticast:0, txPause:0

rxCrcErr:0, rxLenErr:0, rxCodeErr:0, rxOverflow:0, rxBad:0

txUnderrun:0, txCarrierSenceErr:0, singleColl:0 multipleColl:0

Device1#show interface vlan 20

Vlan20:

line protocol is down

Flags: (0x8062) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 2.2.2.1/24

Broadcast address: 2.2.2.255

Metric: 0, MTU: 1500, BW: 1000000 Kbps, DLY: 10 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.0203.0507

Last clearing of "show interface" counters at: 2 hours 56 minutes 43 seconds

input rate 0 bit/sec, 0 packet/sec

output rate 0 bit/sec, 0 packet/sec

0 packets received; 0 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

line status down: speed auto, duplex auto

rxframes:0, rxOctets:0, rxBroadcast:0, rxMulticast:0, rxPause:0

txframes:0, txOctets:0, txBroadcast:0, txMulticast:0, txPause:0

rxCrcErr:0, rxLenErr:0, rxCodeErr:0, rxOverflow:0, rxBad:0

txUnderrun:0, txCarrierSenceErr:0, singleColl:0 multipleColl:0

You can see that after the active interface vlan10 and vlan20 fail, the status is down and the status of the standby interface vlan30 is up.

#View the route table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 127.0.0.0/8 is directly connected, 03:03:56, lo0

C 3.3.3.0/24 is directly connected, 00:02:25, vlan30

C 3.3.3.1/32 is directly connected, 00:02:25, vlan30

You can see that the egress interface of the direct-connected route in the route table of Device1 is the standby interface vlan30.

#View Device1. When the active interface vlan10 or vlan20 recovers normally, disable the standby interface vlan30.

Device1#show interface vlan 10

Vlan 10:

line protocol is up

Flags: (0xc008063) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Internet address: 1.1.1.1/24

Broadcast address: 1.1.1.255

Metric: 0, MTU: 1500, BW: 1000000 Kbps, DLY: 10 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.0203.0406

Last clearing of "show interface" counters at: 0 hour 36 minutes 1 second

10 seconds input rate 0 bit/sec, 0 packet/sec

10 seconds output rate 0 bit/sec, 0 packet/sec

5 packets received; 5 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

line status up: speed 100M, duplex full

rxframes:5, rxOctets:470, rxBroadcast:0, rxMulticast:0, rxPause:0

txframes:5, txOctets:470, txBroadcast:0, txMulticast:0, txPause:0

rxCrcErr:0, rxLenErr:0, rxCodeErr:0, rxOverflow:0, rxBad:0

txUnderrun:0, txCarrierSenceErr:0, singleColl:0 multipleColl:0

Device1#show interface vlan 30

Vlan 30:

line protocol is down

Flags: (0x80f0) POINT-TO-POINT MULTICAST RUNNING

Type: HDLC

Internet address: 3.3.3.1/24

Destination Internet address: 0.0.0.0

Metric: 0, MTU: 1500, BW: 2048 Kbps, DLY: 20000 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Last clearing of "show interface" counters at: 0 hour 32 minutes 40 seconds

input rate 0 bit/sec, 0 packet/sec

output rate 0 bit/sec, 0 packet/sec

0 packets received; 0 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

hdlc version: 3.5

shutdown

rxFrames 0, rxChars 0

txFrames 0, txChars 0

rxNoOctet 0, rxAbtErrs 0, rxCrcErrs 0

rxOverrun 0, rxLenErrs 0, txUnderrun 0

DCD=up

rate=2048000 bps

You can see that after the active interface vlan10 recovers normally, the status of the active interface is up and the status of the standby interface vlan30 is down.

#View the route table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 127.0.0.0/8 is directly connected, 03:03:56, lo0

C 1.1.1.0/24 is directly connected, 00:23:27, vlan 10

You can see that the egress interface of the direct-connected route in Device1 is the active interface vlan10.


2 Dampening


2.1 Overview

The Dampening function mainly indicates the interface flap dampening function. The function is mainly used to detect the frequent flap of the interface, preventing the frequent flapping of the interface from causing the route flap and ensuring the network stability.


2.2 Dampening Function Configuration


2.2.1 Configure Dampening Basic Functions

Table 2‑1 Dampening function configuration list

Configuration Tasks

Configure the Dampening basic functions

Configure the interface flap dampening function

Configure the interface flap dampening recovery function

Configure the maximum flapping times and longest time of the interface dampening

Configure the recovery interval of the interface flap dampening

Configuration Condition

None

Configure Interface Flap Dampening Function

The interface flap dampening function is mainly used to detect the frequent flapping of the interface, preventing the frequent flapping of the interface from causing the route flapping, and ensuring the network stability.

Table 2‑2 Configure the interface flap dampening function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the global switch of the interface flap dampening function | dampening detect cause interface-flap | Optional By default, the global interface flap dampening function is enabled.
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the interface flap dampening function | dampening detect cause interface-flap | Mandatory

l If the interface flap dampening function is configured in the interface, but the global switch of the interface flap dampening function is not enabled, the interface flap dampening function does not take effect.

Configure Interface Flap Dampening Recovery Function

After the interface is dampened and if the interface flap dampening recovery function is configured, the interface automatically recovers to UP after the interface flap dampening recovery interval. Otherwise, the interface does not recover automatically.

Table 2‑3 Configure the interface flap dampening recovery function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the global switch of the interface flap dampening recovery function | dampening recovery cause interface-flap | Optional By default, the global interface flap dampening recovery function is enabled.
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the interface flap dampening recovery function | dampening recovery cause interface-flap | Optional

l If the interface flap dampening recovery function is configured in the interface, but the global switch of the interface flap dampening recovery function is not enabled, the interface flap dampening recovery function does not take effect.

Configure Flapping Frequency of Interface Dampening

Flapping frequency: In the unit time T, the maximum flapping times of the interface is C times, that is, in the unit time T, if the flapping times of the interface exceeds C times, the interface is dampened at once. In the actual using, you can modify the running parameters of the interface flap dampening function as desired.

Table 2‑4 Configure the maximum flapping times and longest time of the interface dampening

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the maximum flapping times and longest time of the interface dampening | dampening flap-setting cause interface-flap max-flaps flap-value time time-value | Optional By default, the maximum flapping times is 2 and the longest time is 5s.

Configure Interface Flap Dampening Recovery Interval

After the interface is dampened, the interface flap dampening recovery function can recover the interface status automatically after the configured dampening recovery interval.

Table 2‑5 Configure the interface flap dampening recovery interval

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the interface flap dampening recovery interval | dampening recovery interval value | Optional By default, the interface flap dampening recovery interval is 300s.


2.2.2 Dampening Monitoring and Maintaining

Table 2‑6 Dampening monitoring and maintaining

Command | Description
show interface dampening [interface] | Display the running parameter information of the interface flap dampening function


2.3 Dampening Typical Configuration Example


2.3.1 Configure Dampening

Network Requirements

l The two interfaces of Device1 and Device2 are interconnected; run the routing protocol between the devices.

l Configure Dampening on the interconnected interfaces of Device1 and Device2, preventing the interconnected interfaces from causing the route flapping and affecting the user services.

Network Topology

Figure 2‑1 Networking of configuring Dampening

Configuration Steps

Step 1: | Configure the IP address of the interface, configure the route and so on (omitted).
Step 2: | Configure Dampening on Device1 interface.

#If configuring Dampening function and configuring the interface flapping times is larger than 3 within 20s, configure the interface to down, preventing the frequent flapping from causing the route flap.

Device1(config)#configure terminal

Device1(config)#interface gigabitethernet 0

Device1(config-if-gigabitethernet0)#dampening detect cause interface-flap

Device1(config-if-gigabitethernet0)#dampening flap-setting cause interface-flap max-flaps 3 time 20

#Configure the auto recovery function of the interface dampening on the interface, letting the interface recover up automatically after being dampened for 120s.

Device1(config-if-gigabitethernet0)#dampening recovery cause interface-flap

Device1(config-if-gigabitethernet0)#dampening recovery interval 120

Device1(config-if-gigabitethernet0)#end

#The configuration of Device2 is the same as that of Device1.

l The global interface flap dampening and auto recovery function are enabled by default.

Step 3:

Check the result.

#View the Dampening configuration information.

Device1#show interface dampening gigabitethernet 0

Dampening information of interface gigabitethernet0:

IfIndex Flaps Suppress SuppV MaxSTm Reuse ReuseTm ReuseV

4 0 FALSE 3 20 TRUE 0 120

#The LOG printing after the interface is dampened:

%IFDAMP-DOWN-3: gigabitethernet0 interface dampening conditions are met to trigger the execution the shutdown action.

#View the information after the interface is dampened.

Device1#show interface dampening gigabitethernet 0

Dampening information of interface gigabitethernet0:

IfIndex Flaps Suppress SuppV MaxSTm Reuse ReuseTm ReuseV

4 0 TRUE 3 20 TRUE 107 120

Device1#show interface gigabitethernet 0

Gigabitethernet0:

line protocol is administratively down by dampening

Flags: (0x18062) BROADCAST MULTICAST ARP RUNNING

Type: ETHERNET_CSMACD

Metric: 0, MTU: 1500, BW: 1000000 Kbps, DLY: 10 usec, VRF: global

Reliability 255/255, Txload 1/255, Rxload 1/255

Ethernet address is 0001.7ac1.1dc3

Last clearing of "show interface" counters never

5 minutes input rate 0 bit/sec, 0 packet/sec

5 minutes output rate 0 bit/sec, 0 packet/sec

0 packets received; 0 packets sent

0 multicast packets received

0 multicast packets sent

0 input errors; 0 output errors

0 collisions; 0 dropped

Unknown protocol 0

line status down: speed auto, duplex auto

rxframes:0, rxOctets:0, rxBroadcast:0, rxMulticast:0, rxPause:0

txframes:0, txOctets:0, txBroadcast:0, txMulticast:0, txPause:0

rxCrcErr:0, rxLenErr:0, rxCodeErr:0, rxOverflow:0, rxBad:0

txUnderrun:0, txCarrierSenceErr:0, singleColl:0 multipleColl:0


3 VRRP


3.1 Overview

VRRP (Virtual Router Redundancy Protocol) is one fault tolerance protocol. It ensures that when the next-hop device of the host fails, it can be replaced by another device in time, so as to ensure the continuity and reliability of the communication. To make VRRP work, first create one virtual IP address and MAC address. In this way, add one virtual device in the network. However, when the host in the network communicates with the virtual device, do not need to know any information of the physical device on the network. One virtual device comprises one host (master) and several slave devices (backup). The master device realizes the real forwarding function. When the master device fails, the slave device becomes the new master device and takes over its work.

The master device mentioned in the following text is replaced by “Master” and the slave device is replaced by “Backup”.


3.2 VRRP Function Configuration

Table 3‑1 VRRP function configuration list

Configuration Task
Configure the VRRP basic functions | Enable the VRRP protocol
 | Configure the VRRP priority
 | Configure the VRRP preemption mode
 | Configure the virtual MAC address of VRRP
Configure the VRRP association group | Configure the VRRP association group
Configure the VRRP network authentication | Configure the VRRP simple text authentication
Configure VRRP to link with Track | Configure VRRP to link with Track to monitor the Master uplink line
 | Configure VRRP to link with Track to monitor the Master and Backup interconnection line


3.2.1 Configure VRRP Basic Functions

In the configuration tasks of VRRP, first enable the VRRP protocol and the virtual IP address of the VRRP group needs to be in the same segment as the IP address of the interface so that the configured other functions can take effect.

Configuration Condition

Before configuring the VRRP basic functions, first complete the following task:

l Configure the IP address of the interface

Enable VRRP Protocol

To enable the VRRP function, you need to create the VRRP group and configure the virtual IP address in the interface.

Table 3‑2 Enable the VRRP protocol

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the VRRP group | vrrp vrid ip ip-address | Mandatory By default, do not enable VRRP.

Configure VRRP Priority

After configuring VRRP and if not setting priority, the default priority is 100. The device with high priority is elected as the Master for forwarding the packet and the other become Backup. If the priorities of all devices are equal, elect according to the interface IP address of the device. The one with large interface IP address becomes Master. We can set the VRRP priority as desired. The larger the value is, the higher the priority is.

Table 3‑3 Configure the VRRP priority

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the VRRP group priority | vrrp vrid priority priority | Mandatory By default, the VRRP priority is 100.

l When the interface IP address is the same as the virtual IP address, it immediately becomes Master and the priority is always 255.

Configure VRRP Preemption Mode

After configuring VRRP, in the preemption mode, once other device in the VRRP group discovers that its priority is higher than that of the current Master, it becomes Master; in non-preemption mode, as long as Master does not fail, even the other device has higher priority, it cannot become Master.

Table 3‑4 Configure the VRRP preemption mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the VRRP group as the preemption mode | vrrp vrid preempt | Mandatory By default, enable the preemption mode

Configure Virtual MAC Address of VRRP

One virtual router in the VRRP group has one virtual MAC address. According to RFC2338, the format of the virtual MAC address is 00-00-5E-00-01-{vrid}. When the virtual router replies the ARP request, the replied is real MAC address, but not the virtual MAC address of the interface. By default, the used is the real MAC address of the interface.

Table 3‑5 Configure the virtual MAC address of VRRP

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure VRRP to use the virtual MAC address | vrrp vrid use-vmac | Mandatory By default, use the real MAC address.

l By default, after configuring VRRP, the used is the real MAC address. After configuring the command of this section, use the virtual MAC, that is, when the host sends the packet, forward by the virtual MAC address; after deleting the command of this section, use the real MAC address, that is, when the host sends the packet, use the real MAC address to forward.


3.2.2 Configure VRRP Link Group

VRRP link group can reduce the interacting of the VRRP packets, relieve the network load, and reach the ms-class switching. Add the multiple common VRRP groups to one VRRP link group and different VRRP groups play different roles in the link group, such as Active or non-Active state. The Active group in the link group sends the protocol packet, while the non-Active does not send, the non-Active group status keeps consistent with the Active group status, that is, when the Active group status switches, the non-Active group status also switches, so as to reduce the interacting of the packet. Moreover, the link group can configure the sending period of the VRRP packet to ms level, so as to realize the fast switching.

Configuration Condition

Before configuring the VRRP link group, first complete the following task:

l Configure multiple VRRP groups

Configure VRRP Link Group

To configure the VRRP link group, first create one VRRP link group and then add the configured common VRRP group to the created link group. When the common VRRP group is added to the link group, it can be added in the Active or non-Active group form, but one link group should have one Active group and can only have one Active group.

Table 3‑6 Configure the VRRP link group

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the link group | vrrp linkgroup lgid [ interval Interval-time ] | Mandatory By default, the Interval-time value is 1000ms
Enter the interface configuration mode | interface interface-name | Mandatory
Add the VRRP general group to the link group by the Active mode | vrrp vrid linkgroup lrid [ active ] | Mandatory By default, the VRRP group is not added to association group.

l Besides the link group, multiple VRRP groups also can realize the load balance. For details, refer to the chapter of “Configure VRRP Load Balance” in “VRRP Typical Configuration Example”.

l In the link group, after the VRRP general group is added, the general group timer becomes invalid, that is, the sending period of the general group VRRP packets takes the timer of the link group as reference.


3.2.3 Configure VRRP Network Authentication

VRRP supports the simple text authentication. The set length of the text authentication cannot 8-bit authentication word.

Configuration Condition

Before configuring the VRRP network authentication, first complete the following task:

l Configure one VRRP group

Configure VRRP Simple Text Authentication

Table 3‑7 Configure the VRRP simple text authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the VRRP simple text authentication | vrrp vrid authentication text string | Mandatory By default, do not enable the simple text authentication function.


3.2.4 Configure VRRP to Link with Track

VRRP can monitor the status of the uplink line and Master, Backup interconnection line to improve the VRRP reliability.

Configuration Condition

Before configuring VRRP to link with Track, first complete the following task:

l Configure one VRRP group

Configure VRRP to Link with Track to Monitor Master Uplink Line

On Master, configure linking with Track. It can associate with the interface via Track, or associate with BFD, RTR to make it concern the status of the uplink interface. After the uplink interface is down, VRRP can reduce the Master priority via the configured decrement. Here, after Backup receives, it automatically switches to Master (note that the Master priority is lower than Backup priority). If it is necessary to switch Backup fast, we can configure receiving low-priority fast switching command on Backup. For details, refer to the following figure.

Figure 3‑1 Configure VRRP to link with Track to monitor Master uplink line

Configure VRRP to Link with Track to Associate with Uplink Interface

Associate VRRP with the concerned uplink interface via Track. When the uplink interface is down, Master automatically reduces its own priority. Here, Backup receives the low-priority VRRP packet and switches to Master. If the user is configured with “Receive low-priority packet fast switching”, that is, low-pri-master function, Backup fast switches to Master.

Table 3‑8 Configure VRRP to link with Track to associate with uplink interface (configure on Master)

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure VRRP to associate with the uplink interface | vrrp vrid track interface-name [ decrement ] | Mandatory By default, VRRP is not associated with Track.
Configure VRRP receiving low-priority packet fast switching function | vrrp vrid switchover low-pri-master | Optional By default, do not enable the low-pri-master function. The command is configured on Backup to switch fast when the Master priority is reduced.

Configure VRRP to Link with Track (Track Linking with BFD, RTR and so on)

If Track is associated with BFD, RTR and so on, Master can directly associate with Track, so as to monitor the line. When the line fails, Master reduces its own priority. Here, Backup receives the low-priority VRRP packet and switches to Master. If the user is configured with “Receive low-priority packet fast switching”, that is, low-pri-master function, Backup fast switches to Master.

Table 3‑9 Configure Master to link with Track (Track linking with BFD, RTR and so on)

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure VRRP to associate with the uplink interface | vrrp vrid track track-id [ decrement ] | Mandatory By default, VRRP is not associated with Track.
Configure VRRP receiving low-priority packet fast switching function | vrrp vrid switchover low-pri-master | Optional By default, do not enable the low-pri-master function. The command is configured on Backup to switch fast when the Master priority is reduced.

l For the configuration method of creating Track, Track associating with BFD or RTR, refer to Track configuration manual.

l If the low-pri-master function is configured and when Backup receives the low-priority packet, even it is non-preemption mode, it also switches fast. If the function is not configured when receiving the low-priority packet, Backup switches after the next timeout. If the switching time requirement is not strict, do not need to configure the low-pri-master function, but if the switching time requirement is strict, the function can make the switching time reach the ms level.

Configure VRRP to Associate with Track to Monitor Master and Backup Interconnection Line

Configure VRRP to associate with track to monitor Master and Backup interconnection line. If the line between Master and Backup is down, Backup fast switches to Master. For details, refer to the following figure.

Figure 3‑2 Configure VRRP to associate with track to monitor Master and Backup interconnection line

Table 3‑10 Configure VRRP to associate with track to monitor Master and Backup interconnection line

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the fast switching function when Backup VRRP device finds that the line between Master and Backup is down | vrrp vrid track track-id switchover | Mandatory By default, VRRP is not associated with Track.

l For the configuration of Track associating BFD and RTR, refer to Track Configuration Manual.

l Track can associate with BFD to monitor the status of the line between Master and Backup.


3.2.5 VRRP Monitoring and Maintaining

Table 3‑11 VRRP monitoring and maintaining

Command | Description
show vrrp [brief] | [ interface interface-name ] | [ [ linkgroup-number ] ] | [ timer ] | Display the VRRP configuration information, including virtual IP address information, virtual MAC address information, device status, device priority, dependent device interface address, link group information and so on.


3.3 VRRP Typical Configuration Example


3.3.1 Configure VRRP Single-backup Group

Network Requirements

l On Device1 and Device2, create one single VRRP backup group so that Device1 and Device2 share one virtual IP address, realizing the backup for the default gateway of the user host and reducing the interruption time of the network.

Network Topology

Figure 3‑3 Networking of configuring VRRP single backup group

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Create the VRRP group.

#On Device1, configure VRRP group 1, the virtual IP address is 10.1.1.3, and configure the priority as 110.

Device1#configure terminal

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#vrrp 1 ip 10.1.1.3

Device1(config-if-gigabitethernet0)#vrrp 1 priority 110

Device1(config-if-gigabitethernet0)#exit

#On Device2, configure VRRP group1 and the virtual IP address is 10.1.1.3.

Device2#configure terminal

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#vrrp 1 ip 10.1.1.3

Device2(config-if-gigabitethernet0)#exit

Step 3:

Check the result.

#View the VRRP status of Device1.

Device1#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.1

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.1/24

State : Master

Normal priority : 110

Currnet priority : 110

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

#View the VRRP status of Device2.

Device2#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.2

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.2/24

State : Backup

Master addr : 10.1.1.1

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

We can see that the VRRP status of Device1 is Master and the VRRP status of Device2 is Backup. Device1 and Device2 share one virtual IP address. The host communicates with the network via the address. When Device1 fails, Device2 switches to Master at once for forwarding data.

l The election principle of the VRRP status is by priority. The one with large priority is Master. If the priorities are the same, compare according to the IP address of the interface. The one with large IP address is Master.

l By default, VRRP works in the preemption mode. The default priority is 100.


3.3.2 Configure VRRP Link Group

Network Requirements

l On Device1 and Device2 sub interfaces, enable VRRP and add to the link group. Only the Active group in the link group interacts the protocol packets.

l The VRRP status of the non-Active keeps consistent with the VRRP status of the Active group. When the Active group status switches, the non-Active group also switches.

Network Topology

Figure 3‑4 VRRP multi-backup group networking

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Create one VRRP link group.

#Configure VRRP link group 1 on Device1.

Device1#configure terminal

Device1(config)#vrrp linkgroup 1

#Configure VRRP link group 1 on Device2.

Device2#configure terminal

Device2(config)#vrrp linkgroup 1

Step 3:

Create the VRRP group.

#Configure the virtual IP address of the VRRP group 1 as 11.1.1.3 on Device1 sub interface.

Device1(config)#interface gigabitethernet0.1

Device1(config-if-gigabitethernet0.1)#vrrp 1 ip 11.1.1.3

Device1(config-if-gigabitethernet0.1)#exit

#Configure the virtual IP address of the VRRP group 2 as 22.1.1.3 on Device1 sub interface.

Device1(config)#interface gigabitethernet0.2

Device1(config-if-gigabitethernet0.2)#vrrp 2 ip 22.1.1.3

Device1(config-if-gigabitethernet0.2)#exit

#Configure the virtual IP address of the VRRP group 1 as 11.1.1.3 on Device2 sub interface.

Device2(config)#interface gigabitethernet0.1

Device2(config-if-gigabitethernet0.1)#vrrp 1 ip 11.1.1.3

Device2(config-if-gigabitethernet0.1)#exit

#Configure the virtual IP address of the VRRP group 2 as 22.1.1.3 on Device2 sub interface.

Device2(config)#interface gigabitethernet0.2

Device2(config-if-gigabitethernet0.2)#vrrp 2 ip 22.1.1.3

Device2(config-if-gigabitethernet0.2)#exit

Step 4:

Configure VRRP to add to the link group.

#On Device1, the VRRP group 1 is added to the link group in Active mode.

Device1(config)#interface gigabitethernet0.1

Device1(config-if-gigabitethernet0.1)#vrrp 1 linkgroup 1 active

Device1(config-if-gigabitethernet0.1)#exit

#On Device1, the VRRP group 2 is added to the link group in non-Active mode.

Device1(config)#interface gigabitethernet0.2

Device1(config-if-gigabitethernet0.2)#vrrp 2 linkgroup 1

Device1(config-if-gigabitethernet0.2)#exit

#On Device2, the VRRP group 1 is added to the link group in Active mode.

Device2(config)#interface gigabitethernet0.1

Device2(config-if-gigabitethernet0.1)#vrrp 1 linkgroup 1 active

Device2(config-if-gigabitethernet0.1)#exit

#On Device2, the VRRP group 2 is added to the link group in non-Active mode.

Device2(config)#interface gigabitethernet0.2

Device2(config-if-gigabitethernet0.2)#vrrp 2 linkgroup 1

Device2(config-if-gigabitethernet0.2)#exit

Step 5:

Check the result.

#View the VRRP status on Device1.

Device1#show vrrp

Interface gigabitethernet0.1 (Flags 0x1)

Pri-addr : 11.1.1.1

Vrf : 0

Virtual router : 1

Linkgroup : 1

Active : TRUE

Virtual IP address : 11.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:11.1.1.1/24

State : Backup

Master addr : 11.1.1.2

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Interface gigabitethernet0.2 (Flags 0x1)

Pri-addr : 22.1.1.1

Vrf : 0

Virtual router : 2

Linkgroup : 1

Active : FALSE

Virtual IP address : 22.1.1.3

Virtual MAC address : 00-00-5e-00-01-02

Depend prefix:22.1.1.1/24

State : Backup

Master addr : 0.0.0.0

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

#View the VRRP status on Device2.

Device2#show vrrp

Interface gigabitethernet0.1 (Flags 0x1)

Pri-addr : 11.1.1.2

Vrf : 0

Virtual router : 1

Linkgroup : 1

Active : TRUE

Virtual IP address : 11.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:11.1.1.2/24

State : Master

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Interface gigabitethernet0.2 (Flags 0x1)

Pri-addr : 22.1.1.2

Vrf : 0

Virtual router : 2

Linkgroup : 1

Active : FALSE

Virtual IP address : 22.1.1.3

Virtual MAC address : 00-00-5e-00-01-02

Depend prefix:22.1.1.2/24

State : Master

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

We can see that the VRRP status of the non-Active group and Active group keep consistent.

Step 6:

Configure the priority of sub interface 1 in Device1 as 110, making the status change.

Device1(config)#interface gigabitethernet0.1

Device1(config-if-gigabitethernet0.1)#vrrp 1 priority 110

Device1(config-if-gigabitethernet0.1)#exit

#View the VRRP status on Device1.

Device1#show vrrp

Interface gigabitethernet0.1 (Flags 0x1)

Pri-addr : 11.1.1.1

Vrf : 0

Virtual router : 1

Linkgroup : 1

Active : TRUE

Virtual IP address : 11.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:11.1.1.1/24

State : Master

Normal priority : 110

Currnet priority : 110

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Interface gigabitethernet0.2 (Flags 0x1)

Pri-addr : 22.1.1.1

Vrf : 0

Virtual router : 2

Linkgroup : 1

Active : FALSE

Virtual IP address : 22.1.1.3

Virtual MAC address : 00-00-5e-00-01-02

Depend prefix:22.1.1.1/24

State : Master

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

#View the VRRP status on Device2.

Device2#show vrrp

Interface gigabitethernet0.1 (Flags 0x1)

Pri-addr : 11.1.1.2

Vrf : 0

Virtual router : 1

Linkgroup : 1

Active : TRUE

Virtual IP address : 11.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:11.1.1.2/24

State : Backup

Master addr : 11.1.1.1

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Interface gigabitethernet0.2 (Flags 0x1)

Pri-addr : 22.1.1.2

Vrf : 0

Virtual router : 2

Linkgroup : 1

Active : FALSE

Virtual IP address : 22.1.1.3

Virtual MAC address : 00-00-5e-00-01-02

Depend prefix:22.1.1.2/24

State : Backup

Master addr : 0.0.0.0

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

We can see that when the status of the Active group switches, the non-Active group also changes and keeps consistent with the Active group. The Active group in the link group is responsible for sending the protocol packets, but the non-Active group does not send packets. This can reduce the interacting of the protocol packets and the network load.

l The sending interval granularity can be smaller. The minimum can be configured to the ms level, so as to reach the ms-class fast switching.


3.3.3 Configure VRRP to Link with Track

Network Requirements

l Enable VRRP between Device1 and Device2; Device1 and Device2 share one virtual IP address, realizing the backup of the default gateway of the user host.

l Device1 monitors the status of the interface gigabitethernet1 via Track. When the uplink port gigabitethernet1 of Device1 is down, VRRP can feel and switch the status, making Backup become new Master for forwarding data.

Network Topology

Figure 3‑5 Networking of VRRP linking with Track

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Create the VRRP group.

#Configure the VRRP group 1 on Device1; the virtual IP address is 10.1.1.3 and the priority is 110.

Device1#configure terminal

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#vrrp 1 ip 10.1.1.3

Device1(config-if-gigabitethernet0)#vrrp 1 priority 110

Device1(config-if-gigabitethernet0)#exit

#Configure the VRRP group 1 on Device2; the virtual IP address is 10.1.1.3.

Device2#configure terminal

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#vrrp 1 ip 10.1.1.3

Device2(config-if-gigabitethernet0)#exit

#View the VRRP status of Device1.

Device1#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.1

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.1/24

State : Master

Normal priority : 110

Currnet priority : 110

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

#View the VRRP status of Device2.

Device2#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.2

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.2/24

State : Backup

Master addr : 10.1.1.1

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Step 3:

Configure VRRP to link with Track.

#On Device1, configure VRRP to link with Track and monitor the uplink interface gigabitethernet1; configure the priority decrement as 20.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#vrrp 1 track gigabitethernet1 20

Device1(config-if-gigabitethernet0)#exit

# View the VRRP status of Device1.

Device1#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.1

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.1/24

State : Master

Normal priority : 110

Currnet priority : 110

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Track interface : gigabitethernet1

Reduce : 20

Reduce state : NO

When the uplink interface gigabitethernet1 of Device1 is down, the VRRP priority is reduced by 20. Here, the priority of Device2 is high, so the status changes.

#View the VRRP status of Device1.

Device1#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.1

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.1/24

State : Backup

Master addr : 10.1.1.2

Normal priority : 110

Currnet priority : 90

Priority reduced : 20

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Track interface : gigabitethernet1

Reduce : 20

Reduce state : YES

#View the VRRP status of Device2.

Device2#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.2

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.2/24

State : Master

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

l If the association of VRRP and Track needs to reach the fast switching, we can configure switchover low-pri-master on Backup.


3.3.4 Configure VRRP to Link with BFD

Network Requirements

l Enable VRRP between Device1 and Device2.

l The VRRP status switching time of Device1 and Device2 needs at least 3s and the service interruption time is long. It is necessary to configure the VRRP and BFD association on Device1 and Device2, realizing the ms-level switching.

Network Topology

Figure 3‑6 Networking of VRRP linking with BFD

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Create the VRRP group.

#Configure the VRRP group 1 on Device1; the virtual IP address is 10.1.1.3 and the priority is 105.

Device1#configure terminal

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#vrrp 1 ip 10.1.1.3

Device1(config-if-gigabitethernet0)#vrrp 1 priority 105

Device1(config-if-gigabitethernet0)#exit

#Configure the VRRP group 1 on Device2; the virtual IP address is 10.1.1.3.

Device2#configure terminal

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#vrrp 1 ip 10.1.1.3

Device2(config-if-gigabitethernet0)#exit

#View the VRRP status of Device1.

Device1#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.2

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.2/24

State : Master

Normal priority : 105

Currnet priority : 105

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

#View the VRRP status of Device2.

Device2#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.2

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.2/24

State : Backup

Master addr : 10.1.1.1

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Step 3:

Configure Track to link with BFD.

#Configure Track to link with BFD on Device1.

Device1(config)#track 1

Device1(config-track)#bfd interface gigabitethernet0 remote-ip 10.1.1.2 local-ip 10.1.1.1

Device1(config-track)#exit

#Configure Track to link with BFD on Device2.

Device2#configure terminal

Device2(config)#track 1

Device2(config-track)#bfd interface gigabitethernet0 remote-ip 10.1.1.1 local-ip 10.1.1.2

Device2(config-track)#exit

#View the BFD status on Device1.

Device1#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

10.1.1.1 10.1.1.2 6/7 UP 5000 gigabitethernet0

#View the BFD status on Device2.

Device2#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

10.1.1.2 10.1.1.1 7/6 UP 5000 gigabitethernet0

Step 4:

Configure VRRP to link with Track.

#Configure VRRP to link with Track on Device2 and configure switchover.

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#vrrp 1 track 1 switchover

Device2(config-if-gigabitethernet0)#exit

Step 5:

Check the result.

#View the VRRP status on Device2.

Device2#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.1

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.1/24

State : Backup

Master addr : 10.1.1.2

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Track object : 1

Switchover state : NO

When Device1 line fails, BFD session is down and Track also becomes down. Device2 feels at once and switches to Master forwarding data.

#View the BFD and VRRP status on Device2.

Device2#show bfd session

OurAddr NeighAddr LD/RD State Holddown interface

10.1.1.2 10.1.1.1 7/0 DOWN 5000 gigabitethernet0

Device2#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.2

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.2/24

State : Master

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Track object : 1

Switchover state : YES

l When VRRP links with Track, Switchover needs to be configured on Backup. Once finding Track down, switch to Master at once.


3.3.5 Configure VRRP Load Balance

Network Requirements

l Device1 and Device2 belong to two VRRP groups at the same time; Device1 is Master in group1 and Backup in group2; Device2 is Backup in group1 and Master in group2.

l PC1 forwards data via Device1 and PC2 forwards data via Device2, realizing the load balance.

Network Topology

Figure 3‑7 VRRP load balance networking

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Create the VRRP group 1.

#Configure the VRRP group 1 on Device1; the virtual IP address is 10.1.1.3 and the priority is 110.

Device1#configure terminal

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#vrrp 1 ip 10.1.1.3

Device1(config-if-gigabitethernet0)#vrrp 1 priority 110

Device1(config-if-gigabitethernet0)#exit

#Configure the VRRP group 1 on Device2; the virtual IP address is 10.1.1.3.

Device2#configure terminal

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#vrrp 1 ip 10.1.1.3

Device2(config-if-gigabitethernet0)#exit

Step 3:

Create VRRP group 2.

#Configure the virtual IP address of VRRP group2 as 10.1.1.4 on Device1.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#vrrp 2 ip 10.1.1.4

Device1(config-if-gigabitethernet0)#exit

#Configure the virtual IP address of VRRP group2 as 10.1.1.4 on Device2 and configure the priority as 110.

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#vrrp 2 ip 10.1.1.4

Device2(config-if-gigabitethernet0)#vrrp 2 priority 110

Device2(config-if-gigabitethernet0)#exit

Step 4:

Check the result.

#View the status of VRRP in group1 and group2 on Device1.

Device1#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.1

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.1/24

State : Master

Normal priority : 110

Currnet priority : 110

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Virtual router : 2

Virtual IP address : 10.1.1.4

Virtual MAC address : 00-00-5e-00-01-02

Depend prefix:10.1.1.1/24

State : Backup

Master addr : 10.1.1.2

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

#View the status of VRRP in group1 and group2 on Device2.

Device2#show vrrp

Interface gigabitethernet0 (Flags 0x1)

Pri-addr : 10.1.1.2

Vrf : 0

Virtual router : 1

Virtual IP address : 10.1.1.3

Virtual MAC address : 00-00-5e-00-01-01

Depend prefix:10.1.1.2/24

State : Backup

Master addr : 10.1.1.1

Normal priority : 100

Currnet priority : 100

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

Virtual router : 2

Virtual IP address : 10.1.1.4

Virtual MAC address : 00-00-5e-00-01-02

Depend prefix:10.1.1.2/24

State : Master

Normal priority : 110

Currnet priority : 110

Priority reduced : 0

Preempt-mode : YES

Advertise-interval : 1

Authentication Mode : None

We can see that Device1 serves as Master of VRRP group1 and Backup of VRRP group2. In contrast with Device1, Device2 serves as Master of VRRP group 2 and Backup of VRRP group 2. When one device fails, two PCs forward data via the other device. This realizes the load balance and backup for each other.


4 VBRP


4.1 Overview

VBRP (Virtual Backup Router Protocol) provides one backup function for the gateway, used by multiple routers to maintain the continuous forwarding of the virtual gateway. VBRP maps the referred multiple routers to one virtual router and ensures that there is only one router to represent for the virtual router to forward packets. When the router for forwarding data cannot work normally because of some reason, another standby router replaces the virtual router to forward packets, while the router that cannot work normally does not bear the forwarding task any more. The switching process is short and it is transparent for the host in the LAN, so as to reach the backup function for the gateway.

The active device mentioned in the following text is replaced by “Active” and the standby device is replaced by “Standby”.


4.2 VBRP Function Configuration

Table 4‑1 VBRP function configuration list

Configuration Task
Configure the VBRP basic functions | Enable the VBRP protocol
 | Enable the VBRP priority
 | Enable the VBRP preemption mode
 | Configure the VBRP virtual MAC address
Configure the VBRP network authentication | Configure the VBRP simple text authentication
 | Configure the VBRP MD5 authentication
Configure VBRP to link with Track to associate with the uplink interface | Configure VBRP to link with Track to associate with the uplink interface


4.2.1 Configure VBRP Basic Functions

In the configuration tasks of VBRP, first enable the VBRP function and the virtual IP address of the VBRP group needs to be in the same segment as the interface IP address so that the configured other functions can take effect.

Configuration Condition

Before configuring the VBRP basic functions, first complete the following task:

l Configure the interface IP address

Enable VBRP Protocol

To enable the VBRP function, we need to create the VBRP group in the interface and add the VBRP router to the group.

Table 4‑2 Enable the VBRP protocol

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the VBRP group | standby [ group-number ] ip [ ip-address ] | Mandatory By default, do not enable VBRP.

Configure VBRP Priority

After configuring VBRP and if not setting the priority, the default priority is 100. The device with high priority is elected as Active for forwarding the packet and the other become Standby. If the priorities of all devices are equal, elect according to the interface IP address of the device. The one with large interface IP address becomes Active. We can set the VBRP priority as desired. The larger the value, the higher the priority.

Table 4‑3 Configure the VBRP priority

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the priority of the VBRP group | standby [ group-number ] priority value | Mandatory By default, the VBRP priority is 100.

Configure VBRP Preemption Mode

In the preemption mode, once other device in the VBRP group discovers that its priority is higher than that of the current Active, it becomes Active; in non-preemption mode, as long as Active does not fail, even the other device has higher priority, it cannot become Active.

Table 4‑4 Configure the VBRP preemption mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the VBRP group as the preemption mode | standby [ group-number ] preempt [ delay delay-time ] | Mandatory By default, it is the non-preemption mode.

Configure VBRP Virtual MAC Address

After configuring VBRP and if it is necessary to make the VBRP group use the virtual MAC address, we need to use the following command to configure. When the virtual router replies the ARP request, the replied is virtual MAC address, but not the real MAC address of the interface. By default, the used is the real MAC address.

Table 4‑5 Configure the VBRP real MAC

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure VBRP as the real MAC | standby [ group-number ] use-vmac | Mandatory By default, use the real MAC address.

l By default, after configuring VBRP, the used is the real MAC address. After configuring the command standby use-vmac, use the virtual MAC, that is, when the host sends the packet, forward by the virtual MAC address; after configuring the command no standby use-vmac, use the real MAC address of the interface, that is, when the host sends the packet, use the real MAC address to forward.


4.2.2 Configure VBRP Network Authentication

VBRP has two modes, that is, simple text authentication and MD5 authentication. The set length of the simple text authentication cannot exceed eight authentication words. The set length of the MD5 authentication is the authentication word not exceeding 64 bits.

Configuration Condition

Before configuring the VBRP basic functions, first complete the following task:

l Configure the VBRP group

Configure VBRP Simple Text Authentication

Configure the VBRP authentication to check and verify the validity of the VBRP packet. We can use the following command to configure the VBRP simple text authentication mode.

Table 4‑6 Configure the VBRP simple text authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the VBRP simple text authentication | standby group-number authentication { string } | Mandatory By default, do not enable the simple text authentication. The configured authentication word is string and the length cannot exceed 8-bit authentication word.

Configure VBRP MD5 Authentication

Configure the VBRP authentication to check and verify the validity of the VBRP packet. We can use the following command to configure the VBRP MD5 authentication mode.

Table 4‑7 Configure the VBRP MD5 authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure the VBRP MD5 authentication | standby group-number authentication { md5 { key-id key-identifier key-string key-string } | { key-string key-string } } | Mandatory By default, do not enable the MD5 authentication. Configure the MD5 network authentication and the length cannot exceed 8-bit authentication word.


4.2.3 Configure VBRP to Link with Track

Associate VBRP with the concerned uplink interface via Track. When the uplink interface is down, Active automatically reduces its own priority. Here, Standby receives the low-priority packet and switches to Active. For details, refer to the following figure.

Figure 3–1 Configure VBRP to link with Track to monitor Active uplink line

Configuration Condition

Before configuring the VBRP basic functions, first complete the following task:

l Configure the VBRP group

Configure VBRP to Link with Track to Associate with Uplink Interface

Associate VBRP with the concerned uplink interface via Track. When the uplink interface is down, Active automatically reduces its own priority. Here, Standby receives the low-priority packet and switches to Active.

Table 4‑8 Configure VBRP to link with Track to associate with the uplink interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure VBRP to link with Track to associate with the uplink interface | standby [ group-number ] track { { interface-name} | track-id } [ decrement ] | Mandatory Configure associating with the interface-name interface. When the interface is down, the priority reduces by decrement. By default, reduce the priority to 10.

Configure VBRP to Link with Track to Associate with BFD and RTR

If Track is associated with BFD, RTR and so on, Active can directly associate with the Track group, so as to monitor the line. When the line fails, Active reduces its own priority. Here, Standby receives the low-priority VBRP packet, switch to Active.

Table 4‑9 Configure VBRP to link with Track to associate with BFD and RTR

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | Mandatory
Configure VBRP to link with Track to associate with the uplink interface | standby [ group-number ] track { track-id } [ decrement ] | Mandatory Configure associating with Track track-id. The Track is associated with BFD, RTR and so on. By default, the priority is reduced by 10.

l For the configuration method of associating Track with BFD, RTR and so on, refer to Track Configuration Manual.


4.2.4 VBRP Monitoring and Maintaining

Table 4‑10 VBRP monitoring and maintaining

Command | Description
Show standby [brief] | [ all ] | [ interface interface-name ] | Display the VBRP configuration information, including virtual IP address information, virtual MAC address information, device status, device priority, dependent device interface address, link group information and so on.


4.3 VBRP Typical Configuration Example


4.3.1 Configure VBRP Basic Mode

Network Requirements

l Enable VBRP between Device1 and Device2; Device1 and Device2 share one virtual IP address, realizing the backup for the default gateway of the user host and reducing the network interruption time.

Network Topology

Figure 4‑2 Networking of VBRP basic mode

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Create the VBRP group.

#Configure VBRP group 1 on Device1; the virtual IP address is 10.1.1.10; enable the preemption mode; configure the priority as 110.

Device1#configure terminal

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#standby 1 ip 10.1.1.10

Device1(config-if-gigabitethernet0)#standby 1 preempt

Device1(config-if-gigabitethernet0)#standby 1 priority 110

Device1(config-if-gigabitethernet0)#exit

#Configure VBRP group 1 on Device2; the virtual IP address is 10.1.1.10; enable the preemption mode;

Device2#configure terminal

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#standby 1 ip 10.1.1.10

Device2(config-if-gigabitethernet0)#standby 1 preempt

Device2(config-if-gigabitethernet0)#exit

Step 3:

Check the result.

#View the VBRP status of Device1.

Device1#show standby

Interface gigabitethernet0

Primary address 10.1.1.1, state up

Group 1

State is Active

Virtual IP address is 10.1.1.10

Refer to local IP prefix 10.1.1.1/24

Local virtual MAC address is 0000.0c07.ac01

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 1.666680 secs

Preemption enabled, delay 0 sec

Active router is local

Standby router is 10.1.1.2, priority 100 (expires in 8.866672 secs)

Priority 110 (configured 110)

#View the VBRP status of Device2.

Device2#show standby

Interface gigabitethernet0

Primary address 10.1.1.2, state up

Group 1

State is Standby

Virtual IP address is 10.1.1.10

Refer to local IP prefix 10.1.1.2/24

Local virtual MAC address is 0000.0c07.ac01

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 0.450022 secs

Preemption enabled, delay 0 sec

Active router is 10.1.1.1, priority 110 (expires in 7.266656 secs)

Standby router is local

Priority 100 (configured 100)

From the VBRP status, we can see that the VBRP priority of Device1 is 110, the status is Active, and the VBRP status of Device2 is Standby. After Device1 fails, Device2 automatically switches to Active for forwarding data.

l The election principle of the VRRP status is by priority. The one with large priority is Active. If the priorities are the same, compare according to the IP address of the interface. The one with large IP address is Active.

l By default, VBRP works in the non-preemption mode. The preemption mode needs to be configured manually. It is recommended to configure as the preemption mode.

l The default priority of VBRP is 100.


4.3.2 Configure VBRP to Link with Track

Network Requirements

l Enable VBRP between Device1 and Device2.

l Device1 monitors the interface gigabitethernet1 status via Track. When the uplink port gigabitethernet1 of Device1 is down, VBRP can feel and switch the status, making Standby become new Active for forwarding data.

Network Topology

Figure 4‑3 Networking of configuring VBRP to link with Track

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Create the VBRP group.

#Configure the virtual IP address of VBRP group 1 on Device1 as 10.1.1.10, enable the preemption function, and configure the priority as 110.

Device1#configure terminal

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#standby 1 ip 10.1.1.10

Device1(config-if-gigabitethernet0)#standby 1 preempt

Device1(config-if-gigabitethernet0)#standby 1 priority 110

Device1(config-if-gigabitethernet0)#exit

#Configure the virtual IP address of VBRP group1 on Device2 as 10.1.1.10 and enable the preemption function.

Device2#configure terminal

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#standby 1 ip 10.1.1.10

Device2(config-if-gigabitethernet0)#standby 1 preempt

Device2(config-if-gigabitethernet0)#exit

#View the VBRP status of Device1.

Device1#show standby

Interface gigabitethernet0

Primary address 10.1.1.1, state up

Group 1

State is Active

Virtual IP address is 10.1.1.10

Refer to local IP prefix 10.1.1.1/24

Local virtual MAC address is 0000.0c07.ac01

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 1.933336 secs

Preemption enabled, delay 0 sec

Active router is local

Standby router is 10.1.1.2, priority 100 (expires in 9.599976 secs)

Priority 110 (configured 110)

#View the VBRP status of Device2.

Device2#show standby

Interface gigabitethernet0

Primary address 10.1.1.2, state up

Group 1

State is Standby

Virtual IP address is 10.1.1.10

Refer to local IP prefix 10.1.1.2/24

Local virtual MAC address is 0000.0c07.ac01

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 1.216658 secs

Preemption enabled, delay 0 sec

Active router is 10.1.1.1, priority 110 (expires in 7.550018 secs)

Standby router is local

Priority 100 (configured 100)

Step 3:

Configure VBRP to link with Track.

#On Device1, configure VBRP to link with Track, monitor the uplink interface gigabitethernet1, and configure the priority decrement as 20.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#standby 1 track gigabitethernet1 20

Device1(config-if-gigabitethernet0)#exit

#View the VBRP status of Device1.

Device1#show standby

Interface gigabitethernet0

Primary address 10.1.1.1, state up

Group 1

State is Active

Virtual IP address is 10.1.1.10

Refer to local IP prefix 10.1.1.1/24

Local virtual MAC address is 0000.0c07.ac01

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 2.716678 secs

Preemption enabled, delay 0 sec

Active router is local

Standby router is 10.1.1.2, priority 100 (expires in 8.166660 secs)

Priority 110 (configured 110)

Track interface gigabitethernet1 state Up decrement 20

#When the uplink port gigabitethernet1 of Device1 is down, the VBRP priority is reduced by 20. Here, the priority of Device2 is high, so the status switches.

#View the VBRP status of Device1.

Device1#show standby

Interface gigabitethernet0

Primary address 10.1.1.1, state up

Group 1

State is Standby

Virtual IP address is 10.1.1.10

Refer to local IP prefix 10.1.1.1/24

Local virtual MAC address is 0000.0c07.ac01

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 0.49998 secs

Preemption enabled, delay 0 sec

Active router is 10.1.1.2, priority 100 (expires in 8.233324 secs)

Standby router is local

Priority 90 (configured 110)

Track interface gigabitethernet1 state Down decrement 20

#View the VBRP status on Device2.

Device2#show standby

Interface gigabitethernet0

Primary address 10.1.1.2, state up

Group 1

State is Active

Virtual IP address is 10.1.1.10

Refer to local IP prefix 10.1.1.2/24

Local virtual MAC address is 0000.0c07.ac01

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 2.699972 secs

Preemption enabled, delay 0 sec

Active router is local

Standby router is 10.1.1.1, priority 90 (expires in 8.516646 secs)

Priority 100 (configured 100)


4.3.3 Configure VBRP Load Balance Mode

Network Requirements

l Device1 and Device2 belong to two VBRP groups at the same time; Device1 is Active in group1 and Standby in group2; Device2 is Standby in group1 and Active in group2.

l PC1 forwards data via Device1 and PC2 forwards data via Device2, realizing the load balance.

Network Topology

Figure 4‑4 Networking of VBRP load balance

Configuration Steps

Step 1: | Configure the IP address of the interface.(Omitted)
Step 2: | Create VBRP group1.

#Configure the virtual IP address of VBRP group 1 on Device1 as 10.1.1.10, enable the preemption function, and configure the priority as 110.

Device1#configure terminal

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#standby 1 ip 10.1.1.10

Device1(config-if-gigabitethernet0)#standby 1 preempt

Device1(config-if-gigabitethernet0)#standby 1 priority 110

Device1(config-if-gigabitethernet0)#exit

#Configure the virtual IP address of VBRP group1 on Device2 as 10.1.1.10 and enable the preemption function.

Device2#configure terminal

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#standby 1 ip 10.1.1.10

Device2(config-if-gigabitethernet0)#standby 1 preempt

Device2(config-if-gigabitethernet0)#exit

Step 3:

Create VBRP group2.

#Configure the virtual IP address of VBRP group 2 on Device1 as 10.1.1.11, and enable the preemption function.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#standby 2 ip 10.1.1.11

Device1(config-if-gigabitethernet0)#standby 2 preempt

Device1(config-if-gigabitethernet0)#exit

#Configure the virtual IP address of VBRP group 1 on Device2 as 10.1.1.11, enable the preemption function, and configure the priority as 120.

Device2(config)#interface gigabitethernet0

Device2(config-if-gigabitethernet0)#standby 2 ip 10.1.1.11

Device2(config-if-gigabitethernet0)#standby 2 preempt

Device2(config-if-gigabitethernet0)#standby 2 priority 120

Device2(config-if-gigabitethernet0)#exit

Step 4:

Check the result.

#View the status of VBRP in group 1 and group 2 on Device1.

Device1#show standby

Interface gigabitethernet0

Primary address 10.1.1.1, state up

Group 1

State is Active

Virtual IP address is 10.1.1.10

Refer to local IP prefix 10.1.1.1/24

Local virtual MAC address is 0000.0c07.ac01

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 0.633348 secs

Preemption enabled, delay 0 sec

Active router is local

Standby router is 10.1.1.2, priority 100 (expires in 7.83370 secs)

Priority 110 (configured 110)

Group 2

State is Standby

Virtual IP address is 10.1.1.11

Refer to local IP prefix 10.1.1.1/24

Local virtual MAC address is 0000.0c07.ac02

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 0.950002 secs

Preemption enabled, delay 0 sec

Active router is 10.1.1.2, priority 120 (expires in 7.300028 secs)

Standby router is local

Priority 100 (configured 100)

#View the status of VBRP in group 1 and group 2 on Device2.

Device2#show standby

Interface gigabitethernet0

Primary address 10.1.1.2, state up

Group 1

State is Standby

Virtual IP address is 10.1.1.10

Refer to local IP prefix 10.1.1.2/24

Local virtual MAC address is 0000.0c07.ac01

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 0.600016 secs

Preemption enabled, delay 0 sec

Active router is 10.1.1.1, priority 110 (expires in 7.700012 secs)

Standby router is local

Priority 100 (configured 100)

Group 2

State is Active

Virtual IP address is 10.1.1.11

Refer to local IP prefix 10.1.1.2/24

Local virtual MAC address is 0000.0c07.ac02

Current MAC type BIA

Hello time 3 sec, hold time 10 sec

Next hello sent in 0.816674 secs

Preemption enabled, delay 0 sec

Active router is local

Standby router is 10.1.1.1, priority 100 (expires in 8.33332 secs)

Priority 120 (configured 120)

We can see that Device1 serves as Active of VBRP group1 and Standby of VBRP group2. In contrast with Device1, Device2 serves as Active of VBRP group 2 and Standby of VBRP group 1. When one device fails, two PCs forward data via the other device. This realizes the load balance and backup for each other.


5 Track


5.1 Overview

Track can be used to monitor some information when the system runs. The other service modules can be associated with Track so that the service module can monitor the change when the system runs. After the service module is associated with Track and when the information monitored by Track changes, Track informs the service module so that the service module can process correspondingly. For example, in the actual application, VRRP and VBRP often monitor the uplink interface status and network availability by associating with Track and adjust its own priority according to the information, so as to realize the active/standby switchover.


5.2 Track Function Configuration

Table 5‑1 Track function configuration list

Configuration Task
Configure the Track group | Configure the Track group
Configure the monitor object | Configure the monitor interface status
 | Configure monitoring the status of the switching port
 | Configure monitoring the direct route of the interface
 | Configure monitoring 3G interface signal
 | Configure monitoring route reachable
 | Configure monitoring the RTR group
 | Configure monitoring the BFD session


5.2.1 Configure Track Group

Configuration Condition

None

Configure Track Group

The system can configure multiple Track groups. Each Track group is independent from each other. One Track group can include multiple monitor objects.

The Track group has two logics, that is, “and”, “or”:

l When the Track group logic is “and”, all monitor objects in Track group need to be up so that the Track group can be up; on contrast, it is down.

l When the Track group logic is “or”, as long as one monitor object in Track group is up, the Track object status can be up; on contrast, it is down.

The Track group has the logical reversing function:

l When the Track group is configured with the logical reversing function, and the previous logical calculation result of the Track group is up, the feedback is down; when the previous logical calculation result is down, the feedback is up.

Table 5‑2 Configure the Track group

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the Track group | track group-id | Mandatory
Configure Track group logic | logic operator { AND | OR } | Optional AND: logic “and” OR: logic “or” By default, Track group logic is “or”.
Configure the logical reversing function of the Track group | logic reverse | Optional By default, the Track group is not configured with the logical reversing function.

l When the service module needs to monitor some information via Track, besides configuring the monitor object in the Track group, we also need to refer to the service module configuration manual and configure the service module to associate with Track group.


5.2.2 Configure Monitor Object

Configuration Condition

Before configuring the monitor object, first complete the following task:

l Configure the Track group

Configure Monitoring Interface Status

We can configure the monitor object as the interface status in the Track group. When the interface network layer protocol is up, the monitor object status is up; when the interface network layer protocol is down, the monitor object status is down.

Table 5‑3 Configure monitoring interface status

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the Track configuration mode | track group-id | Mandatory
Configure monitoring interface status | interface interface-name line-protocol | Mandatory By default, do not configure monitoring the status of the interface network layer protocol.

Configure Monitoring Switching Port Status

We can configure the monitor object as the status of the switching port in the Track group. When the switching port is up, the monitor object status is up; when the switching port is down, the monitor object status is down.

Table 5‑4 Configure monitoring the interface status

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the Track configuration mode | track group-id | Mandatory
Configure monitoring the status of the switching port | switchport interface interface-name | Mandatory By default, do not configure monitoring the switching port status.

Configure Monitoring 3G Interface Signal

In the Track group, we can configure the monitor object as the 3G interface signal. When the 3G interface signal is good, the status of the monitor object is up; when the 3G interface signal is poor, the status of the monitor object is down.

Table 5‑5Configure monitoring the 3G interface signal

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the Track configuration mode | track group-id | Mandatory
Configure monitoring the 3G interface signal | interface interface-name 3g-signal | Mandatory By default, do not configure monitoring the 3G interface signal.

Configure Monitoring Direct Route of Interface

We can configure the monitor object as the direct route of the interface in the Track group. When the interface has IP address and the status is up, the status of the monitor object is up; when the interface does not have IP address or the status is down, the status of the monitor object is down.

Table 5‑6 Configure monitoring the direct route of the interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the Track configuration mode | track group-id | Mandatory
Configure monitoring the direct route of the interface | interface interface-name ip-routing | Mandatory By default, do not configure monitoring the direct route of the interface.

Configure Monitoring Route Reachable

We can configure the monitor object as the route reachable in the Track group. When there is the route of the configured network, the status of the monitor object is up; when there is no route of the configured network, the status of the monitor object is down.

Table 5‑7 Configure monitoring route reachable

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the Track configuration mode | track group-id | Mandatory
Configure monitoring route reachable | ip-route network mask [ vrf vrf-name ] [ metric metric-value ] | Mandatory By default, do not configure monitoring the reachability of the route to the specified network. When there is the option metric, the route metric to the network needs to be smaller than the configured value so that the status of the monitor object can be up.

Configure Monitoring RTR Group

We can configure the monitor object as the RTR group in the Track group. When the status of the RTR group is reachable, the status of the monitor object is up; when the status of the RTR group is unreachable, the status of the monitor object is down. RTR (Response Time Reporter) is one tool of detecting and monitoring the network. Track can monitor the RTR group to monitor the network communication.

Table 5‑8 Configure monitoring the RTR group

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the Track configuration mode | track group-id | Mandatory
Configure monitoring the RTR group | rtr rtr-group-id | Mandatory By default, do not configure monitoring the RTR group.

l For the configuration of the RTR group, refer to SLA chapter of the configuration manual.

Configure Monitoring BFD Session

We can configure the monitor object as the BFD session in the Track group. When the status of the BFD session is up, the status of the monitor object is up; when the status of the BFD session is down, the status of the monitor object is down. The BFD protocol is one set of standard unified detection mechanism, used to fast detect, monitor the path in the network or the connection status of the IP route forwarding. The network connection status can be monitored indirectly by monitoring the BFD session.

Table 5‑9 Configure monitoring the BFD session

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the Track configuration mode | track group-id | Mandatory
Configure monitoring the BFD session | bfd interface interface-name remote-ip ip-address local-ip ip-address | Mandatory By default, do not configure monitoring the BFD session. When configuring monitoring the BFD session, it needs to be configured at the two sides of the BFD session. Otherwise, the BFD session cannot be set up successfully.


5.2.3 Track Monitoring and Maintaining

Table 5‑10 Track monitoring and maintaining

Command | Description
show track object group-id | Display the Track group information.
show track object group-id | Display the Track group information.


6 BFD


6.1 Overview

The BFD (Bidirectional Forwarding Detection) protocol is a set of standard and unified detection mechanism, used to detect and monitor the path in the network or IP route forwarding connection status fast. It provides one universal, standard, medium-independent, and protocol-independent fast fault detection mechanism. It can fast detect the line fault between two devices for the upper-layer protocols, such as routing protocol and MPLS.

BFD can provide the fault detection on any type of path between the systems. One BFD session is set up based on the specific application demand. If multiple application protocols correspond to the same path, you can use one BFD session to detect.

The processing flow of the BFD protocol and the upper application protocol includes:

The upper application protocol sends the neighbor information (including peer IP address, local IP address, interface and so on) to the BFD protocol.

The BFD protocol queries whether there is the corresponding session. If no, create the corresponding session according to the received neighbor information and then the BFD session sends the BFD control packet to drive the running of the status machine. The BFD control packet completes the session via three times handshake mechanism, experiencing the transfer from Down to Init and from Init to Up. When setting up the session, the session parameters are negotiated, including the interval of sending packets and detection interval.

After the session is set up, send the detection packets periodically to detect the path status. If the BFD control packets of the peer device are not received within the detection interval, the BFD protocol regards that the path has fault and informs the fault information to the upper application protocol.

After the upper application protocol receives the fault report, inform the BFD protocol to delete the session when disabling or deleting the neighbor. If no other upper-layer protocol needs to detect the session link, delete the corresponding session.

According to the type of the detection path, it includes the single-hop IP path detection neighboring with the local end and the peer, and the multi-hop IP path detection not neighboring with the local end and peer. Currently, linking OSPF, RIP, EBGP, ISIS, LDP, RSVP-TE, TRACK, and static route protocols with BFD belongs to the single-hop IP path detection. IBGP linking with BFD belongs to multi-hop IP path detection.


6.2 BFD Function Configuration

Table 6‑1 BFD function configuration list

Configuration Task

Configure the BFD basic functions

Configure the minimum sending interval of the BFD control packets

Configure the minimum receiving interval of the BFD control packets

Configure the detection timeout multiples of the BFD session


6.2.1 Configure BFD Basic Functions

Configuration Condition

Before configuring the BFD basic functions, first complete the following tasks:

l Configure the IP address of the interface, making the neighboring node network layer reachable

l Configure the upper-layer application associated with BFD

Configure Minimum Sending Interval of BFD Control Packets

Table 6‑2 Configure the minimum sending interval of BFD control packets

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the minimum sending interval of BFD control packets | bfd min-transmit-interval value | Optional By default, the minimum sending interval of BFD control packets is 1000ms.

l The actual sending interval of the peer BFD packets = MAX (minimum sending interval of the peer BFD control packets, the minimum receiving interval of the local BFD control packets)

Configure Minimum Receiving Interval of BFD Control Packets

Table 6‑3 Configure the minimum receiving interval of the BFD control packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the minimum receiving interval of the BFD control packet | bfd min-receive-interval value | Optional By default, the minimum receiving interval of the BFD control packets is 1000ms.

l The actual sending interval of the local BFD packets = MAX (minimum sending interval of the local BFD control packets, the minimum receiving interval of the peer BFD control packets)

Configure Detection Timeout Multiples of BFD Session

Table 6‑4 Configure the detection timeout multiples of the BFD session

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the detection timeout multiples of the BFD session | bfd multiplier value | Optional By default, the detection timeout multiples of the BFD session is 5.

l To ensure the validity of the BFD session detection, be careful to configure the minimum of the BFD detection timeout multiples.

l Local BFD actual detection time = the detection timeout multiples of the peer BFD session × the actual sending interval of the peer BFD packet


6.2.2 BFD Monitoring and Maintaining

Table 6‑5 BFD monitoring and maintaining

Command | Description
show bfd | Display the supported BFD parameters
show bfd client | Display the BFD client information
show bfd error-statistics | Display the BFD error statistics information
show bfd session [ neighbor-ip-address [ detail ] | detail ] | Display the BFD session information


6.3 BFD Typical Configuration Example


6.3.1 Configure BFD Basic Functions

Network Requirements

l All devices run the OSPF protocol; Device1 and Device3 configure the BFD detection function.

l Modify the BFD parameters. When the line between the switch and Device3 fails, the service data between Device1 and Device3 can realize the ms-level switching.

Network Topology

Figure 6‑1 Networking of configuring the BFD basic functions

Configuration Steps

Step 1: | Configure the interface IP address. (Omitted)
Step 2: | Configure OSPF.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#router-id 1.1.1.1

Device1(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 200.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#router-id 2.2.2.2

Device2(config-ospf)#network 20.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 30.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#router-id 3.3.3.3

Device3(config-ospf)#network 10.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 30.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 201.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

Step 3:

Configure OSPF to link with BFD.

#Configure Device1.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#ip ospf bfd

Device1(config-if-gigabitethernet0)#exit

#Configure Device3.

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#ip ospf bfd

Device3(config-if-gigabitethernet0)#exit

#View the BFD session of Device1.

Device1#show bfd session detail

Total session number: 1

OurAddr NeighAddr LD/RD State Holddown interface

10.0.0.1 10.0.0.2 12/19 UP 5000 gigabitethernet0

Type:ipv4 direct

Local State:UP Remote State:UP Up for: 0h:10m:57s Number of times UP:1

Send Interval:1000ms Detection time:5000ms(1000ms*5)

Local Diag:0 Demand mode:0 Poll bit:0

MinTxInt:1000 MinRxInt:1000 Multiplier:5

Remote MinTxInt:1000 Remote MinRxInt:1000 Remote Multiplier:5

Registered protocols:OSPF

In the route table, we can see that the route 201.0.0.0/24 first selects the line between Device1 and Device3 to communicate.

Step 4:

Configure the BFD parameters.

#Configure Device1. Modify the minimum sending interval and minimum receiving interval of the BFD control packets to 100ms. The detection timeout multiples is 3.

Device1(config)#interface gigabitethernet0

Device1(config-if-gigabitethernet0)#bfd min-transmit-interval 100

Device1(config-if-gigabitethernet0)#bfd min-receive-interval 100

Device1(config-if-gigabitethernet0)#bfd multiplier 3

Device1(config-if-gigabitethernet0)#exit

#Configure Device3. Modify the minimum sending interval and minimum receiving interval of the BFD control packets to 100ms. The detection timeout multiples is 3.

Device3(config)#interface gigabitethernet0

Device3(config-if-gigabitethernet0)#bfd min-transmit-interval 100

Device3(config-if-gigabitethernet0)#bfd min-receive-interval 100

Device3(config-if-gigabitethernet0)#bfd multiplier 3

Device3(config-if-gigabitethernet0)#exit

Step 5:

Check the result.

#View the BFD session of Device1.

Device1#show bfd session detail

Total session number: 1

OurAddr NeighAddr LD/RD State Holddown interface

10.0.0.1 10.0.0.2 2/3 UP 300 gigabitethernet0

Type:ipv4 direct

Local State:UP Remote State:UP Up for: 0h:11m:27s Number of times UP:1

Send Interval:100ms Detection time:300ms(100ms*3)

Local Diag:0 Demand mode:0 Poll bit:0

MinTxInt:100 MinRxInt:100 Multiplier:3

Remote MinTxInt:100 Remote MinRxInt:100 Remote Multiplier:3

Registered protocols:OSPF

After modifying the BFD parameters, the BFD detection timeout is negotiated from 5s to 300ms.

#When the line between Device1 and Device3 fails, BFD fast detects the fault and informs OSPF, and then OSPF switches the route to Device2 for communication. View the route table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 10.0.0.0/24 is directly connected, 00:25:00, gigabitethernet0

C 20.0.0.0/24 is directly connected, 00:30:33, gigabitethernet1

O 30.0.0.0/24 [110/2] via 20.0.0.2, 00:17:32, gigabitethernet1

C 127.0.0.0/8 is directly connected, 00:36:10, lo0

C 200.0.0.0/24 is directly connected, 00:25:11, gigabitethernet2

O 201.0.0.0/24 [110/3] via 20.0.0.2, 00:00:10, gigabitethernet1

Compared with the route table in Step 3, we can see that the route 201.0.0.0/24 is already switched to Device2 for communication.

The BFD processing mode on Device3 is similar to Device1.


1 Network Test and Fault Diagnosis


1.1 Overview

With the network test and fault diagnosis tool, we can check the network connection status and diagnose the system fault. In daily maintenance, when it is necessary to check the network connection, we can use the ping function and traceroute function. We can open the system debugging information to diagnose the system fault.


1.2 Network Test and Fault Diagnosis Application

Table 1‑1 Application list of network test and fault diagnosis

Application Function
Ping function | ping
 | ping ip
 | Interactive ping
 | grouping
Traceroute function | traceroute
 | Interactive traceroute
System debugging function | System debugging


1.2.1 Ping Function

The ping function is used to check the network connection status and whether the host is reachable. The ping function sends the ICMP echo request packet to the host and waits for the ICMP echo response, used to judge whether the destination is reachable. Ping can test the turnaround time from the source to the destination.

Configuration Condition

None

ping

Table 1‑2 ping

Step | Command | Description
Check whether the specified destination address is reachable | ping [ vrf vrf-name ] { host-name | ip-address } [ -l packet-length ] [ -w wait-time ] [ -n packet-number | -t ] | Mandatory

ping ip

Table 1‑3 ping ip

Step | Command | Description
Check whether the specified destination address is reachable | ping ip { host-name | ip-address } | Mandatory The command can only be used for the most simple destination reachability check and there is no optional parameter.

Interactive ping

Table 1‑4 Interactive ping

Step | Command | Description
Enter the ping interactive mode | ping [ vrf vrf-name ] | Mandatory In the privileged user mode, execute the command to enter the ping interactive mode.
Configure the network protocol type | Protocol [ ip ]: [ ip ] | Optional By default, Use the IPv4 protocol. Currently, only support the IPv4 protocol.
Configure the destination IP address or host name | Target IP address or hostname: { ip-address | host-name } | Mandatory
Configure the times of sending the ICMP request packet | Repeat count [5]: [ repeat-count ] | Optional By default, send for 5 times.
Configure the length of the ICMP request packet | Datagram size [76]: [ datagram-size ] | Optional The packet length is the size of the whole IP packet. By default, the packet length is 76 bytes.
Configure the timeout for waiting for the ICMP response | Timeout in seconds [2]: [ timeout ] | Optional By default, time out for 2s.
Enable the extended option | Extended commands [no]: [ yes | no ] | Optional After enabling the extended option, the configuration command of the extended option is available. By default, do not enable the extended option.
Configure the extended option, the source IP address or egress interface of the ICMP request packet | Source address or interface: { ip-address | interfacename } | Optional After enabling the extended option, the command can be configured. By default, do not specify the source address and egress interface of the request packet.
Configure the extended selection, the service type of the ICMP request packet | Type of service [0]: [ tos ] | Optional After enabling the extended option, the command can be configured. By default, the TOS value is 0.
Configure the extended option, setting not permitting the fragment | Set DF bit in IP header? [ no ]: [ yes | no ] | Optional After enabling the extended option, the command can be configured. By default, do not set the DF flag, permitting fragment.
Configure the extended option, validating the data content of the response packet | Validate reply data? [ no ]: [ yes | no ] | Optional After enabling the extended option, the command can be configured. By default, do not validate the data content.
Configure the extended option, the data content of the ICMP request packet | Data pattern [abcd]: [ data-pattern ] | Optional After enabling the extended option, the command can be configured. By default, the data content profile is “abcd”.
Configure the extended option, loose source route option, strict source route option, record route, record timestamp, display details | Loose, Strict, Record, Timestamp, Verbose[ none ]: [ l | s ] [ r / t / v ] | Optional After enabling the extended option, the command can be configured. By default, do not configure the extended option.
Enable scanning the sent ICMP request packet | Sweep range of sizes [ no ]: [ yes | no ] | Optional By default, scanning the sent packet is disabled.
Configure the start value of the scanning | Sweep min size [36]: [ min-szie ] | Optional After enabling scanning the sent packet, the command can be configured. By default, the start value of the scanning is 36.
Configure the end value of the scanning | Sweep max size [18024]: [ max-size ] | Optional After enabling scanning the sent packet, the command can be configured. By default, the end value of the scanning is 18024
Configure the scanning incremental value | Sweep interval [1]: [ interval ] | Optional After enabling scanning the sent packet, the command can be configured. By default, the scanning incremental value is 1.

groupping

Table 1‑5 groupping

Step | Command | Description
Send multiple groups of ICMP request packets, checking whether the destination address is reachable | groupping { hostname | ip-address } [ [ -l packet-length ] [ -g packet-group ] [ -w wait-time ] [ -n packet-number ] [ -t ] | Mandatory

l When pinging the destination host name, first configure the DNS function. Otherwise, ping fails. For DNS configuration, refer to “DNS Configuration” in “IP Network Protocol Configuration”.

l For the ping mpls function, refer to “MPLS OAM Configuration”.


1.2.2 Traceroute Function

The traceroute function is used to view the gateways passed by the packet from the source to the destination. It is mainly used to check whether the destination is reachable and analyze the faulty network node. The executing process of traceroute is: First send one IP packet with TTL 1 to the destination host; the first-hop gateway drops the packet and returns one ICMP timeout error packet. In this way, traceroute gets the first gateway address in the path. And then traceroute sends one packet with TTL 2. In this way, get the address of the second-hop gateway. Continue the process until reaching the destination host. The UDP port number of the traceroute packet is the port number of the destination that cannot be used by any application program. After the destination receives the packet, return one error packet of the port unreachable. In this way, get all gateway addresses on the path.

Configuration Condition

None

traceroute

Table 1‑6 traceroute

Step | Command | Description
View the gateways passed by the packet from the source to the destination | traceroute [ ip | vrf vrf-name ] { hostname | ip-address } | Mandatory

Interactive traceroute

Table 1‑7 Interactive traceroute

Step | Command | Description
Enter the traceroute interactive mode | traceroute [ vrf vrf-name ] | Mandatory In the privileged user mode, execute the command to enter the traceroute interactive mode.
Configure the network protocol type | Protocol [ ip ]: [ ip ] | Optional By default, Use the IPv4 protocol. Currently, only support the IPv4 protocol.
Configure the destination IP address or host name | Target IP address or hostname: { ip-address | host-name } | Mandatory
Configure the source IP address or egress interface of the traceroute packet | Source address or interface: { ip-address | interface-name } | Optional By default, do not specify the source IP address or egress interface of the packet
Configure the timeout for waiting for each detection packet response | Timeout in seconds [3]: timeout | Optional By default, time out after 3s.
Configure the times of sending the detection packet with the same TTL value | Probe count [3]: probe-count | Optional By default, send for three times.
Configure the minimum TTL value of the detection packet | Minimum Time to Live [1]: min-ttl | Optional By default, the minimum TTL value is 1.
Configure the maximum TTL value of the detection packet | Maximum Time to Live [30]: max-ttl | Optional By default, the maximum TTL value is 30.
Configure the destination UDP port number of the detection packet | Port Number [33434]: port-number | Optional By default, the destination port number is 33434.
Configure the extended option, loose source route option, strict source route option, record route, record timestamp, display details | Loose, Strict, Record, Timestamp, Verbose[ none ]: [ l | s ] [ r / t / v ] | Optional By default, do not configure the option.

l For the traceroute mpls function, refer to “MPLS OAM Configuration”.


1.2.3 System Debugging Function

To help the user diagnose the problem, the most function modules of the device provide the debugging function.

The debugging function has two switch controls:

l The debugging switch of the module, controlling whether to generate the debugging information of the module

l The output switch of the screen, controlling whether to output the debugging information to the terminal

Configuration Condition

None

System Debugging

Table 1‑8 System debugging

Step | Command | Description
Open the output switch of the remote login system debugging screen | terminal monitor | Optional The remote login includes telnet, ssh and so on. By default, the switch is closed.
Enter the global configuration mode | configure terminal | -
Open the output switch of the console system debugging screen | logging console | Optional By default, the switch is opened.
Exit the global configuration mode | exit | -
Open the debugging switch of the system function module | debug { all | module-name [ option ] } | Optional By default, all debugging switches of the system function modules are closed.

l The debugging information can be displayed on the terminal only after configuring debug module-name option, terminal monitor or logging console at the same time.

l The generating and output of the debugging information affect the system performance, so when it is necessary, had better use the debug module-name option command to open the specified debugging switch. The debug allcommand opens all debugging switches, so we had better not use. After debugging ends, close the corresponding debugging switch in time or use the no debug all command to close all debugging switches.


1.2.4 Monitoring and Maintaining of Network Test and Fault Diagnosis

Table 1‑9 Monitoring and maintaining of the system test and fault diagnosis

Command | Description
show debugging | Display the function module information of the opened debugging switch in the system.


1.3 Typical Configuration Example of Network Test and Fault Diagnosis


1.3.1 Ping Application

Network Requirement

l Device1 fails to use telnet to log into Device3 and we need to confirm whether the route between Device1 and Device3 is reachable.

Network Topology

Figure 1‑1 ping application networking

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Use the ping command to view whether the route between Device1 and Device3 is reachable.

#View whether Device1 and Device3 can ping each other..

Device1#ping 2.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 2.0.0.2 , timeout is 2 seconds:

.....

Success rate is 0% (0/5).

Step 3:

Use the ping command to view whether the route between Device1 and Device2 is reachable.

#View whether Device1 and Device2 can ping each other..

Device1#ping 1.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 1.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

Step 4:

Use the ping command to view whether the route between Device2 and Device3 is reachable.

#View whether Device2 and Device3 can ping each other..

Device2#ping 2.0.0.2

Press key (ctrl + shift + 6) interrupt it.

Sending 5, 76-byte ICMP Echos to 2.0.0.2 , timeout is 2 seconds:

!!!!!

Success rate is 100% (5/5). Round-trip min/avg/max = 0/0/0 ms.

From the above result, we can see that Device1 and Device2 can communicate with each other, Device2 and Device3 can communicate with each other, and the problem appears between Device1 and Device3. Later, we can check the route configuration, or use the debug ip icmpcommand to view whether the packet content is correct. We also can use traceroute described in the next section to confirm the faulty network node.


1.3.2 Traceroute Application

Network Requirement

l Device1 fails to use telnet to log into Device3 and we need to confirm whether the route between Device1 and Device3 is reachable. If the route is unreachable, we need to confirm the fault of the network node.

Network Topology

Figure 1‑2 Traceroute application networking

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Use the traceroutecommand to view whether the route between Device1 and Device3 is reachable.

# View whether Device1 and Device3 can ping each other.

Device1#traceroute 2.0.0.2

Type escape sequence to abort.

Tracing the route to 2.0.0.2 , min ttl = 1, max ttl = 30 .

1 1.0.0.2 0 ms 0 ms 0 ms

2 * * *

3 * * *

4 * * *

5 * * *

6

From the above result, the traceroute packet sent by Device1 can reach Device2. The traceroute packet from Device2 cannot reach Device3. Later, we need to check the route configuration between Device2 and Device3 and line, or use the debug ip icmp command to view whether the packet content is correct. We also can use ping described in the last section to detect the connection between Device2 and Device3..


2 Keepalive Gateway


2.1 Overview

keepalive gateway sets the Ethernet interface to send the keepalive packet to the specified gateway address, used to monitor the reachability of the destination gateway. When the gateway is unreachable, close the interface IP protocol layer.

After configuring the keepalive gateway on one interface, the interface regularly sends the ARP request packet to the configured gateway address. When the interface does not receive the ARP response packet for successive N times (N is the retry times configured for the user), close the interface IP protocol layer. Until receiving the ARP response packet again, enable the interface IP protocol layer.


2.2 Gateway Keepalive Function Configuration

Table 2-1 Gateway keepalive function configuration list

Configuration Task

Configure the keepalive gateway function

Configure the keepalive gateway basic function

Configure the sending parameters of the keepalive packet


2.2.1 Configure Gateway Keepalive Function

Configuration Condition

None

Configure Gateway Keepalive Basic Function

Table 2-2 Configure the gateway keepalive basic function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Configure the gateway keepalive | keepalive gateway ip-address [ interval { sec interval | msec interval } ] [ retry retry-count ] | Mandatory By default, do not enable the gateway keepalive function.

Configure Sending Parameters of Keepalive Packet

When configuring the sending parameters of the keepalive packet, we can control the sending rate of the gateway keepalive packet. When the sending rate of the keepalive packet reaches the configured value, pause for the configured time and then continue to send the keepalive packets.

Table 2-3 Configure the sending parameters of the keepalive packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the sending parameters of the keepalive packet | keepalive gateway disperse [ pkt-rate packet-rate ] [ pause-time pause-time ] | Optional By default, the maximum sending rate of the keepalive packet is 100pps and the time of pausing sending the keepalive packet is 100ms.

l Usually, the network equipment has speed limitation for the ARP packet. If there are too many gateway keepalive packets sent at the same time, some keepalive packet may be dropped, seriaouly resulting in the gateway keepalive flapping. You can discretize the sending of the keepalive packet by configuring the sending parameter of the gateway keepalive packet, removing the flapping caused by the speed limitation of the ARP packet when configuring lots of gateway keepalive packets.


2.2.2 Monitoring and Maintaining of Gateway Keepalive

Table 2-4 Monitoring and maintaining of gateway keepalive

Command | Description
clear keepalive gateway statistics [ interface-name ] | Clear the sending and receiving statistics information of the gateway keepalive
show keepalive gateway [ interface-name ] | View the interface enabled with the gateway keepalive and its configuration
show keepalive gateway disperse | View the sending parameter configuration of the gateway keepalive packet
show keepalive gateway statistics [ interface-name ] | View the statistics information of the gateway keepalive


2.3 Typical Configuration Example of Gateway Keepalive


2.3.1 Configure Gateway Keepalive

Network Requirements

l All devices run the OSPF protocol to perform the route interacting.

l The data flow from Device1 to the 201.0.0.0/24 segment first selects the lonk from Switch to Device3.

l The link across Switch between Device1 and Device 3 uses the gateway keepalive function. When Switch fails or Switch link fails, the gateway keepalive fast detects the fault and modifies the interface status to down. After OSPF feels the status change of the interface, switch the route to Device2 for communication.

Network Topology

Figure 2-1 Networking of configuring the gateway keepalive

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Configure the OSPF process.

#Configure Device1.

Device1#configure terminal

Device1(config)#router ospf 100

Device1(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#network 200.0.0.0 0.0.0.255 area 0

Device1(config-ospf)#exit

#Configure Device2.

Device2#configure terminal

Device2(config)#router ospf 100

Device2(config-ospf)#network 2.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device2(config-ospf)#exit

#Configure Device3.

Device3#configure terminal

Device3(config)#router ospf 100

Device3(config-ospf)#network 1.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 3.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#network 201.0.0.0 0.0.0.255 area 0

Device3(config-ospf)#exit

#View the route table of Device1.

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 1.0.0.0/24 is directly connected, 00:01:28, vlan3

C 2.0.0.0/24 is directly connected, 03:45:55, vlan2

O 3.0.0.0/24 [110/2] via 2.0.0.2, 03:44:52, vlan2

[110/2] via 1.0.0.2, 00:00:36, vlan3

C 200.0.0.0/24 is directly connected, 43:03:36,vlan4

O 201.0.0.0/24 [110/2] via 1.0.0.2, 00:00:36, vlan3

# The data flow from Device1 to the segment 201.0.0.0/24 first selects the link from Switch to Device3.

l The viewing method of Device2 and Device3 is the same as that of Device1, so the viewing process is omitted here.

Step 3:

Configure the gateway keepalive.

#Configure Device1.

Device1(config)#interface vlan3

Device1(config-if- vlan3)#keepalive gateway 1.0.0.2

Device1(config-if- vlan3)#exit

#Configure Device3.

Device3(config)#interface vlan3

Device3(config-if- vlan3)#keepalive gateway 1.0.0.1

Device3(config-if- vlan3)#exit

#View the gateway keepalive information of Device1.

Device1#show keepalive gateway

interface vlan3 gateway 1.0.0.2 time 10s retry 3 remain 3 now UP

#View the gateway keepalive information of Device3.

Device3#show keepalive gateway

interface vlan3 gateway 1.0.0.1 time 10s retry 3 remain 3 now UP

Step 4:

Check the result.

#After Switch fails or Switch link fails, the gateway keepalive fast detects the fault and modifies the interface fastethernet0 status to down.

Devie1#show keepalive gateway

interface vlan3 gateway 1.0.0.2 time 10s retry 3 remain 0 now DOWN

Device1#show ip interface vlan3

vlan3 is down

Internet address(es):

1.0.0.2/24

Joined group address(es):

224.0.0.1

recently lineproto up: 00:40:13 ago

recently lineproto down: 00:00:41 ago

#After OSPF feels the status change of the interface vlan3, switch the route to Device2 for communication.

Device1#show ip ospf interface vlan3

vlan3 is down, line protocol is down

OSPF is enabled, but not running on this interface

Device1#show ip route

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

C 2.0.0.0/24 is directly connected, 03:59:32, vlan2

O 3.0.0.0/24 [110/2] via 2.0.0.2, 03:58:29, vlan2

C 200.0.0.0/24 is directly connected, 43:17:13, vlan4

O 201.0.0.0/24 [110/3] via 2.0.0.2, 00:07:00, vlan2

#We can see that the data flow from Device1 to the segment 201.0.0.0/24 first selects the route across Device2.


3 SLA


3.1 Overview

SLA (Service Level Agreements) calculates the related parameters according to the packet transmission and outputs the report at ;ast. SLA, also called RTR (Response Time Reporter), is one network detection and monitoring tool. SLA regularly sends the packets of the specified protocol to detect and monitor the network communication. SLA can diagnose different network applications and output the test result by configuring different types of RTR entities and adjusting.

SLA basic concepts:

l RTR Entity: RTR Entity is one universal concept and not related with the specific type of RTR entity. The current RTR entity types of the system include: the ICMP-echo entity, ICMP-path-echo entity, ICMP-path-jitter entity, and UDP-echo entity used to detect the network communication; the VoIP-jitter entity used to detect the VoIP packets transmitted via the network; the FLOW-statistics entity used to detect the interface traffic; the LSP-ping entity used to detect the MPLS network communication.

l RTR Group: One RTR entity group is the set of one or multiple RTR entities;

l RTR responder: The RTR responder is configured at the destination, mainly used to set up the connection with the source and respond the detection packet sent by the source. Most entities do not need to configure the responder, but when using the UDP-echo entity and VoIP-jitter entity, we should configure the responder.

l RTR Schedule: If only configuring the RTR entity or RTR entity group, we cannot detect, but should initiate the scheduling so that the detection can be completed.


3.2 SLA Function Configuration

Table 3‑1 SLA function configuration list

Configuration Task
Enable RTR | Enable RTR
Configure the RTR entity | Create the RTR entity
 | Configure the ICMP-echo entity
 | Configure the ICMP-path-echo entity
 | Configure the ICMP-path-jitter entity
 | Configure the VoIP-jitter entity
 | Configure the UDP-echo entity
 | Configure the FLOW-statistics entity
 | Configure the LSP-ping entity
 | Configure the common configuration of the entity
Configure the RTR entity group | Configure the RTR entity group
Configure the RTR responder | Configure the RTR responder
Configure the RTR schedule | Configure the RTR schedule
Configure pausing scheduling the entity | Configure pausing scheduling the entity
Configure restoring scheduling the entity | Configure restoring scheduling the entity


3.2.1 Enable RTR

In the configuration tasks of RTR, first enable RTR so that the configuration of the other functions can take effect.

Configuration Condition

None

Enable RTR

Table 3‑2 Enable RTR

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable RTR | rtr enable | Mandatory By default, do not enable RTR.


3.2.2 Configure RTR Entity

Configuration Condition

Before configuring the RTR entity, first complete the following task:

l Enable RTR.

Create RTR Entity

One entity corresponds to one type of detection. After creating the RTR entity and entering the entity configuration mode, we can configure the parameters of the entity.

Table 3‑3 Create the RTR entity

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Create the RTR entity | rtr entity-id entity-type | Mandatory

Configure ICMP-echo Entity

The ICMP-echo entity is to detect the network communication. It regularly sends the ICMP echo request packet to one destination address in the network, so as to get the delay and packet loss of the packet transmission from the detection end to the destination end. In one detection period, as long as the ICMP-echo entity receives one ICMP echo request response packet, the entity status is reachable.

The general network devices all support ping, so the entity can take effect in detecting the network communication. With the rich scheduling policies and log recording function, we can let the network administrator get to know the network communication status and history information in time and reduce inputting the common ping command frequently at the same time.

Table 3‑4 Configure the ICMP-echo entity

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the ICMP-echo entity configuration mode | rtr entity-id [ icmpecho ] | Mandatory
Configure the detection attribute | set [ vrf vrf-name ] target-ip-address [ npacket ] [ data-size ] [ timeout ] [ frequency-value ] [ extend source-ip-address [ tos ] [ set-DF ] [ verify-data ] ] | Mandatory By default, do not configure the detection attribute of the entity.
Configure sending the notice when the entity status changes | multi-notify | Optional By default, do not send the notice when the entity status changes.
Configure first checking the interface status when sending the packet | aware-sending-state interface-name | Optional By default, do not check the interface status when sending the packet.
配置将rtt值作为检测实体是否可达的判断依据 | status-care rtt | 可选 缺省情况下，未使用rtt值判断是否可达
Configure the common configuration of the entity | Refer to “Configure Common Configuration of the Entity” | Optional

l The scheduling interval (frequency-value) of the ICMP-echo entity needs to meet the following requirement: scheduling interval > npacket * timeout

l If configuring the scheduler for the entity, the age time of the scheduler should be larger than the scheduling interval of the entity.

Configure ICMP-path-echo Entity

The ICMP-path-echo entity is to detect the network communication. It regularly sends the ICMP echo request packet to one destination address in the network, so as to get the delay and packet loss of the packet transmission from the detection end to the destination end, as well as the delay and packet loss between the detection end and the intermediate devices from the detection end to the destination. In one detection period, as long as the ICMP-path-echo entity receives one ICMP echo request response packet, the entity status is reachable.

The general network devices all support ping, so the entity can take effect in detecting the network communication. With the rich scheduling policies and log recording function, we can let the network administrator get to know the network communication status (for example, which network device on the path has serious delay) and history information in time.

Table 3‑5 Configure the ICMP-path-echo entity

Step | Command | Description
Enter the system configuration mode | configure terminal | -
Enter the ICMP-path-echo entity configuration mode | rtr entity-id [ icmp-path-echo ] | Mandatory
Configure the detection attribute | set dest-ipaddr target-ip-address [ source-ipaddr source-ip-address ] | Mandatory
Configure the loose source route selection | lsr-path [ hop-ip-address-list | none ] | Optional By default, do not configure the loose source route selection.
Configure only detecting the network status from the source to the destination | targetOnly [ true | false ] | Optional By default, if targetOnly is true, only detect the network status from the source to the destination. If targetOnly is false, detect the network status from the source to the destination hop by hop.
Configure whether to verify the content of the response packet | verify-data [ true | false ] | Optional By default, do not verify the data content.
Configure the common configuration of the entity | Refer to “Configure Common Configuration of the Entity” | Optional

Configure ICMP-path-jitter Entity

The ICMP-path-jitter entity is to detect the network communication. It regularly sends the ICMP echo request packet to one destination address in the network, so as to get the delay, jitter, and packet loss of the packet transmission from the detection end to the destination end, as well as the delay, jitter and packet loss between the detection end and the intermediate devices from the detection end to the destination. In one detection period, as long as the ICMP-path-jitter entity receives one ICMP echo request response packet, the entity status is reachable.

The general network devices all support ping, so the entity can take effect in detecting the network communication. With the rich scheduling policies and log recording function, we can let the network administrator get to know the network communication status (for example, which network device on the path has serious delay) and history information in time.

Table 3‑6 Configure the ICMP-path-jitter entity

Step | Command | Description
Enter the system configuration mode | configure terminal | -
Enter the ICMP-path-jitter configuration mode | rtr entity-id [ icmp-path-jitter ] | Mandatory
Configure the detection attribute | set dest-ipaddr target-ip-address [ pkt-number ] [ pkt-interval ] [ source-ipaddr source-ip-address ] | Mandatory
Configure the IP address of the loose source route selection | lsr-path [ hop-ip-address-list | none ] | Optional By default, do not configure the loose source route selection.
Configure only detecting the network status from the source to the destination | targetOnly [ true | false ] | Optional By default, if targetOnly is true, only detect the network status from the source to the destination. If targetOnly is false, detect the network status from the source to the destination hop by hop.
Configure the jitter threshold and over-limit rule | threshold-jitter jitter direction { be | se } | Optional By default, the jitter threshold is 6000ms and the over-limit rule is be.
Configure whether to verify the content of the response packet | verify-data [ true | false ] | Optional By default, do not verify the data content.
Configure the common configuration of the entity | Refer to “Configure Common Configuration of the Entity” | Optional

l When the over-limit rule is be and the actual value is larger than or equal to the threshold, it judged as over-limit; when the over-limit rule is se and the actual value is smaller than or equal to the threshold, it is judged as over-limit.

Configure VoIP-jitter Entity

The VoIP-jitter entity is the RTR entity used to measure the transmission quality of the VoIP packet in the general IP network.

The VoIP-jitter entity can simulate the G.711 A Law, G.711 mu Law, and G.729A codec or the customized codes to send the UDP packet with the corresponding rate, packet interval and size from the source device to the destination device, measure the turnaround time, uni-directional packet loss and uni-directional delay of the packet, and calculates the ICPIF value based on the statistics information. At last, estimate the MOS value according to the ICPIF value. In the detection period, as long as the VoIP-jitter entity receives one detection response packet, the status of the entity is reachable.

Table 3‑7 Configure the VoIP-jitter entity

Step | Command | Description
Enter the system configuration mode | configure terminal | -
Enter the VoIP-jitter configuration mode | rtr entity-id [ jitter ] | Mandatory If the entity already exists, directly enter the entity configuration mode.
Configure the detection attribute | set dest-ipaddr target-ip-address dest-port target-port { g711alaw | g711ulaw | g729a | user_defined packet-size packet-number packet-interval schedule-interval } [ source-ipaddr source-ip-address ] [ source-port source-port ] | Mandatory
Configure the uni-directional delay threshold from the source to the destination and over-limit rule | threshold-sd-delay sd-delay direction { be | se } | Optional By default, the sd delay threshold is 5000ms and the over-limit rule is be.
Configure the uni-directional jitter threshold from the source to the destination and over-limit rule | threshold-sd-jitter sd-jitter direction { be | se } | Optional By default, the sd jitter threshold is 6000ms and the over-limit rule is be.
Configure the packet loss threshold and over-limit rule from the source to the destination | threshold-sd-pktloss sd-packet direction { be | se } | Optional By default, the sd packet loss threshold is 60000 and the over-limit rule is be.
Configure the uni-directional delay threshold from the destination to the source and over-limit rule | threshold-ds-delay ds-delay direction { be | se } | Optional By default, the ds delay threshold is 5000ms and the over-limit rule is be.
Configure the uni-directional jitter threshold from the destination to the source and over-limit rule | threshold-ds-jitter ds-jitter direction { be | se } | Optional By default, the ds unit-directional jitter threshold is 6000ms and the over-limit rule is be.
Configure the packet loss threshold from the destination to the source and over-limit rule | threshold-ds-pktloss ds-packet direction { be | se } | Optional By default, the ds packet loss threshold is 60000 and the over-limit rule is be.
Configure the icpif threshold and the over-limit rule | threshold-icpif icpif-value direction { be | se } | Optional By default, the icpif threshold is 100000000 and the over-limit rule is be.
Configure the mos threshold and the over-limit rule | threshold-mos mos-value direction { be | se } | Optional By default, the mos threshold is 10000000 and the over-limit rule is be.
Configure the common configuration of the entity | Refer to “Configure Common Configuration of the Entity” | Optional

l When using the VoIP-jitter entity detection, besides configuring the VoIP-jitter entity, we also need to configure the RTR responder at the destination.

l By default, the VoIP-jitter entity sends many packets, which occupy the network bandwidth, so when configuring the entity exceeds one hour, the shell prompts.

l When the VoIP-jitter entity detects the network transmitting the VoIP packet, the clocks of the source and the destination need to be consistent, so before scheduling the VoIP-jitter entity, we also need to configure the NTP server at the destination and NTP client at the source. After the clocks are synchronized, configure the RTR responder, and at last, configure the scheduler. For the configuration of NTP, refer to the NTP chapter of the configuration manual.

l When the over-limit rule is be and the actual value is larger than or equal to the threshold, it judged as over-limit; when the over-limit rule is se and the actual value is smaller than or equal to the threshold, it is judged as over-limit.

Configure UDP-echo Entity

The UDP-echo entity mainly detects the UDP packet transmitted in the IP network. In the entity, we need to specify the destination address and port of the sent packet. We can monitor the transmission of the UDP packet in the IP network by scheduling the entity. In one detection period, as long as the UDP-echo entity receives one detection response packet, the entity status is reachable.

The UDP-echo entity can monitor efficiently to record the turnaround delay, packet loss and other information of the UDP packet in the IP network, even record the monitored history information by logs so that the network administrator can get to know the network communication and fix the fault.

Table 3‑8 Configure the UDP-echo entity

Step | Command | Description
Enter the system configuration mode | configure terminal | -
Enter the UDP-echo entity configuration mode | rtr entity-id [ udpecho ] | Mandatory If the entity already exists, directly enter the entity configuration mode.
Configure the detection attribute | set dest-ipaddr target-ip-address dest-port target-port [ source-ipaddr source-ip-address ] [ source-port source-port ] | Mandatory By default, do not configure the detection attribute of the UDP-echo entity.
Configure the filling content of the packet | data-pattern pad | Optional By default, the filling content is “ABCD”.
Configure the common configuration of the entity | Refer to “Configure Common Configuration of the Entity” | Optional

l When using the UDP-echo entity detection, besides configuring the UDP-echo entity, we also need to configure the RTR responder at the destination.

Configure FLOW-statistics Entity

The FLOW-statistics entity is to detect the interface traffic and one entity corresponds to one interface. We can monitor the traffic on the interface by scheduling the entity. In one detection period, as long as there are packets passing the interface monitored by the FLOW-statistics entity, the entity status is reachable.

The interval of the FLOW-statistics entity monitoring the interface traffic is 10s-10min. We can record the traffic peak value information on the interface by monitoring, even can record the history information of the traffic statistics during each monitoring, so as to make the network administrator get to know the network communication status and fix the fault.

Table 3‑9 Configure the FLOW-statistics entity

Step | Command | Description
Enter the system configuration mode | configure terminal | -
Enter the FLOW-statistics entity configuration mode | rtr entity-id [ flow-statistics ] | Mandatory If the entity already exists, directly enter the entity configuration mode.
Configure the detection attribute | flow-statistics interface interface-name interval interval | Mandatory
Configure the traffic threshold received by the interface and the over-limit rule | threshold-inflow flow-value direction { be | se } | Optional By default, the traffic threshold received by the interface is 200000000bps (bit/s) and the over-limit rule is be.
Configure the threshold of the packets received by the interface and the over-limit rule | threshold-inpacket packet-value direction { be | se } | Optional By default, the threshold of the packets received by the interface is 200000000 and the over-limit rule is be.
Configure the threshold of the traffic received by the interface and the over-limit rule | threshold-outflow flow-value direction { be | se } | Optional By default, the traffic threshold sent by the interface is 200000000 bps (bit/s) and the over-limit rule is be.
Configure the threshold of the packets received by the interface and over-limit rule | threshold-outpacket packet-value direction { be | se } | Optional By default, the threshold of the packets received by the interface is 200000000 and the over-limit rule is be.
Configure the common configuration of the entity | Refer to “Configure Common Configuration of the Entity” | Optional

l When the over-limit rule is be and the actual value is larger than or equal to the threshold, it judged as over-limit; when the over-limit rule is se and the actual value is smaller than or equal to the threshold, it is judged as over-limit.

Configure LSP-ping Entity

The LSP-ping entity is used to detect and maintain the fault in the MPLS network. LSP-ping provides one mechanism to detect the end-to-end LSP connection and the consistency of the control layer and data layer. The detected LSP type includes the LSP set up by LDP, BGP, and RSVP-TE. In one detection period, the LSP-ping entity status is reachable as long as receiving one echo response packet.

Table 3‑10 Configure the LSP-ping entity

Step | Command | Description
Enter the system configuration mode | configure terminal | -
Enter the LSP-ping entity configuration mode | rtr entity-id [ lsp-ping ] | Mandatory If the entity already exists, directly enter the entity configuration mode.
Configure the detection attribute | set fec { ipv4 prefix-address prefix-mask-length | traffic-eng tunnel tunnel-interface-number | vrf vrf-name ipv4 prefix-address prefix-mask-length } | Mandatory By default, do not configure the detection attributes of the LSP-ping entity.
Configure the EXP field value in the MPLS label of the echo request packet | exp exp-bits | Optional By default, the value of the EXP field is 0.
Configure the sending interval of the echo request packets | interval interval-value | Optional By default, the sending interval of the echo request packet is 0ms.
Configure the repeat sending times of the echo request packets in one scheduling | repeat repeat-count | Optional By default, the repeat sending times of the echo request packets in one scheduling is 5.
Configure the echo request packet length | request-packet-size packet-size | Optional By default, the echo request packet length is 120 bytes.
Configure the TTL value of the outer label of the echo request packet | ttl ttl-value | Optional By default, the TTL value of the outer label of the echo request packet is 255.
Configure the common configuration of the entity | Refer to “Configure Common Configuration of the Entity” | Optional

Configure Common Configuration of Entities

Table 3‑11 Configure the common configuration of the entities

Step | Command | Description
Configure the alarm type | alarm-type [ log | log-and-trap | trap | none ] | Optional By default, the alarm mode is none, that is, do not alarm.
Configure the number of the saved history records | number-of-history-kept history-number | Optional By default, save one history record.
Configure the period of saving the history records | periods periods | Optional By default, after each scheduling ends, save one history record.
Configure the timeout | timeout timeout | Optional By default, the timeout is: ICMP-path-echo entity 5000ms ICMP-path-jitter entity 5000ms VoIP-jitter entity 50000ms UDP-echo entity 5000ms LSP-ping entity 2s The entity not supporting the command: ICMP-echo entity FLOW-statistics entity
Configure the TOS value of the packet | tos tos-value | Optional By default, the TOS value is 0. The entity not supporting the command: ICMP-echo entity LSP-ping entity FLOW-statistics entity MAC-ping entity
Configure the VRF attribute of the entity | vrf vrf-name | Optional By default, do not configure the VRF attribute of the entity. The entities not supporting the command: ICMP-echo entity LSP-ping entity FLOW-statistics entity
Configure the scheduling interval of the entity | frequency seconds | Optional By default, the scheduling interval is: ICMP-path-echo entity 60s ICMP-path-jitter entity 60s UDP-echo entity 60s LSP-ping entity 20s The entities not supporting the command: ICMP-echo entity VoIP-jitter entity FLOW-statistics entity
Configure the length of the detection packet | request-data-size data-size | Optional By default, the length of the detection packet: ICMP-path-echo entity 70 bytes ICMP-path-jitter entity 70 bytes UDP-echo entity 16 bytes The entities not supporting the command: ICMP-echo entity VoIP-jitter entity LSP-ping entity FLOW-statistics entity
Configure the packet loss threshold and the over-limit rule | threshold-pktloss pktloss direction { be | se } | Optional By default, the packet loss threshold: ICMP-echo entity 150 ICMP-path-echo entity 1 ICMP-path-jitter entity 100 UDP-echo entity 1 LSP-ping entity 200000000 The over-limit rule is be. The entities not supporting the command: VoIP-jitter entity FLOW-statistics entity
Configure the bi-directional delay threshold and the over-limit rule | threshold-rtt rtt direction { be | se } | Optional By default, the bi-directional delay threshold is: ICMP-echo entity 9000ms ICMP-path-echo entity 9000ms ICMP-path-jitter entity 9000ms VoIP-jitter entity 9000ms UDP-echo entity 9000ms LSP-ping entity 9000ms The over-limit rule is be. The entities not supporting the command: FLOW-statistics entity

l If the RTR entity already exists and the entity is in the un-scheduled state, execute the rtr entity-id command to enter the entity configuration mode directly.

l When the over-limit rule is be and the actual value is larger than or equal to the threshold, it judged as over-limit; when the over-limit rule is se and the actual value is smaller than or equal to the threshold, it is judged as over-limit.

l The scheduling interval of the ICMP-path-echo entity needs to meet the following requirement: scheduling interval > timeout.

l The scheduling interval of the ICMP-path-jitter entity needs to meet the following requirement: scheduling interval > timeout; timeout needs to meet the following requirement: timeout > pkt-number * pkt-interval; For the pkt-number parameter and the pkt-interval parameter, refer to the set command of the ICMP-path-echo entity.

l When the scheduling interval of the VoIP-jitter entity selects simulating G.711ALaw, G.711muLaw, and G.729A codec, it is necessary to meet the following requirement: scheduling interval > timeout + 5; when selecting the customized codec, it is necessary to meet the following requirement: scheduling interval > schedule-interval + 5; schedule-interval needs to meet the following requirement: schedule-interval > packet-number * packet-interval; for the schedule-interval, packet-number and packet-interval parameters, refer to the set command of the VoIP-jitter entity.

l The scheduling interval of the UDP-echo entity needs to meet the following requirement: scheduling interval > timeout + 5.

l The scheduling interval of the LSP-ping entity needs to meet the following requirement: scheduling interval >= (interval + timeout)*repeat + 5.


3.2.3 Configure RTR Entity Group

One RTR entity group is the set of one or multiple RTR entity groups. One RTR entity can belong to multiple RTR entity groups and the group cannot become the member of the group. One group can only contain one member once. The RTR entity group is identifies by the group ID uniquely and the group name is automatically generated by the system.

The RTR entity group is mainly to schedule one RTR set. The scheduling for the RTR entity group is equivalent to the scheduling for all RTR entities in the RTR entity group. The detection result is saved in the history records of the RTR entity.

Configuration Condition

Before configuring the RTR entity group, first complete the following task:

l Enable RTR.

Configure RTR Entity Group

Table 3‑12 Configure the RTR entity group

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the configuration mode of the RTR entity group | rtr group group-id | Mandatory If the RTR entity group does not exist, automatically create the entity group.
Add the members in the RTR entity group | member entity-list | Optional By default, the RTR entity group does not contain any member.
Configure the options of the RTR entity group | option { or | and } | Optional By default, the status option of the RTR entity group is and (when all entities in the group are reachable, the group status can be reachable)
Configure the scheduling interval between the members in the RTR entity group | interval interval | Optional By default, the scheduling interval of the members in the group is 0s.
Configure the RTR entity group to generate the scheduler automatically | group probe | Optional By default, do not configure the RTR entity group to generate the scheduler automatically.

l One VoIP-jitter entity or UDP-echo entity cannot be added to multiple groups for scheduling. Otherwise, the scheduling result may be wrong.

l The calculation method for the scheduling interval of the RTR entity group is as follows: scheduling interval = the maximum of all member scheduling intervals + (member quantity - 1) * scheduling interval between the members.


3.2.4 Configure RTR Responder

The RTR responder is mainly used to set up the connection with the source end and respond the detection packets sent by the source end, so as to ensure that the detection result is correct. The VoIP-jitter entity and the UDP-echo entity need to set up the connection with the destination end, so we should configure the RTR responder at the destination end.

Configuration Condition

Before configuring the RTR responder, first complete the following task:

l Enable RTR.

Configure RTR Responder

Table 3‑13 Configure the RTR responder

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the RTR responder | rtr responder | Mandatory By default, do not configure the RTR responder.


3.2.5 Configure RTR Scheduler

The RTR scheduler is the policy of the scheduling detection for the RTR entity or group. The RTR scheduler can take one entity member as the object and also can take one RTR entity group as the object, but cannot take the group and entity as the object together. The RTR scheduler is identified by the schedule ID uniquely and not related with the RTR entity type, but the scheduling interval should consider the attributes of the scheduled RTR entity or the members in the RTR entity group. The RTR scheduler provides rich scheduling policies and can select to schedule at once or start to schedule after some time, even can set the absolute time of starting the scheduling. Besides, the scheduler can automatically demise after the set scheduling times and also can always exist.

Configuration Condition

Before configuring the RTR scheduler, first complete the following task:

l Configure the desired RTR entity or RTR entity group

Configure RTR Scheduler

Table 3‑14 Configure the RTR scheduler

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the RTR scheduler, scheduling one entity or group | rtr schedule schedule-id { entity entity-id | group group-id } start { hh:mm [ :ss ] date month year | after hh:mm [ :ss ] | now } ageout ageout-time life { forever | life-time repeat repeat-times } | Mandatory By default, do not configure the RTR scheduler.

l The age time of the RTR scheduler should be larger than the scheduling interval of the scheduling object. Otherwise, after one scheduling, the scheduler is deleted because of aging and timeout.


3.2.6 Configure Pausing Scheduling Entity

For the entity being scheduled, we can configure pausing scheduling the entity.

Configuration Condition

Before configuring pausing scheduling the entity, first complete the following task:

l The entity is being scheduled

Configure Pausing Scheduling Entity

Table 3‑15 Configure pausing scheduling the entity

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure pausing scheduling the entity | rtr entity-id halt | Optional By default, do not pause the scheduling entity.

l Only one entity can configure rtr halt. If the entity is the member of the RTR entity group, we cannot configure rtr halt.

l After configuring rtr halt and if still not configuring rtr resume before the scheduling period ends, the scheduler of scheduling the entity is deleted because of aging and timeout.


3.2.7 Configure Restoring Scheduling Entity

For the entity paused scheduling, we can configure restoring scheduling the entity.

Configuration Condition

Before configuring restoring scheduling the entity, first complete the following task:

l The entity is in the paused scheduling state

Configure Restoring Scheduling Entity

Table 3‑16 Configure restoring scheduling the entity

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure restoring scheduling the entity | rtr entity-id resume | Optional


3.2.8 SLA Monitoring and Maintaining

Table 3‑17 SLA Monitoring and Maintaining

Command | Description
show rtr entity [ entity-id ] | Display the RTR entity information
show rtr group [ group-id ] | Display the information of the RTR entity group
show rtr history entity-id | Display the history record information of the specified RTR entity
show rtr schedule [ schedule-id ] | Display the information of the RTR scheduler


3.3 SLA Typical Configuration Example


3.3.1 Configure ICMP-echo Entity to Detect Basic Network Communication

Network Requirement

l Use the ICMP-echo entity on Device1, detecting the basic communication of the network from Device1 to Device3.

Network Topology

Figure 3-1 Networking of configuring ICMP-echo entity

Configuration Steps

Step 1: | Configure the IP address and route of the interface, making Device1 and Device3 communicate with each other. (Omitted)
Step 2: | Configure the ICMP-echo entity and add the attribute parameters.

#Configure Device1.

Device1#configure terminal

Device1(config)#rtr enable

Device1(config)#rtr 1 icmpecho

Device1(config-rtr-icmpecho)#set 132.1.1.1 5 70 2 12 extend 131.1.1.1 0 TRUE FALSE

Device1(config-rtr-icmpecho)#alarm-type log

Device1(config-rtr-icmpecho)#number-of-history-kept 255

Device1(config-rtr-icmpecho)#threshold-pktLoss 10 direction be

Device1(config-rtr-icmpecho)#threshold-rtt 1000 direction be

Device1(config-rtr-icmpecho)#exit

#View the ICMP-echo entity parameters.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:IcmpEcho1 Created:TRUE

****************type:ICMPECHO****************

CreatedTime:WED OCT 31 14:49:31 2012

LatestModifiedTime:WED OCT 31 14:53:53 2012

Times-of-schedule:0

TargetIp:132.1.1.1

Transmit-packets:5

Totally-send-packets:0

Packet-size:70

Timeout:2(s)

Alarm-type:log

Threshold-of-rtt:1000(ms) direction:be

Threshold-of-packet-loss:10 direction:be

Number-of-history-kept:255

Periods:1

Extend parameters:

sourceIp:131.1.1.1 tos:0 DF(DON'T FRAG):TRUE Verify-data:FALSE

In-scheduling:FALSE

multi-notify:OFF

Schedule frequency:12(s)

Status:DEFAULT

The result shows that the entity parameters are consistent with the configuration..

In-scheduling: FALSEDescription entity is not scheduled.

Status: DEFAULTDescription entity status is DEFAULT.

l When the entity is not scheduled, the status is DEFAULT; when the entity is scheduled and if the entity is reachable, the status is REACHABLE; if the entity is unreachable, the status is UNREACHABLE.

Step 3:

Schedule the defined ICMP-echo entity and define the attribute parameters of the scheduling.

#Configure Device1

Device1(config)#rtr schedule 1 entity 1 start now ageout 100 life forever

Step 4:

Check the result.

(1) When the network connectivity from Device1 to Device3 is normal:

#View the entity status.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:IcmpEcho1 Created:TRUE

****************type:ICMPECHO****************

CreatedTime:WED OCT 31 14:49:31 2012

LatestModifiedTime:WED OCT 31 14:53:53 2012

Times-of-schedule:1

Time-of-last-schedule:WED OCT 31 14:54:07 2012

TargetIp:132.1.1.1

Transmit-packets:5

Totally-send-packets:5

Packet-size:70

Timeout:2(s)

Alarm-type:log

Threshold-of-rtt:1000(ms) direction:be

Threshold-of-packet-loss:10 direction:be

Number-of-history-kept:255

Periods:1

Extend parameters:

sourceIp:131.1.1.1 tos:0 DF(DON'T FRAG):TRUE Verify-data:FALSE

In-scheduling:TRUE

multi-notify:OFF

Schedule frequency:12(s)

Status:REACHABLE

In-scheduling: TRUE indicates that the entity is being scheduled;

Status: REACHABLE indicates that the entity status is reachable, that is, the network connection from Device1to Device3 is normal.

(2) When the network connectivity from Device1 to Device3 is faulty:

The alarm mode is configured as log, so when the network is disconnected, print the alarm information on the device, as follows:

Rtr 1 (ICMPECHO) rtt [9000ms] was exceeded(>=) threshold [1000ms].

#View the entity status.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:IcmpEcho1 Created:TRUE

****************type:ICMPECHO****************

CreatedTime:WED OCT 31 14:49:31 2012

LatestModifiedTime:WED OCT 31 14:53:53 2012

Times-of-schedule:4

Time-of-last-schedule:WED OCT 31 14:54:43 2012

TargetIp:132.1.1.1

Transmit-packets:5

Totally-send-packets:20

Packet-size:70

Timeout:2(s)

Alarm-type:log

Threshold-of-rtt:1000(ms) direction:be

Threshold-of-packet-loss:10 direction:be

Number-of-history-kept:255

Periods:1

Extend parameters:

sourceIp:131.1.1.1 tos:0 DF(DON'T FRAG):TRUE Verify-data:FALSE

In-scheduling:TRUE

multi-notify:OFF

Schedule frequency:12(s)

Status:UNREACHABLE

In-scheduling: TRUED indicates that the entity is being scheduled;

Status: UNREACHABLE indicates that the entity status is unreachable, that is, the network connection from Device1to Device3 is unreachable.

#View the history record content.

Device1#show rtr history 1

--------------------------------------------------------------

ID:1 Name:IcmpEcho1 CurHistorySize:4 MaxHistorysize:255

History recorded as following:

WED OCT 31 14:54:46 2012

PktLoss:5 ,Rtt:invalid

WED OCT 31 14:54:32 2012

PktLoss:0 ,Rtt:11 (ms)

WED OCT 31 14:54:20 2012

PktLoss:0 ,Rtt:2 (ms)

WED OCT 31 14:54:07 2012

PktLoss:0 ,Rtt:2 (ms)

In the history records, record the packet loss and delay of each scheduling; if Rtt is invalid, it indicates that there is fault in the network and the network is reachable.


3.3.2 Configure ICMP-path-echo Entity to Detect Network Communication

Network Requirement

l Use the ICMP-path-echo entity on Device1, detecting the path network communication from Device1 to Device3.

Network Topology

Figure 3-2 Networking of configuring the ICMP-path-echo entity

Configuration Steps

Step 1: | Configure the IP address and route of the interface, making Device1, Device2, and Device3 communicate with each other. (Omitted)
Step 2: | Configure the ICMP-path-echo entity and add the attribute parameters.

#Configure Device1.

Device1#config terminal

Device1(config)#rtr enable

Device1(config)#rtr 1 icmp-path-echo

Device1(config-rtr-icmppathecho)#set dest-ipaddr 192.0.0.2 source-ipaddr 110.1.0.1

Device1(config-rtr-icmppathecho)#number-of-history-kept 255

Device1(config-rtr-icmppathecho)#targetOnly false

Device1(config-rtr-icmppathecho)#exit

# View the ICMP-path-echo entity parameters.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:IcmpPathEcho1 Created:TRUE

****************type:ICMPPATHECHO****************

CreatedTime:WED OCT 24 10:18:02 2012

LatestModifiedTime:WED OCT 24 10:19:09 2012

Times-of-schedule:0

TargetIp:192.0.0.2

SourceIp:110.1.0.1

Transmit-packets:1 (each hop)

Request-data-size:70

Timeout:5000(ms)

Frequency:60(s)

TargetOnly:FALSE

Verify-data:FALSE

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-pktloss:1 direction:be

Number-of-history-kept:255

Periods:1

In-scheduling:FALSE

Status:DEFAULT

--------------------------------------------------------------

The result shows that the entity parameters are consistent with the configuration..

In-scheduling: FALSE indicates that the entity is not scheduled.

Status: DEFAULT indicates that the entity status is DEFAULT.

Step 3:

Schedule the defined ICMP-path-echo entity and define the attribute parameters of the scheduling.

#Configure Device1.

Device1(config)#rtr schedule 1 entity 1 start now ageout 100 life 600 repeat 10

Step 4:

Check the result.

#View the entity status.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:IcmpPathEcho1 Created:TRUE

****************type:ICMPPATHECHO****************

CreatedTime:WED OCT 24 10:18:02 2012

LatestModifiedTime:WED OCT 24 10:19:09 2012

Times-of-schedule:1

Time-of-last-schedule:WED OCT 24 10:20:01 2012

TargetIp:192.0.0.2

SourceIp:110.1.0.1

Transmit-packets:1 (each hop)

Request-data-size:70

Timeout:5000(ms)

Frequency:60(s)

TargetOnly:FALSE

Verify-data:FALSE

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-pktloss:1 direction:be

Number-of-history-kept:255

Periods:1

In-scheduling:TRUE

Status:REACHABLE

In-scheduling: TRUE indicates that the entity is being scheduled.

Status: REACHABLE indicates that the entity status is reachable, that is, the network connection from Device1to Device3 is normal.

#View the history record content.

Device1#show rtr history 1

--------------------------------------------------------------

ID:1 Name:IcmpPathEcho1

History of hop-by-hop:

110.1.0.2 PktLoss:0 ,Rtt:2 (ms)

192.0.0.2 PktLoss:0 ,Rtt:1 (ms)

History of record from source to dest:

CurHistorySize:1 MaxHistorysize:255

WED OCT 24 10:20:01 2012

PktLoss:0 ,Rtt:1 (ms)

In the history records, record the packet loss and delay of each scheduling.

#Wait for some time and after scheduling for 10 times, view the entity status.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:IcmpPathEcho1 Created:TRUE

****************type:ICMPPATHECHO****************

CreatedTime:WED OCT 24 10:18:02 2012

LatestModifiedTime:WED OCT 24 10:19:09 2012

Times-of-schedule:10

Time-of-last-schedule:WED OCT 24 10:29:01 2012

TargetIp:192.0.0.2

SourceIp:110.1.0.1

Transmit-packets:1 (each hop)

Request-data-size:70

Timeout:5000(ms)

Frequency:60(s)

TargetOnly:FALSE

Verify-data:FALSE

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-pktloss:1 direction:be

Number-of-history-kept:255

Periods:1

In-scheduling:FALSE

Status:DEFAULT

After scheduling for 10 times, the scheduling stops and the entity status is DEFAULT.


3.3.3 Configure ICMP-path-jitter Entity to Detect Network Communication

Network Requirement

l Use the ICMP-path-jitter entity on Device1, detecting the path network communication from Device1 to Device3.

Network Topology

Figure 3-3 Networking of configuring the ICMP-path-jitter entity

Configuration Steps

Step 1: | Configure the IP address and route of the interface, making Device1, Device2, and Device3 communicate with each other. (Omitted)
Step 2: | Configure the ICMP-path-jitter entity and add the attribute parameters.

#Configure Device1.

Device1#config terminal

Device1(config)#rtr enable

Device1(config)#rtr 1 icmp-path-jitter

Device1(config-rtr-icmppathjitter)#set dest-ipaddr 192.0.0.2 10 20 source-ipaddr 110.1.0.1

Device1(config-rtr-icmppathjitter)#number-of-history-kept 255

Device1(config-rtr-icmppathjitter)#targetOnly false

Device1(config-rtr-icmppathjitter)#exit

#View the ICMP-path-jitter entity parameters.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:IcmpPathJitter1 Created:TRUE

****************type:ICMPPATHJITTER****************

CreatedTime:WED OCT 24 10:54:31 2012

LatestModifiedTime:WED OCT 24 10:56:12 2012

Times-of-schedule:0

TargetIp:192.0.0.2

SourceIp:110.1.0.1

Transmit-packets:10 (each hop)

Packets-interval:20(ms)

Request-data-size:70

Timeout:5000(ms)

Frequency:60(s)

TargetOnly:FALSE

Verify-data:FALSE

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-pktLoss: 200000000 direction:be

Threshold-of-jitter:6000(ms) direction:be

Number-of-history-kept:255

Periods:1

In-scheduling:FALSE

Status:DEFAULT

--------------------------------------------------------------

The result shows that the entity parameters are consistent with the configuration..

In-scheduling: FALSE indicates that the entity is not scheduled.

Status: DEFAULT indicates that the entity status is DEFAULT.

Step 3:

Schedule the defined ICMP-path-jitter entity and define the attribute parameters of the scheduling.

#Configure Device1.

Device1(config)#rtr schedule 1 entity 1 start now ageout 100 life foreve

Step 4:

Check the result.

#View the entity status.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:IcmpPathJitter1 Created:TRUE

****************type:ICMPPATHJITTER****************

CreatedTime:WED OCT 24 10:54:31 2012

LatestModifiedTime:WED OCT 24 10:56:12 2012

Times-of-schedule:4

Time-of-last-schedule:WED OCT 24 11:00:25 2012

TargetIp:192.0.0.2

SourceIp:110.1.0.1

Transmit-packets:10 (each hop)

Packets-interval:20(ms)

Request-data-size:70

Timeout:5000(ms)

Frequency:60(s)

TargetOnly:FALSE

Verify-data:FALSE

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-pktLoss: 200000000 direction:be

Threshold-of-jitter:6000(ms) direction:be

Number-of-history-kept:255

Periods:1

In-scheduling:TRUE

Status:REACHABLE

--------------------------------------------------------------

In-scheduling: TRUE indicates that the entity is being scheduled.

Status: REACHABLE indicates that the entity status is reachable, that is, the network connection from Device1to Device2 is normal.

#View the history record content.

Device1#show rtr history 1

--------------------------------------------------------------

ID:1 Name:IcmpPathJitter1

History of hop-by-hop:

110.1.0.2 PktLoss:0 Rtt:1 (ms),Jitter:0 (ms)

192.0.0.2 PktLoss:0 Rtt:0 (ms),Jitter:0 (ms)

History of record from source to dest:

CurHistorySize:4 MaxHistorysize:255

WED OCT 24 11:00:25 2012

PktLoss:0 ,Rtt:1 (ms),Jitter:0 (ms)

WED OCT 24 10:59:25 2012

PktLoss:0 ,Rtt:0 (ms),Jitter:0 (ms)

WED OCT 24 10:58:25 2012

PktLoss:0 ,Rtt:0 (ms),Jitter:0 (ms)

WED OCT 24 10:57:25 2012

PktLoss:0 ,Rtt:0 (ms),Jitter:0 (ms)

--------------------------------------------------------------

In the history records, record the packet loss, delay and jitter of each scheduling.


3.3.4 Configure VoIP-jitter Entity to Detect Network Transmitting VoIP Packets

Network Requirement

l Use the VoIP-jitter entity on Device1 and detect the network transmitting VoIP packets from Device1 to Device3

Network Topology

Figure 3-4 Networking of configuring the VoIP-jitter entity

Configuration Steps

Step 1: | Configure the IP address and route of the interface, making Device1 communicate with Device3. (Omitted)
Step 2: | Configure ntp and synchronize the clock.

#Configure Device3.

Device3#config terminal

Device3(config)#ntp master

Device3(config)#exit

#Configure Device1.

Device1(config)#ntp server 192.0.0.2

#View that Device3 becomes the clock server successfully and prompt that the clock is synchronized.

Device3#show ntp status

Current NTP status information

Clock is synchronized, stratum 8, reference is 127.127.8.10

reference time is D4321EF4.7BBBBB68 (08:01:56.483 Wed Oct 24 2012)

#View that Device1 becomes the clock client successfully, prompt that the clock is synchronized and display the server address.

Device1#show ntp status

Current NTP status information

Clock is synchronized, stratum 9, reference is 192.0.0.2

reference time is D43222C1.91110F31 (08:18:09.566 Wed Oct 24 2012)

Step 3:

Configure responder on Device3 as the responder end.

#Configure Device3

Device3#config terminal

Device3(config)#rtr enable

Device3(config)#rtr responder

Step 4:

Configure the VoIP-jitter entity on Device1 and add the attribute parameters.

#Configure Device1.

Device1#config terminal

Device1(config)#rtr enable

Device1(config)#rtr 1 jitter

Device1(config-rtr-jitter)#set dest-ipaddr 192.0.0.2 dest-port 1234 g711alaw source-ipaddr 110.1.0.1 source-port 1234

Device1(config-rtr-jitter)#number-of-history-kept 255

Device1(config-rtr-jitter)#exit

#View the entity parameter.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:Jitter1 Created:TRUE

****************type:JITTER****************

CreatedTime:WED OCT 24 16:02:32 2012

LatestModifiedTime:WED OCT 24 16:02:58 2012

Times-of-schedule:0

Entry-state:Pend

TargetIp:192.0.0.2 targetPort:1234

Codec:G.711 A-Law Packet-size:172 Packet-number:1000

Packet-transmit-interval:20(ms)

frequency:60(s)

SourceIp:110.1.0.1 Soure-port:1234

TimeOut:50000(ms)

Alarm-type:none

Threshold-of-dsDelay:5000(ms) direction:be

Threshold-of-dsJitter:6000(ms) direction:be

Threshold-of-dsPktLoss:200000000 direction:be

Threshold-of-sdDelay:5000(ms) direction:be

Threshold-of-sdJitter:6000(ms) direction:be

Threshold-of-sdPktLoss:200000000 direction:be

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-mos:10000000 direction:be

Threshold-of-icpif:100000000 direction:be

Number-of-history-kept:255

Periods:1

Status:DEFAULT

--------------------------------------------------------------

The result shows that the entity parameters are consistent with the configuration..

Status: DEFAULT indicates that the entity status is DEFAULT.

Step 5:

Schedule the defined VoIP-jitter entity and define the attribute parameters of the scheduling.

#Configure Device1.

Device1(config)#rtr schedule 1 entity 1 start now ageout 100 life 600 repeat 10

Step6:

Check the result.

#View the entity status.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:Jitter1 Created:TRUE

****************type:JITTER****************

CreatedTime:WED OCT 24 16:02:32 2012

LatestModifiedTime:WED OCT 24 16:06:02 2012

Times-of-schedule:3

Time-of-last-schedule:WED OCT 24 16:08:29 2012

Entry-state:Transmit

TargetIp:192.0.0.2 targetPort:1234

Codec:G.711 A-Law Packet-size:172 Packet-number:1000

Packet-transmit-interval:20(ms)

frequency:60(s)

SourceIp:110.1.0.1 Soure-port:1234

TimeOut:50000(ms)

Alarm-type:none

Threshold-of-dsDelay:5000(ms) direction:be

Threshold-of-dsJitter:6000(ms) direction:be

Threshold-of-dsPktLoss:200000000 direction:be

Threshold-of-sdDelay:5000(ms) direction:be

Threshold-of-sdJitter:6000(ms) direction:be

Threshold-of-sdPktLoss:200000000 direction:be

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-mos:10000000 direction:be

Threshold-of-icpif:100000000 direction:be

Number-of-history-kept:255

Periods:1

Status:REACHABLE

--------------------------------------------------------------

Entry-state: Transmit indicates that the entity is being scheduled.

Status: REACHABLE indicates that the entity status is reachable and the network from Device1 to Device3 transmits the VoIP packets normally.

#View the history record contents.

Device1#show rtr history 1

--------------------------------------------------------------

ID:1 Name:Jitter1 CurHistorySize:3 MaxHistorysize:255

History recorded as following:

WED OCT 24 16:08:46 2012

SdPktLoss:0 ,DsPktLoss:0 ,Rtt:185 (ms),

SdDelay:14 (ms),DsDelay:178 (ms),SdJitter:8 (ms),DsJitter:183 (ms),

Mos:5.000000 ,icpif:0.000000

WED OCT 24 16:07:45 2012

SdPktLoss:0 ,DsPktLoss:0 ,Rtt:14 (ms),

SdDelay:16 (ms),DsDelay:7 (ms),SdJitter:10 (ms),DsJitter:13 (ms),

Mos:5.000000 ,icpif:0.000000

WED OCT 24 16:06:46 2012

SdPktLoss:0 ,DsPktLoss:0 ,Rtt:17 (ms),

SdDelay:16 (ms),DsDelay:9 (ms),SdJitter:11 (ms),DsJitter:13 (ms),

Mos:5.000000 ,icpif:0.000000

--------------------------------------------------------------

In the history records, record the uni-directional packet loss, turnaround delay, uni-directional delay, and uni-directional jitter of each scheduling.

l Before configuring the VoIP-jitter entity, we need to configure the NTP service to realize the network clock synchronization and configure the rtr responder command at the destination end as the responder. Note that if the clock is not synchronized or not configuring the responder end, the scheduling result is wrong.


3.3.5 Configure UDP-echo Entity to Detect Network Transmitting UDP Packets

Network Requirement

l Use the UDP-echo entity on Device1 and detect the network transmitting UDP packets from Device1 to Device3

Network Topology

Figure 3-5 Networking of configuring the UDP-echo entity

Configuration Steps

Step 1: | Configure the IP address and route of the interface, making Device1 communicate with Device3. (Omitted)
Step 2: | Configure responder on Device3 as the responder end.

#Configure Device3

Device3#config terminal

Device3(config)#rtr enable

Device3(config)#rtr responder

Step 3:

Configure the UDP-echoentity on Device1 and add the attribute parameters.

#Configure Device1.

Device1#config terminal

Device1(config)#rtr enable

Device1(config)#rtr 1 udpecho

Device1(config-rtr-udpecho)#set dest-ipaddr 192.0.0.2 dest-port 1001 source-ipaddr 110.1.0.1 source-port 1001

Device1(config-rtr-udpecho)#number-of-history-kept 255

Device1(config-rtr-udpecho)#frequency 11

Device1(config-rtr-udpecho)#exit

#View the entity parameter.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:UdpEcho1 Created:TRUE

****************type:UDPECHO****************

CreatedTime:WED OCT 24 16:36:45 2012

LatestModifiedTime:WED OCT 24 16:37:44 2012

Times-of-schedule:0

Entry-state:Pend

TargetIp:192.0.0.2 TargetPort:1001

SourceIp:110.1.0.1 SourePort:1001

TimeOut:5000(ms)

request-data-size:16

Frequecy:11(s)

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-pktloss:1 direction:be

Number-of-history-kept:255

Periods:1

Status:DEFAULT

--------------------------------------------------------------

The result shows that the entity parameters are consistent with the configuration..

Status: DEFAULT indicates that the entity status is DEFAULT.

Step 4:

Schedule the defined UDP-echo entity and define the attribute parameters of the scheduling.

#Configure Device1.

Device1(config)#rtr schedule 1 entity 1 start now ageout 100 life forever

Step 5:

Check the result.

#View the entity status.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:UdpEcho1 Created:TRUE

****************type:UDPECHO****************

CreatedTime:WED OCT 24 16:36:45 2012

LatestModifiedTime:WED OCT 24 16:37:44 2012

Times-of-schedule:5

Time-of-last-schedule:WED OCT 24 16:39:50 2012

Entry-state:Pend

TargetIp:192.0.0.2 TargetPort:1001

SourceIp:110.1.0.1 SourePort:1001

TimeOut:5000(ms)

request-data-size:16

Frequecy:11(s)

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-pktloss:1 direction:be

Data-pattern:ABCD

Number-of-history-kept:255

Periods:1

Status:REACHABLE

--------------------------------------------------------------

Status: REACHABLE indicates that the entity status is reachable, that is, the network from Device1 to Device2 can transmits the UDP packets normally.

#View the history record content.

Device1#show rtr history 1

--------------------------------------------------------------

ID:1 Name:UdpEcho1 CurHistorySize:5 MaxHistorysize:255

History recorded as following:

WED OCT 24 16:39:54 2012

PktLoss:0 ,Rtt:1 (ms)

WED OCT 24 16:39:44 2012

PktLoss:0 ,Rtt:1 (ms)

WED OCT 24 16:39:33 2012

PktLoss:0 ,Rtt:2 (ms)

WED OCT 24 16:39:23 2012

PktLoss:0 ,Rtt:2 (ms)

WED OCT 24 16:39:13 2012

PktLoss:0 ,Rtt:2 (ms)

--------------------------------------------------------------

In the history records, record the packet loss and delay of each scheduling.

l Before configuring the UDP-echo entity, we need to configure the rtr responder command at the destination end as the responder. If the responder end is not configured, the scheduling result is wrong.


3.3.6 Configure Detection Interface Traffic of FLOW-statistics Entity

Network Requirement

l Use the FLOW-statistics entity on Device1, detecting the traffic of the interface vlan2.

Network Topology

Figure 3-6 Networking of configuring the FLOW-statistics entity

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Configure the FLOW-statistics entity on Device1 and add the attribute parameters.

#Configure Device1.

Device1#config terminal

Device1(config)#rtr enable

Device1(config)#rtr 1 flow-statistics

Device1(config-rtr-flowsta)#flow-statistics interface vlan 2 interval 60

Device1(config-rtr-flowsta)#number-of-history-kept 255

Device1(config-rtr-flowsta)#exit

#View the entity parameters.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:flow-statistics1 Created:TRUE

****************type:FLOWSTATISTICS****************

CreatedTime:THU OCT 25 09:57:43 2012

LatestModifiedTime:THU OCT 25 09:58:03 2012

Times-of-schedule:0

Alarm-type:none

Threshold-of-inputPkt:200000000 direction:be

Threshold-of-inputFlow:200000000 direction:be

Threshold-of-outputPkt:200000000 direction:be

Threshold-of-outputFlow:200000000 direction:be

Interface: vlan 2

Statistics-interval:60(s)

Number-of-history-kept:255

Periods:1

Status:DEFAULT

--------------------------------------------------------------

The result shows that the entity parameters are consistent with the configuration.

Status: DEFAULT indicates that the entity status is DEFAULT.

Step 3:

Schedule the defined FLOW-statistics entity and define the attribute parameters of the scheduling.

#Configure Device1.

Device1(config)#rtr schedule 1 entity 1 start now ageout 100 life 600 repeat 10

Step 4:

Check the result.

1. When there is the received data traffic on the interface vlan 2:

#View the entity status.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:flow-statistics1 Created:TRUE

****************type:FLOWSTATISTICS****************

CreatedTime:THU OCT 25 09:57:43 2012

LatestModifiedTime:THU OCT 25 09:58:03 2012

Times-of-schedule:2

Time-of-last-schedule:THU OCT 25 10:02:11 2012

Alarm-type:none

Threshold-of-inputPkt:200000000 direction:be

Threshold-of-inputFlow:200000000 direction:be

Threshold-of-outputPkt:200000000 direction:be

Threshold-of-outputFlow:200000000 direction:be

Interface:fastethernet0

Statistics-interval:60(s)

Number-of-history-kept:255

Periods:1

Status:REACHABLE

--------------------------------------------------------------

Status: REACHABLE indicates that the entity status is reachable, that is, there are packets entering and leaving the vlan 2 interface.

2. When there is no egress or ingress data traffic on the interface vlan 2.

#View the entity status.

Device1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:flow-statistics1 Created:TRUE

****************type:FLOWSTATISTICS****************

CreatedTime:THU OCT 25 09:57:43 2012

LatestModifiedTime:THU OCT 25 09:58:03 2012

Times-of-schedule:5

Time-of-last-schedule:THU OCT 25 10:05:11 2012

Alarm-type:none

Threshold-of-inputPkt:200000000 direction:be

Threshold-of-inputFlow:200000000 direction:be

Threshold-of-outputPkt:200000000 direction:be

Threshold-of-outputFlow:200000000 direction:be

Interface: vlan 2

Statistics-interval:60(s)

Number-of-history-kept:255

Periods:1

Status:UNREACHABLE

--------------------------------------------------------------

Status: UNREACHABLE indicating when there is egress or ingress traffic on the interface vlan 2, the entity status is un-reachable.

#View the history record content.

Device1#show rtr history 1

--------------------------------------------------------------

ID:1 Name:flow-statistics1 CurHistorySize:5 MaxHistorysize:255

History recorded as following:

THU OCT 25 10:05:11 2012

Input pkt:0 (packets/s),Input flow:0 (bits/s),

Output pkt:0 (packets/s),Output flow:0 (bits/s)

THU OCT 25 10:04:11 2012

Input pkt:209 (packets/s),Input flow:214000 (bits/s),

Output pkt:0 (packets/s),Output flow:0 (bits/s)

THU OCT 25 10:03:11 2012

Input pkt:8460 (packets/s),Input flow:8663000 (bits/s),

Output pkt:0 (packets/s),Output flow:0 (bits/s)

THU OCT 25 10:02:11 2012

Input pkt:8460 (packets/s),Input flow:8663000 (bits/s),

Output pkt:0 (packets/s),Output flow:0 (bits/s)

THU OCT 25 10:01:12 2012

Input pkt:6456 (packets/s),Input flow:6610000 (bits/s),

Output pkt:0 (packets/s),Output flow:0 (bits/s)

--------------------------------------------------------------

In the history records, record the rate of entering and leaving the interface vlan 2 during each scheduling in details (based on the quantity and based on bit).

l The reachability of the FLOW-statistics entity can be defined as: The entity is being scheduled. As long as there is traffic at the IN or OUT direction, the entity status is REACHEABLE; if there is no traffic, the entity status is UNREACHABLE.


3.3.7 Configure LSP-ping Entity to Detect Communication in MPLS Network

Network Requirement

l In the MPLS network, use the LSP-ping entity on PE1, detecting the network communication from PE1 to PE2.

Network Topology

Figure 3-7 Networking of configuring the LSP-ping entity

Configuration Steps

Step 1: | Configure the IP address of the interface; PE1, P and PE2 form the MPLS network; in the MPLS network, run the IGP routing protocol and LDP; set up one LSP from PE1 to PE2 for FEC 3.3.3.3/32. (omitted; for the configuration of the MPLS environment, refer to MPLS configuration document)
Step 2: | Configure the LSP-ping entity on PE1 and add the attribute parameters.

#Configure Device.

PE1#config terminal

PE1(config)#rtr enable

PE1(config)#rtr 1 lsp-ping

PE1(config-rtr-lsp-ping)#set fec ipv4 3.3.3.3 32

PE1(config-rtr-lsp-ping)#number-of-history-kept 255

PE1(config-rtr-lsp-ping)#exit

#View the entity parameters.

PE1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:LspPing1 Created:TRUE

****************type:LSPPING****************

CreatedTime:THU OCT 25 14:02:22 2012

LatestModifiedTime:THU OCT 25 14:05:28 2012

Times-of-schedule:0

LDP IPv4 prefix:3.3.3.3 mask length:32

Echo request time out:2(s)

Echo request ttl:255

Echo request size:120(byte)

Echo request exp:0

Echo request send interval:0(ms)

Echo request repeat count:5

Schedule frequency:20(s)

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-packet-loss:200000000 direction:be

Number-of-history-kept:255

Periods:1

Total count of echo request need to send:0

Total count of echo request actually sent:0

Total count of echo reply received:0

Total count of valid echo reply received:0

In-scheduling:FALSE

Status:DEFAULT

--------------------------------------------------------------

The result shows that the entity parameters are consistent with the configuration.

In-scheduling: FALSE indicates that the entity is not scheduled.

Status: DEFAULT indicates that the entity status is DEFAULT.

Step 3:

Schedule the defined LSP-ping entity, defining the attribute parameters of the scheduling.

#Configure PE1.

PE1(config)#rtr schedule 1 entity 1 start now ageout 100 life forever

Step 4:

Check the result.

#View the entity status.

PE1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:LspPing1 Created:TRUE

****************type:LSPPING****************

CreatedTime:THU OCT 25 14:02:22 2012

LatestModifiedTime:THU OCT 25 14:07:2 2012

Times-of-schedule:4

Time-of-last-schedule:THU OCT 25 14:13:51 2012

LDP IPv4 prefix:3.3.3.3 mask length:32

Echo request time out:2(s)

Echo request ttl:255

Echo request size:120(byte)

Echo request exp:0

Echo request send interval:0(ms)

Echo request repeat count:5

Schedule frequency:20(s)

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-packet-loss:200000000 direction:be

Number-of-history-kept:255

Periods:1

Total count of echo request need to send:120

Total count of echo request actually sent:120

Total count of echo reply received:120

Total count of valid echo reply received:120

In-scheduling:TRUE

Status:REACHABLE

--------------------------------------------------------------

In-scheduling: TRUE indicates that the entity is being scheduled.

Status: REACHABLE indicates that the entity status is reachable, that is, the MPLS network connection from Device1 to Device3 is normal.

#View the history record content.

PE1#show rtr history 1

--------------------------------------------------------------

ID:1 Name:LspPing1 CurHistorySize:4 MaxHistorysize:255

History recorded as following:

THU OCT 25 14:07:11 2012

PktLoss:0 ,Rtt:0 (ms)

THU OCT 25 14:06:51 2012

PktLoss:0 ,Rtt:0 (ms)

THU OCT 25 14:06:31 2012

PktLoss:0 ,Rtt:0 (ms)

THU OCT 25 14:06:12 2012

PktLoss:0 ,Rtt:0 (ms)

--------------------------------------------------------------

In the history records, record the packet loss and delay of each scheduling.


3.3.8 Configure LSP-ping Entity with VRF Option to Detect Communication in MPLS L3VPN Network

Network Requirement

l In the MPLS L3VPN network, use the LSP-ping entity with the VRF option on PE1, detecting the network communication from PE1 to CE2.

Network Topology

Figure 3-8 Networking of configuring the LSP-ping entity with the VRF option

Device | Interface | IP address | Device | Interface | IP address
CE1 | vlan2 | 95.1.1.2/16 | PE2 | vlan4 | 92.1.1.2/16
 | Loopback0 | 5.5.5.5/32 |  | vlan5 | 90.1.1.1/16
PE1 | vlan2 | 93.1.1.1/16 |  | Loopback0 | 75.75.75.75/32
 | vlan3 | 95.1.1.1/16 | CE2 | vlan5 | 90.1.1.2/16
 | Loopback0 | 90.90.90.90/32 |  | Loopback0 | 8.8.8.8/32
P | vlan3 | 93.1.1.2/16 |  |  |
 | vlan4 | 92.1.1.1/16 |  |  |
 | Loopback0 | 11.11.11.11/32 |  |  |

Configuration Steps

Step 1: | Configure the IP address of the interface; CE1, PE1, P and PE2, CE2 form the MPLS L3VPN network; CE1 and CE2 can communicate with each other; VRF is 1 on PE1. (omitted; for the configuration of the MPLS L3VPN environment, refer to the configuration document of MPLS route)
Step 2: | Configure the LSP-ping entity with the VRF option on PE1 and add the attribute parameters.

#Configure PE1.

PE1#config terminal

PE1(config)#rtr enable

PE1(config)#rtr 1 lsp-ping

PE1(config-rtr-lsp-ping)#set fec vrf 1 ipv4 8.8.8.8

PE1(config-rtr-lsp-ping)#number-of-history-kept 255

PE1(config-rtr-lsp-ping)#exit

#View the entity parameters.

PE1#show rtr entity 1

--------------------------------------------------------------

ID:1 name:LspPing1 Created:TRUE

****************type:LSPPING****************

CreatedTime:MON NOV 05 09:39:40 2012

LatestModifiedTime:MON NOV 05 09:39:59 2012

Times-of-schedule:0

VPN IPv4 prefix:8.8.8.8 mask length:32 VRF name:1

Echo request time out:2(s)

Echo request ttl:255

Echo request size:120(byte)

Echo request exp:0

Echo request send interval:0(ms)

Echo request repeat count:5

Schedule frequency:20(s)

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-packet-loss:200000000 direction:be

Number-of-history-kept:255

Periods:1

Total count of echo request need to send:0

Total count of echo request actually sent:0

Total count of echo reply received:0

Total count of valid echo reply received:0

In-scheduling:FALSE

Status:DEFAULT

The result shows that the entity parameters are consistent with the configuration.

In-scheduling: FALSE indicates that the entity is not scheduled.

Status: DEFAULT indicates that the entity status is DEFAULT.

Step 3:

Schedule the defined LSP-ping entity, defining the attribute parameters of the scheduling.

#Configure PE1.

PE1(config)#rtr schedule 1 entity 1 start now ageout 100 life forever

Step 4:

Check the result.

#View the entity status.

PE1#show rtr entity 1

--------------------------------------------------------------

CreatedTime:MON NOV 05 09:39:40 2012

LatestModifiedTime:MON NOV 05 09:39:59 2012

Times-of-schedule:3

Time-of-last-schedule:MON NOV 05 09:41:13 2012

VPN IPv4 prefix:8.8.8.8 mask length:32 VRF name:1

Echo request time out:2(s)

Echo request ttl:255

Echo request size:120(byte)

Echo request exp:0

Echo request send interval:0(ms)

Echo request repeat count:5

Schedule frequency:20(s)

Alarm-type:none

Threshold-of-rtt:9000(ms) direction:be

Threshold-of-packet-loss:200000000 direction:be

Number-of-history-kept:255

Periods:1

Total count of echo request need to send:15

Total count of echo request actually sent:15

Total count of echo reply received:15

Total count of valid echo reply received:15

In-scheduling:TRUE

Status:REACHABLE

--------------------------------------------------------------

In-scheduling: TRUE indicates that the entity is being scheduled.

Status: REACHABLE indicates that the entity status is reachable, that is, the MPLS L3VPN network connection from PE1 to CE2 is normal.

#View the history record content.

PE1#show rtr history 1

--------------------------------------------------------------

ID:1 Name:LspPing1 CurHistorySize:3 MaxHistorysize:255

History recorded as following:

MON NOV 05 09:41:13 2012

PktLoss:0 ,Rtt:0 (ms)

MON NOV 05 09:40:53 2012

PktLoss:0 ,Rtt:0 (ms)x

MON NOV 05 09:40:33 2012

PktLoss:0 ,Rtt:0 (ms)

--------------------------------------------------------------

In the history records, record the packet loss and delay of each scheduling.


3.3.9 Configure TRACK to Link with SLA

Network Requirement

l TRACK links with SLA. Judge the validity of the static route on Device1 via the entity status.

Network Topology

Figure 3-9 Networking of configuring TRACK to link with SLA

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Configure the ICMP-echo entity on Device1 to detect the network connectivity from Device1 to Device2, and add the entity to the entity group.

#Configure Device1.

Device1#config terminal

Device1(config)#rtr enable

Device1(config)#rtr 1 icmpecho

Device1(config-rtr-icmpecho)#set 110.1.0.2 5 70 2 12 extend 110.1.0.1 0 true false

Device1(config-rtr-icmpecho)#number-of-history-kept 255

Device1(config-rtr-icmpecho)#exit

Device1(config)#rtr group 1

Device1(config-rtr-group)#member 1

Device1(config-rtr-group)#exit

Step 3:

Define TRACK and associate with LSA.

#Configure Device1.

Device1(config)#track 1

Device1(config-track)#rtr 1

Step 4:

Add the static route and associate TRACK.

#Configure Device1.

Device1(config)#ip route 192.0.0.0 255.255.255.0 110.1.0.2 track 1

Step 5:

Schedule the entity group.

#Configure Device1.

Device1(config)#rtr schedule 1 group 1 start now ageout 100 life forever

Step 6:

Check the result.

(1) When the network connectivity from Device1 to Device2 is normal:

#View the entity group status.

Device1#show rtr group 1

----------------------------------------------

ID:1 name:rtrGroup1 Members schedule interval:0

Option: AND Status:REACHABLE

*****************************

type:SINGLE Entity Id :1

The status of the entity group is REACHEABLE.

#In the route table of Device1, view the route of the segment 192.0.0.0/24.

Device1#show ip route 192.0.0.0

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

S 192.0.0.0/24 [1/10] via 110.1.0.2, 00:00:09, vlan2

The result displays that there is the route to the segment 192.0.0.0/24, indicating that when the status of the entity group is RECHABLE, judge that the associated static route is valid.

(2) When the network connectivity from Device1 to Device2 is faulty:

#View the status of the entity group:

Device1#show rtr group 1

----------------------------------------------

ID:1 name:rtrGroup1 Members schedule interval:0

Option: AND Status:UNREACHABLE

*****************************

type:SINGLE Entity Id :1

The status of the entity group is UNREACHEABLE.

#In the route table of Device1, view the route of the segment 192.0.0.0/24.

Device1#show ip route 192.0.0.2

Codes: C - connected, S - static, R - RIP, O - OSPF, OE-OSPF External, M - Management

D - Redirect, E - IRMP, EX - IRMP external, o - SNSP, B - BGP, i-ISIS

Gateway of last resort is not set

The result displays that there is no route to the segment 192.0.0.0/24, indicating that when the status of the entity group is UNREACHABLE, judge that the associated static route is invalid.


4 NTP


4.1 Overview

NTP (Network Time Protocol) is the standard Internet protocol used to synchronize the time in Internet. NTP is to synchronize the device time to the standard time. Currently, the adopted time standard is UTC (Universal Time Coordinated).

The design of NTP fully considers the complexity of the time synchronization on Internet. NTP provides the strict, practical, and valid mechanism, applicable to the Internet environments with various scales and speeds. NTP not only corrects the present time, but also continuously tracks the time change and can adjust automatically, even the network fails, it can maintain the time stability. The network cost generated by NTP is small and has the measures of ensuring the network security. The measures can make NTP get the reliable and correct time synchronization on Internet.

In the actual application, select the appropriate NTP work mode according to the network deployment, so as to meet the network clock synchronization requirement in different environments. NTP supports the following three work modes:

l Client/server mode

In the client/server mode, the client sends the clock synchronization packet with Mode field 3 (client mode) to the server. After receiving the packet, the server automatically works in the server mode and sends the response packet with Mode field 4 (server mode). After receiving the response packet, the client synchronizes the system clock. In the mode, the client can synchronize the clock from the server, while the server cannot synchronize the clock from the client.

l Peer mode

In the peer mode, the active peer and passive peer first interact the NTP packet with the Mode field 3 (client mode) and 4 (server mode). And then, the active peer sends the clock synchronization packet with the M ode field 1 (the active peer mode) to the passive peer. After receiving the packet, the passive peer automatically works in the passive peer mode and sends the clock synchronization packet with the Mode field 2 (passive peer mode). In this way, the peer mode is set up. In the mode, the active peer and the passive peer synchronize the clock mutually. If the clocks of the two parties are already synchronized, be subject to the clock with smaller layers.

l Broadcast mode

In the broadcast mode, the broadcast server periodically sends the clock synchronization packet with the Mode field 5 (broadcast server mode) to the broadcast address 255.255.255.255, and the broadcast client monitors the broadcast packet from the broadcast server. When the broadcast client receives the first broadcast packet, the broadcast client and broadcast server interact the NTP packet with the Mode field 3 (client mode) and 4 (server mode), so as to get the network delay of the broadcast client and broadcast server. And then, the broadcast client continues to monitor the broadcast packet and synchronizes the system clock according to the received broadcast packet.


4.2 NTP Function Configuration

Table 4‑1 NTP function configuration list

Configuration Task
Configure the NTP basic functions | Configure the NTP client/server mode
 | Configure the NTP peer mode
 | Configure the NTP broadcast mode
Configure the NTP optional parameters | Configure the NTP reference clock
 | Configure the source interface of the NTP packet
 | Configure the receiving and sending control of the NTP packet
Configure the NTP authentication functions | Configure the NTP client/server authentication
 | Configure the NTP peer authentication
 | Configure the NTP broadcast authentication
Configure the NTP access control | Configure the NTP access control


4.2.1 Configure NTP Basic Functions

Configuration Condition

Before configuring the NTP basic functions, first complete the following task:

l Configure the network layer address of the interface, making the network layer between the NTP clock service requester and clock service provider reachable.

l The NTP clock service provider enables NTP.

Configure NTP Client/Server Mode

When using the NTP client/server mode, do not need special configuration on the server, but it is necessary to ensure that the serve clock is synchronized and the clock layers of the server are smaller than the clock layers of the client.

Perform the following configuration on the NTP client.

Table 4‑2 Configure the NTP client

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Specify the NTP server | ntp server [ vrf vrf-name ] { ip-address | domain-name } [ version version | key key-number | source interface-name ] | Mandatory By default, do not specify the NTP server.

l The ip-address parameter is one unicast address, but cannot be the broadcast address, multicast address or IP address of the local device.

l After specifying the source interface of the client packet via source interface-name, the master IP address of the interface is set as the source IP address of the packet sent by the client.

l If the source interface of the sent packet is specified on the server, the server IP address configured by the client should be the same as the IP address of the source interface. Otherwise, the client cannot process the response packet returned by the server correctly and as a result, the clock cannot be synchronized.

l You can specify multiple servers by configuring the ntp server command for multiples times. You can specify 20 servers at most.

Configure NTP Peer Mode

When using the NTP peer mode, do not need special configuration on the passive peer, but it is necessary to ensure that the passive peer can receive and send the NTP packet. You can enable NTP by configuring the ntp master command on the passive peer or any NTP command in “4.2.1 Configure NTP Basic Functions”.

Perform the following configuration on the NTP active peer.

Table 4‑3 Configure the NTP active peer

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Specify the NTP passive peer | ntp peer [ vrf vrf-name ] { ip-address | domain-name } [ version version | key key-number | source interface-name ] | Mandatory By default, do not specify the NTP passive peer.

l The ip-address parameter is one unicast address, but cannot be the broadcast address, multicast address or IP address of the local device.

l After specifying the sending source interface of the active peer packet via source interface-name, the master IP address of the interface is set as the source IP address of the packet sent by the active peer.

l If the source interface of the sent packet is specified on the passive peer, the server IP address configured by the active peer should be the same as the IP address of the source interface. Otherwise, the active peer cannot process the packet sent by the passive peer correctly and as a result, the clock cannot be synchronized.

l You can specify multiple passive peers by configuring the ntp server command for multiples times. You can specify 20 passive peers at most.

Configure NTP Broadcast Mode

When using the NTP broadcast mode, the broadcast server and broadcast client both need to be configured and it is necessary to ensure that the clock of the broadcast server is synchronized and the clock layers are smaller than the clock layers of the broadcast client. It is necessary to specify one interface for sending the NTP broadcast packet on the broadcast server and one interface for receiving the NTP broadcast packet on the broadcast client, so the configuration of the broadcast mode can only be performed in the specific interface mode.

Perform the following configuration on the NTP broadcast client.

Table 4‑4 Configure the NTP broadcast client

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the NTP broadcast client on the interface | ntp broadcast client | Mandatory By default, the interface does not enable the NTP broadcast client.

Perform the following configuration on the NTP broadcast server.

Table 4‑5 Configure the NTP broadcast server

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the NTP broadcast server on the interface | ntp broadcast [ key key-number| version version-number ] | Mandatory By default, the interface does not enable the NTP broadcast server.

l You can enable the broadcast clients of multiple interfaces by configuring the ntp broadcast client command for multiple times. You can enable the broadcast clients of 20 interfaces at most.

l You can enable the broadcast servers of multiple interfaces by configuring the ntp broadcast command for multiple times. You can enable the broadcast servers of 20 interfaces at most.


4.2.2 Configure NTP Optional Parameters

Configuration Condition

None

Clock NTP Reference Clock

NTP can synchronize the system time via the following two modes:

l Synchronize with the local clock, that is, adopt the local clock as the NTP reference clock

l Synchronize with the other clock source in network, that is, use any of the previous mentioned three NTP work modes.

Table 4‑6 Configure the local clock as the NTP reference clock

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the local clock as the NTP reference clock | ntp master [ stratum-number ] | Mandatory By default, do not configure the local clock as the NTP reference clock.

l After configuring the local clock as the NTP reference clock, NTP cannot synchronize the clock from the other clock source in the network.

l After configuring the local clock as the NTP reference clock, the local device can serve as the clock source to synchronize the other device in the network. Please use the configuration carefully, so as to avoid the clock error of other device in the network.

Configure Source Interface of the NTP Packet

If the source interface of the NTP packet is configured and when the device actively sends the NTP packet, select the master IP address of the specified source interface as the source IP address of the packet.

Table 4‑7 Configure the source interface of the NTP packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the source interface of the NTP packet | ntp source interface-name | Mandatory By default, do not configure the source interface of the NTP packet.

l If using the ntp server or ntp peer command to specify the source interface, first use the source interface specified by the ntp server or ntp peer command.

l If ntp broadcast is configured in the interface mode, the source interface of the NTP broadcast packet is the interface configured with the above command.

l If the source interface of the specified NTP packet is down, do not send the NTP packet.

l If the source interface of the specified NTP packet is not configured with address and is in the up state, the source IP address of the sent NTP packet is the master IP address of the egress interface of the packet.

Configure Receiving and Sending Control of NTP Packet

By default, the device will receive and send all NTP packets. You can configure the receiving and sending control of the NTP packet to prohibit receiving and sending the NTP packet.

Table 4‑8 Configure the receiving and sending control of the NTP packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Prohibit receiving and sending the NTP packet | no ntp enable [ service ] | Mandatory By default, do not prohibit receiving and sending the NTP packet.

l After configuring the no ntp enable command, prohibit sending and receiving all NTP packets. If only the no ntp enable service command is configured, prohibit receiving and sending the NTP packet of the client/server mode.


4.2.3 Configure NTP Authentication Function

In the network with high requirement for the security, when running the NTP protocol, it is necessary to enable the authentication function. Authenticate the packet interacted by the NTP clock service requester and clock service provider to ensure that the clock service requester is synchronized with the valid time, improving the network security.

Configuration Condition

To configure the NTP authentication function, first complete the following task:

l Configure the network layer address of the interface, making the network layer between the NTP clock service requester and clock service provider reachable.

l The NTP clock service provider enables NTP.

Configure NTP Client/Server Authentication

When configuring the NTP client/server authentication, it is necessary to enable the authentication function on the client and server, configure the authentication key, set the authentication key as the trusted key, and specify the key associated with the server on the client.

Perform the following configuration on the NTP client.

Table 4‑9 Configure the NTP client authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the NTP authentication function | ntp authenticate | Mandatory By default, do not enable the NTP authentication function.
Configure the authentication key | ntp authentication-key key-number md5 key | Mandatory By default, do not configure the authentication key.
Configure the specified key as the trusted key | ntp trusted-key key-number | Mandatory By default, do not specify the trusted key.
Specify the key associated with the server | ntp server [ vrf vrf-name ] { ip-address | domain-name } [ version version | source interface-name ] key key-number | Mandatory

Perform the following configuration on the NTP server.

Table 4‑10 Configure the NTP server authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the NTP authentication function | ntp authenticate | Mandatory By default, do not enable the NTP authentication function.
Configure the authentication key | ntp authentication-key key-number md5 key | Mandatory By default, do not configure the authentication key.
Specify the key as the trusted key | ntp trusted-key key-number | Mandatory By default, do not specify the trusted key.

l The server and client need to be configured with the same authentication key.

l The client can associate the un-existing key with the server, but if hoping to enable the authentication function successfully, you should configure the key and specify the key as the trusted key after associating the key.

Configure NTP Peer Authentication

When configuring the NTP peer authentication, it is necessary to enable the authentication function on the active peer and passive peer, configure the authentication key, set the authentication key as the trusted key, and specify the key associated with the passive peer on the active peer.

Perform the following configuration on the NTP active peer.

Table 4‑11 Configure the NTP active peer authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the NTP authentication function | ntp authenticate | Mandatory By default, do not enable the NTP authentication function.
Configure the authentication key | ntp authentication-key key-number md5 key | Mandatory By default, do not configure the authentication key.
Specify the key as the trusted key | ntp trusted-key key-number | Mandatory By default, do not specify the trusted key.
Specify the key associated with the passive peer | ntp peer [ vrf vrf-name ] ip-address | domain-name [ version version | source interface-name ] key key-number | Mandatory

Perform the following configuration on the NTP passive peer.

Table 4‑12 Configure the NTP passive peer authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the NTP authentication function | ntp authenticate | Mandatory By default, do not enable the NTP authentication function.
Configure the authentication key | ntp authentication-key key-number md5 key | Mandatory By default, do not configure the authentication key.
Specify the key as the trusted key | ntp trusted-key key-number | Mandatory By default, do not specify the trusted key

l The active peer and passive peer need to be configured with the same authentication key.

l The active peer can associate the un-existing key with the passive peer, but if hoping to enable the authentication function successfully, you should configure the key and specify the key as the trusted key after associating the key.

Configure NTP Broadcast Authentication

When configuring the NTP broadcast authentication, it is necessary to enable the authentication function on the broadcast client and broadcast server, configure the authentication key, set the authentication key as the trusted key, and specify the key associated with the broadcast server.

Perform the following configuration on the NTP broadcast client.

Table 4‑13 Configure the NTP broadcast client authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the NTP authentication function | ntp authenticate | Mandatory By default, do not enable the NTP authentication function.
Configure the authentication key | ntp authentication-key key-number md5 key | Mandatory By default, do not configure the authentication key.
Specify the key as the trusted key | ntp trusted-key key-number | Mandatory By default, do not specify the trusted key.

Perform the following configuration on the NTP broadcast server.

Table 4‑14 Configure the NTP broadcast server authentication

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the NTP authentication function | ntp authenticate | Mandatory By default, do not enable the NTP authentication function.
Configure the authentication key | ntp authentication-key key-number md5 key | Mandatory By default, do not configure the authentication key.
Specify the key as the trusted key | ntp trusted-key key-number | Mandatory By default, do not specify the trusted key.
Enter the interface configuration mode | interface interface-name | -
Specify the key associated with the broadcast server | ntp broadcast [ version version-number ] key key-number | Mandatory

l The broadcast server and broadcast client need to be configured with the same authentication key.

l The broadcast server can associate the un-existing key with the broadcast server, but if hoping to enable the authentication function successfully, you should configure the key and specify the key as the trusted key after associating the key.


4.2.4 Configure NTP Access Control

Configuration Condition

To configure the NTP access control, first complete the following task:

l Configure the ACL associated with the access control

Configure NTP Access Control

NTP can limit the access for the local NTP server by associating with ACL.

Table 4‑15 Configure the NTP access control

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the NTP access control | ntp access-group peer access-list-number | Mandatory By default, do not configure the access control.


4.2.5 NTP Monitoring and Maintaining

Table 4‑16 NTP Monitoring and Maintaining

Command | Description
show ntp associations | Display the NTP session information
show ntp status | Display the NTP status information


4.3 NTP Typical Configuration Example


4.3.1 Configure NTP Client/Server Mode

Network Requirements

l Device1 and Device2 are interconnected via their interfaces and the route is reachable.

l Device1 is the NTP server and Device2 is the NTP client.

l The NTP server is the clock source and the client gets the clock from the server.

Network Topology

Figure 4‑1 Networking of configuring NTP client/server mode

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Configure Device1 as the NTP server.

#Configure the local clock of the device as the reference clock the clock layers are 3.

Device1#configure terminal

Device1(config)#ntp master 3

Device1(config)# clock timezone BEIJING

Step 3:

Configure Device2 as the NTP client2.

#Configure Device2 as the Beijing time zone.

Device2#configure terminal

Device2(config)#clock timezone BEIJING

#Specify the NTP server Device1 and the IP address is 1.0.0.1.

Device2(config)#ntp server 1.0.0.1

Step 4:

Check the result.

#Execute the show ntp statuscommand on the client Device2, and view the clock synchronization status, indicating that the client and NTP server Device1 are synchronized and the clock layers is 4, larger than Device1.

Device2#show ntp status

Current NTP status information

Clock is synchronized, stratum 4, reference is 1.0.0.1

reference time is D442EB0E.432F29BD (01:49:02.262 Tue Nov 06 2012)

The clock layers of Device2 is 1 larger than Device1, indicating that the client Device2 is already synchronized with the server Device1.

#Execute the show clock command to view the device clock on the client Device2.

Device2#show clock

BEIJING(UTC+08:00) TUE NOV 06 09:49:30 2012


4.3.2 Configure NTP Multi-level Clients/ Server

Network Requirement

l Device2 are interconnected with Device1 and Device 3; the route is reachable.

l Device1 is the NTP server; Device2 and Device3 are the NTP client.

l Device1 provides the clock for Device2; Device2 provides the clock for Device3.

Network Topology

Figure 4‑2 Networking of configuring the NTP server and multi-level clients

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Configure the NTP server Device1.

#Configure the local clock of the device as the reference clock and the clock layers is 3.

Device1#configure terminal

Device1(config)#ntp master 3

Device1(config)# clock timezone BEIJING

Step 3:

Configure the NTP client Device2.

#Configure Device2 as Beijing time zone.

Device2#configure terminal

Device2(config)#clock timezone BEIJING

#Specify the NTP server as Device1 and the IP address is 1.0.0.1.

Device2(config)#ntp server 1.0.0.1

Step 4:

Configure the NTP client Device3.

#Configure Device3 as Beijing time zone.

Device3#configure terminal

Device3(config)#clock timezone BEIJING

#Specify the NTP server as Device2 and the IP address is 2.0.0.1.

Device3(config)#ntp server 1.0.0.1

Step 5:

Check the result, viewing the clock synchronization information on Device2 and Device3.

#Execute the show ntp status command on the client Device2, and view the clock synchronization status.

Device2#show ntp status

Current NTP status information

Clock is synchronized, stratum 4, reference is 1.0.0.1

reference time is D44CC35E.BAA6A190 (13:02:22.729 Tue Nov 13 2012)

The clock layers of Device2 is 1 larger than Device1 and it is 4, indicating that the client Device2 is already synchronized with the server Device1.

#Execute the show clockcommand to view the device clock on the client Device2.

Device2#show clock

BEIJING(UTC+08:00) TUE NOV 13 21:02:24 2012

#Execute the show ntp statuscommand on the client Device3, and view the clock synchronization status.

Device3#show ntp status

Current NTP status information

Clock is synchronized, stratum 5, reference is 2.0.0.1

reference time is D44CC365.5CC8C4C8 (13:02:29.362 Tue Nov 13 2012)

The clock layers of Device3 is 1 larger than Device2 and it is 5, indicating that the client Device3 is already synchronized with the server Device2.

#Execute the show clockcommand to view the device clock on the client Device3.

Device3#show clock

BEIJING(UTC+08:00) TUE NOV 13 21:02:36 2012


4.3.3 Configure NTP Peer Mode

Network Requirements

l Device1, Device2, and Device3 are interconnected via their interfaces; the route is reachable.

l Device1 sets the local clock as the reference clock and the number of the layers is 3.

l Device2 is the NTP client; set Device1 to the NTP server.

l Device3 sets Device2 as the peer, Device3 is the active peer, and Device2 is the passive peer.

Network Topology

Figure 4‑3 Networking of configuring the NTP peer mode

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Device1 sets the local clock as the reference clock and the number of the layers is 3.

Device1#configure terminal

Device1(config)#ntp master 3

Device1(config)# clock timezone BEIJING

Step 3:

Device2 specifies Device1 as the NTP server.

#Configure Device2 as Beijing Timezone.

Device2#configure terminal

Device2(config)#clock timezone BEIJING

#Specify the IP address of the NTP server as 1.0.0.254.

Device2(config)#ntp server 1.0.0.254

Step 4:

Device3 sets Device2 as the peer.

#Configure Device3 as Beijing Timezone.

Device3#configure terminal

Device3(config)#clock timezone BEIJING

#Specify the IP address of the NTP peer as 1.0.0.1.

Device3(config)#ntp peer 1.0.0.1

Step 5:

Check the result.

#Execute the show ntp status command on the client Device2 and view the clock synchronization status information.

Device2#show ntp status

Current NTP status information

Clock is synchronized, stratum 4, reference is 1.0.0.254

reference time is D8E9785D.221F1F5 (03:09:17.8 Tue Apr 28 2015)

The layers of Device2 clock is 4, larger than Device1 by 1, and the reference clock server address is 1.0.0.254, indicating that the client Device2 is already synchronized with the server Device1.

#Execute the show clock command to view the device clock on the client Device2.

Device2#show clock

BEIJING(UTC+08:00) TUE APR 28 11:10:36 2015

#Execute the show ntp status command on the active peer Device3 and view the clock synchronization status information.

Device3#show ntp status

Current NTP status information

Clock is synchronized, stratum 5, reference is 1.0.0.1

reference time is D8E9795C.29835CC9 (03:13:32.162 Tue Apr 28 2015)

The layers of Device3 clock is 5, larger than Device2 by 1, and the reference clock server address is 1.0.0.1, indicating that the active peer Device3 is already synchronized with the passive peer Device2.

#Execute the show clock command to view the device clock on client Device3.

Device3#show clock

BEIJING(UTC+08:00) TUE APR 28 11:16:19 2015


4.3.4 Configure NTP Broadcast Mode

Network Requirements

l Device1, Device2, and Device3 are interconnected via their interfaces; the route is reachable.

l Device1 sets the local clock as the reference clock and the number of the layers is 3.

l Device1 is the NTP broadcast server and sends the NTP broadcast packet from the interface gigabitethernet0.

l Device2 and Device3 are the NTP broadcast client, monitoring the NTP broadcast packet on their interface gigabitethernet0.

Network Topology

Figure 4‑4 Networking of configuring the NTP broadcast mode

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Device1 sets the local clock as the reference clock and the number of the layers is 3; configure Device1 as the NTP broadcast server, sending the NTP broadcast packet from the interface gigabitethernet0.

#Configure the local clock as the reference clock and the number of the clock layers is 3.

Device1#configure terminal

Device1(config)#ntp master 3

#Configure Device1 as the NTP broadcast server, sending the NTP broadcast packet from the interface vlan2.

Device1(config)#interface vlan2

Device1(config-if- vlan2)#ntp broadcast

Step 3:

Configure Device2 as the NTP broadcast client, monitoring the NTP broadcast packet on the interface gigabitethernet0.

Device2#configure terminal

Device2(config)#interface vlan2

Device2(config-if- vlan2)#ntp broadcast client

Step 4:

Configure Device3 as the NTP broadcast client, monitoring the NTP broadcast packet on the interface vlan2.

Device3#configure terminal

Device3(config)#interface vlan2

Device3(config-if- vlan2)#ntp broadcast client

Step 5:

Check the result.

#Execute the show ntp status command on the client Device2 and view the clock synchronization status information.

Device2#show ntp status

Current NTP status information

Clock is synchronized, stratum 4, reference is 1.0.0.254

reference time is D8E97C99.5110D9FE (03:27:21.316 Tue Apr 28 2015)

The number of Device2 clock layers is 4, larger than Device1 by 1, and the reference clock server address is 1.0.0.254, indicating that the client Device2 is already synchronized with the server Device1.

#Execute the show clock command to view the device clock on the client Device2.

Device2#show clock

BEIJING(UTC+08:00) TUE APR 28 11:27:22 2015

#Execute the show ntp status command on the active peer Device3 and view the clock synchronization status information.

Device3#show ntp status

Current NTP status information

Clock is synchronized, stratum 4, reference is 1.0.0.254

reference time is D8E97CAC.78F42CA6 (03:27:40.472 Tue Apr 28 2015)

The layers of Device3 clock is 4, larger than Device1 by 1, and the reference clock server address is 1.0.0.254, indicating that the active peer Device3 is already synchronized with the server Device1.

#Execute the show clock command to view the device clock on client Device3.

Device3#show clock

BEIJING(UTC+08:00) TUE APR 28 11:27:41 2015


4.3.5 Configure NTP Client/Server Authentication Function

Network Requirements

l Device1 and Device2 are interconnected via their interfaces; the route is reachable.

l Device1 is the NTP server; Device2 is the NTP client; both adopt the MD5 algorithm authentication.

l NTP server is the clock source and the client gets the clock from the server.

Network Topology

Figure 4‑5 Networking of configuring the NTP client/server authentication function

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Configure the NTP server.

#Configure the local clock of the device as the reference clock and the clock layers is 3.

Device1#configure terminal

Device1(config)#ntp master 3

Device1(config)# clock timezone BEIJING

#Enable the authentication.

Device1(config)#ntp authenticate

#Configure the authentication key serial number as 1, algorithm as MD5 and key as admin.

Device1(config)#ntp authentication-key 1 md5 admin

#Configure the key 1 be trusted.

Device1(config)#ntp trusted-key 1

Step 4:

Configure the NTP client.

#Configure Device2 as Beijing time zone.

Device2#configure terminal

Device2(config)#clock timezone BEIJING

#Specify the NTP server for the client and the IP address is 1.0.0.1.

Device2(config)#ntp server 1.0.0.1 key 1

#Enable the authentication.

Device2(config)#ntp authenticate

#Configure the authentication key serial number as 1, algorithm as MD5 and key as admin.

Device2(config)#ntp authentication-key 1 md5 admin

#Configure the key 1 be trusted.

Device2(config)#ntp trusted-key 1

Step 5:

Check the result.

#Execute the show ntp statuscommand on the client Device2, and view the clock synchronization status.

Device2#show ntp status

Current NTP status information

Clock is synchronized, stratum 4, reference is 1.0.0.1

reference time is D442ECE1.8BB7B219 (01:56:49.545 Tue Nov 06 2012)

The layers of Device2 clock is 4, larger than Device1 by 1, indicating that the client is already synchronized with the server Device1.

#Execute the show clockcommand to view the device clock on Device2.

Device2#show clock

BEIJING(UTC+08:00) TUE NOV 06 09:56:52 2012

l The authentication serial numbers of the NTP client and server should be the same and the keys should be the same.


4.3.6 Configure NTP Broadcast Authentication Function

Network Requirements

l Device1, Device2, and Device3 are interconnected via their interfaces; the route is reachable.

l Device1 sets the local clock as the reference clock and the number of the layers is 3.

l Device1 is the NTP broadcast server, enable the NTP authentication, and send the NTP broadcast packet from the interface vlan2.

l Device2 and Device3 are the NTP broadcast client, and enable the NTP authentication, monitoring the NTP broadcast packet on their interface vlan2.

Network Topology

Figure 4‑6 Networking of configuring the NTP broadcast authentication function

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Device1 sets the local clock as the reference clock, and the number of the layers is 3. Configure Device1 as the NTP broadcast server and configure the MD5 authentication, sending the NTP broadcast packet on the interface vlan2.

#Configure the local clock of the device as the reference clock and the number of the clock layers is 3.

Device1#configure terminal

Device1(config)#ntp master 3

Device1(config)# clock timezone BEIJING

#Enable the authentication.

Device1(config)#ntp authenticate

#Configure the serial number of the authentication key as 1, the algorithm as MD5, and key as admin.

Device1(config)#ntp authentication-key 1 md5 admin

#Configure key 1 as trusted.

Device1(config)#ntp trusted-key 1

l The authentication serial numbers of the NTP client and server should be the same, and the key should be the same.

#Enable the NTP broadcast server of the interface and specify the key serial number associated with the broadcast server as 1.

Device1(config)#interface vlan2

Device1(config-if-vlan2)#ntp broadcast key 1

Step 3:

Configure Device2 as the NTP broadcast client and configure the MD5 authentication, monitoring the NTP broadcast packet on the interface vlan2.

#Configure Device2 as Beijing timezone.

Device2#configure terminal

Device2(config)#clock timezone BEIJING

#Enable the authentication.

Device2(config)#ntp authenticate

#Configure the serial number of the authentication key as 1, the algorithm as MD5, and the key as admin.

Device2(config)#ntp authentication-key 1 md5 admin

#Configure key 1 as trusted.

Device2(config)#ntp trusted-key 1

#Configure the NTP broadcast client on the interface.

Device2(config)#interface vlan2

Device2(config-if-vlan2)#ntp broadcast client

l When configuring the NTP broadcast authentication function, it is necessary to specify the key serial number associated with the server on the broadcast server, but it is not necessary to specify on the broadcast client.

Step 4:

Configure Device3 as the NTP broadcast client and configure the MD5 authentication, monitoring the NTP broadcast packet on the interface vlan2.

#Configure Device3 as Beijing timezone.

Device3#configure terminal

Device3(config)#clock timezone BEIJING

#Enable the authentication.

Device3(config)#ntp authenticate

#Configure the serial number of the authentication key as 1, the algorithm as MD5, and key as admin.

Device3(config)#ntp authentication-key 1 md5 admin

#Configure key 1 as trusted.

Device3(config)#ntp trusted-key 1

#Configure the NTP broadcast client on the interface.

Device3(config)#interface vlan2

Device3(config-if-vlan2)#ntp broadcast client

l When configuring the NTP broadcast authentication function, it is necessary to specify the key serial number associated with the server on the broadcast server, but it is not necessary to specify on the broadcast client.

Step 5:

Check the result.

#Execute the show ntp status command on client Device2, and view the clock synchronization status information.

Device2#show ntp status

Current NTP status information

Clock is synchronized, stratum 4, reference is 1.0.0.254

reference time is D90954DB.4DE52C7F (07:17:44.972 Fri May 22 2015)

The number of Device2 clock layers is 4, larger than Device1 by 1, indicating that the broadcast client is already synchronized with the server Device1.

#Execute the show clock command to view the device clock on Device2.

Device2#show clock

BeiJing(UTC+08:00) FRI MAY 22 15:18:20 2015

#Execute the show ntp status command on client Device3, and view the clock synchronization status information.

Device3#show ntp status

Current NTP status information

Clock is synchronized, stratum 4, reference is 1.0.0.254

reference time is D90957A2.1B393E2D (07:22:10.106 Fri May 22 2015)

The number of Device3 clock layers is 4, larger than Device1 by 1, indicating that the broadcast client is already synchronized with the NTP broadcast server Device1.

#Execute the show clock command to view the device clock on Device3.

Device3#show clock

BeiJing(UTC+08:00) FRI MAY 22 15:22:15 2015


5 Port Mirror


5.1 Overview


5.1.1 Introduction to Port Mirror

Port mirror, also called SPAN (Switched Port Analyzer), is one management mode used to monitor the data flow of the device port.


5.1.2 Basic Concepts

SPAN Session

SPAN session means to mirror the data flow of one or multiple monitor ports on the device and send to the destination port. The mirrored data flow can be the input data flow and also can be the output data flow or mirror the input and output data flow at the same time. We can configure SPAN for the disabled port and the SPAN session does not take effect, but as long as the related port is enabled, SPAN takes effect.

Local SPAN

Local SPAN supports the port mirror on one device. All mirror ports and destination ports are on the same device.

Traffic Type

Traffic type includes Receive (Rx) (the received traffic of the mirror port, Transmit (Tx) (the forwarded traffic of the mirror port, and Both (the received and forwarded traffic of the mirror port).

SPAN Source Port

SPAN source port is also called monitored port. Its data is monitored for network analysis. The monitored data flow can be at the input direction, output direction or both. It can function in different VLANs. The source port can be general port or aggregation group. One source port can only belong to one SPAN session.

SPAN Destination Port

SPAN destination port can only be one separate actual physical port.

The device supports taking the destination port as the general forwarding port, but for universality and to make the monitored data not be interfered by other data flow, it is suggested to delete the destination port from all VLANs.

l The destination port should not be connected to other device. Otherwise, it may result in the network loop.

l The destination port should be larger than or equal to the bandwidth of the mirror port. Otherwise, there may be packet loss.

l The destination port cannot enable LACP (Link Aggregation Control Protocol), so as to prevent the mirror data from being affected.


5.2 SPAN Function Configuration

Table 5‑1 SPAN function configuration list

Configuration Task

Configure Local SPAN

Configure Local SPAN session


5.2.1 Configure Local SPAN

Local SPAN is used to analyze the data flow of the local device port.

Configuration Condition

None

Configure Local SPAN Session

Local SPAN session copies the received or forwarded packets of one or multiple source ports and forwards out from the destination port without affecting the normal service forwarding of the source port.

Table 5‑2 Configure the Local SPAN session

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the source end of Local SPAN session | monitor session session-number source { interface interface-list | link-aggregation link-aggregation-id } [ both | tx | rx ] | Mandatory By default, do not configure the source end of Local SPAN session.
Configure the destination end of the Local SPAN session | monitor session session-number destination { interface interface-name | link-aggregation link-aggregation-id } | Mandatory By default, do not configure the destination end of the Local SPAN session.

l When configuring the session source end and specifying the port enabled with the mirror as the aggregation group, the specified aggregation group should be already created. If the aggregation group is not created, the configuration fails.

l One port cannot be the source port and destination port of one session at the same time.

l One port cannot exist in multiple sessions at the same time.


5.2.2 SPAN Monitoring and Maintaining

Table 5‑3 SPAN Monitoring and Maintaining

Command | Description
show monitor session { session-number | all | local | remote | erspan } | Display the SPAN session configuration information.


5.3 Typical Configuration Example of Port Mirror


5.3.1 Configure Local SPAN

Network Requirement

l PC1, PC2 and PC3 are connected with Device; PC1 and PC2 communicate with each other in VLAN2.

l Configure Local SPAN on Device; the source port is gigabitethernet0/0; the destination port is gigabitethernet0/2; PC3 monitors the packets received and sent by port gigabitethernet0/0 of Device.

Network Topology

Figure 5‑1 Networking of configuring the Local SPAN

Configuration Steps

Step 1:

Configure the link type of the VLAN and port.

#Create VLAN2 on Device.

Device#configure terminal

Device(config)#vlan 2

Device(config-vlan2)#exit

#Configure the link type of port gigabitethernet0/0 and gigabitethernet0/1 on Device as Access, permitting the services of VLAN2 to pass.

Device(config)#interface gigabitethernet0/0-0/1

Device(config-if-range)#switchport mode access

Device(config-if-range)#switchport access vlan 2

Device(config-if-range)#exit

Step 2:

Configure Local SPAN.

#Configure Local SPAN on Device, the mirror source session is port gigabitethernet0/0, and the destination session is port gigabitethernet0/2.

Device(config)#monitor session 1 source interface gigabitethernet 0/0 both

Device(config)#monitor session 1 destination interface gigabitethernet 0/2

#View the session information of Local SPAN on Device.

Device#show monitor session 1

----------------------------------------------------------

Session 1

Type : SPAN Local Session

Destination Interface : gi0/2

Source Interface(both): gi0/0

Step 3:

Check the result.

#When PC1 and PC2 communicate with each other, the packets sent and received by port gigabitethernet0/0 can be got on PC3.


6 IPFIX


6.1 Overview

IPFIX (IP Flow Information Export) completes the measuring and exporting of the device flow information and is one technology of providing the packet statistics based on the flow. The packets entering the device define the flow according to the source IP address, destination IP address, source port number, destination port number, protocol number, ToS (Type of Service), output interface, and input interface. The same seven-tuple is identified as one flow. The information recorded by the flow also can be sent to NMS (Network Management Station) via the UDP packet for the traffic analysis software to analyze. The network manager can complete the analysis and monitoring of the traffic passing the device by analyzing the statistics information recorded by the flow.


6.2 IPFIX Function Configuration

Table 6‑1IPFIX function configuration list

Configuration Task
Configure the IPFIX statistics function | Configure the IPFIX statistics function
Configure the IPFIX packet attribute | Configure the destination address and port number of the IPFIX packet
 | Configure the source interface of the IPFIX packet
Configure the IPFIX option records | Configure IPFIX to send option records
 | Configure the sending period recorded by the IPFIX option
Configure the IPFIX flow template attributes | Configure the period of updating the IPFIX flow template time
 | Configure the period of updating the IPFIX flow template packet
 | Configure the additional field of the IPFIX flow template
Configure the IPFIX option template attributes | Configure the period of updating the IPFIX option template time
 | Configure the period of updating the IPFIX option template packet


6.2.1 Configure IPFIX Statistics Function

Enable the IPFIX statistics function on the interface and measure the traffic information on the interface. The IPFIX statistics function relies on the flow template. Before enabling the IPFIX statistics on the interface, first enable the flow forwarding function.

Configuration Condition

Before configuring the IPFIX statistics function, first complete the following task:

l Enable the flow forwarding function on the device

Configure IPFIX Statistics Function

Table 6‑2 Configure the IPFIX statistics function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the interface configuration mode | interface interface-name | -
Enable the IPFIX statistics function of the interface | ipfix { egress | ingress } | Mandatory By default, the IPFIX statistics function is disabled on the interface.


6.2.2 Configure IPFIX Packet Attribute

After the device enables the IPFIX statistics function, IPFIX measures the traffic information of the interface. After the flow is aged, the device encapsulates the flow information in the IPFIX packet and sends to NMS.

Configuration Condition

None

Configure Destination Address of IPFIX Packet

Configure the destination IP address and destination port number of the IPFIX packet. If the destination address of the IPFIX packet is not configured, the device does not send the IPFIX packet.

Table 6‑3 Configure the destination address of the IPFIX packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the destination IP address and port number of the IPFIX packet | ipfix destination [ vrf vrf-name ] ip-address port-number | Mandatory We can configure two destination addresses at most. By default, do not configure the destination IP address and port number of the IPFIX packet.

Configure Source Address of IPFIX Packet

Configure the source interface of the IPFIX packet. After configuration, the source address of the IPFIX packet is the configured interface IP address.

Table 6‑4 Configure the source interface of the IPFIX packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the source interface of the IPFIX packet | ipfix source interface-name | Optional By default, the source address of the IPFIX packet is the IP address of the packet egress interface.


6.2.3 Configure IPFIX Option Records

The contents contained by the option records are mainly the process information. The user can select sending the option records to NMS. After configuring IPFIX to send the option records, the device sends the option records every 30 minutes and the sending period of the option records also can be configured.

Configuration Condition

None

Configure IPFIX to Send Option Records

Configure IPFIX to send the option records. After configuration, send one option records every 30 minutes.

Table 6‑5 Configure IPFIX to send the option records

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure IPFIX to send the option records | ipfix option export | Mandatory By default, do not send the option records.

Configure Sending Period of IPFIX Option Records

Configure the sending period of the IPFIX option records.

Table 6‑6 Configure the sending period of the IPFIX option records

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the sending period of the IPFIX option records | ipfix option export timers period | Optional By default, the sending period of the option records is 30 minutes.


6.2.4 Configure IPFIX Flow Template Attribute

The flow template on NMS has the life period. After timeout, the flow template will be deleted and as a result, the subsequent flow information cannot be resolved. Therefore, the device needs to send the flow template to NMS periodically. There are two sending modes:

l Time updating period: The user can configure how many minutes to send the flow template once;

l Packet updating period: The user can configure how many IPFIX packets to be sent before sending the flow template once.

We can configure the time update period and packet update period at the same time. As lone as meeting any update condition, the device will send the flow template to NMS.

Configuration Condition

None

Configure Time Update Period of IPFIX Flow Template

Configure the IPFIX to send the flow template regularly.

Table 6‑7Configure the time update period of the IPFIX flow template

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the time update period of the IPFIX flow template | ipfix template flow refresh timers period | Optional By default, send the flow template every 30 minutes.

Configure Packet Update Period of IPFIX Flow Template

Configure how many packets to be sent before sending the flow template.

Table 6‑8 Configure the packet update period of the IPFIX flow template

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the packet update period of the IPFIX flow template | ipfix template flow refresh packets packets | Optional By default, send the flow template every after sending 20 IPFIX packets.

Configure Additional Field of IPFIX Flow Template

The IPFIX flow template supports the BGP AS option. The user can select whether to carry the BGP AS number in the flow information.

The IPFIX flow template supports the next-hop option of the BGP route. The user can select whether to carry the BGP route next-hop in the flow information.

The IPFIX flow template also supports outputting the statistics option. The user can select whether to carry the output statistics in the flow information.

Table 6‑9 Configure the additional field of the IPFIX flow template

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the IPFIX flow information to carry the BGP AS number | ipfix template flow fields bgp-as | Optional By default, the IPFIX flow information does not carry the BGP AS number.
Configure the IPFIX flow information to carry the next hop of the BGP route | ipfix template flow fields bgp-nexthop | Optional By default, the IPFIX flow information does not carry the next hop of the BGP route.
Configure the IPFIX flow information to carry the output statistics | ipfix template flow fields out-statistics | Optional By default, the IPFIX flow information does not carry the output statistics.

l For the information of the BGP AS and BGP route next hop, refer to “BGP Configuration” in the “Unicast Route” configuration manual.


6.2.5 Configure IPFIX Option Template Attributes

The option template on NMS has the life period. After timeout, the option template will be deleted and as a result, the subsequent flow information cannot be resolved. Therefore, the device needs to send the option template to NMS periodically. There are two sending modes:

l Time updating period: The user can configure how many minutes to send the option template once;

l Packet updating period: The user can configure how many IPFIX packets to be sent before sending the option template once.

We can configure the time update period and packet update period at the same time. As lone as meeting any update condition, the device will send the option template to NMS.

Configuration Condition

None

Configure Time Update Period of IPFIX Option Template

Configure the IPFIX to send the option template regularly.

Table 6‑10 Configure the time update period of the IPFIX option template

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the time update period of the IPFIX option template | ipfix template option refresh timers period | Optional By default, send the flow template every 30 minutes.

Configure Packet Update Period of IPFIX Flow Template

Configure how many packets to be sent before sending the flow template.

Table 6‑11 Configure the packet update period of the IPFIX flow template

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the packet update period of the IPFIX flow template | ipfix template option refresh packets packets | Optional By default, send the flow template every after sending 20 IPFIX packets.


6.2.6 IPFIX Monitoring and Maintaining

Table 6‑12 IPFIX monitoring and maintaining

Command | Description
clear ipfix statistics | Clear the IPFIX statistics information
show ipfix flow interface-name { egress | ingress } [ top top-n ] | Display the flow statistics information of the specified interface
show ipfix statistics | Display the IPFIX statistics information


6.3 IPFIX Typical Configuration Example


6.3.1 Configure IPFIX Basic Functions

Network Requirements

l Run the traffic analysis software on NMS; Device and NMS route are reachable;

l Enable IPFIX to measure the data flow of the interface gigabitethernet1 on Device and send the statistics result to NMS.

Network Topology

Figure 6‑1 Networking of configuring the IPFIX basic functions

Configuration Steps

Step 1: | Configure the IP address of the interface. (omitted)
Step 2: | Enable the flow forwarding function of the device (by default, it is enabled).

#Configure Device.

Enable the flow forwarding function on Device.

Device#configure terminal

Device(config)#ip flow enable

Step 3:

Configure IPFIX.

#Configure Device.

On the interface gigabitethernet1, enable IPFIX and the measure all data flow received and sent from the interface.

Device(config)#interface gigabitethernet1

Device(config-if-gigabitethernet1)#ipfix ingress

Device(config-if-gigabitethernet1)#ipfix egress

Device(config-if-gigabitethernet1)#exit

Configure the destination address and destination port number of the IPFIX packet (that is, NMS address and port number).

Device(config)#ipfix destination 129.255.140.1 9996

l The IPFIX function takes effect after enabling the flow forwarding. By default, the flow forwarding of the device is enabled.

Step 4:

Check the result.

#View the IPFIX statistics information of Device.

Device#show ipfix flow gigabitethernet 1 ingress

PRO SRC DST IF TOS SP DP PKTS BYTES

6 2.0.0.2 192.168.1.1 gigabitethernet1 192 1024 179 777918 85570980

17 2.0.0.2 192.168.1.1 gigabitethernet1 192 1024 1024 334889 36837790

Device#show ipfix flow gigabitethernet 1 egress

PRO SRC DST IF TOS SP DP PKTS BYTES

17 192.168.1.1 2.0.0.2 gigabitethernet1 192 1024 1024 964866 106135260

6 192.168.1.1 2.0.0.2 gigabitethernet1 192 1024 179 964893 106138230

Device#show ipfix statistics

***ipfix statistics***

total send records: 173

total send packets: 33

total send failure: 0

total dropped records: 0

total malloc failure: 0

ipfix event count limit: 44739

We can see that the device measures the data flow received and sent by the interface gigabitethernet1 and sends the statistics result to NMS.

#NMS can monitor all traffic received and sent by the interface gigabitethernet1 of Device.


7 IP Accounting


7.1 Overview

The IP Accounting function is to measure the IP packets sent by the interface. We can configure the statistics rule and maximum statistics sessions to control the measuring process.


7.2 IP Accounting Function Configuration

Table 7‑1 IP Accounting function configuration list

Configuration Task

Configure the IP statistics function

Enable the IP statistics function

Configure the maximum statistics sessions


7.2.1 Configure IP Statistics Function

Configuration Condition

Before configuring the IP statistics function, first complete the following task:

l Configure the IP address of the interface, making the network layer of the neighboring nodes reachable

Enable IP Statistics Function

To enable the IP statistics function of the interface, first configure the IP statistics rule and specify the destination address of the measured packet, and then enable the IP statistics function in the interface, measuring the packets sent by the interface and matching the statistics rule.

Table 7‑2 Enable the IP statistics function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the IP statistics rule | ip accounting-list ip-address wildcard-mask | Mandatory By default, do not configure the IP statistics rule.
Enter the interface configuration mode | interface interface-name | -
Enable the IP statistics function | ip accounting | Mandatory By default, do not enable the IP statistics function.

Configure Maximum Statistics Sessions

After the measure sessions reach the maximum, do not create new statistics session any more.

Table 7‑3 Configure the maximum statistics sessions

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the maximum statistics sessions | ip counting-threshold max-number | Mandatory By default, do not configure the maximum statistics sessions.


7.2.2 IP Accounting Monitoring and Maintaining

Table 7‑4 IP Accounting monitoring and maintaining

Command | Description
clear ip accounting | Clear the statistics session and statistics result.
show ip accounting [ { by-destination [ ip-address wildcard-mask | host ip-address ] } | { by-source [ ip-address wildcard-mask | host ip-address ] } ] | Display the statistics session and statistics result.


7.3 IP Accounting Typical Configuration Example


7.3.1 Configure IP Accounting

Network Requirements

l Two Ethernet ports of Device are connected to two networks.

l Configure IP Accounting on Device, and measure the number of the packets sent to the segment.

Network Topology

Figure 7‑1 Networking of configuring IP Accounting

Configuration Steps

Step 1: | Configure the IP address of the interface, configure the route, and so on.(omitted)
Step 2: | Configure the IP statistics list and measure the number of the packets sent to the segments.

Device#configure terminal

Device(config)#ip accounting-list 0.0.0.0 255.255.255.255

Step 3:

Disable the flow forwarding function of Device and enable IP Accounting on the interface.

Device(config)#no ip flow enable

Device(config)#interface gigabitethernet 0

Device(config-if-gigabitethernet0)#ip accounting

Device(config-if-gigabitethernet0)#interface gigabitethernet 1

Device(config-if-gigabitethernet1)#ip accounting

l It is necessary to disable the global or interface flow forwarding function so that IP Accounting can take effect.

Step 4:

Check the result.

#View the IP Accounting statistics.

Device#show ip accounting

source destination packets bytes out-intf

2.0.0.2 1.0.0.2 703698 32370108 gigabitethernet0

1.0.0.2 2.0.0.2 153820 43377240 gigabitethernet1


8 SNMP


8.1 Overview

SNMP (Simple Network Management Protocol) is one standard protocol of managing Internet. It ensures that the management information can be transmitted between Network Managing Station and managed device SNMP agent. It is convenient for the system administrator to manage the network system.

SNMP is one application layer protocol in the client/server mode. It mainly includes three parts:

l NMS (Network Managing Station)

l SNMP agent

l MIB (Management Information Base).

The structure set of all managed objects maintained by the device is called MIB. The managed objects are organized according to the hierarchical tree structure. MIB defines the network management information got by one device. To be consistent with the standard network management protocol, each device should use the format defined in MIB to display the information. One subset of IOS ASN.1 defines the syntax for MIB. Each MIB uses the tree structure defined in ASN.1 to organize all available information. Each piece of information is one node with punctuation and each node contains one object ID and one short text description.

Figure 8-1 ASN.1 tree diagram of network management

SNMP protocol versions include SNMPv1, SNMPv2, and SNMPv3.

l SNMPv1: The first version of the SNMP protocol. The disadvantages: security problem, bandwidth waste, no communication capability between managers, the protocol only provides the limited operations;

l SNMPv2: It makes some improvement on the basis of SNMPv1, making the functions stronger and the security better;

l SNMPv3: original identity, information integrality and some aspects of re-transmission protect, content confidentiality, authorization and process control, the remote configuration and management capability needed by the above three capabilities;

Therefore, the development of SNMPv3 is centralized on two targets, that is, provide the workable security platform at the enhanced architecture and maintain the consistency of the network management system.

The SNMP protocol mainly includes the following operations:

Figure 8-2 SNMP management operation diagram

l Get-request: SNMP network work station gets one or multiple parameters from the SNMP agent.

l Get-next-request: SNMP network work station gets the next parameter of one or multiple parameters from the SNMP agent.

l Get-bulk: SNMP network work station gets the batch parameters from the SNMP agent.

l Set-request: SNMP network work station sets one or multiple parameters of the SNMP agent.

l Get-response: SNMP agent returns one or multiple parameters and it is the responding operation of the SNMP agent for the above three operations.

l Trap: The packet sent by the SNMP agent actively, informing that something happens to the SNMP network work station.

SNMPv1 and SNMPv2 use the authentication name to check whether to have the right to use the MIB object, so only when the authentication name of the network work station is consistent with one authentication name defined in the device, we can manage the device.

The authentication name has the following two attributes:

l Read-only: The read authority of the authorized network work station for all MIB objects of the device;

l Read-write: The read and write authority of the authorized network work station for all MIB objects of the device.

SNMPv3 determines which security mechanism to be adopted to process the data by the security model and the security level. There are three security models: SNMPv1, SNMPv2c, and SNMPv3.

Table 8-1 Supported security model and security level

Security Model | Security Level | Authentication | Encryption | Description
SNMPv1 | NoAuthNoPriv | Authentication name | None | Confirm the data validity via the authentication name.
SNMPv2c | NoAuthNoPriv | Authentication name | None | Confirm the data validity via the authentication name.
SNMPv3 | NoAuthNoPriv | User name | None | Confirm the data validity via the user name.
SNMPv3 | AuthNoPriv | MD5/SHA | None | Use HMAC-MD5/HMAC-SHA data authentication mode.
SNMPv3 | AuthPriv | MD5/SHA | DES | Use the HMAC-MD5/HMAC-SHA data authentication mode and CBC-DES data encryption mode.


8.2 SNMP Function Configuration

Table 8-2 SNMP function configuration list

Configuration Task
Configure the SNMP basic functions | Enable the SNMP service
 | Configure the MIB view
 | Configure the manager contact information
 | Configure the physical location information of the device
Configure SNMPv1/v2 | Configure the SNMP community name
 | Configure the SNMP Trap functions
Configure SNMPv3 | Configure the SNMP user group
 | Configure the SNMP user
 | Configure SNMP advertising
 | Configure SNMP agent forwarding


8.2.1 Configure SNMP Basic Functions

Configuration Condition

None

Enable SNMP Service

If the device is enabled with the SNMP service, the device can manage and configure via the SNMP network management software.

Table 8-3 Enable the SNMP service

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enable the SNMP service | snmp-server start | Mandatory By default, the SNMP service is disabled.

Configure MIB View

Use the view-based access control model to judge whether the associated management object of one operation is permitted by the view. Only the management objects permitted by the view can be permitted to access.

Table 8-4 Configure the MIB view

Step | Command | Description
Enter the global configuration mode | config terminal | -
Configure the MIB view | snmp-server view view-name oid-string { include | exclude } | Mandatory By default, the SNMP view name is Default.

Configure Manager Contact Information

The manager contact information is one information node in the SNMP protocol. The network management software can get the information via SNMP.

Table 8-5 Configure the manager contact mode

Step | Command | Description
Enter the global configuration mode | config terminal | -
Configure the manager contact information | snmp-server contact contact-line | Mandatory By default, the contact of the device manager is the information of the device provider.

Configure Device Physical Location Information

The device physical location information is one information node in the SNMP protocol. The network management software can get the information via SNMP.

Table 8-6 Configure the physical location information of the device

Step | Command | Description
Enter the global configuration mode | config terminal | -
Configure the physical location information of the device | snmp-server location location | Mandatory By default, the location information is the full name and address of the device manufacturer.


8.2.2 Configure SNMPv1/v2

Configuration Condition

Before configuring SNMPv1/v2, first complete the following task:

l Configure the link-layer protocol, ensuring the normal communication of the link layer

l Configure the IP address of the interface, making the network layer of the neighboring nodes reachable

Create SNMP Community Name

SNMPv1/SNMPv2c adopts the security scheme based on the community name. SNMP community name can be regarded as the password between NMS and SNMP proxy, that is to say, SNMP proxy only accepts the management operations of the same community name and the SNMP from different community name is not responded and is dropped directly.

Table 8-7 Configure the community name

Step | Command | Description
Enter the global configuration mode | config terminal | -
Configure the community name of the SNMP proxy | snmp-server community community-name [ view view-name ] { ro | rw } [ access-list-number | access-list-name] [ ipv6 { access-list-number | access-list-name } ] | Mandatory By default, the community name is public.

Configure SNMP Trap Function

Trap is the information SNMP proxy actively sends to the network work station, used to report some specified events. Trap packets include general Trap and customized Trap. The general trap contains Authentication, Linkdown, Linkup, Coldstart, and Warmstart; the customized Trap is output according to the requirements of the modules.

Table 8-8 Configure Trap

Step | Command | Description
Enter the global configuration mode | config terminal | -
Enable the trap of the link interface down or up | snmp-server enable traps snmp [ linkup | linkdown ] | Mandatory By default, SNMP Trap is disabled.
Enter the interface configuration mode | interface interface-type interface-num | Mandatory
Configure the trap of the interface status change | snmp trap link-status | Mandatory
Configure the Trap target host | snmp-server host { ip-address | host-name } [ community community-name | traps community community-name [ version { 1 | 2 } [vrf vrf-name ] | vrf vrf-name ] | version { 1 | 2 } | vrf vrf-name ] | Mandatory By default, the device does not configure snmp proxy to send the destination address and other parameters of trap. It is necessary to specify ip-address as the IP address of the network work station.
Configure the source address of the Trap packet | snmp-server trap-source ip-address | Mandatory By default, do not configure sending the source address of the trap packet.

l Usually, there is much Trap information, so it occupies the device resources, affecting the device performance. Therefore, it is suggested to enable the Trap function of the specified module as desired, but do not need to enable the Trap of all modules.


8.2.3 Configure SNMPv3

Configuration Conditions

Before configuring SNMPv3, first complete the following task:

l Configure the link-layer protocol, ensuring the normal communication of the link layer

l Configure the IP address of the interface, making the network layer of the neighboring nodes reachable

Create SNMP User Group

During controlling, we can associate some user with one group. The users of one group have the same access authority.

l We can configure one group to associate with the view. There are three kinds of views, that is, read-only view, write view and notify view.

l We can configure the security level of the group, configuring whether to need the authentication and encryption.

Table 8-9 Create the SNMP user group

Step | Command | Description
Enter the global configuration mode | config terminal | -
Create the SNMP user group | snmp-server group group-name v3 { authnopriv | authpriv | noauth } [ notify notify-view | read read-view | write write-view ] | Mandatory By default, the device is not configured with the SNMPv3 group information. Authnopriv: authenticate, but not encrypt Authpriv: authenticate and encrypt Noauth: not authenticate or encrypt

Create SNMP User

Perform the security management via the user-based security model. The network work station can communicate with the SNMP proxy only after using the valid user. The valid user needs to be configured.

For SNMPv3, we also can specify the security level, authentication algorithm (MD5 or SHA), authentication password, encryption algorithm (DES), and encryption password.

Table 8-10 Configure the user

Step | Command | Description
Enter the global configuration mode | config terminal | -
Create the SNMP user | snmp-server user user-name group-name [ remote ip-address port-num ] v3 [ auth { md5 | sha } password [ encrypt des password ] ] | Mandatory By default, do not configure the SNMPv3 user information.

l Configure the SNMPv3 user based on the user security model (USM), save the authentication and encryption information of each user. Note that only after configuring the authentication protocol, we can configure the encryption protocol.

l For the remote user (the so-called remote is relative to the local SNMPv3 entity. If the local SNMPv3 entity needs to communicate with other SNMPv3 entity, the other SNMPv3 entity is called remote SNMPv3 entity. This is mentioned in notify and proxy), we also need to specify the IP address and UDP port number of the remote user. When configuring the remote user, we should configure the engineID of the remote SNMP entity of the user first. Besides, each user should correspond with one group so that we can map one security model and security name to one group name via the view-based access control.

l When configuring the auto proxy forwarding and we may not know the IP address of the delegated device, we only need to input 0.0.0.0 at ip-address. Besides, the auto proxy forwarding should be combined with the keepalive mechanism.

Configure SNMP Notify

SNMPv3 notify configuration contains the following several kinds:

l SNMPv3 notify configuration: Configure the SNMPv3 notify and specify the type of the notify message as inform;

l SNMPv3 notify filter configuration: Notify filter means the filter used to determine whether one notify message should be sent to one destination address.

l SNMPv3 notify address map table configuration: Associate the notify address with one filter table.

Table 8-11Configure the notify

Step | Command | Description
Enter the global configuration mode | config terminal | -
Configure the SNMP notify | snmp-server notify notify notify-name taglist inform | Mandatory
Configure the SNMP notify filter | snmp-server notify filter filter-name oid-subtree { exclude | include } | Mandatory By default, there is no configuration information of the SNMPv3 notify. Exclude: Filter out the notifications of all objects in the MIB sub tree. Include: Inform all objects in the MIB sub tree.
Configure the SNMP address parameters | snmp-server AddressParam { address-name | paramIn } v3 user-name { noauth | authpriv | authnopriv } | Mandatory By default, do not configure the address parameter of the SNMP notify.
Configure the SNMP notify filter map table | snmp-server notify profile filter-name address-param | Mandatory By default, there is no configuration information of the SNMPv3 notify. filter-name: Specify the notify filter name to be mapped address-param: Specify the address parameter name to be mapped.

Configure SNMP Proxy Forwarding

If the network work station cannot directly access the managed SNMP proxy, the intermediate device needs to support the proxy forwarding. Currently, only SNMPv3 supports the proxy forwarding.

Table 8-12 Configure the proxy forwarding

Step | Command | Description
Enter the global configuration mode | config terminal | -
Configure the SNMP remote engine ID | snmp-server engineID remote ip-address port-num [ vrf vrf-name ] engine-id [ group-name ] | Mandatory By default, do not configure engine ID of the remote SNMPv3 entity. Configure the engine ID of the SNMP entity needing the proxy forwarding
Configure the SNMP address parameters | snmp-server AddressParam [ address-name | paramIn ] v3 user-name { noauth | authpriv | authnopriv } | Mandatory By default, do not configure the address parameter of the SNMP notify.
Configure the SNMP notify address | snmp-server TargetAddress target-name ip-address port-num address-param taglist time-out retry-num | Mandatory By default, do not configure the SNMP notify destination address.
Configure the SNMP proxy forwarding | snmp-server proxy proxy-name { inform | trap | read | write } { engineId | auto } engineId address-param target-addr [ context-name ] | Mandatory By default, do not configure the SNMPv3 forwarding proxy.


8.2.4 SNMP Monitoring and Maintaining

Table 8-13 SNMP monitoring and maintaining

Command | Description
show snmp-server | View the SNMP protocol packet statistics information
show snmp-server AddressParams | View the SNMP proxy address parameter information
show snmp-server community | View the SNMP proxy community information
show snmp-server contact | View the device manager contact
show snmp-server context | View the SNMPv3 context
show snmp-server engineGroup | Display the information of the SNMP proxy engine group
show snmp-server engineID | Display the information of the SNMP proxy engine ID
show snmp-server group | View the SNMP proxy user group information
show snmp-server Host | Display the information of the SNMP proxy trap host
show snmp-server location | View the location information of the device
show snmp-server notify filter | Display the information of the SNMP proxy notify filter
show snmp-server notify notify | Display the information of the SNMP proxy notify
show snmp-server notify profile | Display the associated information of the SNMP proxy notify
show snmp-server proxy | View the SNMP proxy forwarding information
show snmp-server reg-list | View the module information of the SNMP registered MIB
show snmp-server TargetAddress | View the SNMP proxy address entry information
show snmp-server user | View the SNMP user information
show snmp-server view | View the SNMP view information


8.3 SNMP Typical Configuration Example


8.3.1 Configure SNMP v1/v2c Proxy Server

Network Requirements

l Device is the SNMP Agent device and the route with the NMS server is reachable.

l NMS monitors and manages Device via SNMP v1 or SNMP v2c; when Device fails, it actively reports to NMS.

Network Topology

Figure 8‑3 Networking of configuring SNMP v1/v2c proxy server

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Enable the SNMP proxy on Device and configure the SNMP community name.

#Configure Device.

Enable the SNMP proxy; configure the node view name as public, read-only community name as public and read-write community name as private.

Device#configure terminal

Device(config)#snmp-server start

Device(config)#snmp-server view public 1.3.6.1 include

Device(config)#snmp-server community public view public ro

Device(config)#snmp-server community private view public rw

Step 3:

Configure Device to send the Trap packets to the network work station (NMS) actively and use the community name public.

#Configure Device.

Device(config)#snmp-server enable traps

Device(config)#snmp-server host 129.255.140.1 traps community public version 2

l The SNMP version specified in the snmp-server host command should be consistent with the SNMP version running on NMS.

Step 4:

Configure NMS.

#On the NMS using SNMP v1/v2c, we need to set “read-only community name” and “read-write community name”. Besides, we also need to set “timeout” and “re-try times”. The user queries and configures the device via the NMS.

l When using the read-only community name, the user can only query the device via NMS.

l When using the read-write community name, the user can query and configure the device via NMS.

Step 5:

Check the result.

#NMS can query and configure some parameters of Device via the MIB node. NMS can receive various Trap information from Device, such as interface up, down of Device, the route change caused by the network oscillation. Device generates the corresponding Trap information and sends to NMS.


8.3.2 Configure SNMP v3 Proxy Server

Network Requirements

l Device is the SNMP Agent device and the route with the NMS server is reachable.

l NMS manages Device via SNMPv3.

Network Topology

Figure 8‑4 Networking of configuring the SNMP v3 proxy server

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted).
Step 2: | Enable the SNMP proxy on Device and configure the SNMPv3 basic information.

#Configure Device.

Enable the SNMP proxy; configure the node view name as public and it can access all objects in the node 1.3.6.1.

Device#configure terminal

Device(config)#snmp-server start

Device(config)#snmp-server view public 1.3.6.1 include

Configure the user group as public and security level as authpriv; the read-write view and notify view both use public; configure the user name as public, belonging to the user group public, authentication algorithm as MD5, authentication password as admin, encryption algorithm as DES and encryption password as admin.

Device(config)#snmp-server group public v3 authpriv read public write public notify public

Device(config)#snmp-server user public public v3 auth md5 admin encrypt des admin

Configure the text name as public.

Device(config)#snmp-server context public

Step 3:

Configure NMS.

#On the NMS using SNMP v3, we need to set the user name and select the security level. According to different security levels, we need to set the authentication algorithm, authentication password, encryption algorithm, encryption password and so on. Besides, we also need to set “timeout” and “re-try times”. The user queries and configures the device via the NMS.

Step 4:

Check the result.

# On NMS, we can query and set some parameters of Device via the MIB node.


8.3.3 Configure SNMP v3 Notify

Network Requirements

l Device is the SNMP Agent device and the route with the NMS server is reachable.

l NMS monitors Device via SNMPv3. When Device fails or has something wrong, it actively reports to NMS.

Network Topology

Figure 8‑5 Networking of configuring SNMPv3 notify

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted).
Step 2: | Enable the SNMP proxy on Device and configure the SNMPv3 basic information.

#Configure Device.

Enable the SNMP proxy; configure the node view name as default and it can access all objects in the node 1.3.6.1.

Device#configure terminal

Device(config)#snmp-server start

Device(config)#snmp-server view default 1.3.6.1 include

Configure the user group as group1 and security level as authpriv; the read-write view and notify view both use default.

Device(config)#snmp-server group group1 v3 authpriv read default write default notify default

Configure the local user name as user, belonging to the user group group1, authentication algorithm as MD5, authentication password as admin, encryption algorithm as DES and encryption password as admin.

Device(config)#snmp-server user user group1 v3 auth md5 admin encrypt des admin

Configure the text name as public.

Device(config)#snmp-server context public

Configure letting Device send all Trap information.

Device(config)#snmp-server enable traps

Step 3:

Configure Device to send notify message to NMS.

#Configure Device.

Configure the IP address and enginID of the remote user, that is, NMS.

Device(config)#snmp-server engineID remote 129.255.140.1 162 bb87654321

Configure the remote user name as re-user1, belonging to the user group group1, authentication algorithm as MD5, authentication password as admin, encryption algorithm as DES and encryption password as admin.

Device(config)#snmp-server user re-user1 group1 remote 129.255.140.1 162 v3 auth md5 admin encrypt des admin

Configure the local address parameter name as param-re-user1; configure the target address name as target-re-user1; use the address parameter param-re-user1; the target address list name is target-re-user1.

Device(config)#snmp-server AddressParam param-re-user1 v3 user1 authpriv

Device(config)#snmp-server TargetAddress target-re-user1 129.255.140.1 162 param-re-user1 tag-re-user1 10 3

Configure the notify entity as notify-re-user1; configure the filter entity of notify as filter-re-user1, containing the notify of all objects in the node 1.3.6.1; configure the notify configuration table, and let the filter entity fileter-re-user1 associate with the address parameter param-re-user1.

Device(config)#snmp-server notify notify notify-re-user1 tag-re-user1 inform

Device(config)#snmp-server notify filter filter-re-user1 1.3.6.1 include

Device(config)#snmp-server notify profile filter-re-user1 param-re-user1

Step 4:

Configure NMS.

#On NMS, do not need to configure, but just need to run the network management software and monitor the UDP port 162.

Step 5:

Check the result.

#NMS can receive various Trap information from Device, such as interface up, down of Device, the route change caused by the network oscillation. Device generates the corresponding Trap information and sends to NMS.


8.3.4 Configure SNMP v3 Proxy Forwarding

Network Requirements

l The route from Device2 to NMS server is reachable.

l Device2 is the proxy device Agent; Device1 is the delegated device.

l On Device1 and Device2, run SNMPv3.

l On NMS, run SNMPv3. NMS manages Device1 and Device2 via SNMP v3.

Network Topology

Figure 8‑6 Networking of configuring the SNMP v3 proxy forwarding

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted).
Step 2: | On the proxy device Device2, enable the SNMP proxy and configure the SNMPv3 basic information.

#Configure Device2.

Enable the SNMP proxy; configure the node view name as default and it can access all objects in the node 1.3.6.1.

Device2#configure terminal

Device2(config)#snmp-server start

Device2(config)#snmp-server view default 1.3.6.1 include

Configure the user group as group-local and security level as noauth; the read-write view and notify view both use default; configure the user name as user1, belonging to the user group group-local, authentication algorithm as MD5, authentication password as proxy, encryption algorithm as DES and encryption password as proxy.

Device2(config)#snmp-server group group-local v3 noauth read default write default notify default

Device2(config)#snmp-server user user1 group-local v3 auth md5 proxy encrypt des proxy

Step 3:

On the delegated device Device1, enable the SNMP proxy and configure the SNMP view.

#Configure Device1.

Device1#configure terminal

Device1(config)#snmp-server start

Device1(config)#snmp-server view default 1.3.6.1 include

Step 4:

Configure the information of the delegated device on the proxy device Device2.

#Configure Device2.

Configure the IP address and enginID of the delegated device.

Device2(config)#snmp-server engineID remote 150.1.2.2 161 800016130300017a000137

Configure the user group of the delegated device as group-user, security level as authpriv; both the read-view and notify view use default.

Device2(config)#snmp-server group group-user v3 authpriv read default write default notify default

Configure the user name as re-user, belonging to the user group group-user, authentication algorithm as MD5, authentication password as proxy, encryption algorithm as DES and encryption password as proxy.

Device2(config)#snmp-server user re-user group-user remote 150.1.2.2 161 v3 auth md5 proxy encrypt des proxy

Configure the local address parameter name as plocal and remote address parameter name as puser; configure the target address name as tuser and use the address parameter puser.

Device2(config)#snmp-server AddressParam plocal v3 user1 authpriv

Device2(config)#snmp-server AddressParam puser v3 re-user authpriv

Device2(config)#snmp-server TargetAddress tuser 150.1.2.2 161 puser taguser 10 2

Configure the proxy forwarding name as proxy-re-user, the operation authority as WRITE, the enginID of the delegated device as 800016130300017a000137, the used address parameter plocal, the used target address tuser; configure the context name as proxyuser.

Device2(config)#snmp-server proxy proxy-re-user WRITE 800016130300017a000137 plocal tuser proxyuser

Device2(config)#snmp-server context proxyuser

#View the enginID information of Device2.

Device2#show snmp-server engineID

Local engine ID: 80001613030000000052fd

IPAddress: 150.1.2.2.0.161 remote engine ID: 800016130300017a000137

l The enginID of the remote device should be consistent with the delegated device. The enginID of the device can be viewed via the show snmp-server engineIDcommand.

l The monitoring protocol of the delegated device is UDP and the port is 161.

Step 5:

Perform the related configuration of SNMPv3 on the delegated device Device1.

#Configure Device1.

Configure the user group as g1 and security level as authpriv; the read-write view and notify view both use default; configure the user name as re-user, authentication algorithm as MD5, authentication password as proxy, encryption algorithm as DES and encryption password as proxy.

Device1(config)#snmp-server group g1 v3 authpriv read default write default notify default

Device1(config)#snmp-server user re-user g1 v3 auth md5 proxy encrypt des proxy

Device1(config)#snmp-server context proxyuser

Step 6:

Configure NMS.

#SNMP v3 adopts the authentication and encryption security mechanism. On the NMS, we need to set the user name and select the security level. According to different security levels, we need to set the authentication algorithm, authentication password, encryption algorithm, encryption password and so on. Besides, we also need to set “timeout” and “re-try times”. The user can query and configure the device via the NMS. When it is necessary to query or configure the delegated device, we also need to set the enginID of the proxy forwarding as the enginID of the delegated device on NMS.

Step 8:

Check the result.

#On NMS, we can query and set some parameters of Device2 and Device1 via the MIB node.


9 RMON


9.1 Overview

One important function of the network management is to monitor the element performances of the network. In the traditional SNMP network management mode, the initiative of the management is mainly mastered by the network management station. Usually, the network management work station regularly polls the data of the device and then measures and analyzes in the network management system, so as to get the desired information of the administrator. In this mode, the network management work station needs to send and receive lots of packets to the network devices. When there are many devices in the network, it causes the additional load for the network. Meanwhile, the network blocking and other factors take various accidents to the running of the network management system. As for this, we put forward the RMON (Remote Network Monitoring) concept.

The realizing of RMON still needs the supporting of the SNMP protocol. In fact, it is one group of MIBs, distributed in MIB-2, and the object ID is 1.3.6.1.2.1.16. Compared with other general MIB, RMON adds the calculation at Agent during realizing, that is, put the processing, such as performance statistics in the device. This realizes the distributed processing in the whole network, reducing the disadvantages brought by the polling of the network management work station.

RMON needs to realize lots of calculation functions, so the previous RMON proxy (also called Probe) is acted by a special device, distributed in the network to monitor the corresponding target. With the improvement of the processing capability of the network device, RMON is gradually integrated to the network devices, so as to realize the RMON requirement high-efficiently. However, this also puts forward higher performance requirement for the network devices, after all, the calculations of RMON occupy lots of system resources, reducing the system performance. This is also the additional cost brought by the management, so RMON is mainly realized in the hardware with the network processing capability, such as switching chip.

RMON MIB has 10 groups:

l statistics: Measure all Ethernet interfaces of the device, such as broadcast and conflict;

l history: Record the samples of the periodical statistics information that is taken out from the statistics group;

l alarm: Permit the administration Console user to configure the sampling interval and alarm when the values of any counters or integers (recorded by the RMON proxy) exceed the threshold value;

l host: Include the input/output traffics of various types of hosts adhering to the subnet;

l hostTopN: Contain the stored statistics information of hosts, some parameters in the host tables of these hosts are the highest;

l matrix: Indicate the error and utilization information in the form of matrix, so that the operator can use any address pair to search for information;

l filter: Permit the monitor to monitor the packets matched with the filter;

l event: Present the table of all events generated by the RMON proxy;

l tokenRing: Maintain the statistic and configuration information of a subnet which is a token ring


9.2 RMON Function Configuration

Table 9‑1 RMON function configuration list

Configuration Task
Enable the RMON function | Enable the RMON function
Configure the RMON alarm group | Configure the RMON alarm instance
Configure the RMON event group | Configure the RMON trigger event
Configure the RMON history group | Configure the RMON history group instance
Configure the RMON statistics group | Configure the RMON statistics management function


9.2.1 Enable RMON Function

Configuration Condition

None

Enable RMON Function

Enabling RMON is to provide the related resource for the RMON monitoring function. The sources can take effect only after configuring the RMON monitoring group function.

Table 9‑2 Enable the RMON function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the RMON function | rmon | Mandatory By default, do not enable the RMON function.


9.2.2 Configure RMON Alarm Group

RMON alarm group function means to configure multiple alarms and each alarm monitors one alarm instance. Within the sampling interval, when the alarm instance data value changes and exceeds the increasing threshold or the decreasing threshold, trigger the alarm event. According to the processing mode defined by the alarm event group, process the alarms. When the data value exceeds the threshold continuously, alarm only for the first exceeding.

Configuration Condition

Before configuring the RMON alarm group, first complete the following task:

l Enable the SNMP proxy function

l Enable the TRAP function of RMON in SNMP

Configure RMON Alarm Instance

Table 9‑3 Configure the RMON alarm instance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the RMON function | rmon | Optional
Configure the RMON alarm group | rmon alarm alarm-num OID interval { absolute | delta } risingthreshold rising-threshold [ rising-event ] fallingthreshold falling-threshold [ falling-event ] [ owner owner ] | Mandatory By default, the alarm trigger event group is 1. By default, the owner of the alarm group is config.


9.2.3 Configure RMON Event Group

Configuring the RMON event group function means to configure multiple events, defining the event serial number and processing mode of each event. The event has the following several processing modes: The event is recorded in the log; the event sends the TRAP message to the network management system; record the event in the log and send the TRAP message to the network management system, but do not process.

Configuration Condition

Before configuring the RMON event group, first complete the following task:

l Enable the SNMP proxy function

l Enable the TRAP function of RMON in SNMP

Configure RMON Trigger Event

RMON trigger event is mainly used to process the events when the RMON alarm happens.

Table 9‑4 Configure the RMON trigger event

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the RMON function | rmon | Optional
Configure the RMON event group | rmon event event-num [ description event-description / log max-num / owner owner / trap communit ] | Mandatory By default, the owner of the event group is config.


9.2.4 Configure RMON History Event

Configuring RMON history group function means to configure multiple history groups. RMON history group stores the subnet data got by sampling with fixed interval. The group comprises the history control table and history data. The control table defines the sampled subnet interface serial number, the sampling interval, and hot much data to sample each time, while the data table is used to store the data got during the sampling.

Configuration Condition

Before configuring the RMON history group, first complete the following task:

l Enable the SNMP proxy function

Configure RMON History Group Instance

RMON history group mainly configures the monitor object of the history control table, sampling interval, hot much data to sample, and so on.

Table 9‑5 Configure the RMON history group instance

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the RMON function | rmon | Optional
Configure the RMON history group | rmon history control history-num OID buckets-num [ interval interval ] [ owner owner ] | Mandatory By default, the sampling interval is 1800s. By default, the owner of the history group is config.


9.2.5 Configure RMON Statistics Group

Configuring the RMON statistics group function is to configure the monitor object as the statistics information of the Ethernet interface. The statistics group provides one table and each row of the table indicates the statistics information of one subnet. The network administrator can get various statistics information of one segment from the table (the traffic of one segment, the distributing of various types of packets, various types of error packets, the number of collisions and so on).

Configuration Condition

Before configuring the RMON statistics group, first complete the following task:

l Enable the RMON function

l Enable the SNMP proxy function

Configure Statistics Management Function

Table 9‑6 Configure RMON statistics management function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the RMON function | rmon | Mandatory
Configure the RMON statistics group | rmon statistics ethernet statistics-num OID [ owner owner ] | Mandatory By default, the owner of the statistics group is config.


9.2.6 RMON Monitoring and Maintaining

Table 9‑7 RMON Monitoring and Maintaining

Command | Description
show rmon alarm | Display the RMON alarms configured in the device
show rmon alarm supportVariable | Display the monitor objects supported in the device
show rmon event | Display the RMON event configured in the device
show rmon history { control | ethernet control-num } | Display the RMON history group configured in the device
show rmon statistics ethernet | Display the RMON statistics group configured in the device


9.3 RMON Typical Configuration Example


9.3.1 Configure RMON Basic Functions

Network Requirements

l Device is the RMON proxy device and the route with the NMS server is reachable;

l Monitor and manage the event groups, alarm groups, history groups and statistics groups of RMON via NMS.

Network Topology

Figure 9‑1 Networking of configuring the RMON basic functions

Configuration Steps

Step 1: | Configure the IP address of the interface. (Omitted)
Step 2: | Configure the SNMP proxy.

#Enable the SNMP proxy, and configure the node view node as default and read-only community name as public.

Device#configure terminal

Device(config)#snmp-server start

Device(config)#snmp-server view default 1.3.6.1 include

Device(config)#snmp-server community public view default ro

#Enable the SNMP Trap function and configure the destination address and the used community name of the Trap packet.

Device(config)#snmp-server enable traps

Device(config)#snmp-server host 129.255.151.1 traps community public

Step 3:

Configure the RMON event group, alarm group, history group and statistics group of Device.

#Enable the RMON proxy.

Device(config)#rmon

#Configure the serial number of the event group as 1 and record the ingress packets of port fastethernet0/1.

Device(config)#rmon event 1 description fastethernet0/1_in_octes log 100 trap public

#Configure the alarm event group; the monitor object is ifInOctets.1; configure the sampling of the relative value; the sampling interval is 10s. Configure the increasing and decreasing threshold as 100; configure the triggered event of reaching the threshold value as event1.

Device(config)#rmon alarm 1 ifInOctets.1 10 delta risingthreshold 100 1 fallingthreshold 100 1 owner 1

#Configure the RMON statistics group.

Device(config)#rmon statistics ethernet 1 ifIndex.1

#Configure the RMON history group.

Device(config)#rmon history control 1 ifIndex.1 10

l The corresponding port of the instance index ifInOctets.1 is igabitethernet0/1 on the device.

l The remote monitored object instance index needs to be read from the interface table ifEntry of MIB-2.

Step 4:

Configure NMS.

#On NMS using SNMP v1/v2c, we need to set “Read-only community name”, “timeout” and “Retry times”.

Step 5:

Check the result.

#View the RMON event group entry configuration of Device.

Device#show rmon event

Event 1 is active, owned by config

Description : gigabitethernet_0/1_in_octes

Event firing causes: log and trap, last fired at 11:38:07

Current log entries:

logIndex logTime Description

----------------------------------------------------------------

1 11:38:07 gigabitethernet_0/1_in_octes

#Configure the RMON alarm entry configuration of Device.

Device#show rmon alarm

Alarm 1 is active, owned by 1

Monitoring variable: ifInOctets.1, Sample interval: 10 second(s)

Taking samples type: delta, last value was 4225

Rising threshold : 100, assigned to event: 1

Falling threshold : 100, assigned to event: 1

#Configure RMON statistics group entry configuration of Device.

Device#show rmon statistics ethernet

-------------------------------

Ethernet statistics table information:

Index: 1

Data Source: ifIndex.1

Owner: config

Status: Valid

------------------------------

ifIndex.1 statistics information:

------------------------------

DropEvents:0

Octets: 26962295

Pkts:252941

BroadcastPkts:156943

MulticastPkts:62331

CRCAlignErrors:51

UndersizePkts:0

OversizePkts:0

Fragments:0

Jabbers:0

Collisions:0

Pkts64Octets:167737

Pkts65to127Octets:47962

Pkts128to255Octets:22497

Pkts256to511Octets:9967

Pkts512to1023Octets:4032

Pkts1024to1518Octets:745

#View the RMON history group entry configuration of Device.

Device#show rmon history control

----------------------------------

RMON history control entry index: 1

Data source: IfIndex.1

Buckets request: 10

Buckets granted: 2

Interval: 1800

Owner: config

Entry status: Valid

----------------------------------

#NMS can query the History, Event and Statistics information in Device via MIB.

NMS can receive the Trap information of the Alarm event from Device. For example, when the ingress traffic change rate of the monitor interface is larger than the increasing threshold or smaller than the decreasing threshold, Device generates the corresponding Trap information and sends to NMS.


10 CWMP


10.1 Overview

CWMP (CPE WAN Management Protocol) is a protocol developed by the BroadBandForum.org to manage and configure the CPE (Customer Premise Equipment), also called TR-069. It defines the general protocol frame, message standard, management mode, and data model to manage the CPE connecting to the carrier's Internet broadband access network.

CWMP can be described as a data frame model, which describes the communication between the device such as broadband router and the ACS (Auto-Configuration Server). It is used to perform the remote centralized configuration and management to the CPE (such as broadband router, switch, Internet gateway device, and STB) from the user side.

CWMP protocol is an application layer protocol above the IP layer. This protocol can be applied widely and has no restrict on the access mode. CPEs based on the following access modes, such as ADSL- (Asymmetrical Dig2wital Subscriber Loop), Ethernet network, and PON (Passive Optical Network), can use this protocol. System architecture based on the TR069 is shown in Figure 10-1. End-to-end architecture of the CWMP protocol has the following features:

1. With elastic connection model, both the CPE and ACS can trigger the connection establishment. This avoids maintaining connection between the CPE and ACS.

2. It can be automatically discovered between the CPE and ACS.

3. ACS can dynamically configure and monitor the CPE.

Figure 10‑1 CPE and ACS architecture

For the CPE, the CWMP mainly completes the following four aspects of work:

1. Configure the CPE automatically and configure the dynamic service. For the ACS, each CPE can mark itself in the protocol, such as the model and version. According to the set rule, the ACS can send the configuration to a certain CPE or to a group of CPEs. The CPE can automatically request the ACS configuration information when it powers on and the ACS can actively initiate the configuration at any time. Through this function, it can achieve the CPE "zero configuration installation" function or control the service parameter dynamic change from the network side.

2. Manage the version file and configuration file of the CPE. The CWMP provides the management and download to the version file and configuration file in the CPE. The ACS can identify the version number of the user device and determines whether to remote update the software version of the device. The ACS can know whether the update succeeds after update completes. The CPE can backup through uploading the configuration file and recover through downloading the configuration file under the ACS control.

3. Configure remote upgrade to the CPE. It is a function initiated by the ACS to configure the remote upgrade to the CPE. Currently, the ACS performs remote upgrade to the CPE configuration in the hierarchical mode.

4. Achieve the secure management to the device interface. Through the RPC mode defined by the CWM (remote process invoking), it can perform secure management to the device interface, including the disabling, enabling, automatic binding, automatic unbinding, 802.1x interface , and disabling the 802.1x function

l Ensure that the device with Flash as 16M will not power off or reboot when upgrading the version using the CWMP and ensure the correctness of the upgrade version. Otherwise, the system may fail to be booted.


10.2 CWMP Function Configuration

Table 10‑1 CWMP function configuration list

Configuration Task
Configure the CWMP basic function | Enter the CWMP configuration mode
 | Enable the CWMP proxy
 | Configure the ACS server related information
 | Configure the WAN device interface
 | Configure the CWMP to periodically send the INFORM packet
 | Configure the period of the CWMP sending the INFORM packet
 | Configure the CWMP file download
 | Configure the breakpoint resume function of the CWMP file
 | Configure the provision code of the CWMP
Configure the CWMP authentication and encryption function | Configure the CWMP authentication information
 | Configure the ACS certificate of the CWMP
 | Configure the ACS certificate fingerprint of the CWMP
Configure the CWMP extended function | Configure the specified IP address of the CWMP
 | Configure the CWMP link backup


10.2.1 Configure CWMP basic function

Configuration Condition

Before configuring the CWMP proxy basic function, first enter the global configuration mode and then configure the CWMP proxy basic function.

Enter CWMP Configuration Mode

For the configuration related to the CWMP proxy, first enter the CWMP proxy configuration mode.

Table 10‑2 Enter the CWMP configuration mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory

Enable CWMP Proxy

If the device is enabled with the CWMP proxy function, then the device can interact with the CS through the CWMP proxy to remote configure and manage the device.

Table 10‑3 Enable the CWMP proxy

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is in the disabled state.

Configure ACS Server Related Information

By configuring the ACS related information, including the connection address of the ACS server, the device can communicate with the ACS server.

Table 10‑4 Configure the ACS server related information

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is in the disabled state.
Configure ACS related information | management server url url-string | Mandatory By default, the device is not configured with the ACS related parameter. For the unencrypted mode, url-string uses the http protocol. For the encryption mode, url-string uses the https protocol.
Configure the user name of the device initiating the connection to the ACS | management server user-name | Optional By default, the device is not configured with the ACS related parameter. If the user name is not configured on the ACS, do not need to configure the user name.
Configure the user name and corresponding password of the device initiating the connection to the ACS | management server password | Optional By default, the device is not configured with the ACS related parameter. If the user name and corresponding password are not configured on the ACS, do not need to configure the user name and password.

Configure WAN Device Interface

Specify the interface as the default WAN device interface in the interface mode. If the default WAN device is not specified, it will cause that the CWMP proxy cannot send the Inform packet to connect the ACS server.

Table 10‑5 Configure the WAN device interface

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L3 interface to be used | interface interface-name | Mandatory It must be configured in the L3 interface mode.
Configure the default WAN device | cwmp wan default | Mandatory By default, the WAN device interface of the CWMP proxy is not specified.

l If the default WAN device is not specified, it may cause that the CWMP cannot send the Inform packet to connect the ACS. It must be clear that the parameter name and the IP address of the WAN device connecting to the Internet in the current system when organizing the Inform packet.

l After an interface is specified as the default WAN device, if the WAN IP address is not configured in the CWMP mode and the interface is configured with the IP address, the connection request URL is generated by using the IP address of the interface.

Configure CWMP to Periodically Send INFORM Packet

By configuring the CWMP to periodically send the Inform packet, the device can periodically send the Inform packet to the ACS. After the ACS receives the Inform packet sent by the device, handle the packet based on the pre-configuration.

Table 10‑6 Configure the CWMP to periodically send the INFORM packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is disabled.
Configure the CWMP to periodically send the INFORM packet | enable inform | Mandatory By default, the function of CWMP periodically sending the INFORM function is enabled.

Configure Period of CWMP Sending INFORM Packet

After configuring the CWMP to periodically send the INFORM packet, you can configure the period of the CWMP proxy sending the Inform packet. The default sending period is 43200s (12h).

Table 10‑7 Configure the period of the CWMP sending the INFORM packet

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is disabled.
Configure the CWMP to periodically send the INFORM packet | enable inform | Mandatory By default, the function of the CWMP periodically sending the INFORM packet is enabled,
Configure the period of the CWMP sending the INFORM packet | inform interval inform-interval | Mandatory By default, the interval for the device automatically sending the inform packet is 43200s.

l After the function of the CWMP proxy sending the Inform packet is configured and the sending period of the Inform packet is not configured, the CWMP sends the Inform packet to the ACS in 43200s (12h) by default.

l After the periodical sending interval of the Inform packet is modified, the modified interval can only take effect when the last interval expires. If you want the modified interval to take effect immediately, you can reboot the CWMP proxy. Wherein, for enable and no enable, refer to the related chapter in the CWMP command manual.

Configure CWMP File Download

When the function of CWMP proxy supporting the file download is required to download the version file and configuration file, configure the CWMP proxy file download function in advance.

Table 10‑8 Configure the CWMP file download

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is disabled.
Configure the CWMP file download function | enable download | Mandatory By default, the file download function of the CWMP is not enabled.

Configure Breakpoint Resume Function of CWMP File

After the CWMP file download function is configured and the CWMP is required to support the breakpoint resume function, you can configure the function.

Table 10‑9 Configure the breakpoint resume function of the CWMP file

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is disabled.
Configure the CWMP file download function | enable download | Mandatory By default, the file download function of the CWMP is not enabled.
Configure the breakpoint resume function of the CWMP file | enable download resume | Mandatory By default, the file breakpoint resume function of the CWMP is not enabled.

l Before the breakpoint resume function of the CWMP file is configured the file download function of the CWMP must be configured. If the file download function is not configured at first, then the file breakpoint resume function will not take effect even if the file resume function is configured.

Configure CWMP Provision Code

This function is used to configure the CWMP provision code which is used to mark the basic service information provided by the CWMP.

Table 10‑10 Configure CWMP provision code

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is disabled.
Configure the CWMP provision code | provision code provision-code | Mandatory By default, the CWMP is not configured with the provision code.


10.2.2 Configure CWMP Authentication and Encryption Function

Configuration Condition

Before configuring the CWMP authentication and encryption function, first complete the following task:

l The basic configuration of the CWMP proxy is completed, including the CWMP proxy enabling configuration and the ACS information configuration of the CWMP proxy.

l When configuring the encryption function, prepare the certificate and it requires manual import.

Configure CWMP Authentication Function

When the ACS requires initiating the connection to the device, configure the CWMP proxy to authenticate the connection request sent from the ACS in terms of the security.

Table 10‑11 Configure the CWMP authentication function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is disabled.
Configure the user name for the CPE authenticating the connection request from the ACS | connection request username user-name | Mandatory By default, the user name is not configured.
Configure the password for the CPE authenticating the connection request from the ACS | connection request password password | Mandatory By default, the password is not configured.

Configure CWMP PKI Trust Domain Name

Viewing from the security, when the device connects to the ACS through the HTTPS mode, you need to specify the KPI trust domain name of the CWMP proxy, so as to verify the validity of the ACS certificate.

Table 10‑12 Configure the CWMP ACS certificate

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is disabled.
Configure the KPI trust domain name of the CWMP proxy | secure-identity ca-name | Mandatory By default, the CWMP proxy does not have the KPI trust domain name.


10.2.3 Configure CWMP Extended Function

Configuration Condition

Before configuring the CWMP extended function, first complete the following tasks:

l Complete the CWMP basic configurations, including the CWMP proxy enabling configuration, CWMP proxy ACS information configuration.

l Configure the IP address of the interface to enable that the network layers of the neighboring nodes are reachable.

l When the link backup function is required, the interface configured as backup must be normal, including the configured IP address and the interface in the UP state.

Configure CWMP Specified Source IP Address

When the source IP address is configured, the ACS can directly communicate with the specified IP address.

Table 10‑13 Configure the source IP address specified by the CWMP

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the CWMP proxy configuration mode | cwmp agent | Mandatory
Enable the CWMP proxy | enable | Mandatory By default, the CWMP proxy is disabled.
Configure the source IP address specified by the CWMP proxy | ip source ip-address | Mandatory By default, the source IP address of the packet is not specified when the device establishes link with the ACS and the source IP address of the packet is the packet egress interface.

Configure CWMP link backup

When the link backup function is configured under the interface mode, there is one default WAN interface and others are backup WAN interfaces when the device is configured with multiple WAN interfaces. The IP address of the default WAN interface is used to generate the connection request URL and then send it to the ACS. When the default WAN interface is down, one interface is chosen from the backup WAN interface and is considered as the current WAN interface. Then, its IP address is used to generate the connection request URL,

Table 10‑14 Configure the CWMP link backup

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L3 interface requiring setting backup | interface interface-name | Mandatory
Configure the backup interface of CWMP proxy | cwmp wan backup | Mandatory By default, the WAN device backup interface of the CWMP proxy is not specified.

l Each device can only be configured with one CWMP WAN default interface and one CWMP WAN backup interface.


10.2.4 CWMP Monitoring and Maintaining

Table 10‑15 CWMP monitoring and maintaining

Command | Description
show cwmp agent | Display the related information of the CWMP proxy.
show cwmp session | Display the session information of the CWMP proxy.
show cwmp methods | Display the RPC (Remote Procedure Call)) supported by the CWMP proxy
show cwmp parameter all | Display all the parameter names of the CWMP proxy
show cwmp parameter para-string | Display the detailed parameter information of the specified CWMP proxy
show cwmp parameter notify { active | all | forceactive | passive } | Display the notified parameter name of the CWMP proxy
show cwmp parameter values [ para-string | error ] | Display the detailed parameter information of the specified CWMP proxy


10.3 CWMP Typical Configuration Example


10.3.1 Configure CWMP Authentication Function

Network Requirements

l Device visits the ACS through the Network and enable the CWMP function on Device. Configure the authentication function both on Device and ACS.

l After the authentication passes, Device will execute the version upgrade, configuration restoration, configuration backup, and configuration upgrade tasks sent by the ACS.

Network Topology

Figure 10‑2 Networking of the CWMP authentication function

Configuration Steps

Step 1: | Configure the IP address and route of the interface. (Omitted)
Step 2: | Configure the CWMP.

#Enable the CWMP proxy and file download function on Device and configure the URL of the ACS.

Device#configure terminal

Device(config)#cwmp agent

Device(config-cwmp)#enable

Device(config-cwmp)#management server url http://129.255.136.200:8080/openacs/acs

Device(config-cwmp)#enable download

Device(config-cwmp)#exit

#Configure the gigabitethernet0 interface as the default WAN device.

Device(config)#interface gigabitethernet0

Device (config-if-gigabitethernet0)#cwmp wan default

Device (config-if-gigabitethernet0)#exit

Step 3:

Configure the ACS server.

#Create the fragment template on the ACS and configure both the authentication user name and password as admin. (Omitted)

#Create the configuration upgrade task on the ACS and choose the fragment template to be created. Deliver the configuration task to Device. (Omitted)

l The ACS sends the authentication user name and password to Device through configuring the upgrade task to ensure that the ACS can pass the Device authentication.

#Create version upgrade task, restoration task, and backup task on the ACS.

Step 4:

Check the result.

#Execute the show running-config command on Device and it can be viewed that the ACS sends the user name and password of Device.

cwmp agent

management server url http://129.255.136.200:8080/openacs/acs

connection request username admin

connection request password admin

enable download

enable

exit

#Device can successfully execute the version upgrade task. Configure the restoration task and backup task sent by the ACS.


10.3.2 Configure Source IP Address specified by CWMP

Network Requirements

l Device visits the ACS through Network and enable the CWMP function on Device.

l Specify the source IP address of the CWMP as 1.0.0.1. enable Device to visit the ACS through the firewall and execute the version upgrade, configuration restoration, and configuration backup tasks sent by the ACS.

Network Topology

Figure 10‑3 Networking of configuring the source IP address specified by the CWMP

Configuration Steps

Step 1: | Configure the IP address and router of the interfaces. (Omitted)
Step 2: | Configure the CWMP.

# Enable the CWMP proxy and file download function on Device. Configure the URL of the ACS and the source IP address of the CWMP as 1.0.0.1.

Device#configure terminal

Device(config)#cwmp agent

Device(config-cwmp)#enable

Device(config-cwmp)#management server url http://129.255.136.200:8080/openacs/acs

Device(config-cwmp)#enable download

Device(config-cwmp)#ip source 1.0.0.1

Device(config-cwmp)#exit

#Configure the Loopback0 interface as the default WAN device.

Device(config)#interface loopback 0

Device(config-if-loopback0)#cwmp wan default

Device(config-if-loopback0)#exit

Step 3:

Configure the firewall.

#The firewall rejects the packet with the source IP address as 43.0.0.1 to pass and allows the packet with the source IP address as 1.0.0.1 to pass.

Step 4:

Configure the ACS server.

#Create the version upgrade task and configuration restoration task and configuration backup task on the ACS.

Step 5:

Check the result.

#Execute the show running-config command on Device and the configured source IP address can be viewed.

cwmp agent

management server url http://129.255.136.200:8080/openacs/acs

enable download

enable

ip source 1.0.0.1

exit

#Device can successfully execute the version upgrade task and configuration restoration task and configuration backup task sent by the ACS.


10.3.3 Configure CWMP Link Backup

Network Requirements

l Device can visit the ACS through two links. The gigabitethernet0 interface is selected by priority to communicate with the ACS.

l When the gigabitethernet0 interface is faulty, Device can communicate with the ACS through the gigabitethernet1 interface. When the gigabitethernet0 interface recovers, Device can communicate with the ACS through the gigabitethernet0 interface.

Network Topology

Figure 10‑4 Networking of configuring the CWMP link backup

Configuration Steps

Step 1: | Configure the IP address and route of the interfaces. (Omitted)
Step 2: | Configure the CWMP.

#Enable the CWMP proxy and file download function on Device and configure the URL of the ACS.

Device#configure terminal

Device(config)#cwmp agent

Device(config-cwmp)#enable

Device(config-cwmp)#management server url http://129.255.136.200:8080/openacs/acs

Device(config-cwmp)#enable download

Device(config-cwmp)#exit

#Configure the gigabitethernet0 interface as the default WAN interface.

Device(config)#interface gigabitethernet0

Device (config-if-gigabitethernet0)#cwmp wan default

Device (config-if-gigabitethernet0)#exit

#Configure the gigabitethernet1 interface as the backup WAN device.

Device(config)#interface gigabitethernet1

Device (config-if-gigabitethernet1)#cwmp wan backup

Device (config-if-gigabitethernet1)#exit

Step 3:

Check the result.

#View the CWMP proxy information on Device.

Device#show cwmp agent

Agent status: Enabled

Periodic Inform: Enabled

Download files: Enabled

Inform interval: 43200

ACS URL: http://129.255.136.200:8080/openacs/acs

ACS user name:

ACS user password:

Connection request URL: http://42.0.0.1:7547/00017A/MP2900-14/00017aaabb29/cwmp

Connection request user name:

Connection request password:

Default WAN device: gigabitethernet0

Current WAN device: gigabitethernet0

Secure identity:

It can be viewed that the default WAN device is gigabitethernet0 and current WAN device is gigabitethernet0. It can be viewed on the ACS management page that the corresponding IP address of Device is 42.0.0.1.

#When the gigabitethernet0 interface on Device is faulty, view the CWMP proxy information.

Device#show cwmp agent

Agent status: Enabled

Periodic Inform: Enabled

Download files: Enabled

Inform interval: 43200

ACS URL: http://129.255.136.200:8080/openacs/acs

ACS user name:

ACS user password:

Connection request URL: http://43.0.0.1:7547/00017A/MP2900-14/00017aaabb29/cwmp

Connection request user name:

Connection request password:

Default WAN device: gigabitethernet0

Current WAN device: gigabitethernet1

Secure identity:

It can be viewed that the default WAN device is gigabitethernet0 and current WAN device is gigabitethernet1. It can be viewed on the ACS management page that the corresponding IP address of Device is 43.0.0.1.

#When the gigabitethernet0 interface on Device is recovered, view the CWMP proxy information. It can be viewed that both the default WAN device and the current WAN device is gigabitethernet0. It can be viewed on the ACS management page that the corresponding IP address of Device is 42.0.0.1.


11 LLDP


11.1 Overview


11.1.1 Overview of LLDP Protocol

LLDP (Link Layer Discovery Protocol) is the link layer protocol defined in the IEEE 802.1ab standard. It organizes the information of the local device to TLV (Type/Length/Value), encapsulates in LLDPDU (Link Layer Discovery Protocol Data Unit) and sends to the direct-connected neighbor device. Meanwhile, it saves the LLDPDU received from the neighbor device in the standard MIB (Management Information Base) mode. With LLDP, the device can save and manage its own and direct-connected neighbor device information for the network management system to query and judge the link communication status.


11.1.2 TLV Type Information

TLV that LLDP can encapsulate includes the basic TLV, organization-defined TLV and MED (Media Endpoint Discovery) TLV. Basic TLV is a group of TLV regarded as the basis of the network device management. Organization defined TLV and MED TLV is the TLV defined by the standard organization and other institutions, used to strengthen the management for the network devices. We can configure whether to release in LLDPDU according to the actual demand.

Basic TLV

In basic TLV, there are several types of TLV, which are mandatory for realizing the LLDP function, that is, should release in LLDPDU, as shown in the following table.

Table 11‑1 Description of the basic TLV

TLV Type | Description | Whether to release
End of LLDPDU TLV | Indicate LLDPDU end | Yes
Chassis ID TLV | The MAC address of the sending device | Yes
Port ID TLV | Used to identify the port of the LLDPDU sending end; when the device does not send MED TLV, the content is the port name; when selecting to send MED TLV, the content is the MAC address of the port. | Yes
Time To Live TLV | The live time of the local device information on the neighbor device | Yes
Port Description TLV | The description character string | No
System Name TLV | The device name | No
System Description TLV | The system description | No
System Capabilities TLV | The main functions of the system and which functions can be enabled | No
Management Address TLV | Management address, and the corresponding interface number and OID (Object Identifier); the management address is permitted by the interface to pass and is the main IP address of the VLAN with the minimum VLAN ID; if the VLAN with the minimum VLAN ID is not configured with the main IP address, the management address value is 127.0.0.1.. By default, send the TLV. | Yes

Organization-defined TLV

The organization-defined TLV includes the 802.1 organization-defined TLV and 802.3 organization-defined TLV, as shown in the following table.

Table 11‑2 The description of 802.1 organization-defined TLV

TLV Type | Description | Whether to release
Port VLAN ID TLV | Port VLAN ID | No
Port And Protocol VLAN ID TLV | The protocol VLAN ID of the port | No
VLAN Name TLV | The port VLAN name | No
Protocol Identity TLV | The protocol type supported by the port. The local device does not support sending Protocol Identity TLV, but can receive the type of TLV. | No

Table 11‑3 The description of the 802.3 organization-defined TLV

TLV Type | Description | Whether to release
MAC/PHY Configuration/Status TLV | The rate and duplex status of the port, whether to support the auto negotiation of the port rate, whether to enable the auto negotiation function, and the current rate and duplex status | No
Power Via MDI TLV | The power supply capability of the port | No
Link Aggregation TLV | Whether the port supports the link aggregation and whether to enable the link aggregation | No
Maximum Frame Size TLV | The supported maximum frame length, using the configured MTU of the port (Max Transmission Unit) | No

MED TLV

The MED TLV information is as shown in the following table.

Table 11‑4 The description of MED TLV

TLV Type | Description | Whether to release
LLDP-MED Capabilities TLV | The MED device type of the device and the LLDP MED TLV type that can be encapsulated in LLDPDU | No
Network Policy TLV | The port VLAN ID, supported application (such as voice and video), application priority and used policy information | No
Extended Power-via-MDI TLV | The power supply capability of the device | No
Hardware Revision TLV | The hardware version of the device | No
Firmware Revision TLV | The firmware version of the device | No
Software Revision TLV | The software version of the device | No
Serial Number TLV | The serial number of the device | No
Manufacturer Name TLV | The manufacturer of the device | No
Model Name TLV | The module name of the device | No
Asset ID TLV | The asset ID of the device for directory management and asset tracking | No
Location Identification TLV | The location ID information of the connected device, used by the other devices in the application based on the location | No


11.1.3 LLDP Work Mechanism

LLDP Work Mode

The port includes the following four LLDP work modes:

l RxTx: send and receive LLDPDU;

l Tx: only send LLDPDU;

l Rx: only receive LLDPDU;

l Disable: do not send or receive LLDPDU.

LLDP Sending Mechanism

The LLDP sending mechanism:

l When the port works in the RxTx or Tx mode, regularly send LLDPDU to the neighbor device according to the sending period of the LLDP packet;

l After the port enables the polling function, regularly poll whether the LLDP concerned configuration in the local device changes. If the configuration changes, send LLDPDU at once. To prevent the frequent change of the local information from causing lots of the sent LLDPDU, it is necessary to delay and wait for some time and then continue to send the next LLDPDU when sending one LLDPDU every time.

l When some configuration related with the local device LLDP changes (for example, select the released TLV type), or if finding the configuration change after enabling the polling function, enable the fast sending mechanism, that is, immediately send the LLDPDU of the specified quantity continuously, and then restore the normal LLDP packet sending period.

l When the global LLDP function is disabled or the port enabled with LLDP executes shutdown, adds to the aggregation group, and disables the LLDP, as well as restarts the device, send one LLDPDU with CLOSE TLV to inform the neighbor device.

LLDP Receiving Mechanism

When the port works in the RxTx or Rx mode, check the validity of the received LLDPDU and the carried TLV. After passing the validity check, save the neighbor information to the local device and set the age time of the neighbor information at the local device according to the TTL (Time To Live) carried in LLDPU. If the TTL value in the received LLDPDU is 0, age the neighbor information at once. The storing capability of the LLDP protocol for the neighbor is limited. Currently, one port of the device supports the information of 200 neighbors at most. The device can store 1000 neighbors at most. If the neighbors reach the threshold, more neighbor advertising packets are dropped and cannot be saved.


11.2 LLDP Function Configuration

Table 11‑5 LLDP function configuration list

Configuration Task |
Configure the LLDP basic functions | Enable the global LLDP function
 | Enable the port LLDP function
Configure the LLDP work mode | Configure the LLDP work mode
Configure the TLV that LLDP permits to release | Configure the basic TLV permitted to release
 | Configure the organization-defined TLV permitted to release
 | Configure the MED TLV permitted to release
Configure the LLDP parameters | Configure the neighbor live time
 | Configure the delay of sending packets
 | Configure the sending period of packets
 | Configure the number of the packets sent fast
 | Configure the re-initializing delay
 | Configure the period of checking the LLDP configuration


11.2.1 Configure LLDP Basic Functions

Enable the global LLDP function and port LLDP function at the same time so that LLDP can work normally. The local device gets the neighbor device information by interacting LLDPDU with other device.

Configuration Condition

None

Enable Global LLDP Function

Table 11‑6 Enable the global LLDP function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enable the global LLDP function | lldp run | Mandatory By default, do not enable the global LLDP function.

Enable Port LLDP Function

Table 11‑7 Enable the port LLDP function

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2/L3 Ethernet interface configuration mode | interface interface-name | Either After entering the L2/L3 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After entering the aggregation group configuration mode, the subsequent configuration takes effect only on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Enable the port LLDP function | lldp enable | Mandatory By default, do not enable the port LLDP function.


11.2.2 Configure LLDP Work Mode

Configuration Condition

None

Configure LLDP Work Mode

The user can set different work modes according to the role of the device in the network. If it is the seed device (the center device collected by network topology), it is suggested to configure the LLDP work mode as Rx. Otherwise, it is suggested to configure the LLDP work mode as Tx.

Table 11‑8 Configure the LLDP work mode

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2/L3 Ethernet interface configuration mode | interface interface-name | Either After entering the L2/L3 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After entering the aggregation group configuration mode, the subsequent configuration takes effect only on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the LLDP work mode as Rx | lldp receive | Optional By default, LLDP work mode is RxTx. LLDP work mode is decided by the command lldp receive and lldp transmit together.
Configure the LLDP work mode as Tx | lldp transmit


11.2.3 Configure TLV LLDP Permits to Release

The neighbor device can get to know the details of the local device by releasing TLV.

Configuration Condition

None

Configure Basic TLV LLDP Permits to Release

The user can release different basic TLVs according to the actual application demand.

Table 11‑9 Configure the basic TLV LLDP permits to release

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2/L3 Ethernet interface configuration mode | interface interface-name | Either After entering the L2/L3 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After entering the aggregation group configuration mode, the subsequent configuration takes effect only on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the basic TLV LLDP permits to release | lldp tlv-select { basic-tlv { all | port-description | system-capability | system-description | system-name } | dot1-tlv { all | port-vlan-id | protocol-vlan-id | vlan-name } | dot3-tlv { all | link-aggregation | mac-physic | max-frame-size | power } } | Optional By default, permit to release all basic TLVs.

Configure Organization-defined TLV LLDP Permits to Release

The user can release different organization-defined TLVs according to the actual application demand.

Table 11‑10 Configure the organization-defined TLV LLDP permits to release

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2/L3 Ethernet interface configuration mode | interface i nterface-name | Either After entering the L2/L3 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After entering the aggregation group configuration mode, the subsequent configuration takes effect only on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the organization-defined TLV LLDP permits to release | lldp tlv-select { basic-tlv { all | port-description | system-capability | system-description | system-name } | dot1-tlv { all | port-vlan-id | protocol-vlan-id | vlan-name } | dot3-tlv { all | link-aggregation | mac-physic | max-frame-size | power } } | Optional By default, permit to release all organization-defined TLVs.

Configure MED TLV LLDP Permits to Release

The user can release different MED TLVs according to the actual application demand.

Table 11‑11 Configure the MED TLV LLDP permits to release

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2/L3 Ethernet interface configuration mode | interface interface-name | Either After entering the L2/L3 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After entering the aggregation group configuration mode, the subsequent configuration takes effect only on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Configure the MED TLV LLDP permits to release | lldp med-tlv-select { all | capability | location-id elin-address phonenum | network-policy | power-via-mdi | inventory } | Optional By default, do not permit to release all MED TLVs.


11.2.4 Configure LLDP Parameters

Configuration Condition

None

Configure Neighbor Life Time

Specify the life time of the local device information on the neighbor device by configuring the neighbor TTL so that the neighbor device can delete the local device information after the TTL of the local device arrives.

Table 11‑12 Configure the neighbor life time

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the life time of the local device on the neighbor device | lldp holdtime holdtime-value | Optional By default, the life time of the local device on the neighbor device is 120s.

Configure the Delay of Sending Packets

Configuring the delay of sending packets can prevent the frequent change of the local information from causing lots of LLDPDU to be sent.

Table 11‑13 Configure the delay of sending packets

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the delay of sending the LLDP packets | lldp transmit-delay transmit-delay-value | Optional By default, the delay of sending the LLDP packets is 2s.

Configure Packet Sending Period

The local device regularly sends the LLDP packet to the neighbor device by configuring the period of sending the packets so that the information of the local device on the neighbor device is not aged.

Table 11‑14 Configure the period of sending packets

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the period of sending the LLDP packets | lldp transmit-interval transmit-interval-value | Optional By default, the period of sending the LLDP packets is 30s.

Configure Fast Sent Packet Quantity

When some LLDP configuration of the local device (for example, select the released TLV type) changes, or when the polling mechanism finds that the LLDP concerned configuration information in the local device changes after enabling the polling function, to make other devices discover the change of the local device as soon as possible, enable the fast sending mechanism, that is, continuously send the LLDPDUs of the specified quantity (it is 3 by default) at once, and then restore the normal sending period.

Table 11‑15 Configure the fast sent packet quantity

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the number of the fast sent packets | lldp fast-count fast-count-value | Optional By default, the number of the fast sent packets is 3.

Configure Re-initializing Delay

When the port work mode changes, re-initialize the port protocol status machine. To prevent the frequent change of the port work mode from re-initializing the port protocol status machine continuously, we can configure the re-initializing delay of the port.

Table 11‑16 Configure the re-initializing delay

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Configure the re-initializing delay | lldp reinit reinit-value | Optional By default, the re-initializing delay is 2s.

Configure LLDP Configuration Check Period

To inform the neighbor device in time after the LLDP configuration changes, we can configure the period of checking the LLDP configuration.

Table 11‑17 Configure the period of checking the LLDP configuration

Step | Command | Description
Enter the global configuration mode | configure terminal | -
Enter the L2/L3 Ethernet interface configuration mode | interface interface-name | Either After entering the L2/L3 Ethernet interface configuration mode, the subsequent configuration takes effect only on the current port. After entering the aggregation group configuration mode, the subsequent configuration takes effect only on the aggregation group.
Enter the aggregation group configuration mode | link-aggregation link-aggregation-id
Enable the polling function and configure the polling period | lldp check-change-interval check-change-interval-value | Optional By default, the polling function is disabled.


11.2.5 LLDP Monitoring and Maintaining

Table 11‑18 LLDP Monitoring and Maintaining

Command | Description
clear lldp neighbors [ interface interface-name | link-aggregation link-aggregation-id ] | Clear the neighbor information
show lldp neighbors [ detail | interface interface-name [ detail ] | link-aggregation link-aggregation-id [ detail ] ] | Display the neighbor information
show lldp neighbors oui [ interface interface-name | link-aggregation link-aggregation-id ] | Display the neighbor OUI address information and write the Voice-VLAN OUT entry status
clear lldp statistics | Clear the LLDP packet statistics information
show lldp statistics { interface interface-name | link-aggregation link-aggregation-id } | Display the received and sent LLDP packet statistics information of the specified port
show lldp | Display the LLDP global configuration information
show lldp interface interface-name | Display the LLDP work mode of the specified port and the polling period of checking the LLDP configuration change
show lldp link-aggregation link-aggregation-id | Display the LLDP work mode of the specified aggregation group and the polling period of checking the LLDP configuration change
show lldp tlv-select [ interface interface-name | link-aggregation link-aggregation-id ] | Display the basic TLV and organization-defined TLV configuration information
show lldp voice neighbors [ detail | interface interface-name [ detail ] | link-aggregation link-aggregation-id [ detail ] ] | Display the voice neighbor information


11.3 LLDP Typical Configuration Example


11.3.1 Configure LLDP Basic Functions

Network Requirement

l Configure the LLDP function on Device1, Device2 and Device3, realizing the link-layer neighbor discovery.

Network Topology

Figure 11‑1 Networking of configuring the LLDP basic functions

Configuration Steps

Step 1:

Enable the LLDP function on Device.

# Enable the LLDP function on Device1.

Device1#configure terminal

Device1(config)#lldp run

#Enable the LLDP function on Device2.

Device2#configure terminal

Device2(config)#lldp run

#Enable the LLDP function on Device3.

Device3#configure terminal

Device3(config)#lldp run

Step 2:

Configure the LLDP function on the port.

#Enable the LLDP function on port gigabitethernet0/1 of Device1.

Device1(config)#interface gigabitethernet 0/1

Device1(config-if-gigabitethernet0/1)#lldp enable

Device1(config-if-gigabitethernet0/1)#exit

#Enable the LLDP function on port gigabitethernet0/1 of Device2.

Device2(config)#interface gigabitethernet 0/1

Device2(config-if-gigabitethernet0/1)#lldp enable

Device2(config-if-gigabitethernet0/1)#exit

Device2(config)#interface gigabitethernet 0/2

Device2(config-if-gigabitethernet0/2)#lldp enable

Device2(config-if-gigabitethernet0/2)#exit

#Enable the LLDP function on port gigabitethernet0/1 of Device3.

Device3(config)#interface gigabitethernet 0/1

Device3(config-if-gigabitethernet0/1)#lldp enable

Device3(config-if-gigabitethernet0/1)#exit

Step 3:

Check the result.

#View the neighbor information on Device1.

Device1#show lldp neighbors

Capability codes:

(R) Router, (B) Bridge, (T) Telephone, (C) DOCSIS Cable Device

(W) WLAN Access Point, (P) Repeater, (S) Station, (O) Other

Device ID Local Intf Hold-time Capability Peer Intf

Device2 fa0/1 120 P,R, fa0/1

Device2 discovers neighbor Device2.

#View the details of Device1 neighbor.

Device1#show lldp neighbors detail

Basic information

Chassis ID : 0001.7a54.5c36

Interface ID : fa0/1

Interface Description : gigabitethernet0/1

System Name : Device2

System Description : MyPower (R) Operating System Software

Copyright (C) 2013 Maipu Communication Technology Co.,Ltd.All Rights Reserved.

Time Remaining : 114 seconds

System Capabilities : P,R,

Enabled Capabilities : P,R,

Management Addresses : IP,127.0.0.1

802.1 organizationally information

Port VLAN ID : 1

Port And Protocol VLAN ID : 0

VLAN Name Of VLAN 1 : DEFAULT

802.3 organizationally information

Auto Negotiation : Supported, Enabled

PMD Auto Negotiation Advertised : 10BASE-T,10BASE-TFD,100BASE-TX,100BASE-TXFD,

Media Attachment Unit Type : 100BaseTXFD,

Port Class : PSE

PSE Power : Supported, Enabled

PSE Pairs Control Ability : No

Power Pairs : 1

Power Class : 1

Link Aggregation : Supported, Disabled

Link Aggregation ID : 0

Max Translate Unit : 1824

MED organizationally information

Capabilities : Not Supported

Class Type : Not Supported

Application Type : Not Supported

Policy : Not Supported

VLAN Tagged : Not Supported

VLAN ID : Not Supported

L2 Priority : Not Supported

DSCP Value : Not Supported

Location ID : Not Supported

Power Type : Not Supported

Power Source : Not Supported

Power Priority : Not Supported

Power Value : Not Supported

HardwareRev : Not Supported

FirmwareRev : Not Supported

SoftwareRev : Not Supported

SerialNum : Not Supported

Manufacturer Name : Not Supported

Model Name : Not Supported

Asset Tracking Identifier : Not Supported

---------------------------------------------

Total entries displayed: 1

l For viewing the neighbor information of Device2 and Device3, refer to Device1.


1 System Operation Basics


1 Interface Basis


1 Forwarding


1 Routing Basics


1 MPLS Basis