Reference Guide

ManualsBrandsDell ManualsserversDell C7008/C300 Aggregation Core chassis Switch

FTOS Configuration Guide

FTOS 8.4.5.0

E-Series TeraScale, C-Series,

S-Series (S50/S25)

Summary of content (1260 pages)

PAGE 1
FTOS Configuration Guide FTOS 8.4.5.
PAGE 2
Notes, Cautions, and Warnings NOTE: A NOTE indicates important information that helps you make better use of your computer. CAUTION: A CAUTION indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING indicates a potential for property damage, personal injury, or death. Information in this publication is subject to change without notice. © 2013 Dell Force10. All rights reserved.
PAGE 3
1 About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 4
www.dell.com | support.dell.com Change System Logging Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .63 Display the Logging Buffer and the Logging Configuration . . . . . . . . . . . . . . . . . . . . . . .64 Configure a UNIX Logging Facility Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .66 Synchronize Log Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 5
6 802.3ah . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Link Layer OAM Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .93 Link Layer OAMPDUs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .94 Link Layer OAM Operational Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95 Link Layer OAM Discovery . . . . . .
PAGE 6
www.dell.com | support.dell.com MAC Authentication Bypass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .127 MAB in Single-host and Multi-Host Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .128 MAB in Multi-Supplicant Authentication Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . .128 Dynamic CoS with 802.1X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 7
Configuring BFD for VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .198 Configuring BFD for Port-Channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .201 Configuring Protocol Liveness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .203 Troubleshoot BFD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .203 10 Border Gateway Protocol IPv4 (BGPv4) . . . . . . . .
PAGE 8
www.dell.com | support.dell.com Boot Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 When to Use CAM Profiling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .287 Important Points to Remember . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .288 Select CAM Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 9
Configure the System to be a DHCP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .314 Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .315 Configure the Server for Automatic Address Allocation . . . . . . . . . . . . . . . . . . . . . .315 Specify a Default Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .316 Enabling DHCP Server . . . . . . . . . . . . . . . . . . . . . .
PAGE 10
www.dell.com | support.dell.com Specify an SMTP Server for FTSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .349 Providing an Administrator E-mail Address . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .349 FTSA Messaging Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .350 Enable the FTSA Messaging Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 11
Hot-lock Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .393 Warm Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393 Configure Cache Boot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .394 In-Service Modular Hot-Fixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 12
www.dell.com | support.dell.com Displaying Information on a Management Interface . . . . . . . . . . . . . . . . . . . . . . . .425 VLAN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 426 Loopback Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .427 Null Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 13
Configurable ARP Retries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .475 ICMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475 Configuration Task List for ICMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .475 UDP Helper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 14
www.dell.com | support.dell.com 23 Intermediate System to Intermediate System . . . . . . . . . . . . . . . . . . . . . . . . . . . 507 Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .507 IS-IS Addressing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 508 Multi-Topology IS-IS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 15
mac learning-limit station-move . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .563 mac learning-limit no-station-move . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .564 mac learning-limit sticky . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .564 Displaying MAC Learning-Limited Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . .566 Learning Limit Violation Actions . . . . . . . . . . . . . . . .
PAGE 16
www.dell.com | support.dell.com Configuring LLDPDU Intervals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .598 Configuring Transmit and Receive Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .599 Configuring a Time to Live . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .600 Debugging LLDP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 17
Manage the Source-active Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .626 View the Source-active Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .627 Limit the Source-active Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .627 Clear the Source-active Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .627 Enable the Rejected Source-active Cache . . . . . . . . .
PAGE 18
www.dell.com | support.dell.com Implementation Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .669 Multicast Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .669 IPv4 Multicast Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .669 IPv6 Multicast Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 19
Configuration Task List for OSPFv2 (OSPF for IPv4) . . . . . . . . . . . . . . . . . . . . . . . . . .708 Enable OSPFv2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .709 Enable Multi-Process OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711 Assign an OSPFv2 area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .712 Enable OSPFv2 on interfaces . . . . . . . . . . . . . . .
PAGE 20
www.dell.com | support.dell.com Requesting Multicast Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .760 Refusing Multicast Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .760 Sending Multicast Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .761 Important Points to Remember . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 21
Power Additional PoE Ports on the S-Series . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .803 Deploying VOIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803 Create VLANs for an Office VOIP Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . .804 Configure LLDP-MED for an Office VOIP Deployment . . . . . . . . . . . . . . . . . . . . . .805 Configure Quality of Service for an Office VOIP Deployment . . . . . . .
PAGE 22
www.dell.com | support.dell.com 40 Per-VLAN Spanning Tree Plus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 843 Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .843 Implementation Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .844 Configure Per-VLAN Spanning Tree Plus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 23
42 Routing Information Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885 Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .885 RIPv1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885 RIPv2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 24
www.dell.com | support.dell.com TACACS+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 938 Configuration Task List for TACACS+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .938 TACACS+ Remote Authentication and Authorization . . . . . . . . . . . . . . . . . . . . . . .940 Command Authorization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 25
Important Points to Remember . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .982 Enable and Disable sFlow . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .983 Enable and Disable on an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .983 sFlow Show Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .984 Show sFlow Globally . . . . . . . . . . . . . . .
PAGE 26
www.dell.com | support.dell.com 10GE WAN Physical Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1017 SONET Alarm Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1018 SONET TRAP Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1021 SONET Syslog Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 27
52 Spanning Tree Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1057 Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1057 Configuring Spanning Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1057 Related Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 28
www.dell.com | support.dell.com UFD and NIC Teaming . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1095 Important Points to Remember . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1096 Configuring Uplink Failure Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1097 Clearing a UFD-Disabled Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 29
58 Virtual Router Redundancy Protocol (VRRP) . . . . . . . . . . . . . . . . . . . . . . . . . . 1135 VRRP Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1135 VRRP Benefits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1137 VRRP Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1137 VRRP version 3 . . . . . . . .
PAGE 30
www.dell.com | support.dell.com Recognize an under-voltage condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1183 Troubleshoot an under-voltage condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1183 Trace logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1183 Automatic trace log updates . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 31
Parity error detection and correction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1219 Enable parity error correction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1219 Recognize a transient parity error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1220 Recognize a non-recoverable parity error . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1221 Trace logs . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 32
| www.dell.com | support.dell.
PAGE 33
1 About this Guide Objectives This guide describes the protocols and features supported by the Dell Networking Force10 Operating System (FTOS) and provides configuration instructions and examples for implementing them. It supports the system platforms E-Series, C-Series, and S-Series. The E-Series ExaScale platform is supported with FTOS version 8.1.1.0. and later. Though this guide contains information on protocols, it is not intended to be a complete reference.
PAGE 34
www.dell.com | support.dell.com Conventions This document uses the following conventions to describe command syntax: Convention Description keyword Keywords are in bold and should be entered in the CLI as listed. parameter Parameters are in italics and require a number or word to be entered in the CLI. {X} Keywords and parameters within braces must be entered in the CLI. [X] Keywords and parameters within brackets are optional.
PAGE 35
2 Configuration Fundamentals The FTOS Command Line Interface (CLI) is a text-based interface through which you can configure interfaces and protocols. The CLI is largely the same for the E-Series, C-Series, and S-Series with the exception of some commands and command outputs. The CLI is structured in modes for security and management purposes. Different sets of commands are available in each mode, and you can limit user access to modes using privilege levels.
PAGE 36
www.dell.com | support.dell.com CLI Modes Different sets of commands are available in each mode. A command found in one mode cannot be executed from another mode (with the exception of EXEC mode commands preceded by the command do; see The do Command). You can set user access rights to commands and command modes using privilege levels; for more information on privilege levels and security options, refer to Chapter 45, Security.
PAGE 37
Figure 2-2.
PAGE 38
Prompt Access Command EXEC FTOS> Access the router through the console or Telnet. EXEC Privilege FTOS# • • CONFIGURATION FTOS(conf)# • • From EXEC mode, enter the command enable. From any other mode, use the command end. From EXEC privilege mode, enter the command configure. From every mode except EXEC and EXEC Privilege, enter the command exit. Note: Access all of the following modes from CONFIGURATION mode. IP ACCESS-LIST LINE 38 FTOS Command Modes CLI Command Mode INTERFACE modes www.
PAGE 39
Table 2-1.
PAGE 40
www.dell.com | support.dell.com The do Command Enter an EXEC mode command from any CONFIGURATION mode (CONFIGURATION, INTERFACE, SPANNING TREE, etc.) without returning to EXEC mode by preceding the EXEC mode command with the command do. Figure 2-4 illustrates the do command. Note: The following commands cannot be modified by the do command: enable, disable, exit, and configure. Figure 2-4.
PAGE 41
Obtain Help Obtain a list of keywords and a brief functional description of those keywords at any CLI mode using the ? or help command: • Enter ? at the prompt or after a keyword to list the keywords available in the current mode. • ? after a prompt lists all of the available keywords. The output of this command is the same for the help command. Figure 2-6.
PAGE 42
www.dell.com | support.dell.com • • • Table 2-2. The UP and DOWN arrow keys display previously entered commands (see Command History). The BACKSPACE and DELETE keys erase the previous letter. Key combinations are available to move quickly across the command line, as described in Table 2-2. Short-Cut Keys and their Actions Key Combination Action CNTL-A Moves the cursor to the beginning of the command line. CNTL-B Moves the cursor back one character. CNTL-D Deletes character at cursor.
PAGE 43
Filter show Command Outputs Filter the output of a show command to display specific information by adding | [except | find | grep | no-more | save] specified_text after the command. The variable specified_text is the text for which you are filtering and it IS case sensitive unless the ignore-case sub-option is implemented. Starting with FTOS 7.8.1.0, the grep command accepts an ignore-case sub-option that forces the search to case-insensitive.
PAGE 44
www.dell.com | support.dell.com • find displays the output of the show command beginning from the first occurrence of specified text Figure 2-11 shows this command used in combination with the command show linecard all. Figure 2-11.
PAGE 45
3 Getting Started This chapter contains the following major sections: • • • • • • Default Configuration Configure a Host Name Access the System Remotely Configure the Enable Password Configuration File Management File System Management When you power up the chassis, the system performs a Power-On Self Test (POST) during which Route Processor Module (RPM), Switch Fabric Module (SFM), and line card status LEDs blink green.
PAGE 46
www.dell.com | support.dell.com • Characters within the string can be letters, digits, and hyphens. To configure a host name: Step 1 Task Command Syntax Command Mode Create a new host name. hostname name CONFIGURATION Figure 3-1 illustrates the hostname command. Figure 3-1. Configuring a Hostname Default Hostname FTOS(conf)#hostname R1 R1(conf)# New Hostname Access the System Remotely You can configure the system to access it remotely by Telnet.
PAGE 47
Note: Assign different IP addresses to each RPM’s management port. To configure the management port IP address: Step 1 2 Task Command Syntax Command Mode Enter INTERFACE mode for the Management port. interface ManagementEthernet slot/port CONFIGURATION Assign an IPv4 or IPv6 address to the interface. ip address {ipv4-address | ipv6-address}/mask • • • • • 3 Enable the interface. slot range: 0 to 1 port range: 0 INTERFACE ipv4-address: an address in dotted-decimal format (A.B.C.D).
PAGE 48
www.dell.com | support.dell.com To configure a username and password: Step 1 Task Command Syntax Command Mode Configure a username and password to access the system remotely. username username password [encryption-type] password encryption-type specifies how you are inputting the CONFIGURATION password, is 0 by default, and is not required. • • 0 is for inputting the password in clear text. 7 is for inputting a password that is already encrypted using a Type 7 hash.
PAGE 49
Configure the Enable Password The EXEC Privilege mode is accessed by the enable command. Configure a password as a basic security measure. When using a console connection, EXEC Privilege mode is unrestricted by default; it cannot be reached by a VTY connection if no password is configured. There are two types of enable passwords: • enable password stores the password in the running/startup configuration using a DES encryption method.
PAGE 50
www.dell.com | support.dell.com Copy Files to and from the System The command syntax for copying files is similar to UNIX. The copy command uses the format copy source-file-url destination-file-url. Note: See the FTOS Command Reference for a detailed description of the copy command. • • Table 3-1. To copy a local file to a remote system, combine the file-origin syntax for a local file location with the file-destination syntax for a remote file location shown in Table 3-1.
PAGE 51
The usbflash and rpm0usbflash commands are supported on E-Series ExaScale platform only. Refer to the FTOS Release Notes for a list of approved USB vendors. • Figure 3-3 shows an example of using the copy command to save a file to an FTP server. Figure 3-3. Saving a file to a Remote System Local Location Remote Location FTOS#copy flash://FTOS-EF-8.2.1.0.bin ftp://myusername:mypassword@10.10.10.10//FTOS/FTOS-EF-8.2.1.
PAGE 52
www.dell.com | support.dell.com Task Command Syntax Command Mode Save the running-configuration to: the startup-configuration on the internal flash of the primary RPM copy running-config startup-config the internal flash on an RPM copy running-config rpm{0|1}flash://filename Note: The internal flash memories on the RPMs are synchronized whenever there is a change, but only if the RPMs are running the same version of FTOS.
PAGE 53
To view a list of files on the internal or external Flash: Step 1 Task Command Syntax Command Mode the internal flash of an RPM dir flash: EXEC Privilege the external flash of an RPM dir slot: View a list of files on: The output of the command dir also shows the read/write privileges, size (in bytes), and date of modification for each file, as shown in Figure 3-5. Figure 3-5.
PAGE 54
www.dell.com | support.dell.com Figure 3-6. Track Changes with Configuration Comments FTOS#show running-config Current Configuration ... ! Version 8.2.1.0 ! Last configuration change at Thu Apr 3 23:06:28 2008 by admin ! Startup-config last updated at Thu Apr 3 23:06:55 2008 by admin ! boot system rpm0 primary flash://FTOS-EF-8.2.1.0.bin boot system rpm0 secondary flash://FTOS-EF-7.8.1.0.bin boot system rpm0 default flash://FTOS-EF-7.7.1.1.bin boot system rpm1 primary flash://FTOS-EF-7.8.1.0.
PAGE 55
Figure 3-8. Alternative Storage Location FTOS#cd slot0: FTOS#copy running-config test FTOS#copy run test ! 7419 bytes successfully copied FTOS#dir Directory of slot0: 1 2 3 4 5 6 7 8 9 drwdrwx ----rw---------------- 32768 512 0 7419 0 0 0 0 0 Jan Jul Jan Jul Jan Jan Jan Jan Jan 01 23 01 23 01 01 01 01 01 No File System Specified 1980 2007 1970 2007 1970 1970 1970 1970 1970 00:00:00 00:38:44 00:00:00 20:44:40 00:00:00 00:00:00 00:00:00 00:00:00 00:00:00 . ..
PAGE 56
| Getting Started www.dell.com | support.dell.
PAGE 57
4 System Management System Management is supported on platforms: ces This chapter explains the different protocols or services used to manage the Dell Networking system including: • • • • • • • • Configure Privilege Levels Configure Logging File Transfer Services Terminal Lines Lock CONFIGURATION mode Recovering from a Forgotten Password Recovering from a Forgotten Password on S-Series Recovering from a Failed Start Configure Privilege Levels Privilege levels restrict access to commands based on user or
PAGE 58
www.dell.com | support.dell.com A user can access all commands at his privilege level and below. Remove a command from EXEC mode Remove a command from the list of available commands in EXEC mode for a specific privilege level using the command privilege exec from CONFIGURATION mode. In the command, specify a level greater than the level given to a user or terminal line, followed by the first keyword of each command to be restricted.
PAGE 59
Task Command Syntax Allow access to INTERFACE, LINE, ROUTE-MAP, and/or ROUTER mode. Specify all keywords in the command. privilege configure level level {interface | line | route-map | router} {command-keyword ||...|| command-keyword} Allow access to a CONFIGURATION, INTERFACE, LINE, ROUTE-MAP, and/or ROUTER mode command. privilege {configure |interface | line | route-map | router} level level {command ||...
PAGE 60
www.dell.com | support.dell.com Figure 4-1. 60 Create a Custom Privilege Level FTOS(conf)#do show run priv ! privilege exec level 3 capture privilege exec level 3 configure privilege exec level 4 resequence privilege exec level 3 capture bgp-pdu privilege exec level 3 capture bgp-pdu max-buffer-size privilege configure level 3 line privilege configure level 3 interface FTOS(conf)#do telnet 10.11.80.201 [telnet output omitted] FTOS#show priv Current privilege level is 3.
PAGE 61
Apply a Privilege Level to a Username To set a privilege level for a user: Task Command Syntax Command Mode Configure a privilege level for a user. username username privilege level CONFIGURATION Apply a Privilege Level to a Terminal Line To set a privilege level for a terminal line: Task Command Syntax Command Mode Configure a privilege level for a terminal line.
PAGE 62
www.dell.com | support.dell.com Log Messages in the Logging Buffer All error messages, except those beginning with %BOOTUP (Message 1), are log in the internal buffer.
PAGE 63
Send System Messages to a Syslog Server Send system messages to a syslog server by specifying a server: Task Command Syntax Command Mode Specify the server to which you want to send system messages. You can configure up to eight syslog servers, which may be IPv4 and/or IPv6 addressed. logging {ip-address | ipv6-address | hostname} CONFIGURATION Configure a Unix System as a Syslog Server Configure a UNIX system as a syslog server by adding the following lines to /etc/syslog.
PAGE 64
www.dell.com | support.dell.com Task Command Syntax Command Mode Specify the size of the logging buffer. Note: When you decrease the buffer size, FTOS deletes all messages stored in the buffer. Increasing the buffer size does not affect messages in the buffer. logging buffered size CONFIGURATION Specify the number of messages that FTOS saves to its logging history table.
PAGE 65
Figure 4-2. show logging Command Example FTOS#show logging syslog logging: enabled Console logging: level Debugging Monitor logging: level Debugging Buffer logging: level Debugging, 40 Messages Logged, Size (40960 bytes) Trap logging: level Informational %IRC-6-IRC_COMMUP: Link to peer RPM is up %RAM-6-RAM_TASK: RPM1 is transitioning to Primary RPM.
PAGE 66
www.dell.com | support.dell.com Configure a UNIX Logging Facility Level Facility is a message tag used to describe the application or process that submitted the log message. You can save system log messages with a UNIX system logging facility: Command Syntax Command Mode Purpose logging facility [facility-type] CONFIGURATION Specify one of the following parameters.
PAGE 67
Synchronize Log Messages You can configure a terminal line to hold all logs until all command inputs and outputs are complete so that log printing does not interfere when you are performing management tasks. Log synchronization also filters system messages for a specific line based on severity level and limits number of messages that are printed at once. Step 1 2 Task Command Syntax Command Mode Enter the LINE mode.
PAGE 68
www.dell.com | support.dell.com File Transfer Services You can configure the system to transfer files over the network using File Transfer Protocol (FTP). Configuration Task List for File Transfer Services The following list includes the configuration tasks for file transfer services: • • • Enable FTP server Configure FTP server parameters Configure FTP client parameters Enable FTP server To make the system an FTP server: Task Command Syntax Command Mode Make the system an FTP server.
PAGE 69
Note: You cannot use the change directory (cd) command until ftp-server topdir is configured. Display your FTP configuration using the command show running-config ftp from EXEC Privilege mode, as shown in Figure 4-4. Configure FTP client parameters When the system will be an FTP client, configure FTP client parameters: Task Command Syntax Command Mode Specify a source interface. ip ftp source-interface interface CONFIGURATION Configure a password.
PAGE 70
www.dell.com | support.dell.com Figure 4-5. Applying an Access List to a VTY Line FTOS(config-std-nacl)#show config ! ip access-list standard myvtyacl seq 5 permit host 10.11.0.1 FTOS(config-std-nacl)#line vty 0 FTOS(config-line-vty)#show config line vty 0 access-class myvtyacl FTOS Behavior: Prior to FTOS version 7.4.2.0, in order to deny access on a VTY line, you must apply an ACL and AAA authentication to the line. Then users are denied access only after they enter a username and password.
PAGE 71
Step 3 Task Command Syntax Command Mode If you used the line authentication method in the method list you applied to the terminal line, configure a password for the terminal line. password LINE In Figure 4-6 VTY lines 0-2 use a single authentication method, line. Figure 4-6.
PAGE 72
www.dell.com | support.dell.com Figure 4-7. Configuring EXEC Timeout FTOS(conf)#line con 0 FTOS(config-line-console)#exec-timeout 0 FTOS(config-line-console)#show config line console 0 exec-timeout 0 0 FTOS(config-line-console)# Telnet to Another Network Device To telnet to another device: Task Command Syntax Telnet to the peer RPM. You do not need to configure the management port on the peer RPM to be able to telnet to it. telnet-peer-rpm Telnet to a device with an IPv4 or IPv6 address.
PAGE 73
A two types of locks can be set: auto and manual. • • Set an auto-lock using the command configuration mode exclusive auto from CONFIGURATION mode. When you set an auto-lock, every time a user is in CONFIGURATION mode all other users are denied access. This means that you can exit to EXEC Privilege mode, and re-enter CONFIGURATION mode without having to set the lock again. Set a manual lock using the command configure terminal lock from CONFIGURATION mode.
PAGE 74
www.dell.com | support.dell.com You can then send any user a message using the send command from EXEC Privilege mode. Alternatively you can clear any line using the command clear from EXEC Privilege mode. If you clear a console session, the user is returned to EXEC mode. Recovering from a Forgotten Password If you configure authentication for the console and you exit out of EXEC mode or your console session times out, you are prompted for a password to re-enter.
PAGE 75
Step Task Figure 4-12. Command Syntax Command Mode Rename the startup-config RPM0-CP BOOT_ADMIN # dir flash: Directory of flash: 1 -rwx 11407411 Jun 09 2004 09:38:40 FTOS-EE3-5.3.1.1.bin 2 -rwx 4977 Jun 09 2004 09:38:38 startup-config.bak 7 Reload the system. reload BOOT_ADMIN 8 Copy startup-config.bak to the running config. copy flash://startup-config.bak running-config EXEC Privilege 9 Remove all authentication statements you might have for the console.
PAGE 76
www.dell.com | support.dell.com Step 9 Task Command Syntax Command Mode Save the running-config to the startup-config. The startup-config files on both RPMs will be synchronized. copy running-config startup-config EXEC Privilege Recovering from a Forgotten Password on S-Series If you configure authentication for the console and you exit out of EXEC mode or your console session times out, you are prompted for a password to re-enter.
PAGE 77
Recovering from a Failed Start A system that does not start correctly might be attempting to boot from a corrupted FTOS image or from a incorrect location. To resolve the problem, you can restart the system and interrupt the boot process to point the system to another boot location by using the boot change command, as described below.
PAGE 78
www.dell.com | support.dell.com Very similar to the options of the boot change command, the boot system command is available in CONFIGURATION mode on the C-Series and E-Series to set the boot parameters that, when saved to the startup configuration file, are stored in NVRAM and are then used routinely: Task Command Syntax Command Mode Configure the system to routinely boot from the designated location. After entering rpm0 or rpm1, enter one of the three keywords and then the file-url.
PAGE 79
5 802.1ag 802.1ag is available only on platform: s Ethernet Operations, Administration, and Maintenance (OAM) is a set of tools used to install, monitor, troubleshoot and manage Ethernet infrastructure deployments. Ethernet OAM consists of three main areas: 1. Service Layer OAM: IEEE 802.1ag Connectivity Fault Management (CFM) 2. Link Layer OAM: IEEE 802.3ah OAM 3.
PAGE 80
www.dell.com | support.dell.com There is a need for Layer 2 equivalents to manage and troubleshoot native Layer 2 Ethernet networks. With these tools, you can identify, isolate, and repair faults quickly and easily, which reduces operational cost of running the network. OAM also increases availability and reduces mean time to recovery, which allows for tighter service level agreements, resulting in increased revenue for the service provider.
PAGE 81
These roles define the relationships between all devices so that each device can monitor the layers under its responsibility. Maintenance points drop all lower-level frames and forward all higher-level frames. Figure 5-2.
PAGE 82
www.dell.com | support.dell.com Implementation Information • Since the S-Series has a single MAC address for all physical/LAG interfaces, only one MEP is allowed per MA (per VLAN or per MD level). Configure CFM Configuring CFM is a five-step process: 1. Configure the ecfmacl CAM region using the cam-acl command. See Configuring Ingress Layer 2 ACL Sub-partitions. 2. Enable Ethernet CFM. 3. Create a Maintenance Domain. 4. Create a Maintenance Association. 5. Create Maintenance Points. 6.
PAGE 83
Enable Ethernet CFM Task Command Syntax Command Mode Spawn the CFM process. No CFM configuration is allowed until the CFM process is spawned. ethernet cfm CONFIGURATION Disable Ethernet CFM without stopping the CFM process. disable ETHERNET CFM Create a Maintenance Domain Connectivity Fault Management (CFM) divides a network into hierarchical maintenance domains, as shown in Figure 5-1. Step 1 Task Command Syntax Command Mode Create maintenance domain.
PAGE 84
www.dell.com | support.dell.com Create a Maintenance Association A Maintenance Association MA is a subdivision of an MD that contains all managed entities corresponding to a single end-to-end service, typically a VLAN. An MA is associated with a VLAN ID. Task Command Syntax Command Mode Create maintenance association. service name vlan vlan-id ECFM DOMAIN Create Maintenance Points Domains are comprised of logical entities called Maintenance Points.
PAGE 85
Task Command Syntax Command Mode FTOS#show ethernet cfm maintenance-points local mep ------------------------------------------------------------------------------MPID Domain Name Level Type Port CCM-Status MA Name VLAN Dir ------------------------------------------------------------------------------- MAC 100 cfm0 7 MEP Gi 4/10 Enabled test0 10 DOWN 00:01:e8:59:23:45 200 cfm1 6 MEP Gi 4/10 Enabled test1 20 DOWN 00:01:e8:59:23:45 300 cfm2 5 MEP Gi 4/10 Enabled test2 30 DOWN
PAGE 86
www.dell.com | support.dell.com Task Command Syntax Command Mode FTOS#show ethernet cfm maintenance-points remote detail MAC Address: 00:01:e8:58:68:78 Domain Name: cfm0 MA Name: test0 Level: 7 VLAN: 10 MP ID: 900 Sender Chassis ID: FTOS MEP Interface status: Up MEP Port status: Forwarding Receive RDI: FALSE MP Status: Active Display the MIP Database.
PAGE 87
Continuity Check Messages Continuity Check Messages (CCM) are periodic hellos used to: • • • • discover MEPs and MIPs within a maintenance domain detect loss of connectivity between MEPs detect misconfiguration, such as VLAN ID mismatch between MEPs to detect unauthorized MEPs in a maintenance domain Continuity Check Messages (CCM) are multicast Ethernet frames sent at regular intervals from each MEP.
PAGE 88
www.dell.com | support.dell.com Enable CCM Step 1 Task Command Syntax Command Mode Enable CCM. no ccm disable ECFM DOMAIN Default: Disabled 2 Configure the transmit interval (mandatory). The interval specified applies to all MEPs in the domain. ccm transmit-interval seconds ECFM DOMAIN Default: 10 seconds Enable Cross-checking Task Command Syntax Command Mode Enable cross-checking. mep cross-check enable ETHERNET CFM Default: Disabled Start the cross-check operation for an MEP.
PAGE 89
Figure 5-4. Linktrace Message and Response MPLS Core MEP Lin MIP ktra c e m M essa MIP MIP ge L i n k t ra ce R e s p o n s e Link trace messages carry a unicast target address (the MAC address of an MIP or MEP) inside a multicast frame. The destination group address is based on the MD level of the transmitting MEP (01:80:C2:00:00:3[8 to F]).
PAGE 90
www.dell.com | support.dell.com Task Command Syntax Command Mode FTOS#show ethernet cfm traceroute-cache Traceroute to 00:01:e8:52:4a:f8 on Domain Customer2, Level 7, MA name Test2 with VLAN 2 -----------------------------------------------------------------------------Hops Host IngressMAC Ingr Action Relay Action Next Host -----------------------------------------------------------------------------4 00:00:00:01:e8:53:4a:f8 00:01:e8:52:4a:f8 IngOK Delete all Link Trace Cache entries.
PAGE 91
Three values are given within the trap messages: MD Index, MA Index, and MPID. You can reference these values against the output of show ethernet cfm domain and show ethernet cfm maintenance-points local mep.
PAGE 92
www.dell.com | support.dell.com Task Command Syntax Command Mode Display CFM statistics by port.
PAGE 93
6 802.3ah 802.3ah is available only on platform: s A metropolitan area network (MAN) is a set of LANs, geographically separated but managed by a single entity. If the distance is large—across a city, for example—connectivity between LANs is managed by a service provider. While LANs use Ethernet, service providers networks use an array of protocols (PPP and ATM), and a variety access technologies.
PAGE 94
www.dell.com | support.dell.com • Remote Loopback—directs the remote system to reflects back frames that the local system transmits so that an administrator can isolate a fault. Remote Failure Indication—notifies a peer of a critical link event. • Link Layer OAMPDUs Link Layer OAM is conducted using OAMPDUs, shown in Figure 6-1. OAM is a slow protocol and by requirement may transmit no more than 10 frames per second, transmits to a multicast destination MAC, and uses an Ethernet subtype. Figure 6-1.
PAGE 95
Link Layer OAM Operational Modes When participating in EFM OAM, system may operate in active or passive mode. • • Active mode—Active mode systems initiate discovery. Once the Discovery process completes, they can send any OAMPDU while connected to a peer in Active mode, and a subset of OAMPDUs if the peer is in Passive mode (see Table 6-1). Passive mode—Passive mode systems wait for an active mode system to initiate discovery, and do not send Variable Request or Loopback Control OAMPDUs.
PAGE 96
www.dell.com | support.dell.com Link Layer OAM Events Link Layer OAM defines a set of events that may impact link operation, and monitors the link for those events. If an event occurs, the detecting system notifies its peer. There are two types of events: • • Critical Link Events—There are three critical events; each has an associated flag which can be set in the OAMPDU when the event occurs. Critical link events are communicated to the peer using Remote Failure Indication.
PAGE 97
Configuring Link Layer OAM Configuring Link Layer OAM is a two-step process: 1. Enable Link Layer OAM. 2. Enable any or all of the following: a Link Performance Event Monitoring b Remote Failure Indication c Remote Loopback Related Configuration Tasks • • • Adjust the OAMPDU Transmission Parameters Display Link Layer OAM Configuration and Statistics Manage Link Layer OAM Enable Link Layer OAM Link Layer OAM is disabled by default.
PAGE 98
www.dell.com | support.dell.com Task Command Syntax Command Mode FTOS# show ethernet oam discovery interface Output format: Local client __________ Administrative configurations: Mode:active Unidirection:not supported Link monitor:supported (on) Remote loopback:not supported MIB retrieval:not supported Mtu size:1500 Operational status: Port status:operational Loopback status:no loopback PDU permission:any PDU revision:1 Remote client ___________ MAC address:0030.88fe.
PAGE 99
Adjust the OAMPDU Transmission Parameters Task Command Syntax Command Mode Specify a the maximum or minimum number of OAMPDUs to be sent per second. ethernet oam [max-rate value | min-rate value] INTERFACE Set the transmission mode to active or passive. ethernet oam mode {active | passive} Specify the amount of time that the system waits to receive an OAMPDU from a peer before considering it non-operational.
PAGE 100
www.dell.com | support.dell.com Set Threshold Values The available pre-defined errors fall under two categories: • • Symbol Errors—a symbol is an (electrical or optical) pulse on the physical medium that represents one or more bits. A symbol error occurs when a symbol degrades in transit so that the receiver is not able to decode it. Gigabit and 10-Gigabit Ethernet have and expect symbol rate, also called Baud. Frame Errors—frame errors are frames with a bad CRC.
PAGE 101
Frame Errors per Second Task Specify the high threshold value for frame errors, or disable the high threshold. Command Syntax Command Mode ethernet oam link-monitor frame threshold high INTERFACE {frames | none} Range: 1-65535 Default: None Specify the low threshold for frame errors. ethernet oam link-monitor frame threshold low frames Specify the time period for frame errors per second condition.
PAGE 102
www.dell.com | support.dell.com Task Command Syntax Command Mode Specify the time period for error second per time period condition. ethernet oam link-monitor frame-seconds window milliseconds INTERFACE Range: 100-900, in multiples of 100 Default: 1000 milliseconds Execute an Action upon Exceeding the High Threshold When an error exceeds the low threshold, an event notification is sent to the peer.
PAGE 103
Remote Loopback An active-mode device can place a passive peer into loopback mode by sending a Loopback Control OAMPDU. When in loopback mode: • • the remote peer returns unaltered all non-OAMPDU frames sent by the local peer, and all outbound data frames are discarded. Note: Control traffic egresses from loopback initiator and from interface in loopback mode. You must explicitly disable L2/L3 protocols to stop control traffic.
PAGE 104
www.dell.com | support.dell.com Display Link Layer OAM Configuration and Statistics Task Command Syntax Command Mode Display Link Layer OAM status per interface.
PAGE 105
Task Command Syntax Command Mode FTOS# show ethernet oam statistics interface Counters: _________ Information OAMPDU Tx: 3439489 Information OAMPDU Rx: 9489 Unique Event Notification OAMPDU Tx: 0 Unique Event Notification OAMPDU x: 0 Duplicate Event Notification OAMPDU Tx: 0 Duplicate Event Notification OAMPDU Rx: 0 Loopback Control OAMPDU Tx: 0 Loopback Control OAMPDU Rx: 2 Variable Request OAMPDU Tx: 0 Variable Request OAMPDU Rx: 0 Variable Response OAMPDU Tx: 0 Variab
PAGE 106
www.dell.com | support.dell.com Manage Link Layer OAM Enable MIB Retrieval Support/Function IEEE 802.3ah defines the Link OAM MIB in Sec 30A.20, “OAM entity managed object class”; all of the objects described there are supported. Note that 802.3ah does not include the ability to set/write remote MIB variables. You must enable MIB retrieval support and the MIB retrieval function. Task Command Syntax Command Mode Enable MIB retrieval support and/or the MIB retrieval function.
PAGE 107
7 802.1X 802.1X is supported on platforms: ces This chapter has the following sections: • • • • • • • • • • • • • • Protocol Overview Configuring 802.1X Important Points to Remember Enabling 802.
PAGE 108
www.dell.com | support.dell.com 802.1X employs Extensible Authentication Protocol (EAP)* to transfer a device’s credentials to an authentication server (typically RADIUS) via a mandatory intermediary network access device, in this case, a Dell Networking switch. The network access device mediates all communication between the end-user device and the authentication server so that the network remains secure.
PAGE 109
• The authentication-server selects the authentication method, verifies the information provided by the supplicant, and grants it network access privileges. Ports can be in one of two states: • • Ports are in an unauthorized state by default. In this state, non-802.1X traffic cannot be forwarded in or out of the port. The authenticator changes the port state to authorized if the server can authenticate the supplicant. In this state, network traffic can be forwarded normally.
PAGE 110
www.dell.com | support.dell.com Figure 7-2. 802.1X Authentication Process Supplicant Authenticator EAP over LAN (EAPOL) Authentication Server EAP over RADIUS Request Identity Response Identity Access Request Access Challenge EAP Request EAP Reponse Access Request Access {Accept | Reject} EAP {Sucess | Failure} EAP over RADIUS 802.1X uses RADIUS to shuttle EAP packets between the authenticator and the authentication server, as defined in RFC 3579.
PAGE 111
RADIUS Attributes for 802.1 Support Dell Networking systems includes the following RADIUS attributes in all 802.1X-triggered Access-Request messages: Table 7-1. 802.1X Supported RADIUS Attributes Attribute Name Description 1 User-Name the name of the supplicant to be authenticated. 4 NAS-IP-Address 5 NAS-Port 24 State 30 Called-Station-Id 31 Calling-Station-Id relays the supplicant MAC address to the authentication server. 61 NAS-Port-Type NAS-port physical port type.
PAGE 112
www.dell.com | support.dell.com Important Points to Remember • • • • • FTOS supports 802.1X with EAP-MD5, EAP-OTP, EAP-TLS, EAP-TTLS, PEAPv0, PEAPv1, and MS-CHAPv2 with PEAP. All platforms support only RADIUS as the authentication server. On E-Series ExaScale, if the primary RADIUS server becomes unresponsive, the authenticator begins using a secondary RADIUS server, if configured. 802.1X is not supported on port-channels or port-channel members.
PAGE 113
To enable 802.1X: Step Task Command Syntax Command Mode 1 Enable 802.1X globally. dot1x authentication CONFIGURATION 2 Enter INTERFACE mode on an interface or a range of interfaces. interface [range] INTERFACE 3 Enable 802.1X on an interface or a range of interfaces. dot1x authentication INTERFACE Verify that 802.1X is enabled globally and at interface level using the command show running-config | find dot1x from EXEC Privilege mode, as shown in Figure 7-5. Figure 7-5. Verify 802.
PAGE 114
www.dell.com | support.dell.com Configuring Request Identity Re-transmissions If the authenticator sends a Request Identity frame, but the supplicant does not respond, the authenticator waits 30 seconds and then re-transmits the frame. The amount of time that the authenticator waits before re-transmitting and the maximum number of times that the authenticator re-transmits are configurable.
PAGE 115
Figure 7-7 shows configuration information for a port for which the authenticator re-transmits an EAP Request Identity frame: • • After 90 seconds and a maximum of 10 times for an unresponsive supplicant Re-transmits an EAP Request Identity frame Figure 7-7. Configure a Request Identity Re-transmissions FTOS(conf-if-range-gi-2/1)#dot1x tx-period 90 FTOS(conf-if-range-gi-2/1)#dot1x max-eap-req 10 FTOS(conf-if-range-gi-2/1)#dot1x quiet-period 120 FTOS#show dot1x interface gigabitethernet 2/1 802.
PAGE 116
www.dell.com | support.dell.com To place a port in one of these three states: Step 1 Task Command Syntax Command Mode Place a port in the ForceAuthorized, ForceUnauthorized, or Auto state. dot1x port-control {force-authorized | force-unauthorized | auto} INTERFACE Default: auto Figure 7-8 shows configuration information for a port that has been force-authorized. Figure 7-8.
PAGE 117
To configure a maximum number of re-authentications: Step 1 Task Command Syntax Command Mode Configure the maximum number of times that the supplicant can be reauthenticated. dot1x reauth-max number INTERFACE Figure 7-9. Range: 1-10 Default: 2 Configure a Reauthentiction Period FTOS(conf-if-gi-2/1)#dot1x reauthentication interval 7200 FTOS(conf-if-gi-2/1)#dot1x reauth-max 10 FTOS(conf-if-gi-2/1)#do show dot1x interface gigabitethernet 2/1 802.
PAGE 118
www.dell.com | support.dell.com To terminate the authentication process due to an unresponsive authentication server: Step 1 Task Command Syntax Command Mode Terminate the authentication process due to an unresponsive authentication server. dot1x server-timeout seconds INTERFACE Range: 1-300.
PAGE 119
Dynamic VLAN Assignment with Port Authentication Dynamic VLAN Assignment with Port Authentication is supported on platforms: c s et FTOS supports dynamic VLAN assignment when using 802.1X. During 802.1x authentication, the existing VLAN configuration of a port assigned to a non-default VLAN is overwritten and the port is assigned to a specified VLAN. • • If 802.1x authentication is disabled on the port, the port is re-assigned to the previously-configured VLAN. If 802.
PAGE 120
www.dell.com | support.dell.com Figure 7-11 shows the configuration on a Dell Networking switch that uses dynamic VLAN assignment with 802.1X before you connect the end-user device (black and blue text), and after you connect the device (red text). The blue text corresponds to the numbered steps on page 119. Note that the GigabitEthernet 1/11 port, on which dynamic VLAN assignment with 802.1X is configured, is initially an untagged member of VLAN 300. After a successful 802.
PAGE 121
Guest and Authentication-Fail VLANs Typically, the authenticator (Dell Networking system) denies the supplicant access to the network until the supplicant is authenticated. If the supplicant is authenticated, the authenticator enables the port and places it in either the VLAN for which the port is configured, or the VLAN that the authentication server indicates in the authentication data. Note: Ports cannot be dynamically assigned to the default VLAN.
PAGE 122
www.dell.com | support.dell.com Configure an Authentication-Fail VLAN If the supplicant fails authentication, the authenticator re-attempts to authenticate after a specified amount of time (30 seconds by default, see Configuring a Quiet Period after a Failed Authentication). You can configure the maximum number of times the authenticator re-attempts authentication after a failure (3 by default), after which the port is placed in the Authentication-fail VLAN.
PAGE 123
Multi-Host Authentication Multi-Host Authentication is available on platforms: c et s 802.1x assumes that a single end-user is connected to a single authenticator port, as shown in Figure 7-15; this one-to-one mode of authentication is called Single-host mode. If multiple end-users are connected to the same port, a many-to-one configuration, only the first end-user to respond to the identity request is authenticated.
PAGE 124
www.dell.com | support.dell.com When the host mode is changed on a port that is already authenticated: • • Single-host to Multi-host: all devices attached to the port that were previously blocked may access the network; the supplicant does not re-authenticate. Multi-host to Single-host: the port restarts the authentication process, and the first end-user to respond is authenticated and allowed access. Task Command Syntax Command Mode Configure Multi-host Authentication mode on a port.
PAGE 125
Task Command Syntax Command Mode Configure Single-host Authentication mode on a port. dot1x host-mode single-host INTERFACE FTOS(conf-if-gi-2/1)#dot1x port-control force-authorized FTOS(conf-if-gi-2/1)#do show dot1x interface gigabitethernet 2/1 802.
PAGE 126
www.dell.com | support.dell.com During the authentication process, the Dell Networking system is able to learn the MAC address of the device though the EAPoL frames, and the VLAN assignment from the RADIUS server. With this information it creates an authorized-MAC to VLAN mapping table per port. Then, the system can tag all incoming untagged frames with the appropriate VLAN-ID based on the table entries. Task Command Syntax Command Mode Enable Multi-Supplicant Authentication mode on a port.
PAGE 127
MAC Authentication Bypass MAC Authentication Bypass is supported on platforms: cs MAC Authentication Bypass (MAB) enables you to provide MAC-based security by allowing only known MAC addresses within the network using a RADIUS server. 802.1X-enabled clients can authenticate themselves using the 802.1X protocol. Other devices that do not use 802.1X—like IP phones, printers, and IP fax machines—still need connectivity to the network. The guest VLAN provides one way to access the network.
PAGE 128
www.dell.com | support.dell.com MAB in Single-host and Multi-Host Mode In single-host and multi-host mode, the switch attempts to authenticate a supplicant using 802.1X. If 802.1X times out because the supplicant does not respond to the Request Identity frame and MAB is enabled, the switch attempts to authenticate the first MAC it learns on the port. Subsequently, for single-host mode, traffic from all other MACs is dropped; for multi-host mode, all traffic from all other MACs is accepted.
PAGE 129
Step Task Command Syntax Command Mode 3 (Optional) Use MAB authentication only— do not use 802.1X authentication first. If MAB fails the port or the MAC address is blocked, the port is placed in the guest VLAN (if configured). 802.1x authentication is not even attempted. Re-authentication is performed using 802.1X timers. dot1x auth-type mab-only INTERFACE 4 Display the 802.1X and MAB configuration. show dot1x interface EXEC Privilege FTOS#show dot1x int Gi 2/32 802.
PAGE 130
www.dell.com | support.dell.com Dynamic CoS with 802.1X Dynamic CoS with 802.1X is supported on platforms: cs Class of Service (CoS) is a method of traffic management that groups similar types of traffic so that they are serviced differently. One way of classifying traffic is 802.1p, which uses the 3-bit Priority field in the VLAN tag to mark frames (other classification methods include ToS, ACL, and DSCP).
PAGE 131
FTOS Behavior: The following conditions are applied to the use of dynamic CoS with 802.1X authentication on C-Series and S-Series platforms: • In accordance with port-based QoS, incoming dot1p values can be mapped to only four priority values: 0, 2, 4, and 6. If the RADIUS server returns any other dot1p value (1, 3, 5, or 7), the value is not used and frames are forwarded on egress queue 0 without changing the incoming dot1p value.
PAGE 132
| 802.1X www.dell.com | support.dell.
PAGE 133
8 IP Access Control Lists (ACL), Prefix Lists, and Route-maps IP Access Control Lists, Prefix Lists, and Route-maps are supported on platforms: ces ces Egress IP ACLs are supported on platform: e Ingress IP ACLs are supported on platforms: Overview At their simplest, Access Control Lists (ACLs), Prefix lists, and Route-maps permit or deny traffic based on MAC and/or IP addresses. This chapter discusses implementing IP ACLs, IP Prefix lists and Route-maps.
PAGE 134
www.dell.com | support.dell.com • • • • • • • Assign an IP ACL to an Interface Configure Ingress ACLs Configure Egress ACLs Configure ACLs to Loopback • Applying an ACL on Loopback Interfaces IP Prefix Lists ACL Resequencing Route Maps IP Access Control Lists (ACLs) In the Dell Networking switch/routers, you can create two different types of IP ACLs: standard or extended. A standard ACL filters packets based on the source IP packet.
PAGE 135
User Configurable CAM Allocations are supported on platform CAM optimization is supported on platforms c cs CAM Profiling CAM optimization is supported on platforms et CAM profiling for ACLs is supported on E-Series TeraScale only. For complete information regarding E-Series TeraScale CAM profiles and configuration, refer to Chapter 11, Content Addressable Memory. The default CAM profile has 1K Layer 2 ingress ACL entries.
PAGE 136
www.dell.com | support.dell.com Allocate space for IPV6 ACLs on the C-Series by using the cam-acl command in CONFIGURATION mode. The CAM space is allotted in FP blocks. The total space allocated must equal 13 FP blocks. Note that there are 16 FP blocks, but the System Flow requires 3 blocks that cannot be reallocated.
PAGE 137
Figure 8-1.
PAGE 138
www.dell.com | support.dell.com Standard and Extended ACLs take up the same amount of CAM space. A single ACL rule uses 2 CAM entries whether it is identified as a Standard or Extended ACL. Determine the order in which ACLs are used to classify traffic When you link class-maps to queues using the command service-queue, FTOS matches the class-maps according to queue priority (queue numbers closer to 0 have lower priorities).
PAGE 139
• • • • • • Second and subsequent fragments are allowed because a Layer 4 rule cannot be applied to these fragments. If the packet is to be denied eventually, the first fragment would be denied and hence the packet as a whole cannot be reassembled. Implementing the required rules will use a significant number of CAM entries per TCP/UDP entry. For IP ACL, FTOS always applies implicit deny. You do not have to configure it.
PAGE 140
www.dell.com | support.dell.com In the following, TCP packets that are first fragments or non-fragmented from host 10.1.1.1 with TCP destination port equal to 24 are permitted. Additionally, all TCP non-first fragments from host 10.1.1.1 are permitted. All other IP packets that are non-first fragments are denied. FTOS(conf)#ip access-list extended ABC FTOS(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24 FTOS(conf-ext-nacl)#permit tcp host 10.1.1.
PAGE 141
A standard IP ACL uses the source IP address as its match criterion. Note: On E-Series ExaScale systems, TCP ACL flags are not supported in standard or extended ACLs with IPv6 microcode. An error message is shown if IPv6 microcode is configured and an ACL is entered with a TCP filter included.
PAGE 142
www.dell.com | support.dell.com Figure 8-4. Command example: seq FTOS(config-std-nacl)#seq 25 deny ip host 10.5.0.0 any log FTOS(config-std-nacl)#seq 15 permit tcp 10.3.0.0 /16 any FTOS(config-std-nacl)#show config ! ip access-list standard dilling seq 15 permit tcp 10.3.0.0/16 any seq 25 deny ip host 10.5.0.0 any log FTOS(config-std-nacl)# To delete a filter, use the no seq sequence-number command in the IP ACCESS LIST mode.
PAGE 143
Figure 8-6. Command Example: show ip accounting access-list FTOS#show ip accounting access example interface gig 4/12 Extended IP access list example seq 10 deny tcp any any eq 111 seq 15 deny udp any any eq 111 seq 20 deny udp any any eq 2049 seq 25 deny udp any any eq 31337 seq 30 deny tcp any any range 12345 12346 seq 35 permit udp host 10.21.126.225 10.4.5.0 /28 seq 40 permit udp host 10.21.126.226 10.4.5.0 /28 seq 45 permit udp 10.8.0.0 /16 10.50.188.118 /31 range 1812 1813 seq 50 permit tcp 10.8.0.
PAGE 144
www.dell.com | support.dell.com Step Command Syntax Command Mode Purpose 2 seq sequence-number {deny | permit} {ip-protocol-number | icmp | ip | tcp | udp} {source mask | any | host ip-address} {destination mask | any | host ip-address} [operator port [port]] [count [byte] | log] [order] [monitor] [fragments] CONFIG-EXT-NACL Configure a drop or forward filter. • log and monitor options are supported on E-Series only.
PAGE 145
When you create the filters with a specific sequence number, you can create the filters in any order and the filters are placed in the correct order. Note: When assigning sequence numbers to filters, keep in mind that you might need to insert a new filter. To prevent reconfiguring multiple filters, assign sequence numbers in multiples of five or another number. Figure 8-7 illustrates how the seq command orders the filters according to the sequence number assigned.
PAGE 146
www.dell.com | support.dell.com Figure 8-8 illustrates an extended IP ACL in which the sequence numbers were assigned by the software. The filters were assigned sequence numbers based on the order in which they were configured (for example, the first filter was given the lowest sequence number). The show config command in the IP ACCESS LIST mode displays the two filters with the sequence numbers 5 and 10. Figure 8-8. Extended IP ACL FTOS(config-ext-nacl)#deny tcp host 123.55.34.
PAGE 147
If a rule is simply appended, existing counters are not affected. Table 8-2. L2 and L3 ACL Filtering on Switched Packets L2 ACL Behavior L3 ACL Behavior Decision on Targeted Traffic Deny Deny Denied by L3 ACL Deny Permit Permitted by L3 ACL Permit Deny Denied by L2 ACL Permit Permit Permitted by L2 ACL Note: If an interface is configured as a “vlan-stack access” port, the packets are filtered by an L2 ACL only. The L3 ACL applied to such a port does not affect traffic.
PAGE 148
www.dell.com | support.dell.com To apply an IP ACL (standard or extended) to a physical or port channel interface, use these commands in the following sequence in the INTERFACE mode: Step Command Syntax Command Mode Purpose 1 interface interface slot/port CONFIGURATION Enter the interface number. 2 ip address ip-address INTERFACE Configure an IP address for the interface, placing it in Layer-3 mode.
PAGE 149
Step 3 Task View the number of packets matching the ACL using the show ip accounting access-list from EXEC Privilege mode. Configure Ingress ACLs Ingress ACLs are applied to interfaces and to traffic entering the system.These system-wide ACLs eliminate the need to apply ACLs onto each interface and achieves the same results. By localizing target traffic, it is a simpler implementation. To create an ingress ACLs, use the ip access-group command (Figure 233) in the EXEC Privilege mode.
PAGE 150
www.dell.com | support.dell.com An egress ACL is used when users would like to restrict egress traffic. For example, when a DOS attack traffic is isolated to one particular interface, you can apply an egress ACL to block that particular flow from exiting the box, thereby protecting downstream devices. To create an egress ACLs, use the ip access-group command Figure 8-11 in the EXEC Privilege mode.
PAGE 151
FTOS Behavior: VRRP hellos and IGMP packets are not affected when egress ACL filtering for CPU traffic is enabled. Packets sent by the CPU with the source address as the VRRP virtual IP address have the interface MAC address instead of VRRP virtual MAC address.
PAGE 152
www.dell.com | support.dell.com Step Command Syntax Command Mode Purpose [seq number] permit loopback-logging any any CONFIGURATION If you are applying an extended ACL, and it has a deny ip any any entry, this entry denies internally generated packets as well as packets received from external devices. To prevent internally generated packets from being dropped, make sure that the ACL you intend to apply has the following entry: [seq number] permit loopback-logging any any.
PAGE 153
IP Prefix Lists Prefix Lists are supported on platforms: ces IP prefix lists control routing policy. An IP prefix list is a series of sequential filters that contain a matching criterion (examine IP route prefix) and an action (permit or deny) to process routes. The filters are processed in sequence so that if a route prefix does not match the criterion in the first filter, the second filter (if configured) is applied.
PAGE 154
www.dell.com | support.dell.com The following list includes the configuration tasks for prefix lists: • • Configuring a prefix list Use a prefix list for route redistribution For a complete listing of all commands related to prefix lists, refer to the FTOS Command Line Interface Reference document.
PAGE 155
If you are creating a standard prefix list with only one or two filters, you can let FTOS assign a sequence number based on the order in which the filters are configured. The FTOS assigns filters in multiples of five. To configure a filter without a specified sequence number, use these commands in the following sequence starting in the CONFIGURATION mode: Step 1 2 Command Syntax Command Mode Purpose ip prefix-list prefix-name CONFIGURATION Create a prefix list and assign it a unique name.
PAGE 156
www.dell.com | support.dell.com Figure 8-15. Command example: show ip prefix-list detail FTOS>show ip prefix detail Prefix-list with the last deletion/insertion: filter_ospf ip prefix-list filter_in: count: 3, range entries: 3, sequences: 5 - 10 seq 5 deny 1.102.0.0/16 le 32 (hit count: 0) seq 6 deny 2.1.0.0/16 ge 23 (hit count: 0) seq 10 permit 0.0.0.0/0 le 32 (hit count: 0) ip prefix-list filter_ospf: count: 4, range entries: 1, sequences: 5 - 10 seq 5 deny 100.100.1.0/24 (hit count: 0) seq 6 deny 200.
PAGE 157
Figure 8-17. Command Example: show config in the ROUTER RIP Mode FTOS(conf-router_rip)#show config ! router rip distribute-list prefix juba out network 10.0.0.0 FTOS(conf-router_rip)#router ospf 34 To apply a filter to routes in OSPF, use either of the following commands in the ROUTER OSPF mode: Command Syntax Command Mode Purpose router ospf CONFIGURATION Enter OSPF mode distribute-list prefix-list-name in [interface] CONFIG-ROUTER-OSPF Apply a configured prefix list to incoming routes.
PAGE 158
www.dell.com | support.dell.com IPv4 and IPv6 ACLs and prefixes and MAC ACLs can be resequenced. No CAM writes happen as a result of resequencing, so there is no packet loss; the behavior is like Hot-lock ACLs. Note: ACL Resequencing does not affect the rules or remarks or the order in which they are applied. It merely renumbers them so that new rules can be placed within the list as desired. Table 8-3. ACL Resequencing Example (Insert New Rules) seq 5 permit any host 1.1.1.1 seq 6 permit any host 1.1.
PAGE 159
Figure 8-19. Resequence ACLs FTOS(config-ext-nacl)# show config ! ip access-list extended test remark 4 XYZ remark 5 this remark corresponds to permit any host 1.1.1.1 seq 5 permit ip any host 1.1.1.1 remark 9 ABC remark 10 this remark corresponds to permit ip any host 1.1.1.2 seq 10 permit ip any host 1.1.1.2 seq 15 permit ip any host 1.1.1.3 seq 20 permit ip any host 1.1.1.
PAGE 160
www.dell.com | support.dell.com Figure 8-20. Resequence Remarks FTOS(config-ext-nacl)# show config ! ip access-list extended test remark 4 XYZ remark 5 this remark corresponds to permit any host 1.1.1.1 seq 5 permit ip any host 1.1.1.1 remark 9 ABC remark 10 this remark corresponds to permit ip any host 1.1.1.2 seq 10 permit ip any host 1.1.1.2 seq 15 permit ip any host 1.1.1.3 seq 20 permit ip any host 1.1.1.
PAGE 161
Important Points to Remember • • • For route-maps with more than one match clause: • Two or more match clauses within the same route-map sequence have the same match commands (though the values are different), matching a packet against these clauses is a logical OR operation. • Two or more match clauses within the same route-map sequence have different match commands, matching a packet against these clauses is a logical AND operation.
PAGE 162
www.dell.com | support.dell.com To view the configuration, use the show config command in the ROUTE-MAP mode (Figure 8-21). Figure 8-21. Command Example: show config in the ROUTE-MAP Mode FTOS(config-route-map)#show config ! route-map dilling permit 10 FTOS(config-route-map)# You can create multiple instances of this route map by using the sequence number option to place the route maps in the correct order. FTOS processes the route maps with the lowest sequence number first.
PAGE 163
Figure 8-24. Command Example: show route-map FTOS#show route-map dilling route-map dilling, permit, sequence 10 Match clauses: Set clauses: route-map dilling, permit, sequence 15 Match clauses: interface Loopback 23 Set clauses: tag 3444 FTOS# To delete a route map, use the no route-map map-name command in the CONFIGURATION mode. Configure route map filters Within the ROUTE-MAP mode, there are match and set commands.
PAGE 164
www.dell.com | support.dell.com Also, if there are different instances of the same route-map, then it’s sufficient if a permit match happens in any instance of that route-map.
PAGE 165
Command Syntax Command Mode Purpose match ip address prefix-list-name CONFIG-ROUTE-MAP Match destination routes specified in a prefix list (IPv4). match ipv6 address prefix-list-name CONFIG-ROUTE-MAP Match destination routes specified in a prefix list (IPv6). match ip next-hop {access-list-name | prefix-list prefix-list-name} CONFIG-ROUTE-MAP Match next-hop routes specified in a prefix list (IPv4).
PAGE 166
www.dell.com | support.dell.com Command Syntax Command Mode Purpose set ipv6 next-hop ip-address CONFIG-ROUTE-MAP Assign an IPv6 address as the route’s next hop. set origin {egp | igp | incomplete} CONFIG-ROUTE-MAP Assign an ORIGIN attribute. set tag tag-value CONFIG-ROUTE-MAP Specify a tag for the redistributed routes. set weight value CONFIG-ROUTE-MAP Specify a value as the route’s weight. Use these commands to create route map instances.
PAGE 167
Figure 8-25. Route Redistribution into OSPF router ospf 34 default-information originate metric-type 1 redistribute static metric 20 metric-type 2 tag 0 route-map staticospf ! route-map staticospf permit 10 match interface GigabitEthernet 0/0 match metric 255 set level backbone Configure a route map for route tagging One method for identifying routes from different routing protocols is to assign a tag to routes from that protocol.
PAGE 168
www.dell.com | support.dell.com Figure 8-27.
PAGE 169
9 Bidirectional Forwarding Detection Bidirectional Forwarding Detection is supported only on platforms: BFD is supported on E-Series ExaScale ce ex with FTOS 8.2.1.0 and later. Protocol Overview Bidirectional Forwarding Detection (BFD) is a protocol that is used to rapidly detect communication failures between two adjacent systems. It is a simple and lightweight replacement for existing routing protocol link state detection mechanisms.
PAGE 170
www.dell.com | support.dell.com How BFD Works Two neighboring systems running BFD establish a session using a three-way handshake. After the session has been established, the systems exchange control packets at agreed upon intervals. In addition, systems send a control packet anytime there is a state change or change in a session parameter; these control packets are sent without regard to transmit and receive intervals. Note: FTOS does not support multi-hop BFD sessions.
PAGE 171
Version (4) IHL TOS Total Length Preamble Flags Start Frame Delimiter Frag Offset Destination MAC TTL (255) Source MAC Protocol Ethernet Type (0x8800) Header Checksum Version (1) State Range: 3784 Source Port Options Diag Code Dest IP Addr Padding Checksum UDP Packet Detect Mult My Discriminator Your Discriminator Random number generated by remote system to identify a session Required Min RX Interval Required Min Echo RX Interval Auth Type The minimum interval between Echo pac
PAGE 172
www.dell.com | support.dell.com Table 9-1. BFD Packet Fields Field Description Diagnostic Code The reason that the last session failed. State The current local session state. See BFD sessions. Flag A bit that indicates packet function. If the poll bit is set, the receiving system must respond as soon as possible, without regard to its transmit interval. The responding system clears the poll bit and sets the final bit in its response.
PAGE 173
BFD sessions BFD must be enabled on both sides of a link in order to establish a session. The two participating systems can assume either of two roles: • • Active—The active system initiates the BFD session. Both systems can be active for the same session. Passive—The passive system does not initiate a session. It only responds to a request for session initialization from the active system.
PAGE 174
www.dell.com | support.dell.com handshake. At this point, the discriminator values have been exchanged, and the transmit intervals have been negotiated. 4. The passive system receives the control packet, changes its state to Up. Both systems agree that a session has been established. However, since both members must send a control packet—that requires a response—anytime there is a state change or change in a session parameter, the passive system sends a final response indicating the state change.
PAGE 175
Figure 9-3. BFD State Machine current session state Up, Admin Down, Timer the packet received Down Init Down Admin Down, Timer Down Init Admin Down, Down, Timer Init, Up Up Up, Init Important Points to Remember • • • • • • • • BFD for line card ports is hitless, but is not hitless for VLANs since they are instantiated on the RPM. BFD is supported on C-Series and E-Series only. FTOS supports a maximum of 100 sessions per BFD agent.
PAGE 176
www.dell.com | support.dell.com Configuring BFD for Physical Ports BFD on physical ports is useful when no routing protocol is enabled. Without BFD, if the remote system fails, the local system does not remove the connected route until the first failed attempt to send a packet. When BFD is enabled, the local system removes the route as soon as it stops receiving periodic control packets from the remote system. Configuring BFD for a physical port is a two-step process: 1. Enable BFD globally. 2.
PAGE 177
Figure 9-5. Establishing a BFD Session for Physical Ports R2: ACTIVE Role R1: ACTIVE Role 4/24 2/1 Force10(config)# bfd enable Force10(config)# interface gigabitethernet 2/1 Force10(conf-if-gi-2/1)# ip address 2.2.2.2/24 Force10(conf-if-gi-2/1)# bfd neighbor 2.2.2.1 Force10(config)# bfd enable Force10(config)# interface gigabitethernet 4/24 Force10(conf-if-gi-2/1)# ip address 2.2.2.1/24 Force10(conf-if-gi-2/1)# bfd neighbor 2.2.2.
PAGE 178
www.dell.com | support.dell.com Figure 9-7. View Session Details R1(conf-if-gi-4/24)#do show bfd neighbors detail Session Discriminator: 1 Neighbor Discriminator: 1 Local Addr: 2.2.2.1 Local MAC Addr: 00:01:e8:09:c3:e5 Remote Addr: 2.2.2.
PAGE 179
Figure 9-8. Change Session Parameters for Physical Ports R1(conf-if-gi-4/24)#bfd interval 100 min_rx 100 multiplier 4 role passive R1(conf-if-gi-4/24)#do show bfd neighbors detail Session Discriminator: 1 Neighbor Discriminator: 1 Local Addr: 2.2.2.1 Local MAC Addr: 00:01:e8:09:c3:e5 Remote Addr: 2.2.2.
PAGE 180
www.dell.com | support.dell.com To re-enable BFD on an interface: Step 1 Task Command Syntax Command Mode Enable BFD on an interface. bfd enable INTERFACE Configuring BFD for Static Routes BFD gives systems a link state detection mechanism for static routes. With BFD, systems are notified to remove static routes from the routing table as soon as the link state change occurs, rather than having to wait until packets fail to reach their next hop.
PAGE 181
To establish a BFD session: Step 1 Task Command Syntax Command Mode Establish BFD sessions for all neighbors that are the next hop of a static route. ip route bfd CONFIGURATION Verify that sessions have been created for static routes using the command show bfd neighbors, as shown in Figure 9-10. View detailed session information using the command show bfd neighbors detail, as shown in Figure 9-8. Figure 9-10. View Established Sessions for Static Routes R1(conf)#ip route 2.2.3.0/24 2.2.2.
PAGE 182
www.dell.com | support.dell.com To disable BFD for static routes: Step 1 Task Command Syntax Command Mode Disable BFD for static routes. no ip route bfd CONFIGURATION Configuring BFD for OSPF When using BFD with OSPF, the OSPF protocol registers with the BFD manager on the RPM. BFD sessions are established with all neighboring interfaces participating in OSPF.
PAGE 183
Figure 9-11. Establishing Sessions with OSPF Neighbors Force10(conf-if-gi-2/1)# ip address 2.2.2.2/24 Force10(conf-if-gi-2/1)# no shutdown Force10(conf-if-gi-2/1)# exit Force10(config)# router ospf 1 Force10(config-router_ospf )# network 2.2.2.0/24 area 0 Force10(config-router_ospf )# bfd all-neighbors Force10(conf-if-gi-2/2)# ip address 2.2.3.1/24 Force10(conf-if-gi-2/2)# no shutdown Force10(conf-if-gi-2/2)# exit Force10(config)# router ospf 1 Force10(config-router_ospf )# network 2.2.3.
PAGE 184
www.dell.com | support.dell.com Changing OSPF session parameters BFD sessions are configured with default intervals and a default role. The parameters that can be configured are: Desired TX Interval, Required Min RX Interval, Detection Multiplier, and system role. These parameters are configured for all OSPF sessions or all OSPF sessions on a particular interface; if you change a parameter globally, the change affects all OSPF neighbors sessions.
PAGE 185
Configuring BFD for BGP BFD for BGP is only supported on platforms: ec In a BGP core network, BFD provides rapid detection of communication failures in BGP fast-forwarding paths between internal BGP (iBGP) and external BGP (eBGP) peers for faster network reconvergence. BFD for BGP is supported on 1GE, 10GE, 40GE, port-channel, and VLAN interfaces. BFD for BGP does not support IPv6 and the BGP multihop feature. Prerequisites Before configuring BFD for BGP, you must first perform the following tasks: 1.
PAGE 186
www.dell.com | support.dell.com Note that the sample configuration shows alternative ways to establish a BFD session with a BGP neighbor: • • By establishing BFD sessions with all neighbors discovered by BGP (bfd all-neighbors command) By establishing a BFD session with a specified BGP neighbor (neighbor {ip-address | peer-group-name} bfd command) BFD packets originating from a router are assigned to the highest priority egress queue to minimize transmission delays.
PAGE 187
Step 5 Task Command Syntax Command Mode Configure parameters for a BFD session established with all neighbors discovered by BGP. bfd all-neighbors [interval millisecs min_rx millisecs multiplier value role {active | passive}] CONFIG-ROUTERBGP OR OR Establish a BFD session with a specified BGP neighbor or peer group using the default BFD session parameters.
PAGE 188
www.dell.com | support.dell.com • The neighbor inherits only the global timer values that are configured with the bfd all-neighbors command (interval, min_rx, and multiplier). If you explicitly enable (or disable) a peer group for BFD that has no BFD parameters configured (e.g. advertisement interval) using the neighbor peer-group-name bfd command, the peer group inherits any BFD settings configured with the bfd all-neighbors command.
PAGE 189
The following examples show the BFD for BGP output displayed for these show commands. Figure 9-14. Verify a BFD for BGP Configuration: show running-config bgp Command R2# show running-config bgp ! router bgp 2 neighbor 1.1.1.2 remote-as 1 neighbor 1.1.1.2 no shutdown neighbor 2.2.2.2 remote-as 1 neighbor 2.2.2.2 no shutdown neighbor 3.3.3.2 remote-as 1 neighbor 3.3.3.2 no shutdown bfd all-neighbors Figure 9-15.
PAGE 190
www.dell.com | support.dell.com Figure 9-16. Verify BFD Sessions with BGP Neighbors: show bfd neighbors detail Command R2# show bfd neighbors detail Session Discriminator: 9 Neighbor Discriminator: 10 Local Addr: 1.1.1.3 Local MAC Addr: 00:01:e8:66:da:33 Remote Addr: 1.1.1.
PAGE 191
Figure 9-17. Display BFD Packet Counters: show bfd counters bgp Command R2# show bfd counters bgp Interface TenGigabitEthernet 6/0 Protocol BGP Messages: Registration : 5 De-registration : 4 Init : 0 Up : 6 Down : 0 Admin Down : 2 Interface TenGigabitEthernet 6/1 Protocol BGP Messages: Registration : 5 De-registration : 4 Init : 0 Up : 6 Down : 0 Admin Down : 2 Interface TenGigabitEthernet 6/2 Protocol BGP Messages: Registration : 1 De-registration : 0 Init : 0 Up : 1 Down : 0 Admin Down : 2 Figure 9-18.
PAGE 192
www.dell.com | support.dell.com Figure 9-19. Display Routing Sessions with BGP Neighbors: show ip bgp neighbors Command R2# show ip bgp neighbors 2.2.2.2 BGP neighbor is 2.2.2.2, remote AS 1, external link BGP version 4, remote router ID 12.0.0.
PAGE 193
Configuring BFD for IS-IS BFD for IS-IS is supported on platform: e When using BFD with IS-IS, the IS-IS protocol registers with the BFD manager on the RPM. BFD sessions are then established with all neighboring interfaces participating in IS-IS. If a neighboring interface fails, the BFD agent on the line card notifies the BFD manager, which in turn notifies the IS-IS protocol that a link state change occurred. Configuring BFD for IS-IS is a two-step process: 1. Enable BFD globally.
PAGE 194
www.dell.com | support.dell.com To establish BFD with all IS-IS neighbors out of a single interface: Step 1 Task Command Syntax Command Mode Establish sessions with all IS-IS neighbors out of an interface. isis bfd all-neighbors INTERFACE View the established sessions using the command show bfd neighbors, as shown in Figure 9-21. Figure 9-21.
PAGE 195
Disabling BFD for IS-IS If BFD is disabled globally, all sessions are torn down, and sessions on the remote system are placed in a Down state. If BFD is disabled on an interface, sessions on the interface are torn down, and sessions on the remote system are placed in a Down state (Message 3). Disabling BFD does not trigger a change in BFD clients; a final Admin Down packet is sent before the session is terminated.
PAGE 196
www.dell.com | support.dell.com Figure 9-22. Establish Sessions with VRRP Neighbors VIRTUAL IP Address: 2.2.5.4 R1: BACKUP R2: MASTER 2/3 4/25 Force10(config-if-range-gi-4/25)# ip address 2.2.5.1/24 Force10(config-if-range-gi-4/25)# no shutdown Force10(config-if-range-gi-4/25)# vrrp-group 1 Force10(config-if-range-gi-4/25)# virtual-address 2.2.5.4 Force10(config-if-range-gi-4/25)# vrrp bfd all-neighbors Force10(config-if-range-gi-4/25)# vrrp bfd neighbor 2.2.5.2 Force10(conf-if-gi-2/3)#ip address 2.
PAGE 197
Figure 9-23. View Established Sessions for VRRP Neighbors R1(conf-if-gi-4/25)#vrrp bfd all-neighbors R1(conf-if-gi-4/25)#do show bfd neighbor * Ad Dn C I O R V - Active session role Admin Down CLI ISIS OSPF Static Route (RTM) VRRP LocalAddr * 2.2.5.1 RemoteAddr 2.2.5.2 VRRP BFD Sessions Enabled Interface State Rx-int Tx-int Mult Clients Gi 4/25 Down 1000 1000 3 V Session state information is also shown in the show vrrp command output, as shown in Figure 9-24. Figure 9-24.
PAGE 198
www.dell.com | support.dell.com To change parameters for a particular VRRP session: Step 1 Task Command Syntax Command Mode Change parameters for a particular VRRP session. vrrp bfd neighbor ip-address interval milliseconds min_rx milliseconds multiplier value role [active | passive] INTERFACE View session parameters using the command show bfd neighbors detail, as shown in Figure 9-8. Disabling BFD for VRRP If any or all VRRP sessions are disabled, the sessions are torn down.
PAGE 199
Configuring BFD for VLANs is a two-step process: 1. Enable BFD globally on all participating routers. See Enabling BFD globally. 2. Establish sessions with VLAN neighbors. See page 199. Related configuration tasks • • Change session parameters. See page 200. Disable BFD for VLANs. See page 182. Establishing sessions with VLAN neighbors To establish a session, BFD must be enabled at interface level on both ends of the link, as shown in Figure 9-25. The session parameters do not need to match. Figure 9-25.
PAGE 200
www.dell.com | support.dell.com Figure 9-26. View Established Sessions for VLAN Neighbors R2(conf-if-vl-200)#bfd neighbor 2.2.3.2 R2(conf-if-vl-200)#do show bfd neighbors * Ad Dn C I O R V - Active session role Admin Down CLI ISIS VLAN BFD OSPF Static Route (RTM) VRRP LocalAddr * 2.2.3.2 RemoteAddr 2.2.3.1 Sessions Enabled Interface State Rx-int Tx-int Mult Clients Vl 200 Up 100 100 3 C Changing session parameters BFD sessions are configured with default intervals and a default role.
PAGE 201
Configuring BFD for Port-Channels BFD on port-channels is analogous to BFD on physical ports. If no routing protocol is enabled, and a remote system fails, the local system does not remove the connected route until the first failed attempt to send a packet. If BFD is enabled, the local system removes the route when it stops receiving periodic control packets from the remote system.
PAGE 202
www.dell.com | support.dell.com To establish a session on a port-channel: Step 1 Task Command Syntax Establish a session on a port-channel. bfd neighbor ip-address Command Mode INTERFACE PORT-CHANNEL View the established sessions using the command show bfd neighbors, as shown in Figure 9-21. Figure 9-28. View Established Sessions for VLAN Neighbors R2(conf-if-po-1)#bfd neighbors 2.2.2.
PAGE 203
To disable BFD for a port-channel: Step 1 Task Command Syntax Command Mode Disable BFD for a port-channel. no bfd enable INTERFACE PORT-CHANNEL Configuring Protocol Liveness Protocol Liveness is a feature that notifies the BFD Manager when a client protocol is disabled. When a client is disabled, all BFD sessions for that protocol are torn down. Neighbors on the remote system receive an Admin Down control packet and are placed in the Down state (Message 3).
PAGE 204
www.dell.com | support.dell.com Figure 9-30. 204 debug bfd packet Command Output RX packet dump: 20 c0 03 18 00 00 00 01 86 a0 00 00 00:34:13 : Sent packet for TX packet dump: 20 c0 03 18 00 00 00 01 86 a0 00 00 00:34:14 : Received packet RX packet dump: 20 c0 03 18 00 00 00 01 86 a0 00 00 00:34:14 : Sent packet for TX packet dump: 00 05 00 00 00 04 00 01 86 a0 00 00 session with neighbor 2.2.2.2 on Gi 4/24 00 04 00 00 00 05 00 01 86 a0 00 00 for session with neighbor 2.2.2.
PAGE 205
10 Border Gateway Protocol IPv4 (BGPv4) Border Gateway Protocol IPv4 (BGPv4) version 4 (BGPv4) is supported on platforms: ces Platforms support BGP according to the following table: FTOS version Platform support 8.1.1.0 E-Series ExaScale 7.8.1.0 S-Series 7.7.1.0. C-Series pre-7.7.1.0 E-Series TeraScale ex s c et This chapter is intended to provide a general description of Border Gateway Protocol version 4 (BGPv4) as it is supported in the Dell Networking Force10 Operating System (FTOS).
PAGE 206
www.dell.com | support.dell.
PAGE 207
A stub AS is one that is connected to only one other AS. A transit AS is one that provides connections through itself to separate networks. For example as seen in Figure 10-1, Router 1 can use Router 2 (the transit AS) to connect to Router 4. ISPs are always transit ASs, because they provide connections from one network to another. The ISP is considered to be “selling transit service” to the customer network, so thus the term Transit AS.
PAGE 208
www.dell.com | support.dell.com Figure 10-2. Full Mesh Examples 4 Routers 6 Routers 8 Routers The number of BGP speakers each BGP peer must maintain increases exponentially. Network management quickly becomes impossible. Sessions and Peers When two routers communicate using the BGP protocol, a BGP session is started. The two end-points of that session are Peers. A Peer is also called a Neighbor. Establish a session Information exchange between peers is driven by events and timers.
PAGE 209
In order to make decisions in its operations with other BGP peers, a BGP peer uses a simple finite state machine that consists of six states: Idle, Connect, Active, OpenSent, OpenConfirm, and Established. For each peer-to-peer session, a BGP implementation tracks which of these six states the session is in. The BGP protocol defines the messages that each peer should exchange in order to change the session from one state to another. The first state is the Idle mode.
PAGE 210
Figure 10-3. Route Reflection Example Router A { eBGP Route eBGP Route Router B Router E { www.dell.com | support.dell.com To illustrate how these rules affect routing, see Figure 10-3 and the following steps.Routers B, C, D, E, and G are members of the same AS - AS100. These routers are also in the same Route Reflection Cluster, where Router D is the Route Reflector. Router E and H are client peers of Router D; Routers B and C and nonclient peers of Router D.
PAGE 211
BGP Attributes Routes learned via BGP have associated properties that are used to determine the best route to a destination when multiple paths exist to a particular destination. These properties are referred to as BGP attributes, and an understanding of how BGP attributes influence route selection is required for the design of robust networks.
PAGE 212
www.dell.com | support.dell.com Figure 10-4. BGP Best Path Selection No, or Not Resulting in a Single Route Highest Weight Highest Local Pref Locally Originated Path Shortest AS Path Lowest Origin Code Lowest MED Learned via EBGP Lowest NEXT-HOP Cost Tie Breakers Lowest Cluster ID List from Lowest Router ID from Lowest Neighbor Addr A Single Route is Selected and Installed in the Routing Table Best Path selection details 1. Prefer the path with the largest WEIGHT attribute. 2.
PAGE 213
• AS_CONFED_SEQUENCE has a path length of 1, no matter how many ASs are in the AS_CONFED_SEQUENCE. 5. Prefer the path with the lowest ORIGIN type (IGP is lower than EGP, and EGP is lower than INCOMPLETE). 6. Prefer the path with the lowest Multi-Exit Discriminator (MED) attribute. The following criteria apply: • • • This comparison is only done if the first (neighboring) AS is the same in the two paths; the MEDs are compared only if the first AS in the AS_SEQUENCE is the same for both paths.
PAGE 214
www.dell.com | support.dell.com Weight The Weight attribute is local to the router and is not advertised to neighboring routers. If the router learns about more than one route to the same destination, the route with the highest weight will be preferred. The route with the highest weight is installed in the IP routing table. Local Preference Local Preference (LOCAL_PREF) represents the degree of preference within the entire AS. The higher the number, the greater the preference for the route.
PAGE 215
One AS assigns the MED a value and the other AS uses that value to decide the preferred path. For this example, assume the MED is the only attribute applied. In Figure 10-6, AS100 and AS200 connect in two places. Each connection is a BGP session. AS200 sets the MED for its T1 exit point to 100 and the MED for its OC3 exit point to 50. This sets up a path preference through the OC3 link. The MEDs are advertised to AS100 routers so they know which is the preferred path. An MED is a non-transitive attribute.
PAGE 216
www.dell.com | support.dell.com Generally, an IGP indicator means that the route was derived inside the originating AS. EGP generally means that a route was learned from an external gateway protocol. An INCOMPLETE origin code generally results from aggregation, redistribution or other indirect ways of installing routes into BGP. In FTOS, these origin codes appear as shown in Figure 10-7. The question mark (?) indicates an Origin code of INCOMPLETE. The lower case letter (i) indicates an Origin code of IGP.
PAGE 217
Next Hop The Next Hop is the IP address used to reach the advertising router. For EBGP neighbors, the Next-Hop address is the IP address of the connection between the neighbors. For IBGP, the EBGP Next-Hop address is carried into the local AS. A Next Hop attribute is set when a BGP speaker advertises itself to another BGP speaker outside its local AS. It can also be set when advertising routes within an AS.
PAGE 218
www.dell.com | support.dell.com • • • If the redistribute command does not have any metric configured and BGP Peer out-bound route-map does have metric-type internal configured, BGP advertises the IGP cost as MED. If the redistribute command has metric configured (route-map set metric or redistribute route-type metric) and the BGP Peer out-bound route-map has metric-type internal configured, BGP advertises the metric configured in the redistribute command as MED.
PAGE 219
Where the 2-Byte format is 1-65535, the 4-Byte format is 1-4294967295. Enter AS Numbers using the traditional format. If the ASN is greater than 65535, the dot format is shown when using the show ip bgp commands. For example, an ASN entered as 3183856184 will appear in the show commands as 48581.51768; an ASN of 65123 is shown as 65123. To calculate the comparable dot format for an ASN from a traditional format, use ASN/65536. ASN%65536. Table 10-2.
PAGE 220
www.dell.com | support.dell.com ASDOT representation combines the ASPLAIN and ASDOT+ representations. AS Numbers less than 65536 appear in integer format (asplain); AS Numbers equal to or greater than 65536 appear using the decimal method (asdot+). For example, the AS Number 65526 appears as 65526, and the AS Number 65546 appears as 1.10. Dynamic AS Number Notation application FTOS 8.3.1.0 applies the ASN Notation type change dynamically to the running-config statements.
PAGE 221
Figure 10-10. config Dynamic changes when bgp asnotation command is disabled in the show running AS NOTATION DISABLED FTOS(conf-router_bgp)#no bgp asnotation FTOS(conf-router_bgp)#sho conf ! router bgp 100 bgp four-octet-as-support neighbor 172.30.1.250 local-as 65057 FTOS(conf-router_bgp)#do sho ip bgp BGP table version is 28093, local router ID is 172.30.1.
PAGE 222
www.dell.com | support.dell.com Figure 10-11. Local-AS Scenario Router A AS 100 Router C AS 300 Router B AS 200 Before Migration Router A AS 100 AS 100 Router C AS 300 Router B Local AS 200 After Migration, with Local-AS enabled When you complete your migration, and you have reconfigured your network with the new information you must disable this feature. If the “no prepend” option is used, the local-as will not be prepended to the updates received from the eBGP peer.
PAGE 223
Local-as is prepended before the route-map to give an impression that update passed thru a router in AS 200 before it reached Router B. BGP4 Management Information Base (MIB) The FORCE10-BGP4-V2-MIB enhances FTOS BGP Management Information Base (MIB) support with many new SNMP objects and notifications (traps) defined in the draft-ietf-idr-bgp4-mibv2-05. To see these enhancements, download the MIB from the Dell Networking website, www.force10networks.com.
PAGE 224
www.dell.com | support.dell.com • • • • • • • • • • • The AFI/SAFI is not used as an index to the f10BgpM2PeerCountersEntry table. The BGP peer's AFI/ SAFI (IPv4 Unicast or IPv6 Multicast) is used for various outbound counters. Counters corresponding to IPv4 Multicast cannot be queried.
PAGE 225
BGP Configuration To enable the BGP process and begin exchanging information, you must assign an AS number and use commands in the ROUTER BGP mode to configure a BGP neighbor. Defaults By default, BGP is disabled. By default, FTOS compares the MED attribute on different paths from within the same AS (the bgp always-compare-med command is not enabled). Note: In FTOS, all newly configured neighbors and peer groups are disabled.
PAGE 226
www.dell.com | support.dell.
PAGE 227
Use these commands in the following sequence, starting in the CONFIGURATION mode to establish BGP sessions on the router. Step 1 Command Syntax Command Mode Purpose router bgp as-number CONFIGURATION Assign an AS number and enter the ROUTER BGP mode. AS Number: 0-65535 (2-Byte) or 1-4294967295 (4-Byte) or 0.1-65535.65535 (Dotted format) Only one AS is supported per system If you enter a 4-Byte AS Number, 4-Byte AS Support is enabled automatically.
PAGE 228
www.dell.com | support.dell.com Enter show config in CONFIGURATION ROUTER BGP mode to view the BGP configuration. Use the show ip bgp summary command in EXEC Privilege mode to view the BGP status. Figure 10-12 shows the summary with a 2-Byte AS Number displayed; Figure 10-13 shows the summary with a 4-Byte AS Number displayed. Figure 10-12. Command example: show ip bgp summary (2-Byte AS Number displayed) R2#show ip bgp summary BGP router identifier 192.168.10.
PAGE 229
Figure 10-14 displays two neighbors, one is an external and the second one is an internal BGP neighbor. The first line of the output for each neighbor displays the AS number and states whether the link is an external or internal. The third line of the show ip bgp neighbors output contains the BGP State. If anything other than ESTABLISHED is listed, the neighbor is not exchanging information and routes.
PAGE 230
www.dell.com | support.dell.com Figure 10-15. Command example: show running-config bgp R2#show running-config bgp ! router bgp 65123 bgp router-id 192.168.10.2 network 10.10.21.0/24 network 10.10.32.0/24 network 100.10.92.0/24 network 192.168.10.0/24 bgp four-octet-as-support neighbor 10.10.21.1 remote-as 65123 neighbor 10.10.21.1 filter-list ISP1in neighbor 10.10.21.1 no shutdown neighbor 10.10.32.3 remote-as 65123 neighbor 10.10.32.3 no shutdown neighbor 100.10.92.9 remote-as 65192 neighbor 100.10.92.
PAGE 231
Task Command Syntax Command Mode Enable ASDOT AS Number representation. Figure 10-17 bgp asnotation asdot CONFIG-ROUTER-BGP Enable ASDOT+ AS Number representation.Figure 10-18 bgp asnotation asdot+ CONFIG-ROUTER-BGP Figure 10-16. Command example and output: bgp asnotation asplain FTOS(conf-router_bgp)#bgp asnotation asplain FTOS(conf-router_bgp)#sho conf ! router bgp 100 bgp four-octet-as-support neighbor 172.30.1.250 remote-as 18508 neighbor 172.30.1.250 local-as 65057 neighbor 172.30.1.
PAGE 232
www.dell.com | support.dell.com Configure Peer Groups To configure multiple BGP neighbors at one time, create and populate a BGP peer group. Another advantage of peer groups is that members of a peer groups inherit the configuration properties of the group and share same update policy. A maximum of 256 Peer Groups are allowed on the system. You create a peer group by assigning it a name, then adding members to the peer group. Once a peer group is created, you can configure route policies for it.
PAGE 233
When you add a peer to a peer group, it inherits all the peer group’s configured parameters.
PAGE 234
www.dell.com | support.dell.com Figure 10-20. Command example: show config (peer-group enabled FTOS(conf-router_bgp)#neighbor zanzibar no shutdown FTOS(conf-router_bgp)#show config ! router bgp 45 bgp fast-external-fallover bgp log-neighbor-changes neighbor zanzibar peer-group neighbor zanzibar no shutdown neighbor 10.1.1.1 remote-as 65535 neighbor 10.1.1.1 shutdown neighbor 10.14.8.60 remote-as 18505 neighbor 10.14.8.
PAGE 235
Figure 10-21. Command example: show ip bgp peer-group FTOS>show ip bgp peer-group Peer-group zanzibar, remote AS 65535 BGP version 4 Minimum time between advertisement runs is 5 seconds For address family: IPv4 Unicast BGP neighbor is zanzibar, peer-group internal, Number of peers in this group 26 Peer-group members (* - outbound optimized): 10.68.160.1 10.68.161.1 10.68.162.1 10.68.163.1 10.68.164.1 10.68.165.1 10.68.166.1 10.68.167.1 10.68.168.1 10.68.169.1 10.68.170.1 10.68.171.1 10.68.172.1 10.68.
PAGE 236
www.dell.com | support.dell.com The BGP fast fall-over feature is configured on a per-neighbor or peer-group basis and is disabled by default.
PAGE 237
Figure 10-22. Command example: show ip bgp neighbors FTOS#sh ip bgp neighbors BGP neighbor is 100.100.100.100, remote AS 65517, internal link Member of peer-group test for session parameters BGP version 4, remote router ID 30.30.30.
PAGE 238
www.dell.com | support.dell.com Figure 10-23. Command example: show ip bgp peer-group FTOS#sh ip bgp peer-group Peer-group test Fall-over enabled BGP version 4 Minimum time between advertisement runs is 5 seconds For address family: IPv4 Unicast BGP neighbor is test Number of peers in this group 1 Peer-group members (* - outbound optimized): 100.100.100.100* FTOS# router bgp 65517 neighbor test peer-group Fast Fall-Over neighbor test fall-over neighbor test no shutdown Indicator neighbor 100.100.100.
PAGE 239
Step Command Syntax Command Mode Purpose 3 neighbor peer-group-name no shutdown CONFIG-ROUTERBGP Enable the peer group. 4 neighbor peer-group-name remote-as as-number CONFIG-ROUTERBGP Create and specify a remote peer as a BGP neighbor. Only after the peer group responds to an OPEN message sent on the subnet does its BGP state change to ESTABLISHED. Once the peer group is ESTABLISHED, the peer group is the same as any other peer group.
PAGE 240
www.dell.com | support.dell.com Figure 10-24. Local-as information shown R2(conf-router_bgp)#show conf ! router bgp 65123 bgp router-id 192.168.10.2 network 10.10.21.0/24 network 10.10.32.0/24 network 100.10.92.0/24 network 192.168.10.0/24 bgp four-octet-as-support neighbor 10.10.21.1 remote-as 65123 neighbor 10.10.21.1 filter-list Laura in neighbor 10.10.21.1 no shutdown neighbor 10.10.32.3 remote-as 65123 neighbor 10.10.32.3 no shutdown neighbor 100.10.92.9 remote-as 65192 neighbor 100.10.92.
PAGE 241
Figure 10-25. Allowas-in information shown R2(conf-router_bgp)#show conf ! router bgp 65123 bgp router-id 192.168.10.2 network 10.10.21.0/24 network 10.10.32.0/24 network 100.10.92.0/24 network 192.168.10.0/24 bgp four-octet-as-support neighbor 10.10.21.1 remote-as 65123 neighbor 10.10.21.1 filter-list Laura in neighbor 10.10.21.1 no shutdown neighbor 10.10.32.3 remote-as 65123 neighbor 10.10.32.3 no shutdown neighbor 100.10.92.9 remote-as 65192 neighbor 100.10.92.9 local-as 6500 neighbor 100.10.92.
PAGE 242
www.dell.com | support.dell.com • • • Advertise to all BGP neighbors and peer-groups that the forwarding state of all routes has been saved. This prompts all peers to continue saving the routes they receive from your E-Series and to continue forwarding traffic. Bring the secondary RPM online as the primary and re-open sessions with all peers operating in “no shutdown” mode. Defer best path selection for a certain amount of time.
PAGE 243
Filter on an AS-Path attribute The BGP attribute, AS_PATH, can be used to manipulate routing policies. The AS_PATH attribute contains a sequence of AS numbers representing the route’s path. As the route traverses an Autonomous System, the AS number is prepended to the route. You can manipulate routes based on their AS_PATH to affect interdomain routing. By identifying certain AS numbers in the AS_PATH, you can permit or deny routes based on the number in its AS_PATH.
PAGE 244
www.dell.com | support.dell.com Step Command Syntax Command Mode Purpose 2 {deny | permit} filter CONFIG-AS-PATH Enter the parameter to match BGP AS-PATH for filtering. This is the filter that will be used to match the AS-path. The entries can be any format, letters, numbers, or regular expressions. This command can be entered multiple times if multiple filters are desired. See Table 10-4 for accepted expressions.
PAGE 245
Figure 10-27. Filter with Regular Expression FTOS(config)#router bgp 99 FTOS(conf-router_bgp)#neigh AAA peer-group FTOS(conf-router_bgp)#neigh AAA no shut FTOS(conf-router_bgp)#show conf ! router bgp 99 neighbor AAA peer-group neighbor AAA no shutdown neighbor 10.155.15.2 remote-as 32 neighbor 10.155.15.2 shutdown FTOS(conf-router_bgp)#neigh 10.155.15.
PAGE 246
www.dell.com | support.dell.com Table 10-4. Regular Expressions Regular Expression Definition ( ) (parenthesis) Specifies patterns for multiple use when followed by one of the multiplier metacharacters: asterisk *, plus sign +, or question mark ? [ ] (brackets) Matches any enclosed character; specifies a range of single characters - (hyphen) Used within brackets to specify a range of AS or community numbers. _ (underscore) Matches a ^, a $, a comma, a space, a {, or a }.
PAGE 247
Command Syntax Command Mode Purpose redistribute ospf process-id [match external {1 | 2} | match internal] [metric-type {external | internal}] [route-map map-name] ROUTER BGP or CONF-ROUTER_BGPv6_ AF Include specific OSPF routes in IS-IS. Configure the following parameters: • process-id range: 1 to 65535 • match external range: 1 or 2 • match internal • metric-type: external or internal. • map-name: name of a configured route map.
PAGE 248
www.dell.com | support.dell.com Use these commands in the following sequence, starting in the CONFIGURATION mode to configure an IP community list. Step Command Syntax Command Mode Purpose 1 ip community-list CONFIGURATION Create a Community list and enter the COMMUNITY-LIST mode.
PAGE 249
Figure 10-28.
PAGE 250
www.dell.com | support.dell.com Manipulate the COMMUNITY attribute In addition to permitting or denying routes based on the values of the COMMUNITY attributes, you can manipulate the COMMUNITY attribute value and send the COMMUNITY attribute with the route information. By default, FTOS does not send the COMMUNITY attribute. Use the following command in the CONFIGURATION ROUTER BGP mode to send the COMMUNITY attribute to BGP neighbors.
PAGE 251
Step Command Syntax Command Mode Purpose 3 exit CONFIG-ROUTE-MAP Return to the CONFIGURATION mode. 4 router bgp as-number CONFIGURATION Enter the ROUTER BGP mode. 5 neighbor {ip-address | peer-group-name} route-map map-name {in | out} CONFIG-ROUTER-BGP Apply the route map to the neighbor or peer group’s incoming or outgoing routes. To view the BGP configuration, use the show config command in CONFIGURATION ROUTER BGP mode.
PAGE 252
www.dell.com | support.dell.com Use any or all of the following commands in the CONFIGURATION ROUTER BGP mode to change how the MED attribute is used. Command Syntax Command Mode Purpose bgp always-compare-med CONFIG-ROUTERBGP Enable MED comparison in the paths from neighbors with different ASs. By default, this comparison is not performed.
PAGE 253
Step Command Syntax Command Mode Purpose 4 router bgp as-number CONFIGURATION Enter the ROUTER BGP mode. 5 neighbor {ip-address | peer-group-name} route-map map-name {in | out} CONFIG-ROUTER-BGP Apply the route map to the neighbor or peer group’s incoming or outgoing routes. To view the BGP configuration, use the show config command in the CONFIGURATION ROUTER BGP mode. To view a route map configuration, use the show route-map command in EXEC Privilege mode.
PAGE 254
www.dell.com | support.dell.com You can also use route maps to change this and other BGP attributes. For example, you can include the following command in a route map to specify the next hop address: Command Syntax Command Mode Purpose set weight weight CONFIG-ROUTE-MAP Sets weight for the route. • weight range: 0 to 65535 Enable multipath By default, the software allows one path to a destination. You can enable multipath to allow up to 16 parallel paths to a destination.
PAGE 255
Refer to Chapter 8, IP Access Control Lists (ACL), Prefix Lists, and Route-maps for configuration information on prefix lists, AS-PATH ACLs, and route maps. Note: When you configure a new set of BGP policies, always reset the neighbor or peer group by entering the clear ip bgp command in EXEC Privilege mode. Use these commands in the following sequence, starting in the CONFIGURATION mode to filter routes using prefix lists.
PAGE 256
www.dell.com | support.dell.com Use these commands in the following sequence, starting in the CONFIGURATION mode to filter routes using a route map. Step Command Syntax Command Mode Purpose route-map map-name [permit | deny] [sequence-number] CONFIGURATION Create a route map and assign it a name. 2 {match | set} CONFIG-ROUTE-MAP Create multiple route map filters with a match or set action.
PAGE 257
Step Command Syntax Command Mode Purpose 5 neighbor {ip-address | peer-group-name} filter-list as-path-name {in | out} CONFIG-ROUTER-B GP Filter routes based on the criteria in the configured route map. Configure the following parameters: • ip-address or peer-group-name: enter the neighbor’s IP address or the peer group’s name. • as-path-name: enter the name of a configured AS-PATH ACL. • in: apply the AS-PATH ACL map to inbound routes. • out: apply the AS-PATH ACL to outbound routes.
PAGE 258
www.dell.com | support.dell.com Aggregate routes FTOS provides multiple ways to aggregate routes in the BGP routing table. At least one specific route of the aggregate must be in the routing table for the configured aggregate to become active. Use the following command in the CONFIGURATION ROUTER BGP mode to aggregate routes.
PAGE 259
Use the following commands in the CONFIGURATION ROUTER BGP mode to configure BGP confederations. Command Syntax Command Mode Purpose bgp confederation identifier as-number CONFIG-ROUTERBGP Specifies the confederation ID. AS-number: 0-65535 (2-Byte) or 1-4294967295 (4-Byte) bgp confederation peers as-number [... as-number] CONFIG-ROUTERBGP Specifies which confederation sub-AS are peers. AS-number: 0-65535 (2-Byte) or 1-4294967295 (4-Byte) All Confederation routers must be either 4-Byte or 2-Byte.
PAGE 260
www.dell.com | support.dell.com Figure 10-31.
PAGE 261
To set dampening parameters via a route map, use the following command in CONFIGURATION ROUTE-MAP mode: Command Syntax Command Mode Purpose set dampening half-life reuse CONFIG-ROUTE-MAP Enter the following optional parameters to configure route dampening parameters: • half-life range: 1 to 45. Number of minutes after which the Penalty is decreased. After the router assigns a Penalty of 1024 to a route, the Penalty is decreased by half after the half-life period expires.
PAGE 262
www.dell.com | support.dell.com Use the following command in EXEC Privilege mode to clear information on route dampening and return suppressed routes to active state. Command Syntax Command Mode Purpose clear ip bgp dampening [ip-address mask] EXEC Privilege Clear all information or only information on a specific route. Use the following command in EXEC and EXEC Privilege mode to view statistics on route flapping.
PAGE 263
Change BGP timers Use either or both of the following commands in the CONFIGURATION ROUTER BGP mode to configure BGP timers. Command Syntax Command Mode Purpose neighbors {ip-address | peer-group-name} timers keepalive CONFIG-ROUTERBGP Configure timer values for a BGP neighbor or peer group. • keepalive range: 1 to 65535. Time interval, in seconds, between keepalive messages sent to the neighbor routers. (Default: 60 seconds) • holdtime range: 3 to 65536.
PAGE 264
www.dell.com | support.dell.com Use the clear ip bgp command in EXEC Privilege mode to reset a BGP connection using BGP soft reconfiguration. Command Syntax Command Mode Purpose neighbor {ipv4-address | ipv6-address | peer-group-name} soft-reconfiguration inbound CONFIG-ROUTERBGP Enable inbound soft-reconfiguration for the specified BGP neighbor. BGP stores all updates received by the neighbor but does not reset the peer session.
PAGE 265
Route map continue The BGP route map continue feature (in ROUTE-MAP mode) allows movement from one route-map entry to a specific route-map entry (the sequence number). If the sequence number is not specified, the continue feature moves to the next sequence number (also known as an implied continue). If a match clause exists, the continue feature executes only after a successful match occurs. If there are no successful matches, continue is ignored.
PAGE 266
www.dell.com | support.dell.com MBGP Configuration et c MBGP for IPv4 Multicast is supported on platform c et s MBGP is not supported on the E-Series ExaScale ex platform. MBGP for IPv6 unicast is supported on platforms Multiprotocol BGP (MBGP) is an enhanced BGP that carries IP multicast routes. BGP carries two sets of routes: one set for unicast routing and one set for multicast routing.
PAGE 267
BGP Regular Expression Optimization BGP policies that contain regular expressions to match against as-paths and communities might take a lot of CPU processing time, thus affect BGP routing convergence. Also, show bgp commands that get filtered through regular expressions can to take a lot of CPU cycles, especially when the database is large.
PAGE 268
www.dell.com | support.dell.com Command Syntax Command Mode Purpose debug ip bgp {ip-address | peer-group-name} soft-reconfiguration EXEC Privilege Enable soft-reconfiguration debug. Enable soft-reconfiguration debug. To enhance debugging of soft reconfig, use the following command only when route-refresh is not negotiated to avoid the peer from resending messages: bgp soft-reconfig-backup In-BGP is shown via the show ip protocols command. FTOS displays debug messages on the console.
PAGE 269
Figure 10-34. View the Last Bad PDU from BGP Peers FTOS(conf-router_bgp)#do show ip bgp neighbors 1.1.1.2 BGP neighbor is 1.1.1.2, remote AS 2, external link BGP version 4, remote router ID 2.4.0.
PAGE 270
www.dell.com | support.dell.com The buffer size supports a maximum value between 40 MB (the default) and 100 MB. The capture buffers are cyclic and reaching the limit prompts the system to overwrite the oldest PDUs when new ones are received for a given neighbor or direction. Setting the buffer size to a value lower than the current max, might cause captured PDUs to be freed to set the new limit. Note: Memory on RP1 is not pre-allocated, and is allocated only when a PDU needs to be captured.
PAGE 271
With full internet feed (205K) captured, approximately 11.8MB is required to store all of the PDUs, as shown in Figure 10-36. Figure 10-36. Required Memory for Captured PDUs FTOS(conf-router_bgp)#do show capture bgp-pdu neighbor 172.30.1.250 Incoming packet capture enabled for BGP neighbor 172.30.1.250 Available buffer size 29165743, 192991 packet(s) captured using 11794257 bytes [. . .] FTOS(conf-router_bgp)#do sho ip bg s BGP router identifier 172.30.1.
PAGE 272
www.dell.com | support.dell.com Figure 10-37. Sample Configuration Illustration Physical Links AS 99 Virtual Links GigE 1/21 10.0.1.21 /24 GigE 2/11 10.0.1.22 /24 Peer Group AAA e Pe Loopback ck 1 192.168.128.1 /24 Loopback 1 Lo 192.168.128.2 /24 19 rG u ro p GigE 1/31 10.0.3.31 /24 BB B er Pe GigE 3/11 10.0.3.33 /24 o Gr C CC p u GigE 3/21 10.0.2.3 /24 Loopback 1 192.168.128.3 /24 AS 100 272 | Border Gateway Protocol IPv4 (BGPv4) GigE 2/31 10.0.2.
PAGE 273
Figure 10-38. Enable BGP - Router 1 R1# conf R1(conf)#int loop 0 R1(conf-if-lo-0)#ip address 192.168.128.1/24 R1(conf-if-lo-0)#no shutdown R1(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.1/24 no shutdown R1(conf-if-lo-0)#int gig 1/21 R1(conf-if-gi-1/21)#ip address 10.0.1.21/24 R1(conf-if-gi-1/21)#no shutdown R1(conf-if-gi-1/21)#show config ! interface GigabitEthernet 1/21 ip address 10.0.1.21/24 no shutdown R1(conf-if-gi-1/21)#int gig 1/31 R1(conf-if-gi-1/31)#ip address 10.0.3.
PAGE 274
www.dell.com | support.dell.com Figure 10-39. Enable BGP - Router 2 R2# conf R2(conf)#int loop 0 R2(conf-if-lo-0)#ip address 192.168.128.2/24 R2(conf-if-lo-0)#no shutdown R2(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.2/24 no shutdown R2(conf-if-lo-0)#int gig 2/11 R2(conf-if-gi-2/11)#ip address 10.0.1.22/24 R2(conf-if-gi-2/11)#no shutdown R2(conf-if-gi-2/11)#show config ! interface GigabitEthernet 2/11 ip address 10.0.1.
PAGE 275
Figure 10-40. Enable BGP - Router 3 R3# conf R3(conf)# R3(conf)#int loop 0 R3(conf-if-lo-0)#ip address 192.168.128.3/24 R3(conf-if-lo-0)#no shutdown R3(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.3/24 no shutdown R3(conf-if-lo-0)#int gig 3/11 R3(conf-if-gi-3/11)#ip address 10.0.3.33/24 R3(conf-if-gi-3/11)#no shutdown R3(conf-if-gi-3/11)#show config ! interface GigabitEthernet 3/11 ip address 10.0.3.
PAGE 276
www.dell.com | support.dell.com Figure 10-41. Enable Peer Group - Router 1 R1#conf R1(conf)#router bgp 99 R1(conf-router_bgp)# network 192.168.128.0/24 R1(conf-router_bgp)# neighbor AAA peer-group R1(conf-router_bgp)# neighbor AAA no shutdown R1(conf-router_bgp)# neighbor BBB peer-group R1(conf-router_bgp)# neighbor BBB no shutdown R1(conf-router_bgp)# neighbor 192.168.128.2 peer-group AAA R1(conf-router_bgp)# neighbor 192.168.128.
PAGE 277
Figure 10-42.
PAGE 278
www.dell.com | support.dell.com Figure 10-43. Enable Peer Groups - Router 2 R2#conf R2(conf)#router bgp 99 R2(conf-router_bgp)# neighbor CCC peer-group R2(conf-router_bgp)# neighbor CC no shutdown R2(conf-router_bgp)# neighbor BBB peer-group R2(conf-router_bgp)# neighbor BBB no shutdown R2(conf-router_bgp)# neighbor 192.168.128.1 peer AAA R2(conf-router_bgp)# neighbor 192.168.128.1 no shut R2(conf-router_bgp)# neighbor 192.168.128.3 peer BBB R2(conf-router_bgp)# neighbor 192.168.128.
PAGE 279
Figure 10-44. Enable Peer Group - Router 3 R3#conf R3(conf)#router bgp 100 R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# AAA peer-group AAA no shutdown CCC peer-group CCC no shutdown 192.168.128.2 peer-group BBB 192.168.128.2 no shutdown 192.168.128.1 peer-group BBB 192.168.128.
PAGE 280
www.dell.com | support.dell.com Figure 10-45.
PAGE 281
11 Content Addressable Memory Content Addressable Memory is supported on platforms c et s Note: Different platforms support varying levels of CAM adjustment. Be sure to read this chapter carefully prior to changing any CAM parameters.
PAGE 282
www.dell.com | support.dell.com • • • The ExaScale EH and EJ series line cards are single-CAM line cards that support 10M and 40M CAM for storing the lookup information. The TeraScale EG-series line cards are dual-CAM and use two 18 Megabit CAM modules with a dedicated 512 IPv4 Forwarding Information Base (FIB), and flexible CAM allocations for Layer2, FIB, and ACLs. Either ExaScale 10G or 40G CAM line cards can be used in a system.
PAGE 283
Table 11-1. CAM Profile Descriptions CAM Profile Description Default An all-purpose profile that allocates CAM space according to the way Dell Networking systems are most commonly used. Available Microcodes: default, lag-hash-align, lag-hash-mpls, l2-switched-pbr eg-default For EG-series line cards only. EG series line cards have two CAM modules per Port-pipe.
PAGE 284
L2FIB L2ACL IPv4FIB IPv4ACL IPv4Flow EgL2ACL EgIPv4ACL Reserved IPv6FIB IPv6ACL IPv6Flow EgIPv6ACL CAM entries per partition Default 32K 2K 256K 12K 24K 1K 1K 8K 0 0 0 0 eg-default 32K 2K 512K 12K 24K 1K 1K 8K 32K 3K 4K 1K ipv4-320k 32K 2K 320K 12K 12K 1K 1K 4K 0 0 0 0 pv4-egacl-16k 32K 2K 192K 8K 24K 0 16K 8K 0 0 0 0 ipv6-extacl 32K 2K 192K 12K 8K 1K 1K 2K 6K 3K 4K 2K l2-ipv4-inacl 32K 33K 64K 27K 8K 2K 2K 2K 0 0 0 0
PAGE 285
Table 11-3. Microcode Descriptions Microcode Description lag-hash-mpls For hashing based on MPLS labels (up to five labels deep). With the default microcode, MPLS packets are distributed over a port-channel based on the MAC source and destination address. With the lag-hash-mpls microcode, MPLS packets are distributed across the port-channel based on IP source and destination address and IP protocol. This is applicable for MPLS packets with up to five labels.
PAGE 286
www.dell.com | support.dell.com Table 11-4. Layer 2 ACL CAM Sub-partition Sizes Partition % Allocated QoS 12 L2PT 13 FRRP 5 You can re-configure the amount of space, in percentage, allocated to each sub-partition. As with the IPv4Flow partition, you can configure the Layer 2 ACL partition from EXEC Privilege mode or CONFIGURATION mode.
PAGE 287
Message 2 EH Line Card with EG Chassis Profile Error # Before reload: 01:09:56: %RPM0-P:CP %CHMGR-4-EH_PROFILE_WARN: If EH CAM profile is selected, non-EJ cards will be in problem state after reload # After reload: 00:04:46: %RPM0-P:CP %CHMGR-3-PROFILE_MISMATCH: Mismatch: line card 1 has mismatch CAM profile or microcode Figure 11-1.
PAGE 288
www.dell.com | support.dell.com Important Points to Remember • • • • • • CAM Profiling is available on the E-Series TeraScale with FTOS versions 6.3.1.1 and later. All line cards within a single system must have the same CAM profile; this profile must match the system CAM profile (the profile on the primary RPM). • FTOS automatically reconfigures the CAM profile on line cards and the secondary RPM to match the system CAM profile by saving the correct profile on the card and then rebooting it.
PAGE 289
Step Task Command Syntax Command Mode 3 Verify that the new CAM profile will be written to the CAM on the next boot. show cam-profile summary EXEC Privilege 4 Reload the system. reload EXEC Privilege CAM Allocation User Configurable CAM Allocations is available on platforms: cs Allocate space for IPV4 ACLs and QoS regions, and IPv6 6 ACLs and QoS regions on the C-Series and S-Series by using the cam-acl command in CONFIGURATION mode. The CAM space is allotted in FP blocks.
PAGE 290
www.dell.com | support.dell.com To configure the IPv4 and IPv6 ACLs and Qos regions on the entire system: Step 1 Task Command Syntax Command Mode Select a cam-acl action cam-acl [default | l2acl] CONFIGURATION Note: Selecting default resets the CAM entries to the default settings. Select l2acl to allocate space for the ACLs, and QoS regions. 2 Enter the number of FP blocks for each region.
PAGE 291
View CAM Profiles View the current CAM profile for the chassis and each component using the command show cam-profile, as shown in Figure 11-4. This command also shows the profile that will be loaded upon the next chassis or component reload. Figure 11-4.
PAGE 292
www.dell.com | support.dell.com Figure 11-6.
PAGE 293
Figure 11-7.
PAGE 294
www.dell.com | support.dell.com • The IPv4Flow configuration is applied to entire system when you enter the command cam-ipv4flow from CONFIGURATION mode, however, you must save the running-configuration to affect the change. The amount of space that is allocated among the sub-partitions must be equal to the amount of CAM space allocated to IPv4Flow by the selected CAM profile (see Table 11-1.); Message 3 is displayed if the total allocated space is not correct.
PAGE 295
Figure 11-8. Configure IPv4Flow on the Entire System FTOS(conf)#cam-ipv4flow default FTOS#copy running-config startup-config File with same name already exist.
PAGE 296
www.dell.com | support.dell.com Table 11-6. Layer 2 ACL CAM Sub-partition Sizes (continued) Partition % Allocated L2PT 13 FRRP 5 You can re-configure the amount of space, in percentage, allocated to each sub-partition. • Apply the Ingress Layer 2 ACL configuration to entire system by entering the command cam-l2acl from CONFIGURATION mode, however, you must save the running-configuration to affect the change.
PAGE 297
Figure 11-9.
PAGE 298
www.dell.com | support.dell.com Figure 11-10.
PAGE 299
• If the packet has more than 5 MPLS labels, hashing is based on the source and destination MAC address. To enable this type of hashing, use the default CAM profile with the microcode lag-hash-mpls. LAG Hashing based on Bidirectional Flow To hash LAG packets such that both directions of a bidirectional flow (for example, VoIP or P2P file sharing) are mapped to the same output link in the LAG bundle, use the default CAM profile with the microcode lag-hash-align.
PAGE 300
www.dell.com | support.dell.com QoS CAM Region Limitation The default CAM profile allocates a partition within the IPv4Flow region to store QoS service policies. If the QoS CAM space is exceeded, messages similar to the ones in Message 5 are displayed.
PAGE 301
12 Configuration Replace and Rollback Configuration Replace and Rollback is supported on platforms ce The E-Series ExaScale platform is supported with FTOS 8.1.1.0 and later. Configuration Replace and Rollback enables you to replace the current running-configuration with different configuration without restarting the chassis.
PAGE 302
www.dell.com | support.dell.com Configuring Configuration Replace and Rollback Configuring Configuration Replace and Rollback is a three-step process: 1. Enable the Archive Service. 2. Archive a Configuration File. 3. Replace the Current Running Configuration.
PAGE 303
You do not have to enable the archive service again if you save the running configuration after completing task. If you reload the system or upgrade your FTOS version without saving the running configuration you must enable the archive service again. Archive a Configuration File Archive the current running configuration file using the command archive config from EXEC Privilege mode. Figure 12-2.
PAGE 304
www.dell.com | support.dell.com • • The hostname of the Dell Networking system is changed from “R1” to “FTOS.” The running configuration is replaced with archive_0, in which the hostname is “R1.” Figure 12-3.
PAGE 305
Figure 12-5.
PAGE 306
www.dell.com | support.dell.com Figure 12-8.
PAGE 307
Figure 12-9. Configure an Archive Time-period R1(conf-archive)#time-period 5 R1(conf-archive)#show config ! archive maximum 2 time-period 5 R1(conf-archive)# Copy and Delete an Archive File Copy an archive file to another location using the command archive backup, as shown in Figure 12-10. Delete an archive file using the command archive delete from CONFIG ARCHIVE mode. View and Edit the Contents of an Archive File You cannot view or edit the contents of archived files.
PAGE 308
www.dell.com | support.dell.com Figure 12-10.
PAGE 309
Figure 12-11.
PAGE 310
www.dell.com | support.dell.
PAGE 311
13 Dynamic Host Configuration Protocol Dynamic Host Configuration Protocol is available on platforms: ces This chapter contains the following sections: • • • • • • Protocol Overview Implementation Information Configuration Tasks Configure the System to be a DHCP Server Configure the System to be a Relay Agent Configure Secure DHCP Protocol Overview Dynamic Host Configuration Protocol (DHCP) is an application layer protocol that dynamically assigns IP addresses and other configuration parameters to netwo
PAGE 312
www.dell.com | support.dell.com DHCP Packet Format and Options DHCP uses UDP as its transport protocol. The server listens on port 67 and transmits to port 68; the client listens on port 68 and transmits to port 67. The configuration parameters are carried as options in the DHCP packet in Type, Length, Value (TLV) format; many options are specified in RFC 2132.
PAGE 313
Assign an IP Address using DHCP When a client joins a network: 1. The client initially broadcasts a DHCPDISCOVER message on the subnet to discover available DHCP servers. This message includes the parameters that the client requires and might include suggested values for those parameters. 2. Servers unicast or broadcast a DHCPOFFER message in response to the DHCPDISCOVER that offers to the client values for the requested parameters.
PAGE 314
www.dell.com | support.dell.com Implementation Information • • • The Dell Networking implementation of DHCP is based on RFC 2131 and RFC 3046. DHCP is available on VLANs and Private VLANs. IP Source Address Validation is a sub-feature of DHCP Snooping; FTOS uses ACLs internally to implement this feature and as such, you cannot apply ACLs to an interface which has IP Source Address Validation.
PAGE 315
• • • • Configuration Parameter Storage and Management: DHCP servers also store and maintain other parameters that are sent to clients when requested. These parameters specify in detail how a client is to operate. Lease Management: DHCP servers use leases to allocate addresses to clients for a limited time. The DHCP server maintains information about each of the leases, including lease length.
PAGE 316
www.dell.com | support.dell.com To create an address pool: Step Task Command Syntax Command Mode 1 Access the DHCP server CLI context. ip dhcp server CONFIGURATION 2 Create an address pool and give it a name. pool name DHCP 3 Specify the range of IP addresses from which the DHCP server may assign addresses. • network is the subnet address. • prefix-length specifies the number of bits used for the network portion of the address you specify.
PAGE 317
Enabling DHCP Server DHCP server is disabled by default. Step Task Command Syntax Command Mode 1 Enter the DHCP command-line context. ip dhcp server CONFIGURATION 2 Enable DHCP server. no disable DHCP Default: Disabled 3 Display the current DHCP configuration. show config DHCP In Figure 13-3, an IP phone is powered by PoE and has acquired an IP address from the Dell Networking system, which is advertising LLDP-MED.
PAGE 318
www.dell.com | support.dell.com Address Resolution using NetBIOS WINS Windows Internet Naming Service (WINS) is a name resolution service that Microsoft DHCP clients use to correlate host names to IP addresses within a group of networks. Microsoft DHCP clients can be one of four types of NetBIOS nodes: broadcast, peer-to-peer, mixed, or hybrid.
PAGE 319
To create a manual binding: Step Task Command Syntax Command Mode 1 Create an address pool pool name DHCP 2 Specify the client IP address. host address DHCP 3 Specify the client hardware address or client-identifier. • hardware-address is the client MAC address. type is the protocol of the hardware platform. The default protocol is Ethernet. client-identifier is required for Microsoft clients instead of a hardware addresses.
PAGE 320
www.dell.com | support.dell.com DHCP Clear Commands Task Command Syntax Command Mode Clear DHCP binding entries for the entire binding table. clear ip dhcp binding EXEC Privilege Clear a DHCP binding entry for an individual IP address. clear ip dhcp binding ip address EXEC Privilege Clear a DHCP address conflict. clear ip dhcp conflict EXEC Privilege Clear DHCP server counters.
PAGE 321
Figure 13-4. Configure Dell Networking Systems as a DHCP Relay Device DHCP Server 10.11.2.5 Unicast Source IP : 10.11.1.5 Destination IP: 10.11.0.3 Source Port: 67 Destination Port: 68 Unicast Broadcast Source IP : 10.11.1.5 Destination IP: 255.255.255.255 Source Port: 67 Destination Port: 68 DHCP Server 10.11.1.5 1/4 Broadcast Source IP : 0.0.0.0 Destination IP: 255.255.255.255 Source Port: 68 Destination Port: 67 Relay Agent Address: 0.0.0.0 1/3 Unicast Source IP : 10.11.1.3 Destination IP: 10.11.
PAGE 322
www.dell.com | support.dell.com • • • DHCP Snooping Dynamic ARP Inspection Source Address Validation Option 82 RFC 3046 (Relay Agent Information option, or Option 82) is used for class-based IP address assignment. The code for the Relay Agent Information option is 82, and is comprised of two sub-options, Circuit ID and Remote ID. • • Circuit ID is the interface on which the client-originated message is received. Remote ID identifies the host from which the message is received.
PAGE 323
When DHCP Snooping is enabled, the relay agent builds a binding table—using DHCPACK messages— containing the client MAC address, IP addresses, IP address lease time, port, VLAN ID, and binding type. Every time the relay agent receives a DHCPACK on an trusted port, it adds an entry to the table.
PAGE 324
www.dell.com | support.dell.com Add a static entry in the binding table Task Command Syntax Command Mode Add a static entry in the binding table. ip dhcp snooping binding mac EXEC Privilege Clear the binding table Task Command Syntax Command Mode Delete all of the entries in the binding table clear ip dhcp snooping binding EXEC Privilege Display the contents of the binding table Task Command Syntax Command Mode Display the contents of the binding table.
PAGE 325
Drop DHCP packets on snooped VLANs only Binding table entries are deleted when a lease expires, or the relay agent encounters a DHCPRELEASE. Starting with FTOS Release 8.2.1.1, line cards maintain a list of snooped VLANs. When the binding table fills, DHCP packets are dropped only on snooped-VLANs, while such packets will be forwarded across non-snooped VLANs. Since DHCP packets are dropped, no new IP address assignments are made.
PAGE 326
www.dell.com | support.dell.com packets to it. Likewise, the attacker sends the gateway an ARP message containing the attacker’s MAC address and the client’s IP address. The gateway then thinks that the attacker is the client, and forwards all packets addressed to the client to it. As a result, the attacker is able to sniff all packets to and from the client.
PAGE 327
View the number of entries in the ARP database with the show arp inspection database command. Figure 13-8. Command example: show arp inspection database FTOS#show arp inspection database Protocol Address Age(min) Hardware Address Interface VLAN CPU ---------------------------------------------------------------------------Internet 10.1.1.251 00:00:4d:57:f2:50 Gi 0/2 Vl 10 CP Internet 10.1.1.252 00:00:4d:57:e6:f6 Gi 0/1 Vl 10 CP Internet 10.1.1.253 00:00:4d:57:f8:e8 Gi 0/3 Vl 10 CP Internet 10.1.1.
PAGE 328
www.dell.com | support.dell.com • • DHCP MAC Source Address Validation verifies a DHCP packet’s source hardware address matches the client hardware address field (CHADDR) in the payload. IP+MAC Source Address Validation verifies that the IP source address and MAC source address are a legitimate pair. IP Source Address Validation IP Source Address Validation (SAV) prevents IP spoofing by forwarding only IP packets that have been validated against the DHCP binding table.
PAGE 329
IP Source Address Validation validates the IP source address of an incoming packet against the DHCP Snooping binding table. IP+MAC Source Address Validation ensures that the IP source address and MAC source address are a legitimate pair, rather validating each attribute individually. IP+MAC Source Address Validation cannot be configured with IP Source Address Validation. Step Task Command Syntax Command Mode 1 Allocate at least one FP block to the ipmacacl CAM region.
PAGE 330
www.dell.com | support.dell.
PAGE 331
14 Equal Cost Multi-Path This chapter describes how to configure: • • ECMP for Flow-based Affinity (E-Series), including the configurable hash algorithm Configurable ECMP Hash Algorithm (C- and S-Series) ECMP for Flow-based Affinity (E-Series) ECMP for Flow-based Affinity (E-Series) is available on platform: e The hashing algorithm on E-Series TeraScale and E-Series ExaScale are different: • • On ExaScale, the hashing algorithm is based on CRC, checksum, or XOR.
PAGE 332
www.dell.com | support.dell.com FTOS Behavior: In FTOS versions prior to 8.2.1.2, the ExaScale default hash-algorithm is 0. Beginning with version 8.2.1.2, the default hash-algorithm is 24. For information on the load-balancing criteria used by the hash algorithm to distribute traffic among ECMP paths and LAG members on an E-Series system, see E-Series load-balancing. Deterministic ECMP Next Hop Deterministic ECMP Next Hop arranges all ECMPs in order before writing them into the CAM.
PAGE 333
Task Specify the hash algorithm seed. Command Syntax Command Mode hash-algorithm seed value [linecard number] CONFIGURATION [port-set number] Range: 0 - 4095 In Figure 14-1, Core Router 1 is an E-Series TeraScale and Core Router 2 is an E-Series ExaScale. They have similar configurations and have routes for prefix P with two possible next-hops.
PAGE 334
www.dell.com | support.dell.com Configurable ECMP Hash Algorithm (C- and S-Series) Configurable ECMP Hash Algorithm (C- and S-Series) is available on platforms: cs On C-Series and S-Series, the hash-algorithm command is specific to ECMP groups and has a different default from the E-Series (see Configurable Hash Algorithm (E-Series)). The default ECMP hash configuration is crc-lower, which takes the lower 32 bits of the hash key to compute the egress port.
PAGE 335
15 Force10 Resilient Ring Protocol Force10 Resilient Ring Protocol is supported on platforms ce s The E-Series ExaScale platform is supported with FTOS 8.1.1.0 and later. Force10 Resilient Ring Protocol (FRRP) provides fast network convergence to Layer 2 switches interconnected in a ring topology, such as a Metropolitan Area Network (MAN) or large campuses.
PAGE 336
www.dell.com | support.dell.com Each Transit node is also configured with a Primary port and a Secondary port on the ring, but the port distinction is ignored as long as the node is configured as a Transit node. If the ring is complete, the Master node logically blocks all data traffic in the transmit and receive directions on the Secondary port to prevent a loop.
PAGE 337
If the Master node does not receive the Ring Health Frame (RHF) before the fail-period timer expires (a configurable timer), the Master node moves from the Normal state to the Ring-Fault state and unblocks its Secondary port. The Master node also clears its forwarding table and sends a control frame to all other nodes, instructing them to also clear their forwarding tables. Immediately after clearing its forwarding table, each node starts learning the new topology.
PAGE 338
www.dell.com | support.dell.com In the example shown in Figure 15-2, FRRP 101 is a ring with its own Control VLAN, and FRRP 202 has its own Control VLAN running on another ring. A Member VLAN that spans both rings is added as a Member VLAN to both FRRP groups. Switch R3 has two instances of FRRP running on it: one for each ring. The example topology that follows shows R3 assuming the role of a Transit node for both FRRP 101 and FRRP 202. Figure 15-2.
PAGE 339
• • • • • • • • • • Ring Status Check Frames are transmitted by the Master Node at specified intervals. Multiple physical rings can be run on the same switch. One Master node is supported per ring. All other nodes are Transit nodes. Each node has 2 member interfaces: Primary and Secondary. There is no limit to the number of nodes on a ring. The Master node ring port states are: blocking, pre-forwarding, forwarding, and disabled.
PAGE 340
www.dell.com | support.dell.com Table 15-1. FRRP Components Concept Explanation Ring Interface State Each interface (port) that is part of the ring maintains one of four states • • • • Blocking State: Accepts ring protocol packets but blocks data packets. LLDP, FEFD, or other Layer 2 control packets are accepted. Only the master node Secondary port can enter this state. Pre-Forwarding State: A transition state before moving to the Forward state.
PAGE 341
• • • The Control VLAN is used to carry any data traffic; it carries only RHFs. The Control VLAN cannot have members that are not ring ports. If multiple rings share one or more member VLANs, they cannot share any links between them. • Member VLANs across multiple rings are not supported in Master nodes. • Each ring has only one Master node; all others are transit nodes. FRRP Configuration These are the tasks to configure FRRP.
PAGE 342
www.dell.com | support.dell.com 342 • • • • • • • All VLANS must be in Layer 2 mode. Only ring nodes can be added to the VLAN. A Control VLAN can belong to one FRRP group only. Control VLAN ports must be tagged. All ports on the ring must use the same VLAN ID for the Control VLAN. A VLAN cannot be configured as both a Control VLAN and Member VLAN on the same ring. Only two interfaces can be members of a Control VLAN (the Master Primary and Secondary ports).
PAGE 343
Step Command Syntax Command Mode Purpose 5 member-vlan vlan-id {range} CONFIG-FRRP Identify the Member VLANs for this FRRP group VLAN-ID, Range: VLAN IDs for the ring’s Member VLANS. 6 no disable CONFIG-FRRP Enable FRRP Configuring and add the Member VLANs Control and Member VLANS are configured normally for Layer 2. Their status as Control or Member is determined at the FRRP group commands. For complete information about configuring VLANS in Layer 2 mode, see Chapter 25, Layer 2.
PAGE 344
www.dell.com | support.dell.com Step Command Syntax Command Mode Purpose 3 interface primary int slot/port secondary int slot/port control-vlan vlan id CONFIG-FRRP Assign the Primary and Secondary ports, and the Control VLAN for the ports on the ring. Interface: • For a 10/100/1000 Ethernet interface, enter the keyword keyword GigabitEthernet followed by the slot/port information.
PAGE 345
Command Syntax Command Mode Purpose clear frrp EXEC PRIVELEGED Clear the counters associated with all FRRP groups Show FRRP configuration Use the following command to view the configuration for the FRRP group. Command Syntax Command Mode Purpose show configuration CONFIG-FRRP Show the configuration for this FRRP group Show FRRP information Use one of the following commands show general FRRP information.
PAGE 346
www.dell.com | support.dell.com Figure 15-3 is an example of a basic FRRP topology. Below the figure are the associated CLI commands. Figure 15-3.
PAGE 347
16 Force10 Service Agent Force10 Service Agent is supported on platforms: ce FTSA is supported on the E-Series ExaScale platform with FTOS 8.2.1.0 and later. Accurate and timely resolution of problems in your system or network requires gathering relevant data at the time a condition manifests, and getting that information to administrators as soon as possible.
PAGE 348
www.dell.com | support.dell.com Configure Force10 Service Agent The minimal FTSA configuration is four steps: 1. Enable Force10 Service Agent. 2. Specify an SMTP Server for FTSA. 3. Providing an Administrator E-mail Address. 4. Enable the FTSA Messaging Service or: • • Configure a non-default recipient. See Add Additional Recipients of FTSA E-mails. Enable the FTSA Messaging Service.
PAGE 349
Figure 16-1. Display the Default FTSA Configuration FTOS(conf-callhome)#show config ! call-home no enable-all server Force10 recipient ftsa@force10networks.com keyadd Force10DefaultPublicKey encrypt no enable Specify an SMTP Server for FTSA To specify the SMTP server that will receive and forward the E-mail messages generated by FTSA: Task Command Syntax Command Mode Specify an SMTP server in the form smtp.domain-name.com.
PAGE 350
www.dell.com | support.dell.com FTSA Messaging Service The purpose of FTSA is to automatically send information about the switch to the network administrators or Dell Networking TAC, so that when there is a network problem, the relevant information is collected at the time the problem manifests.
PAGE 351
You must still explicitly enable messaging for each recipient, including the default recipient. Each recipient has a (user-configurable) mnemonic label. FTOS creates a CLI context based on this label from which you can enable messaging and modify the E-mail parameters for the recipient. You can enter the context for a recipient by entering the command server label from the CALLHOME context. For example, the default label is Force10.
PAGE 352
www.dell.com | support.dell.com To add a recipient, you first create a mnemonic label for it. FTOS uses this label to create an FTOS context in which you can configure the E-mail parameters for the recipient. For example, the default recipient is Dell Networking TAC and the label for this recipient is Force10. FTOS creates the context conf-callhome-Force10 in which you can configure the parameters for E-mails destined for Dell Networking TAC only, as shown in Figure 16-2. Figure 16-2.
PAGE 353
Per-recipient, you have a choice of sending FTSA E-mails in clear text or with PGP5 encryption. Messages to the default recipient are configured for encryption using a public encryption key, as shown in Figure 16-2. Step Task Command Command Mode 1 Copy the encryption key file to the internal flash. The key Force10DefaultPublicKey for the default recipient is packed with FTOS, so enable encryption for it, proceed to Step 3.
PAGE 354
www.dell.com | support.dell.com Set the Frequency of FTSA Type 3 Messages When messaging is enabled, FTSA sends an E-mail every 24 hours containing inventory information to all recipients. There is no facility for setting the frequency for individual recipients. Task Command Command Mode Set the frequency at which FTSA generates inventory E-mails.
PAGE 355
Task Command Command Mode All E-mails are generated in XML format by default. For Type 5 messages only, you may generate E-mails in clear text format. The configuration is per action list. message-format {xml | text} CALLHOME ACTIONLIST FTOS Behavior: FTOS versions prior to 8.2.1.0 diverted Type 5 messages to the internal flash root directory when you enter the command log-only. Beginning in version 8.2.1.0, FTOS stores these messages in /CALL-HOME-LOGs on the internal flash.
PAGE 356
www.dell.com | support.dell.com Figure 16-5. FTSA Type 2 Message Type - 2 00:25:36.893 UTC Thu Feb 19 2009 0036232 Force10 0 FTSA periodically generates Type 3 messages, which contain the output of the command show inventory. Figure 16-6.
PAGE 357
Figure 16-7. FTSA Type 4 Messages ---------------------------------Message Body----------------------------------------- Type - 4 01:57:46.453 UTC Fri Feb 20 2009 0036232 Force10 0 ---------------------------------Message Attachment-----------------------------------Chassis Type : E300 Chassis Mode : TeraScale Software Version : 7.8.1.
PAGE 358
www.dell.com | support.dell.com 2. Create the list of actions that FTSA should take if any of the conditions exist. See Create a Policy Action List. 3. Create a policy and assign a test list and action list. See Creating a Policy and Assign a Test and Action List. 4. Set optional policy parameters. See Additional Policy Configurations Figure 16-8.
PAGE 359
Table 16-1.
PAGE 360
www.dell.com | support.dell.com Table 16-2. Custom Policy Test Conditions Condition Keyword Description OID Memory Usage memory-free Per-CPU free memory in Megabytes. chSysProcessorMemSize * (1 chRpmMemUsageUtil) memory-free-percent Per-CPU total free memory in percent. 1 - chRpmMemUsageUtil memory-used Per-CPU total memory usage in Megabytes. chSysProcessorMemSize * chRpmMemUsageUtil memory-used-percent Per-CPU total memory usage in percent.
PAGE 361
• • • • increase—If the difference between successive samples, calculated by subtracting the first value from the last, is greater than or equal to the previously sampled value, then the action list is executed. less-than—If the value of the probed system variable is less than the specified value, then the action list is executed. not-equal-to—If the value of the probed system variable is not the same as the specified value, then the action list is executed.
PAGE 362
www.dell.com | support.dell.com 362 Add actions to a policy action list Once you create a policy action list, FTOS enters the CALLHOME ACTIONLIST context. The list you created is initially empty. You may choose one of three pre-defined action lists and add an unlimited number of custom actions. Table 16-3.
PAGE 363
To add a pre-defined list of actions to your policy action list: Task Command Command Mode Add a pre-defined list of actions to your policy action list. default-action [exception | hardware | software] CALLHOME ACTIONLIST You may add an unlimited number of three types of custom actions: Task Command Command Mode Execute a recovery action when FTSA reaches the test-limit. You may reload the chassis or reset an RPM or linecard.
PAGE 364
www.dell.com | support.dell.com Additional Policy Configurations Task Command Command Mode Associate a Dell Networking TAC case number with the policy. Configure a case number only if you already have a case open with Dell Networking for the policy. This case number is included in action-list messages sent to Dell Networking. case-number number CALLHOME POLICY Delay the subsequent execution of the test list after a match occurs.
PAGE 365
Figure 16-9. Configure an FTSA Policy for a Linecard Down call-home admin-email pubsadmin@training10.com smtp server-address 192.168.1.1 no enable-all server Force10 recipient pubslab@training10.
PAGE 366
www.dell.com | support.dell.com Figure 16-11. FTSA Type 5 Message for a Linecard Down Policy ---------------------------------Message Body----------------------------------------- Type - 5 23:19:37.
PAGE 367
Figure 16-12. FTSA Type 5 Message for a Linecard Down Policy (continued) show logging driverlog linecard 1 23:19:46.191 UTC Wed Feb 25 2009 show logging driverlog linecard 1 [output omitted] show logging driverlog linecard 4 23:19:46.
PAGE 368
www.dell.com | support.dell.com Figure 16-13. 368 FTSA Type 5 Message for a Linecard Down Policy (continued) remote-exec cp dhsTestCp 23:19:54.597 UTC Wed Feb 25 2009 remote-exec cp dhsTestCp [output omitted] remote-exec cp dhsTestCp 23:20:00.
PAGE 369
Figure 16-14. FTSA Type 5 Message for a BGP Peer Down Policy ---------------------------------Message Body----------------------------------------- Type - 5 17:14:28.
PAGE 370
www.dell.com | support.dell.com Figure 16-15. Configure an FTSA Policy for an Excessive CRC-error Condition call-home admin-email pubsadmin@training10.com smtp server-address 192.168.1.1 no enable-all server Force10 recipient pubslab@training10.
PAGE 371
Figure 16-17. FTSA Type 5 Message for an Excessive CRC-error Condition ---------------------------------Message Body----------------------------------------- Type - 5 21:10:04.
PAGE 372
www.dell.com | support.dell.com Figure 16-18. 372 Call-home Debug All during Type 5 Message Generation #02:13:49 : CALL-HOME: Sending the following email 02:13:49 : From: pubsadmin@training10.com To: pubslab@training10.com Subject: Type - 5 Attachment: ramdisk:/crcerror-21_10_04.685.txt 02:13:49 : Message: Type - 5 21:10:04.
PAGE 373
17 GARP VLAN Registration Protocol GARP VLAN Registration Protocol is supported on platform ces GVRP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Typical VLAN implementation involves manually configuring each Layer 2 switch that participates in a given VLAN. GARP VLAN Registration Protocol (GVRP), defined by the IEEE 802.1q specification, is a Layer 2 network protocol that provides for automatic VLAN configuration of switches.
PAGE 374
www.dell.com | support.dell.com Figure 17-1. GVRP Compatibility Error Message FTOS(conf)#protocol spanning-tree pvst FTOS(conf-pvst)#no disable % Error: GVRP running. Cannot enable PVST. ......... FTOS(conf)#protocol spanning-tree mstp FTOS(conf-mstp)#no disable % Error: GVRP running. Cannot enable MSTP. ......... FTOS(conf)#protocol gvrp FTOS(conf-gvrp)#no disable % Error: PVST running. Cannot enable GVRP. % Error: MSTP running. Cannot enable GVRP.
PAGE 375
Figure 17-2. GVRP Configuration Overview GVRP is configured globally and on all VLAN trunk ports for the edge and core switches. Edge Switches Edge Switches Core Switches VLANs 70-80 VLANs 10-20 VLANs 10-20 VLANs 30-50 VLANs 70-80 VLANs 30-50 NOTES: VLAN 1 mode is always fixed and cannot be configured All VLAN trunk ports must be configured for GVRP All VLAN trunk ports must be configured as 802.1Q Basic GVRP configuration is a 2-step process: 1. Enable GVRP globally. See page 376. 2.
PAGE 376
www.dell.com | support.dell.com Figure 17-3. Enabling GVRP Globally FTOS(conf)#protocol gvrp FTOS(config-gvrp)#no disable FTOS(config-gvrp)#show config ! protocol gvrp no disable FTOS(config-gvrp)# Enabling GVRP on a Layer 2 Interface Enable GVRP on a Layer 2 interface using the command gvrp enable in INTERFACE mode, as shown in Figure 17-4.
PAGE 377
Based on the configuration in the example shown in Figure 17-5, the interface 1/21 will not be removed from VLAN 34 or VLAN 35 despite receiving a GVRP Leave message. Additionally, the interface will not be dynamically added to VLAN 45 or VLAN 46, even if a GVRP Join message is received. Figure 17-5.
PAGE 378
www.dell.com | support.dell.com 378 FTOS displays Message 1 if an attempt is made to configure an invalid GARP timer. Message 1 GARP Timer Error FTOS(conf)#garp timers join 300 % Error: Leave timer should be >= 3*Join timer.
PAGE 379
18 High Availability High Availability is supported on platforms: ces High availability is a collection of features that preserves system continuity by maximizing uptime and minimizing packet loss during system disruptions. To support all the features within the HA collection, you should have the latest boot code. The following table lists the boot code requirements as of this FTOS release. Component Boot Code E-Series TeraScale RPM 2.4.2.1 E-Series TeraScale Line Card 2.3.2.
PAGE 380
www.dell.com | support.dell.com Component Redundancy Dell Networking systems eliminates single points of failure by providing dedicated or load-balanced redundancy for each component. RPM Redundancy The current version of FTOS supports 1+1 hitless Route Processor Module (RPM) redundancy. The primary RPM performs all routing, switching, and control operations while the standby RPM monitors the primary RPM.
PAGE 381
Boot the chassis with dual RPMs When you boot the system with two RPMs installed, the RPM in slot R0 is the primary RPM by default. Both RPMs should be running the same version of FTOS. You can configure either RPM to be the primary upon the next chassis reboot using the command redundancy primary from CONFIGURATION mode. Version compatibility between RPMs In general, the two RPMs should have the same FTOS version.
PAGE 382
www.dell.com | support.dell.com Automatic and manual RPM failover RPM failover is the process of the standby RPM becoming the primary RPM. FTOS fails over to the standby RPM when: 1. communication is lost between the standby and primary RPMs 2. you request a failover via the CLI 3. you remove the primary RPM Use the command show redundancy from EXEC Privilege mode to display the reason for the last failover. Figure 18-1.
PAGE 383
Communication between RPMs E-Series RPMs have three CPUs: Control Processor (CP), Routing Processor 1 (RP1), and Routing Processor 2 (RP2). The CPUs use Fast Ethernet connections to communicate to each other and to the line card CPUs (LP) using Inter-Processor Communication (IPC). The CP monitors the health status of the other processors by sending a heartbeat message.
PAGE 384
www.dell.com | support.dell.com Table 18-2. Failover Behaviors Platform Failover Trigger Failover Behavior e RP task or kernel crash on the primary RPM CP on the primary RPM detects the RP IPC timeout and notifies the standby RPM. The standby RPM initiates a failover. FTOS saves an RP application or kernel core dump, the CP trace log, and the CP IPC-related system status. Then the new primary RPM reboots the failed RPM.
PAGE 385
RPM synchronization Data between the two RPMs is synchronized immediately after bootup. Once the two RPMs have done an initial full synchronization (block sync), thereafter FTOS only updates changed data (incremental sync). The data that is synchronized consists of configuration data, operational data, state and status, and statistics depending on the FTOS version.
PAGE 386
www.dell.com | support.dell.com Figure 18-3. Using the redundancy force-failover rpm Command to Copy Software between RPMs FTOS#redundancy force-failover rpm Peer RPM's SW version is different but HA compatible. Failover can be done by warm or hitless upgrade. All linecards will be reset during warm upgrade.
PAGE 387
Online Insertion and Removal You can add, replace, or remove chassis components while the chassis is operating. This section contains the following sub-sections: • • RPM Online Insertion and Removal Line Card Online Insertion and Removal RPM Online Insertion and Removal Dell Networking systems are functional with only one RPM. If a second RPM is inserted, it comes online as the standby RPM, as shown in Figure 18-4.
PAGE 388
www.dell.com | support.dell.com Figure 18-5.
PAGE 389
Replace a line card If you are replacing a line card with a line card of the same type, you may replace the card without any additional configuration. If you are replacing a line card with a line card of a different type, remove the card and then remove the existing line card configuration using the command no linecard. If you do not, FTOS reports a card mismatch (Message 6) when you insert the new card, and the installed line card has a card mismatch status.
PAGE 390
www.dell.com | support.dell.com Hitless behavior is defined in the context of an RPM failover only and does not include line card, SFM, and power module failures. • • On the E-Series: Failovers triggered by software exception, hardware exception, forced failover via the CLI, and manual removal of the primary RPM are all hitless. On the C-Series: Only failovers via the CLI are hitless. The system is not hitless in any other scenario.
PAGE 391
Runtime System Health Check Runtime System Health Check is supported on platform: e FTOS runs a system health check to detect data transfer errors within the system. FTOS performs the check during normal operation by interspersing among, test frames among the data frames that carry user and system data. One such check is a data plane loopback test.
PAGE 392
www.dell.com | support.dell.com Software Component Health Monitoring On each of the line cards and the RPM, there are a number of software components. FTOS performs a periodic health check on each of these components by querying the status of a flag, which the corresponding component resets within a specified time. If any health checks on the RPM fail, then the FTOS fails over to standby RPM. If any health checks on a line card fails, FTOS resets the card to bring it back to the correct state.
PAGE 393
• • The kernel is the central component of an operating system that manages system processors and memory allocation and makes these facilities available to applications. A kernel core dump is the contents of the memory in use by the kernel at the time of an exception. An application core dump is the contents of the memory allocated to a failed application at the time of an exception. System Log Event messages provide system administrators diagnostics and auditing information.
PAGE 394
www.dell.com | support.dell.com Table 18-4 show the warm upgrade and downtime impact, if any, which each step. Table 18-4. Control Plane and Data Plane Status during Warm Upgrade Download 6.3.1.1 to Reboot RPM1 to RPMs Upgrade Initiate Warm Failover Reboot RPM0 to Upgrade RPM 0 7.6.1.0 Primary 7.6.1.0 Primary 7.6.1.0 Secondary 7.7.1.0 Secondary RPM 1 7.6.1.0 Secondary 7.7.1.0 Secondary 7.7.1.0 Primary 7.7.1.0 Primary Line Cards 7.6.1.0 7.6.1.0 7.7.1.0 7.7.1.
PAGE 395
Figure 18-8. Determining your System Pre-requisites for Cache Boot FTOS#show rpm -- RPM card 0 -Status : active Next Boot : online Card Type : RPM - Route Processor Module (LC-EF3-RPM) Hardware Rev : 2.2i Hardware Revision 2.1 or later Num Ports : 1 Up Time : 1 day, 4 hr, 25 min Last Restart : reset by user FTOS Version : 4.7.5.427 Jumbo Capable : yes Specified boot code version CP Boot Flash : A: 2.4.1.1 [booted] B: 2.4.1.1 RP1 Boot Flash: A: 2.4.1.1 B: 2.4.1.1 [booted] RP2 Boot Flash: A: 2.4.1.1 B: 2.4.
PAGE 396
www.dell.com | support.dell.com Select the Cache Boot Image Select the FTOS image that you want to cache using the command upgrade system-image, as shown in Figure 18-9. Dell Networking recommends using the keyword all with this command to avoid any mis-matched configurations. Note: The cache boot feature is not enabled by default; you must copy the running configuration to the startup configuration (copy running-config startup-config) after selecting a cache boot image in order to enable it. Figure 18-9.
PAGE 397
Figure 18-10. Viewing the Cache Boot Configuration FTOS#show boot system all Current system image information in the system: ============================================= Type Boot Type A B ---------------------------------------------------------------CP DOWNLOAD BOOT 4.7.5.427 invalid RP1 DOWNLOAD BOOT 4.7.5.427 invalid RP2 DOWNLOAD BOOT 4.7.5.427 invalid linecard 0 DOWNLOAD BOOT 4.7.5.427 invalid linecard 1 is not present. linecard 2 is not present. linecard 3 is not present.
PAGE 398
www.dell.com | support.dell.com In-Service Modular Hot-Fixes In-Service Modular Hot-Fixes are supported on platforms: e In-Service Modular Hot-Fixes provides a tool whereby you can install a patch while the system is on-line and running. This feature allows a patch to be added to a running FTOS process to obtain debugging information or to resolve a software issue in a deployed system. There is no need to reload or reboot the system when the patch is inserted.
PAGE 399
Note: The show patch command can be used on both the primary and secondary RPMs, as shown here: FTOS(standby)#show patch Patch version Module E.1.1.bgp.1.0 bgp E.2.1.l2mgr.1.
PAGE 400
www.dell.com | support.dell.com You can select which process may attempt to restart, and the number of consecutive restart attempts before failover, but by default, every process causes a system reload or RPM failover. Task Command Syntax Command Mode Enable Process Restartability for a process or task.
PAGE 401
FTOS Behavior: When debug tacacs or debug radius is enabled, and the respective process restarts, FTOS does not continue to print debug messages after the restart; you must execute debug tacacs or debug radius again. This is because debugging is not saved to the running configuration, rather, FTOS marks the process for debugging with a flag that is cleared during the restart.
PAGE 402
| High Availability www.dell.com | support.dell.
PAGE 403
19 Internet Group Management Protocol Table 19-1. FTOS Support for IGMP and IGMP Snooping Feature Platform IGMP version 1, 2, and 3 ces IGMP Snooping version 1, 2, and 3 ces Note: When both E-Series TeraScale and ExaScale are supported, only the e symbol is shown. If a feature is supported by one or the other chassis, the specific symbols are shown: e t for E-Series TeraScale or ex for E-Series ExaScale.
PAGE 404
www.dell.com | support.dell.com IGMP version 2 IGMP version 2 improves upon version 1 by specifying IGMP Leave messages, which allows hosts to notify routers that they no longer care about traffic for a particular group. Leave messages reduce the amount of time that the router takes to stop forwarding traffic for a group to a subnet (leave latency) after the last host leaves the group.
PAGE 405
Sending an Unsolicited IGMP Report A host does not have to wait for a general query to join a group. It may send an unsolicited IGMP Membership Report, also called an IGMP Join message, to the querier. Leaving a Multicast Group 1. A host sends a membership report of type 0x17 (IGMP Leave message) to the all routers multicast address 224.0.0.2 when it no longer cares about multicast traffic for a particular group. 2.
PAGE 406
www.dell.com | support.dell.com Figure 19-3. Version (4) IHL IGMP version 3 Membership Report Packet Format TOS (0xc0) Total Length Flags Frag Offset TTL (1) Protocol (2) Header Checksum Type Reserved Src IP Addr Dest IP Addr (224.0.0.
PAGE 407
Figure 19-4. IGMP Membership Reports: Joining and Filtering Membership Reports: Joining and Filtering 3 Interface Multicast Group Filter Source Source Address Timer Mode Timer 1/1 224.1.1.1 GMI Exclude None 1/1 224.1.1.1 Include 10.11.1.1 GMI 1/1 224.1.1.1 Include 10.11.1.1 GMI IGMP Group-and-Source Specific Query Non-Querier Querier Type: 0x11 Group Address: 244.1.1.1 Number of Sources: 1 Source Address: 10.11.1.1 1/1 10.11.1.
PAGE 408
www.dell.com | support.dell.com Figure 19-5. IGMP Membership Queries: Leaving and Staying in Groups Membership Queries: Leaving and Staying Non-Querier Querier Interface Multicast Group Filter Source Source Address Timer Mode Timer 1/1 224.1.1.1 Include 10.11.1.1 LQMT 10.11.1.2 LQMT Non-querier builds identical table and waits Other Querier Present Interval to assume Querier role 1/1 2/1 224.2.2.2 GMI Exclude None IGMP Group-and-Source Specific Query Type: 0x11 Group Address: 224.1.1.
PAGE 409
Figure 19-6. Viewing IGMP-enabled Interfaces FTOS#show ip igmp interface gig 7/16 GigabitEthernet 7/16 is up, line protocol is up Internet address is 10.87.3.2/24 IGMP is enabled on interface IGMP query interval is 60 seconds IGMP querier timeout is 300 seconds IGMP max query response time is 10 seconds Last member query response interval is 199 ms IGMP activity: 0 joins, 0 leaves IGMP querying router is 10.87.3.
PAGE 410
www.dell.com | support.dell.com Figure 19-8. Viewing Static and Learned IGMP Groups FTOS(conf-if-gi-1/0)#do sho ip igmp groups Total Number of Groups: 2 IGMP Connected Group Membership Group Address Interface Uptime 224.1.1.1 GigabitEthernet 1/0 00:00:03 224.1.2.1 GigabitEthernet 1/0 00:56:55 Expires Never 00:01:22 Last Reporter CLI 1.1.1.2 Adjusting Timers View the current value of all IGMP timers using the command show ip igmp interface from EXEC Privilege mode, as shown in Figure 19-6.
PAGE 411
2. When a router receives a query it compares the IP address of the interface on which it was received with the source IP address given in the query. If the receiving router IP address is greater than the source address given in the query, the router stops sending queries. By this method, the router with the lowest IP address on the subnet is elected querier and continues to send queries. 3.
PAGE 412
www.dell.com | support.dell.com IGMP Snooping Multicast packets are addressed with multicast MAC addresses, which represent a group of devices, rather than one unique device. Switches forward multicast frames out of all ports in a VLAN by default, even though there may be only some interested hosts, which is a waste of bandwidth.
PAGE 413
Figure 19-10. Enabling IGMP Snooping FTOS(conf-if-vl-100)#show config ! interface Vlan 100 no ip address ip igmp snooping fast-leave shutdown FTOS(conf-if-vl-100)# Disabling Multicast Flooding If the switch receives a multicast packet that has an IP address of a group it has not learned (unregistered frame), the switch floods that packet out of all ports on the VLAN.
PAGE 414
www.dell.com | support.dell.com • When enabled, IGMP snooping Querier starts after one query interval in case no IGMP general query (with IP SA lower than its VLAN IP address) is received on any of its VLAN members. Adjusting the Last Member Query Interval When the querier receives a leave message from a receiver, it sends a group-specific query out of the ports specified in the forwarding table. If no response is received, it sends another.
PAGE 415
20 Interfaces This chapter describes interface types, both physical and logical, and how to configure them with FTOS. 10/100/1000 Mbps Ethernet, Gigabit Ethernet, and 10 Gigabit Ethernet interfaces are supported on platforms ces SONET interfaces are only supported on platform e and are covered in the SONET/SDH chapter.
PAGE 416
www.dell.com | support.dell.
PAGE 417
Figure 20-1. show interfaces Command Example FTOS#show interfaces tengigabitethernet 1/0 TenGigabitEthernet 1/0 is up, line protocol is up Hardware is Force10Eth, address is 00:01:e8:05:f3:6a Current address is 00:01:e8:05:f3:6a Pluggable media present, XFP type is 10GBASE-LR. Medium is MultiRate, Wavelength is 1310nm XFP receive power reading is -3.7685 Interface index is 67436603 Internet address is 65.113.24.
PAGE 418
www.dell.com | support.dell.com Figure 20-3. Interfaces listed in the show running-config Command (Partial) FTOS#show running Current Configuration ...
PAGE 419
To confirm that the interface is enabled, use the show config command in the INTERFACE mode. To leave the INTERFACE mode, use the exit command or end command. The user can not delete a physical interface. Physical Interfaces The Management Ethernet interface, is a single RJ-45 Fast Ethernet port on the Route Processor Module (RPM) of the C-Series and E-Series, and provides dedicated management access to the system.
PAGE 420
www.dell.com | support.dell.com Overview of Layer Modes On all systems running FTOS, you can place physical interfaces, port channels, and VLANs in Layer 2 mode or Layer 3 mode. By default, VLANs are in Layer 2 mode. Table 20-1.
PAGE 421
For information on enabling and configuring Spanning Tree Protocol, see Chapter 25, Layer 2. To view the interfaces in Layer 2 mode, use the command show interfaces switchport in the EXEC mode. Configure Layer 3 (Network) Mode When you assign an IP address to a physical interface, you place it in Layer 3 mode. Use the ip address command and no shutdown command in INTERFACE mode to enable Layer 3 mode on an individual interface.
PAGE 422
www.dell.com | support.dell.com Command Syntax Command Mode Purpose ip address ip-address mask [secondary] INTERFACE Configure a primary IP address and mask on the interface. The ip-address must be in dotted-decimal format (A.B.C.D) and the mask must be in slash format (/xx). Add the keyword secondary if the IP address is the interface’s backup IP address. You can only configure one (1) primary IP address per interface. You can configure up to 255 secondary IP addresses on a single interface.
PAGE 423
Management Interfaces Configure Management Interfaces on the E-Series and C-Series On the E-Series and C-Series, the dedicated Management interface is located on the RPM and provides management access to the system. You can configure this interface with FTOS, but the configuration options on this interface are limited. Gateway addresses and IP addresses cannot be configured if it appears in the main routing table of FTOS. In addition, Proxy ARP is not supported on this interface.
PAGE 424
www.dell.com | support.dell.com Important Things to Remember — virtual-ip • • • • • • virtual-ip is a CONFIGURATION mode command. You may enter an IPv4 or IPv6 address. When applied, the management port on the primary RPM assumes the virtual IP address.
PAGE 425
Displaying Information on a Management Interface To view information about the primary RPM management port, use the show interface Managementethernet command in EXEC or EXEC Privilege mode. If there are two RPMs on the system, you cannot view information on the interface. Figure 20-9.
PAGE 426
www.dell.com | support.dell.com VLAN Interfaces VLANs are logical interfaces and are, by default, in Layer 2 mode. Physical interfaces and port channels can be members of VLANs. For more information on VLANs and Layer 2, refer to Chapter 25, Layer 2. See also VLAN Stacking. Note: To monitor VLAN interfaces, use the Management Information Base for Network Management of TCP/IP-based internets: MIB-II (RFC 1213). Monitoring VLAN interfaces via SNMP is supported only on E-Series.
PAGE 427
Loopback Interfaces A Loopback interface is a virtual interface in which the software emulates an interface. Packets routed to it are processed locally. Since this interface is not a physical interface, you can configure routing protocols on this interface to provide protocol stability. You can place Loopback interfaces in default Layer 3 mode.
PAGE 428
www.dell.com | support.dell.com Port Channel Interfaces Port channel interfaces support link aggregation, as described in IEEE Standard 802.3ad. This section covers the following topics: • • • • Port channel definition and standards Port channel benefits Port channel implementation Configuration task list for port channel interfaces Port channel definition and standards Link aggregation is defined by IEEE 802.
PAGE 429
• Dynamic—Port channels that are dynamically configured using Link Aggregation Control Protocol (LACP). For details, see Chapter 24, Link Aggregation Control Protocol. Table 20-2. Number of Port-channels per Platform Platform Port-channels Members/Channel E-Series 255 16 C-Series 128 8 S-Series: S50 and S25 52 8 S-Series: S55, S60 and S4810 128 8 Table 20-3. Maximum number of configurable Port-channels Platform Port-channels E-Series ExaScale 512 Members/Channel 64 Table 20-4.
PAGE 430
www.dell.com | support.dell.com The common speed is determined when the port channel is first enabled. At that time, the software checks the first interface listed in the port channel configuration. If that interface is enabled, its speed configuration becomes the common speed of the port channel. If the other interfaces configured in that port channel are configured with a different speed, FTOS disables them.
PAGE 431
The port channel is now enabled and you can place the port channel in Layer 2 or Layer 3 mode. Use the switchport command to place the port channel in Layer 2 mode or configure an IP address to place the port channel in Layer 3 mode. You can configure a port channel as you would a physical interface by enabling or configuring protocols or assigning access control lists.
PAGE 432
www.dell.com | support.dell.com Figure 20-13. show interfaces port-channel brief Command Example FTOS#show int port brief LAG Mode 1 L2L3 Status up Uptime 00:06:03 2 up 00:06:03 L2L3 Ports Gi 13/6 Gi 13/12 Gi 13/7 Gi 13/8 Gi 13/13 Gi 13/14 (Up) * (Up) (Up) * (Up) (Up) (Up) FTOS# Figure 20-14 displays the port channel’s mode (L2 for Layer 2 and L3 for Layer 3 and L2L3 for a Layer 2 port channel assigned to a routed VLAN), the status, and the number of interfaces belonging to the port channel.
PAGE 433
Figure 20-15. Error Message FTOS(conf-if-portch)#show config ! interface Port-channel 5 no ip address switchport channel-member GigabitEthernet 1/6 FTOS(conf-if-portch)#int gi 1/6 FTOS(conf-if)#ip address 10.56.4.4 /24 % Error: Port is part of a LAG Gi 1/6. FTOS(conf-if)# Error message Reassign an interface to a new port channel An interface can be a member of only one port channel.
PAGE 434
www.dell.com | support.dell.com Figure 20-16.
PAGE 435
To add a port channel to a VLAN, use either of the following commands: Command Syntax Command Mode Purpose tagged port-channel id number INTERFACE VLAN Add the port channel to the VLAN as a tagged interface. An interface with tagging enabled can belong to multiple VLANs. untagged port-channel id number INTERFACE VLAN Add the port channel to the VLAN as an untagged interface. An interface without tagging enabled can belong to only one VLAN.
PAGE 436
www.dell.com | support.dell.com Load balancing through port channels FTOS uses hash algorithms for distributing traffic evenly over channel members in a port channel (LAG). The hash algorithm distributes traffic among ECMP paths and LAG members. The distribution is based on a flow, except for packet-based hashing. A flow is identified by the hash and is assigned to one link. In packet-based hashing, a single flow can be distributed on the LAG and uses one link.
PAGE 437
On the E-Series, to change the 5-tuple default to 3-tuple, MAC, or packet-based, use the following command in CONFIGURATION mode: Command Syntax Command Mode Purpose [no] load-balance [ip-selection {3-tuple | packet-based}] [mac] CONFIGURATION To designate a method to balance traffic over a port channel. By default, IP 5-tuple is used to distribute traffic over members port channel. ip-selection 3-tuple—Distribute IP traffic based on IP source address, IP destination address, and IP protocol type.
PAGE 438
www.dell.com | support.dell.com IPv4, IPv6, and non-IP traffic handling on the E-Series The table below presents the combinations of the load-balance command and their effect on traffic types. Table 20-7.
PAGE 439
Hash algorithm The load-balance command discussed above selects the hash criteria applied to port channels. If even distribution is not obtained with the load-balance command, the hash-algorithm command can be used to select the hash scheme for LAG, ECMP and NH-ECMP. The 12 bit Lag Hash can be rotated or shifted till the desired hash is achieved. The nh-ecmp option allows you to change the hash value for recursive ECMP routes independently of non-recursive ECMP routes.
PAGE 440
www.dell.com | support.dell.com • lsb — always uses the least significant bit of the hash key to compute the egress port To change to another method, use the following command in the CONFIGURATION mode: Command Syntax Command Mode Purpose hash-algorithm ecmp {crc-upper} | {dest-ip} | {lsb} CONFIGURATION Change to another algorithm.
PAGE 441
Bulk Configuration Examples The following are examples of using the interface range command for bulk configuration: • Create a single-range • Create a multiple-range • Exclude duplicate entries • Exclude a smaller port range • Overlap port ranges • Commas • Add ranges Create a single-range Figure 20-20. Creating a Single-Range Bulk Configuration FTOS(config)# interface range gigabitethernet 5/1 - 23 FTOS(config-if-range-gi-5/1-23)# no shutdown Create a multiple-range Figure 20-21.
PAGE 442
www.dell.com | support.dell.com Overlap port ranges If overlapping port ranges are specified, the port range is extended to the smallest start port number and largest end port number: Figure 20-24.
PAGE 443
Define the Interface Range This example shows how to define an interface-range macro named “test” to select Fast Ethernet interfaces 5/1 through 5/4: FTOS(config)# define interface-range test gigabitethernet 5/1 - 4 To show the defined interface-range macro configuration, use the command show running-config in the EXEC mode.
PAGE 444
www.dell.com | support.dell.com Monitor and Maintain Interfaces Monitor interface statistics with the monitor interface command. This command displays an ongoing list of the interface status (up/down), number of packets, traffic statistics, etc. Command Syntax Command Mode Purpose monitor interface interface EXEC Privilege View the interface’s statistics.
PAGE 445
Figure 20-27. Command Example: monitor interface FTOS#monitor interface gi 3/1 FTOS uptime is 1 day(s), 4 hour(s), 31 minute(s) Monitor time: 00:00:00 Refresh Intvl.
PAGE 446
www.dell.com | support.dell.com To test the condition of cables on 10/100/1000 BASE-T modules, use the tdr-cable-test command: Step 1 Command Syntax Command Mode Usage tdr-cable-test gigabitethernet / EXEC Privilege To test for cable faults on the GigabitEthernet cable. • Between two ports, the user must not start the test on both ends of the cable. • The user must enable the interface before starting the test. • The port should be enabled to run the test or the test prints an error message.
PAGE 447
• Changes made do not affect any ongoing debounces. The timer changes take affect from the next debounce onward. Assign a debounce time to an interface Command Syntax Command Mode Purpose link debounce time [milliseconds] INTERFACE Enter the time to delay link status change notification on this interface. Range: 100-5000 ms • • Figure 20-28.
PAGE 448
www.dell.com | support.dell.com When an E300 system boots up and a single SFM is active this configuration, any ports configured with this feature will be shut down. All other ports are booted up. Similarly, if an SFM fails (or is removed) in an E300 system with two SFM, ports configured with this feature will be shut down. All other ports are treated normally. When a second SFM is installed or replaced, all ports are booted up and treated as normally.
PAGE 449
Enable Link Dampening Enable link dampening using the command dampening from INTERFACE mode, as shown in Figure 20-30. Figure 20-30. Configuring Link Dampening R1(conf-if-gi-1/1)#show config ! interface GigabitEthernet 1/1 ip address 10.10.19.
PAGE 450
www.dell.com | support.dell.com Figure 20-33.
PAGE 451
The globally assigned 48-bit Multicast address 01-80-C2-00-00-01 is used to send and receive pause frames. To allow full duplex flow control, stations implementing the pause operation instruct the MAC to enable reception of frames with destination address equal to this multicast address. The PAUSE frame is defined by IEEE 802.3x and uses MAC Control frames to carry the PAUSE commands. Ethernet Pause Frames are supported on full duplex only.
PAGE 452
www.dell.com | support.dell.com Enable Pause Frames Note: On the C-Series and S-Series platforms, Ethernet Pause Frames TX should be enabled only after consulting with the Dell Networking Technical Assistance Center. Ethernet Pause Frames flow control must be enabled on all ports on a chassis or a line card. If not, the system may exhibit unpredictable behavior. On the C-Series and S-Series systems, the flow-control sender and receiver must be on the same port-pipe.
PAGE 453
Configure MTU Size on an Interface If a packet includes a Layer 2 header, the difference in bytes between the link MTU and IP MTU must be large enough to include the Layer 2 header. For example, for VLAN packets, if the IP MTU is 1400 bytes, the Link MTU must 1422 bytes or greater to accommodate the 22-byte VLAN header: 1400-byte IP MTU + 22-byte VLAN Tag = 1422-byte link MTU On the E-Series and C-Series, you configure the Link MTU size on an interface by entering the mtu command.
PAGE 454
www.dell.com | support.dell.com Port-pipes A port pipe is a Dell Networking specific term for the hardware path that packets follow through a system. Port pipes travel through a collection of circuits (ASICs) built into line cards and RPMs on which various processing events for the packets occur. One or two port pipes process traffic for a given set of physical interfaces or a port-set. The E300 only supports one port pipe per slot.
PAGE 455
Auto-Negotiation on Ethernet Interfaces Setting speed and duplex mode of Ethernet Interfaces By default, auto-negotiation of speed and duplex mode is enabled on 10/100/1000 Base-T Ethernet interfaces. Only 10GE interfaces do not support auto-negotiation. When using 10GE interfaces, verify that the settings on the connecting devices are set to no auto-negotiation. Note: Starting with FTOS 7.8.1.
PAGE 456
www.dell.com | support.dell.com Note: The show interfaces status command displays link status, but not administrative status. For link and administrative status, use show ip interface [interface | brief | linecard slot-number] [configuration]. Figure 20-34.
PAGE 457
Figure 20-36. Setting Auto-Negotiation Options FTOS(conf)# int gi 0/0 FTOS(conf-if)#neg auto FTOS(conf-if-autoneg)# ? end Exit from configuration mode exit Exit from autoneg configuration mode mode Specify autoneg mode no Negate a command or set its defaults For details on the speed, duplex, and negotiation auto commands, see the Interfaces chapter of the FTOS Command Reference.
PAGE 458
www.dell.com | support.dell.com Figure 20-37.
PAGE 459
Figure 20-39.
PAGE 460
www.dell.com | support.dell.com Dynamic Counters By default, counting for the following four applications is enabled: • • • • IPFLOW IPACL L2ACL L2FIB For remaining applications, FTOS automatically turns on counting when the application is enabled, and is turned off when the application is disabled. Please note that if more than four counter-dependent applications are enabled on a port pipe, there is an impact on line rate performance.
PAGE 461
Clear interface counters The counters in the show interfaces command are reset by the clear counters command. This command does not clear the counters captured by any SNMP program.
PAGE 462
| Interfaces www.dell.com | support.dell.
PAGE 463
21 IPv4 Addressing IPv4 Addressing is supported on platforms ces IPv4 addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. FTOS supports various IP addressing features. This chapter explains the basics of Domain Name Service (DNS), Address Resolution Protocol (ARP), and routing principles and their implementation in FTOS.
PAGE 464
www.dell.com | support.dell.com At its most basic level, an IP address is 32-bits composed of network and host portions and represented in dotted decimal format. For example, 00001010110101100101011110000011 is represented as 10.214.87.131 For more information on IP addressing, refer to RFC 791, Internet Protocol. Implementation Information In FTOS, you can configure any IP address as a static route except IP addresses already assigned to interfaces. Note: FTOS versions 7.7.1.
PAGE 465
To assign an IP address to an interface, use these commands in the following sequence, starting in the CONFIGURATION mode: Step Command Syntax Command Mode Purpose interface interface CONFIGURATION Enter the keyword interface followed by the type of interface and slot/port information: • For a 1-Gigabit Ethernet interface, enter the keyword GigabitEthernet followed by the slot/port information. • For a Loopback interface, enter the keyword loopback followed by a number from 0 to 16383.
PAGE 466
www.dell.com | support.dell.com FTOS#show ip int gi 0/8 GigabitEthernet 0/8 is up, line protocol is up Internet address is 10.69.8.1/24 Broadcast address is 10.69.8.
PAGE 467
Figure 21-3. show ip route static Command Example (partial) FTOS#show ip route static Destination Gateway ----------------S 2.1.2.0/24 Direct, Nu 0 S 6.1.2.0/24 via 6.1.20.2, S 6.1.2.2/32 via 6.1.20.2, S 6.1.2.3/32 via 6.1.20.2, S 6.1.2.4/32 via 6.1.20.2, S 6.1.2.5/32 via 6.1.20.2, S 6.1.2.6/32 via 6.1.20.2, S 6.1.2.7/32 via 6.1.20.2, S 6.1.2.8/32 via 6.1.20.2, S 6.1.2.9/32 via 6.1.20.2, S 6.1.2.10/32 via 6.1.20.2, S 6.1.2.11/32 via 6.1.20.2, S 6.1.2.12/32 via 6.1.20.2, S 6.1.2.13/32 via 6.1.20.2, S 6.1.
PAGE 468
www.dell.com | support.dell.com To view the configured static routes for the management port, use the show ip management-route command in the EXEC privilege mode. Figure 21-4. show ip management-route Command Example FTOS>show ip management-route Destination ----------1.1.1.0/24 172.16.1.0/24 172.31.1.0/24 Gateway ------172.31.1.250 172.31.1.
PAGE 469
Command Syntax Command Mode Purpose ip domain-lookup CONFIGURATION Enable dynamic resolution of host names. ip name-server ipv4-address [ipv4-address2 ... ipv4-address6] CONFIGURATION Specify up to 6 IPv4 or IPv6 name servers. The order you entered the servers determines the order of their use. You may have IPv4 and IPv6 name servers configured at the same time. ipv6 name-server ipv6-address [ipv6-address2 ... ipv6-address6] To view current bindings, use the show hosts command. Figure 21-5.
PAGE 470
www.dell.com | support.dell.com Command Syntax Command Mode Purpose ip domain-list name CONFIGURATION Configure names to complete unqualified host names. Configure this command up to 6 times to specify a list of possible domain names. FTOS searches the domain names in the order they were configured until a match is found or the list is exhausted. DNS with traceroute To configure your switch to perform DNS with traceroute, follow the steps below in the CONFIGURATION mode.
PAGE 471
ARP FTOS uses two forms of address resolution: ARP and Proxy ARP. Address Resolution Protocol (ARP) runs over Ethernet and enables endstations to learn the MAC addresses of neighbors on an IP network. Over time, FTOS creates a forwarding table mapping the MAC addresses to their corresponding IP address. This table is called the ARP Cache and dynamically learned addresses are removed after a defined period of time. For more information on ARP, see RFC 826, An Ethernet Address Resolution Protocol.
PAGE 472
www.dell.com | support.dell.com Command Syntax Command Mode Purpose arp ip-address mac-address interface CONFIGURATION Configure an IP address and MAC address mapping for an interface. • ip-address: IP address in dotted decimal format (A.B.C.D). • mac-address: MAC address in nnnn.nnnn.nnnn format • interface: enter the interface type slot/port information. These entries do not age and can only be removed manually. To remove a static ARP entry, use the no arp ip-address command syntax.
PAGE 473
Command Syntax Command Mode Purpose clear arp-cache [interface | ip ip-address] [no-refresh] EXEC privilege Clear the ARP caches for all interfaces or for a specific interface by entering the following information: • For a 1-Gigabit Ethernet interface, enter the keyword GigabitEthernet followed by the slot/port information. • For a port channel interface, enter the keyword port-channel followed by a number from 1 to 255 for TeraScale and ExaScale.
PAGE 474
www.dell.com | support.dell.com Beginning with version 8.3.1.0, when a Gratuitous ARP is received, FTOS installs an ARP entry on all 3 CPUs. Task Command Syntax Command Mode Enable ARP learning via gratuitous ARP. arp learn-enable CONFIGURATION ARP Learning via ARP Request In FTOS versions prior to 8.3.1.0, FTOS learns via ARP Requests only if the Target IP specified in the packet matches the IP address of the receiving router interface.
PAGE 475
Configurable ARP Retries In FTOS versions prior to 8.3.1.0 the number of ARP retries is set to 5 and is not configurable. After 5 retries, FTOS backs off for 20 seconds before it sends a new request. Beginning with FTOS version 8.3.1.0, the number of ARP retries is configurable. The backoff interval remains at 20 seconds. Task Command Syntax Command Mode Set the number of ARP retries. arp retries number CONFIGURATION Default: 5 Range: 5-20 Display all ARP entries learned via gratuitous ARP.
PAGE 476
www.dell.com | support.dell.com Enable ICMP unreachable messages By default, ICMP unreachable messages are disabled. When enabled ICMP unreachable messages are created and sent out all interfaces. To disable ICMP unreachable messages, use the no ip unreachable command.
PAGE 477
Configuring UDP Helper Configuring FTOS to direct UDP broadcast is a two-step process: 1. Enable UDP helper and specify the UDP ports for which traffic is forwarded. See Enabling UDP Helper. 2. Configure a broadcast address on interfaces that will receive UDP broadcast traffic. See Configuring a Broadcast Address. Important Points to Remember about UDP Helper • • • • The existing command ip directed broadcast is rendered meaningless if UDP helper is enabled on the same interface.
PAGE 478
www.dell.com | support.dell.com Configuring a Broadcast Address Configure a broadcast address on an interface using the command ip udp-broadcast-address, as shown in Figure 21-12. Figure 21-12. Configuring a Broadcast Address FTOS(conf-if-vl-100)#ip udp-broadcast-address 1.1.255.255 FTOS(conf-if-vl-100)#show config ! interface Vlan 100 ip address 1.1.0.1/24 ip udp-broadcast-address 1.1.255.
PAGE 479
UDP Helper with Broadcast-all Addresses When the destination IP address of an incoming packet is the IP broadcast address, FTOS rewrites the address to match the configured broadcast address. In Figure 21-14: 1. Packet 1 is dropped at ingress if no UDP helper address is configured. 2. If UDP helper (using the command ip udp-helper udp-port) is enabled, and the UDP destination port of the packet matches the UDP port configured, the system changes the destination address to the configured broadcast 1.1.255.
PAGE 480
www.dell.com | support.dell.com In Figure 21-15, Packet 1 has the destination IP address 1.1.1.255, which matches the subnet broadcast address of VLAN 101. If UDP helper is configured and the packet matches the specified UDP port, then the system changes the address to the configured IP broadcast address and floods the packet on VLAN 101. Packet 2 is sent from host on VLAN 101. It has a broadcast MAC address and a destination IP address of 1.1.1.255.
PAGE 481
UDP Helper with No Configured Broadcast Addresses • • If the incoming packet has a broadcast destination IP address, then the unaltered packet is routed to all Layer 3 interfaces. If the Incoming packet has a destination IP address that matches the subnet broadcast address of any interface, then the unaltered packet is routed to the matching interfaces. Troubleshooting UDP Helper Display debugging information using the command debug ip udp-helper, as shown in Figure 21-17. Figure 21-17.
PAGE 482
| IPv4 Addressing www.dell.com | support.dell.
PAGE 483
22 IPv6 Addressing IPv6 Addressing is supported on platforms: ces Note: The basic IPv6 commands are supported on all platforms. However, not all IPv6-based features are supported on all platforms and on all releases. Refer to Table 22-2 to see which FTOS version supports an IPv6 feature on each platform. IPv6 (Internet Protocol Version 6) is the successor to IPv4. Due to the extremely rapid growth in internet users, and IP addresses, IPv4 is reaching its maximum usage.
PAGE 484
www.dell.com | support.dell.com Some key changes in IPv6 are: • • • • Extended Address Space Stateless Autoconfiguration Header Format Simplification Improved Support for Options and Extensions Extended Address Space The address format is extended from 32 bits to 128 bits. This not only provides room for all anticipated needs, it allows for the use of a hierarchical address space structure to optimize global addressing.
PAGE 485
IPv6 Headers The IPv6 header has a fixed length of 40 bytes. This provides 16 bytes each for Source and Destination information, and 8 bytes for general header information. The IPv6 header includes the following fields: • • • • • • • • Version (4 bits) Traffic Class (8 bits) Flow Label (20 bits) Payload Length (16 bits) Next Header (8 bits) Hop Limit (8 bits) Source Address (128 bits) Destination Address (128 bits) IPv6 provides for Extension Headers. Extension Headers are used only if necessary.
PAGE 486
www.dell.com | support.dell.com Traffic Class (8 bits) The Traffic Class field deals with any data that needs special handling. These bits define the packet priority and are defined by the packet Source. Sending and forwarding routers use this field to identify different IPv6 classes and priorities. Routers understand the priority settings and handle them appropriately during conditions of congestion.
PAGE 487
Table 22-1. Next Header field values (continued) Value Description 59 No Next Header 60 Destinations option header Note: This is not a comprehensive table of Next Header field values. Refer to the Internet Assigned Numbers Authority (IANA) web page http://www.iana.org/assignments/protocol-numbers for a complete and current listing. Hop Limit (8 bits) The Hop Limit field shows the number of hops remaining for packet processing.
PAGE 488
www.dell.com | support.dell.com Hop-by-Hop Options header The Hop-by-Hop options header contains information that is examined by every router along the packet’s path. It follows the IPv6 header and is designated by the Next Header value 0 (zero) (Table 22-1). When a Hop-by-Hop Options header is not included, the router knows that it does not have to process any router specific information and immediately processes the packet to its final destination.
PAGE 489
• • • • • • 2001:0db8:0000:0000:0000:0000:1428:57ab 2001:0db8:0000:0000:0000::1428:57ab 2001:0db8:0:0:0:0:1428:57ab 2001:0db8:0:0::1428:57ab 2001:0db8::1428:57ab 2001:db8::1428:57ab IPv6 networks are written using Classless Inter-Domain Routing (CIDR) notation. An IPv6 network (or subnet) is a contiguous group of IPv6 addresses the size of which must be a power of two; the initial bits of addresses, which are identical for all hosts in the network, are called the network's prefix.
PAGE 490
www.dell.com | support.dell.com Implementing IPv6 with FTOS FTOS supports both IPv4 and IPv6, and both may be used simultaneously in your system. Note: Dell Networking recommends that you use FTOS version 7.6.1.0 or later when implementing IPv6 functionality on an E-Series system. Table 22-2 lists the FTOS Version in which an IPv6 feature became available for each platform. The sections following the table give some greater detail about the feature.
PAGE 491
Table 22-2. FTOS and IPv6 Feature Support (continued) IS-IS for IPv6 7.5.1 8.2.1 8.4.2 8.4.2 Chapter 23, Intermediate System to Intermediate System in the FTOS Configuration Guide IPv6 IS-IS in the FTOS Command Line Reference Guide IS-IS for IPv6 support for redistribution 7.6.1 8.2.1 8.4.2 8.4.2 Chapter 23, Intermediate System to Intermediate System in the FTOS Configuration Guide IPv6 IS-IS in the FTOS Command Line Reference Guide ISIS for IPv6 support for 7.6.
PAGE 492
www.dell.com | support.dell.com Table 22-2. FTOS and IPv6 Feature Support (continued) PIM-SSM for IPv6 7.5.1 8.2.1 8.4.2 8.4.2 IPv6 Multicast in this chapter IPv6 PIM in the FTOS Command Line Reference Guide MLDv1/v2 7.4.1 8.2.1 8.4.2 8.4.2 IPv6 Multicast in this chapter Multicast IPv6 in the FTOS Command Line Reference Guide MLDv1 Snooping 7.4.1 8.2.1 8.4.2 8.4.2 IPv6 Multicast in this chapter Multicast IPv6 in the FTOS Command Line Reference Guide MLDv2 Snooping 8.3.1.0 8.3.1.0 8.
PAGE 493
Path MTU (Maximum Transmission Unit) defines the largest packet size that can traverse a transmission path without suffering fragmentation. Path MTU for IPv6 uses ICMPv6 Type-2 messages to discover the largest MTU along the path from source to destination and avoid the need to fragment the packet. The recommended MTU for IPv6 is 1280.
PAGE 494
www.dell.com | support.dell.com Figure 22-3. NDP Router Redistribution Router C Network 2001:db8::1428:57ab Send a Packet to Network 2001:db8::1428:57ab Router A Router B Local Link Packet Destination (2001:db8::1428:57ab) ICMPv6 Redirect (Data: Use Router C) Packet Destination (Destination 2001:db8::1428:57ab) IPv6 Neighbor Discovery of MTU packets With FTOS 8.3.1.0, you can set the MTU advertised through the RA packets to incoming routers, without altering the actual MTU setting on the interface.
PAGE 495
FTOS IPv6 supports quality of service based on DSCP field. You can configure FTOS to honor the DSCP value on incoming routed traffic and forward the packets with the same value. Refer to Chapter 41, Quality of Service for details. Refer also to the Honor DSCP values on ingress packets in the QoS chapter for information relating to the trust diffserv command.
PAGE 496
www.dell.com | support.dell.
PAGE 497
Figure 22-5.
PAGE 498
www.dell.com | support.dell.com Save the new CAM settings to the startup-config (write-mem or copy run start) then reload the system for the new settings to take effect. Command Syntax Command Mode Purpose cam-acl {default | l2acl number ipv4acl number ipv6acl number, ipv4qos number l2qos number, l2pt number ipmacacl number ecfmacl number [vman-qos | vman-dual-qos number} CONFIGURATION Allocate space for IPV6 ACLs.
PAGE 499
Assign a Static IPv6 Route IPv6 Static Routes are supported on platforms ces Use the ipv6 route command to configure IPv6 static routes.
PAGE 500
www.dell.com | support.dell.com Command Syntax Command Mode Purpose telnet ipv6 address EXEC or EXEC Privileged Enter the IPv6 Address for the device. ipv6 address : x:x:x:x::x mask : prefix length 0-128 IPv6 addresses are normally written as eight groups of four hexadecimal digits, where each group is separated by a colon (:). Omitting zeros is accepted as described in Addressing earlier in this chapter.
PAGE 501
Command Syntax Command Mode Purpose FTOS#show ipv6 ? accounting IPv6 accounting information cam linecard IPv6 CAM Entries for Line Card fib linecard IPv6 FIB Entries for Line Card interface IPv6 interface information mbgproutes MBGP routing table mld MLD information mroute IPv6 multicast-routing table neighbors IPv6 neighbor information ospf OSPF information pim PIM V6 information prefix-list List IPv6 prefix lists route IPv6 routing information rpf RPF table FTOS# Show an IPv6 Interface View the IPv6 c
PAGE 502
www.dell.com | support.dell.com Figure 22-6.
PAGE 503
Figure 22-7 illustrates the show ipv6 route command output. Figure 22-7.
PAGE 504
www.dell.com | support.dell.com Show the Running-Configuration for an Interface View the configuration for any interface with the following command.
PAGE 505
Command Syntax Command Mode Purpose IPv6 addresses are normally written as eight groups of four hexadecimal digits, where each group is separated by a colon (:). Omitting zeros is accepted as described in Addressing earlier in this chapter.
PAGE 506
| IPv6 Addressing www.dell.com | support.dell.
PAGE 507
23 Intermediate System to Intermediate System Intermediate System to Intermediate System is supported on platform: e Intermediate System to Intermediate System (IS-IS) protocol is an interior gateway protocol (IGP) that uses a shortest-path-first algorithm. Dell Networking supports both IPv4 and IPv6 versions of IS-IS, as described in this chapter.
PAGE 508
www.dell.com | support.dell.com routing information directly with external routers located outside of the routing domains. Level 1-2 systems manage both inter-area and intra-area traffic by maintaining two separate link databases; one for Level 1 routes and one for Level 2 routes. A Level 1-2 router does not advertise Level 2 routes to a Level 1 router. To establish adjacencies, each IS-IS router sends different Protocol Data Units (PDU).
PAGE 509
Multi-Topology IS-IS FTOS 7.8.1.0 and later support Multi-Topology Routing IS-IS. E-Series ExaScale platform ex supports Multi-Topology IS-IS with FTOS 8.2.1.0 and later. Multi-Topology IS-IS (MT IS-IS) allows you to create multiple IS-IS topologies on a single router with separate databases. This feature is used to place a virtual physical topology into logical routing domains, which can each support different routing and security policies.
PAGE 510
www.dell.com | support.dell.com Adjacencies Adjacencies on point-to-point interfaces are formed as usual, where IS-IS routers do not implement Multi-Topology (MT) extensions. If a local router does not participate in certain MTs, it will not advertise those MT IDs in its IIHs and so will not include that neighbor within its LSPs. If an MT ID is not detected in the remote side's IIHs, the local router does not include that neighbor within its LSPs.
PAGE 511
• The T3 timer sets the overall wait time after which the router determines that it has failed to achieve database synchronization (by setting the overload bit in its own LSP). This timer can be based on adjacency settings with the value derived from adjacent routers that are engaged in graceful restart recovery (the minimum of all the Remaining Time values advertised by the neighbors) or by setting a specific amount of time manually.
PAGE 512
www.dell.com | support.dell.com Table 23-1 displays the default values for IS-IS. Table 23-1.
PAGE 513
Configuration Task List for IS-IS The following list includes the configuration tasks for IS-IS: • • • • • • • • • • Enable IS-IS Configure Multi-Topology IS-IS (MT IS-IS) Configure IS-IS Graceful Restart Change LSP attributes Configure IS-IS metric style and cost Change the IS-type Control routing updates Configure authentication passwords Set the overload bit Debug IS-IS Enable IS-IS By default, IS-IS is not enabled. The system supports one instance of IS-IS.
PAGE 514
www.dell.com | support.dell.com Step Task Command Syntax Command Mode 3 Enter the interface configuration mode. Enter the keyword interface followed by the type of interface and slot/port information: • For a 1-Gigabit Ethernet interface, enter the keyword GigabitEthernet followed by the slot/port information. • For the Loopback interface on the RPM, enter the keyword loopback followed by a number from 0 to 16383.
PAGE 515
Figure 23-2. Command Example: show isis protocol FTOS#show isis protocol IS-IS Router: System Id: EEEE.EEEE.EEEE IS-Type: level-1-2 Manual area address(es): 47.0004.004d.0001 Routing for area address(es): 21.2223.2425.2627.2829.3031.3233 47.0004.004d.
PAGE 516
www.dell.com | support.dell.com Configure Multi-Topology IS-IS (MT IS-IS) Step 1 Task Command Syntax Command Mode Enable Multi-Topology IS-IS for IPv6. Enter the transition keyword to allow an IS-IS IPv6 user to continue to use single-topology mode while upgrading to multi-topology mode.After every router has been configured with the transition keyword, and all the routers are in MT IS-IS IPv6 mode users can remove the transition keyword on each router.
PAGE 517
Configure Multi-Topology IS-IS (MT IS-IS) Step 1 Task Command Syntax Command Mode Enable Multi-Topology IS-IS for IPv6. Enter the transition keyword to allow an IS-IS IPv6 user to continue to use single-topology mode while upgrading to multi-topology mode.After every router has been configured with the transition keyword, and all the routers are in MT IS-IS IPv6 mode users can remove the transition keyword on each router.
PAGE 518
www.dell.com | support.dell.com Command Syntax Command Mode Purpose graceful-restart restart- wait seconds ROUTER-ISIS Enable the Graceful Restart maximum wait time before a restarting peer comes up. Be sure to set the t3 timer to adjacency on the restarting router when implementing this command.
PAGE 519
Use the show isis graceful-restart detail command in EXEC Privilege mode to view all Graceful Restart related configuration. Figure 23-4.
PAGE 520
www.dell.com | support.dell.com Figure 23-5. Command Example: show isis interface show isis interface G1/34 GigabitEthernet 2/10 is up, line protocol is up MTU 1497, Encapsulation SAP Routing Protocol: IS-IS Circuit Type: Level-1-2 Interface Index 0x62cc03a, Local circuit ID 1 Level-1 Metric: 10, Priority: 64, Circuit ID: 0000.0000.000B.01 Hello Interval: 10, Hello Multiplier: 3, CSNP Interval: 10 Number of active level-1 adjacencies: 1 Level-2 Metric: 10, Priority: 64, Circuit ID: 0000.0000.000B.
PAGE 521
Figure 23-6. Command Example: show running-config isis FTOS#show running-config isis ! router isis lsp-refresh-interval 902 net 47.0005.0001.000C.000A.4321.00 net 51.0005.0001.000C.000A.4321.00 FTOS# Configure IS-IS metric style and cost All IS-IS links or interfaces are associated with a cost that is used in the SPF calculations. The possible cost varies depending on the metric style supported.
PAGE 522
www.dell.com | support.dell.com Figure 23-7. Command Example: show isis protocol FTOS#show isis protocol IS-IS Router: System Id: EEEE.EEEE.EEEE IS-Type: level-1-2 Manual area address(es): 47.0004.004d.0001 Routing for area address(es): 21.2223.2425.2627.2829.3031.3233 47.0004.004d.
PAGE 523
Table 23-3. Correct Value Range for the isis metric command Metric Style Correct Value Range narrow transition 0 to 63 transition 0 to 63 Configuring the distance of a route Configure the distance for a route using the distance command from ROUTER ISIS mode.
PAGE 524
www.dell.com | support.dell.com Figure 23-8. Command Example: show isis database FTOS#show isis database IS-IS Level-1 Link State Database LSPID LSP Seq Num B233.00-00 0x00000003 eljefe.00-00 * 0x00000009 eljefe.01-00 * 0x00000001 eljefe.02-00 * 0x00000001 Force10.00-00 0x00000002 IS-IS Level-2 Link State Database LSPID LSP Seq Num B233.00-00 0x00000006 eljefe.00-00 * 0x0000000D eljefe.01-00 * 0x00000001 eljefe.02-00 * 0x00000001 Force10.
PAGE 525
Distribute Routes Another method of controlling routing information is to filter the information through a prefix list. Prefix lists are applied to incoming or outgoing routes and routes must meet the conditions of the prefix lists or FTOS does not install the route in the routing table. The prefix lists are globally applied on all interfaces running IS-IS. Configure the prefix list in the PREFIX LIST mode prior to assigning it to the IS-IS process.
PAGE 526
www.dell.com | support.dell.com Command Syntax Command Mode Purpose distribute-list prefix-list-name out [bgp as-number | connected | ospf process-id | rip | static] ROUTER ISIS Apply a configured prefix list to all outgoing IPv4 IS-IS routes. You can configure one of the optional parameters: • connected: for directly connected routes. • ospf process-id: for OSPF routes only. • rip: for RIP routes only. • static: for user-configured routes.
PAGE 527
Command Syntax Command Mode Purpose distribute-list prefix-list-name out [bgp as-number | connected | ospf process-id | rip | static] ROUTER ISIS-AF IPV6 Apply a configured prefix list to all outgoing IPv6 IS-IS routes. You can configure one of the optional parameters: • connected: for directly connected routes. • ospf process-id: for OSPF routes only. • rip: for RIP routes only. • static: for user-configured routes.
PAGE 528
www.dell.com | support.dell.com Command Syntax Command Mode Purpose redistribute ospf process-id [level-1| level-1-2 | level-2] [metric value] [match external {1 | 2} | match internal] [metric-type {external | internal}] [route-map map-name] ROUTER ISIS Include specific OSPF routes in IS-IS. Configure the following parameters: • process-id range: 1 to 65535 • level-1, level-1-2, or level-2: Assign all redistributed routes to a level. Default is level-2. • metric range: 0 to 16777215. Default is 0.
PAGE 529
Use the show running-config isis command in EXEC Privilege mode to view IS-IS configuration globally (including both IPv4 and IPv6 settings), or the show config command in ROUTER ISIS mode to view the current IPv4 IS-IS configuration, or the show config command in ROUTER ISIS-ADDRESS FAMILY IPV6 mode to view the current IPv6 IS-IS configuration Configure authentication passwords You can assign an authentication password for routers in Level 1 and for routers in Level 2.
PAGE 530
www.dell.com | support.dell.com When the bit is set, a 1 is placed in the OL column in the show isis database command output. In Figure 23-9, the overload bit is set in both the Level-1 and Level-2 database because the IS type for the router is Level-1-2 Figure 23-9. Command Example: show isis database FTOS#show isis database IS-IS Level-1 Link State Database LSPID LSP Seq Num B233.00-00 0x00000003 eljefe.00-00 * 0x0000000A eljefe.01-00 * 0x00000001 eljefe.02-00 * 0x00000001 Force10.
PAGE 531
Command Syntax Command Mode Purpose debug isis snp-packets [interface] EXEC Privilege View IS-IS SNP packets, include CSNPs and PSNPs. To view specific information, enter one of the following optional parameters: • interface: Enter the type of interface and slot/port information to view IS-IS information on that interface only. debug isis spf-triggers EXEC Privilege View the events that triggered IS-IS shortest path first (SPF) events for debugging purposes.
PAGE 532
www.dell.com | support.dell.com Configure Metric Values The following topics are covered in this section: • • • Maximum Values in the Routing Table Changing the IS-IS Metric Style in One Level Only Leaking from One Level to Another For any level (Level-1, Level-2, or Level-1-2), the value range possible in the isis metric command in INTERFACE mode changes depending on the metric style. Table 23-4.
PAGE 533
Table 23-5. Metric Value when Metric Style Changes Beginning metric style Final metric style Resulting IS-IS metric value wide narrow transition default value (10) if the original value is greater than 63. A message is sent to the console.
PAGE 534
www.dell.com | support.dell.com Table 23-6.
PAGE 535
Sample Configuration The following configurations are examples for enabling IPv6 IS-IS. These are not comprehensive directions. They are intended to give you a some guidance with typical configurations. S Note: Only one IS-IS process can run on the router, even if both IPv4 and IPv6 routing is being used. You can copy and paste from these examples to your CLI. Be sure you make the necessary changes to support your own IP Addresses, Interfaces, Names, etc.
PAGE 536
www.dell.com | support.dell.com Figure 23-10. IS-IS Sample Configuration Router 1 R1(conf)#interface Loopback 0 R1(conf-if-lo-0)#ip address 192.168.1.1/24 R1(conf-if-lo-0)#ipv6 address 2001:db8:9999:1::/48 R1(conf-if-lo-0)#ip router isis 9999 R1(conf-if-lo-0)#no shutdown R1(conf-if-lo-0)#router isis 9999 R1(conf-router_isis)#is-type level-1 R1(conf-router_isis)#net FF.F101.0002.0C00.1111.
PAGE 537
Figure 23-11. IS-IS Sample Configuration continued Router 2 R2(conf)#interface Loopback 0 R2(conf-if-lo-0)#ip address 192.168.1.1/24 R2(conf-if-lo-0)#ipv6 address 2001:db8:9999:1::/48 R2(conf-if-lo-0)#ip router isis 9999 R2(conf-if-lo-0)#no shutdown R2(conf-if-lo-0)#router isis 9999 R2(conf-router_isis)#int gi 2/11 R2(conf-if-gi-2/11)#ip address 10.0.12.
PAGE 538
www.dell.com | support.dell.com Figure 23-12. IS-IS Sample Configuration continued Router 3 R3(conf)#interface Loopback 0 R3(conf-if-lo-0)#ip address 192.168.1.3/24 R3(conf-if-lo-0)#ipv6 address 2001:db8:9999:3::/48 R3(conf-if-lo-0)#ip router isis 9999 R3(conf-if-lo-0)#no shutdown R3(conf-if-lo-0)#router isis 9999 R3(conf-router_isis)#net FF.F101.0002.0C00.1133.
PAGE 539
Figure 23-13. IPv6 IS-IS Sample Topography Loopback 0 2001:0db8:9999:2:: /48 (192.168.1.2 /24) GigE 2/11 2001:0db8:1021:2:: /48 (10.0.12.2 /24) GigE 2/31 2001:0db8:1023:2:: /48 (10.0.23.2 /24) R2 GigE 1/21 2001:0db8:1021:1:: /48 (10.0.12.1 /24) GigE 3/21 2001:0db8:1023:3:: /48 (10.0.23.3 /24) Loopback 0 R1 2001:0db8:9999:1:: /48 GigE 1/34 (192.168.1.1 /24) 2001:0db8:1022:1:: /48 (10.0.13.1 /24) R3 Loopback 0 2001:0db8:9999:3:: /48 (192.168.1.
PAGE 540
www.dell.com | support.dell.
PAGE 541
24 Link Aggregation Control Protocol Link Aggregation Control Protocol is supported on platforms ce s LACP addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later.
PAGE 542
www.dell.com | support.dell.com LACP functions by constantly exchanging custom MAC PDUs across LAN Ethernet links. The protocol packets are only exchanged between ports that are configured as LACP capable. Important Points to Remember • • • • • • • • • On ExaScale, LACP is supported on 200 physical ports. Use static LAGs for the remaining ports to avoid unpredictable results. LACP enables you to add members to a port channel (LAG) as long as it has no static members.
PAGE 543
LACP modes FTOS provides the following three modes for configuration of LACP: • • • Off—In this state, an interface is not capable of being part of a dynamic LAG. LACP does not run on any port that is configured to be in this state. Active—In this state, the interface is said to be in the “active negotiating state.” LACP runs on any link that is configured to be in this state. A port in Active state also automatically initiates negotiations with other ports by initiating LACP packets.
PAGE 544
www.dell.com | support.dell.com LACP Configuration Tasks The tasks covered in this section are: • • • • • Create a LAG Configure the LAG interfaces as dynamic Set the LACP long timeout Monitor and Debugging LACP Configure Shared LAG State Tracking Create a LAG To create a dynamic port channel (LAG), define the LAG and then the LAG interfaces. Use the interface port-channel and switchport commands, as shown in Figure 24-1, which uses the example of LAG 32: Figure 24-1.
PAGE 545
Figure 24-3. Creating a Dynamic LAG Example FTOS(conf)#interface Gigabitethernet 3/15 FTOS(conf-if-gi-3/15)#no shutdown FTOS(conf-if-gi-3/15)#port-channel-protocol lacp FTOS(conf-if-gi-3/15-lacp)#port-channel 32 mode active ... FTOS(conf)#interface Gigabitethernet 3/16 FTOS(conf-if-gi-3/16)#no shutdown FTOS(conf-if-gi-3/16)#port-channel-protocol lacp FTOS(conf-if-gi-3/16-lacp)#port-channel 32 mode active ...
PAGE 546
www.dell.com | support.dell.com Figure 24-4. Invoking the LACP Long Timeout FTOS(conf)# interface port-channel 32 FTOS(conf-if-po-32)#no shutdown FTOS(conf-if-po-32)#switchport FTOS(conf-if-po-32)#lacp long-timeout FTOS(conf-if-po-32)#end FTOS# show lacp 32 Port-channel 32 admin up, oper up, mode lacp Actor System ID: Priority 32768, Address 0001.e800.a12b Partner System ID: Priority 32768, Address 0001.e801.
PAGE 547
Figure 24-5. LAGs using ECMP without Shared LAG State Tracking R4 Po 2 Po 1 Po 1 failure R1 Po 2 over-subscribed R2 R3 fnC0049mp To avoid packet loss, traffic must be re-directed through the next lowest-cost link (R3 to R4). FTOS has the ability to bring LAG 2 down in the event that LAG 1 fails, so that traffic can be re-directed, as described. This is what is meant by Shared LAG State Tracking.
PAGE 548
www.dell.com | support.dell.com In Figure 24-8, LAGs 1 and 2 are members of a failover group. LAG 1 fails and LAG 2 is brought down upon the failure. This effect is logged by Message 2, in which a console message declares both LAGs down at the same time. Figure 24-8.
PAGE 549
• • • • Only a LAG can be a member of a failover group. Shared LAG State Tracking can be configured on one side of a link or on both sides. If a LAG that is part of a failover group is deleted, the failover group is deleted. If a LAG moves to the down state due to this feature, its members may still be in the up state. Configure LACP as Hitless Configure LACP as Hitless is supported only on platforms: ce LACP on Dell Networking systems can be configured to be hitless.
PAGE 550
www.dell.com | support.dell.com Figure 24-11. LACP Sample Topology Port Channel 10 ALPHA BRAVO Gig 3/21 Gig 2/31 Gig 2/32 Gig 3/23 Gig 2/33 Configuring a LAG on ALPHA Figure 24-12.
PAGE 551
Figure 24-13. Inspecting a LAG Port Configuration on ALPHA Alpha#sh int gig 2/31 GigabitEthernet 2/31 is up, line protocol is up Port is part of Port-channel 10 Hardware is Force10Eth, address is 00:01:e8:06:95:c0 Current address is 00:01:e8:06:95:c0 Interface index is 109101113 Port will not be disabled on partial SFM failure Internet address is not set MTU 1554 bytes, IP MTU 1500 bytes Shows the speed of this physical interface.
PAGE 552
www.dell.com | support.dell.com Figure 24-14. 552 Inspecting Configuration of LAG 10 on ALPHA Indicates the MAC address assigned to the LAG. This does NOT match any of the physical interface MAC addresses.
PAGE 553
Figure 24-15. Using the show lacp Command to Verify LAG 10 Status on ALPHA Alpha#sho lacp 10 Port-channel 10 admin up, oper up, mode lacp Actor System ID: Priority 32768, Address 0001.e806.953e Partner System ID: Priority 32768, Address 0001.e809.
PAGE 554
www.dell.com | support.dell.com Summary of the configuration on ALPHA Figure 24-16.
PAGE 555
Summary of the configuration on BRAVO Figure 24-17.
PAGE 556
www.dell.com | support.dell.com Figure 24-18. 556 Using the show interface Command to Inspect a LAG Port on BRAVO Shows the status of this nterface. Also shows it is part of LAG 10. Bravo#show int gig 3/21 GigabitEthernet 3/21 is up, line protocol is up Port is part of Port-channel 10 Hardware is Force10Eth, address is 00:01:e8:09:c3:82 Current address is 00:01:e8:09:c3:82 Shows that this is a Layer 2 port.
PAGE 557
Figure 24-19. Using the show interfaces port-channel Command to Inspect LAG 10 This does NOT match any of the physical interface MAC addresses.
PAGE 558
www.dell.com | support.dell.com Figure 24-20. Using the show lacp Command to Inspect LAG Status Force10#show lacp 10 Port-channel 10 admin up, oper up, mode lacp Actor System ID: Priority 32768, Address 0001.e809.c24a Partner System ID: Priority 32768, Address 0001.e806.
PAGE 559
25 Layer 2 Layer 2 features are supported on platforms ces The E-Series ExaScale platform is supported with FTOS 8.1.1.0 and later.
PAGE 560
www.dell.com | support.dell.com Clear the MAC Address Table You may clear the MAC address table of dynamic entries: Task Command Syntax Command Mode Clear a MAC address table of dynamic entries.
PAGE 561
Configure a Static MAC Address A static entry is one that is not subject to aging. Static entries must be entered manually: Task Command Syntax Command Mode Create a static MAC address entry in the MAC address table. mac-address-table static CONFIGURATION Display the MAC Address Table To display the contents of the MAC address table: Task Command Syntax CommandMode Display the contents of the MAC address table. • address displays the specified entry. • aging-time displays the configured aging-time.
PAGE 562
www.dell.com | support.dell.
PAGE 563
mac learning-limit dynamic After you enable a MAC learning limit, MAC addresses learned on the port and entered in the MAC address table are static by default. If you configure the MAC learning dynamic option, learned MAC addresses are stored in the dynamic region of the table and are subject to aging. Entries created before this option is set are not affected. On the C-Series and S-Series, the MAC address table is stored in the Layer 2 FIB region of CAM.
PAGE 564
www.dell.com | support.dell.com mac learning-limit no-station-move Note: Sticky MAC is not supported on the S25 or S50 in FTOS release 8.4.2.6. The no-station-move option, also known as “sticky MAC,” provides additional port security by preventing a station move. When this option is configured, the first entry in the table is maintained instead of creating a new entry on the new interface. no-station-move is the default behavior. Entries created before this option is set are not affected.
PAGE 565
FTOS Behavior: The following conditions apply when you enable the sticky-MAC address option for MAC learning on an interface: • When you enable the sticky MAC learning option, all dynamically-learned MAC addresses that you save to the start-up configuration are converted to statically-configured MAC addresses when you reboot the switch.
PAGE 566
www.dell.com | support.dell.com Displaying MAC Learning-Limited Interfaces To display a list of all interfaces with a MAC learning limit: Task Command Syntax Command Mode Display a list of all interfaces with a MAC learning limit.
PAGE 567
To display a list of interfaces configured with MAC learning limit or station move violation actions: Task Command Syntax Command Mode Display a list of all of the interfaces configured with MAC learning limit or station move violation.
PAGE 568
www.dell.com | support.dell.com Figure 25-1. Per-VLAN MAC Learning Limit Internet Exchange Point 802.1QTagged interface GigabitEthernet 1/1 ... mac learning-limit 1 vlan 10 mac learning-limit 1 vlan 20 ISP A ISP B ISP C ISP A, B, and C are all public peers through VLAN 10. In addition, ISP A and C are private peers on a separate VLAN, VLAN 20. Since the access ports for ISP A and C are members of multiple VLANs, Per-VLAN MAC Learning Limit can be applied to those ports.
PAGE 569
NIC Teaming NIC teaming is a feature that allows multiple network interface cards in a server to be represented by one MAC address and one IP address in order to provide transparent redundancy, balancing, and to fully utilize network adapter resources. Figure 25-2 shows a topology where two NICs have been teamed together. In this case, if the primary NIC fails, traffic switches to the secondary NIC, since they are represented by the same set of addresses. Figure 25-2.
PAGE 570
www.dell.com | support.dell.com Figure 25-3. Configuring mac-address-table station-move refresh-arp Command X MAC: A:B:C:D A:B IP: 1.1.1.1 Port 0/1 Move MAC address k Active Lin Port 0/5 fnC0026mp mac-address-table station-move refresh-arp configured at time of NIC teaming MAC Move Optimization MAC Move Optimization is supported only on platform: e Station-move detection takes 5000ms because this is the interval at which the detection algorithm runs.
PAGE 571
Since the virtual MAC address is never learned, traffic is forwarded to only one server rather than the entire cluster, and failover and balancing are not preserved (Figure 25-5). Figure 25-4.
PAGE 572
www.dell.com | support.dell.com Figure 25-6.
PAGE 573
Configuring Redundant Pairs Configuring Redundant Pairs is supported: • • ces On physical interfaces on platforms On static and dynamic port-channel interfaces on platforms ces The Redundant Pairs feature allows you to provide redundancy for Layer 2 links without using Spanning Tree (STP). You create redundant links by configuring pairs of Layer 2 (physical or port-channel) interfaces so that only one interface is up and carries user traffic at any time.
PAGE 574
www.dell.com | support.dell.com To ensure that existing network applications see no difference when a primary interface in a redundant pair transitions to the backup interface, be sure to apply identical configurations of other traffic parameters to each interface. If you remove an interface in a redundant link (remove the line card of a physical interface or delete a port channel with the no interface port-channel command), the redundant pair configuration is also removed.
PAGE 575
In Figure 25-8, interface 3/41 is a backup interface for 3/42, and 3/42 is DOWN as shown in message Message 1. If 3/41 fails, 3/42 transitions to the UP state, which makes the backup link active. A message similar to Message 1 appears whenever you configure a backup port.
PAGE 576
www.dell.com | support.dell.com Restricting Layer 2 Flooding Restricting Layer 2 Flooding is supported only on platform: et When Layer 2 multicast traffic must be forwarded on a VLAN that has multiple ports with different speeds on the same port-pipe, forwarding is limited to the speed of the slowest port.
PAGE 577
Far-end Failure Detection Far-end Failure Detection is supported only on platform: e Far-end Failure Detection (FEFD) is a protocol that senses remote data link errors in a network. It responds by sending a unidirectional report that triggers an echoed response after a specified time interval. Figure 25-10.
PAGE 578
www.dell.com | support.dell.com 5. If the FEFD system has been set to Aggressive mode and neighboring echoes are not received after three intervals, the state changes to Err-disabled. All interfaces in the Err-disabled state must be manually reset using the fefd reset [interface] command in EXEC privilege mode (it can be done globally or one interface at a time) before the FEFD enabled system can become operational again. Table 25-1.
PAGE 579
Step Task Command Syntax Command Mode 2 Activate the necessary ports administratively no shutdown INTERFACE 3 Enable fefd globally fefd {interval | mode} CONFIGURATION Entering the show fefd command in EXEC privilege mode displays information about the state of each interface. Figure 25-11. Show FEFD global outputs FTOS#show fefd FEFD is globally 'ON', interval is 3 seconds, mode is 'Normal'.
PAGE 580
www.dell.com | support.dell.com Figure 25-12. FEFD enabled interface configuration FTOS(conf-if-gi-1/0)#show config ! interface GigabitEthernet 1/0 no ip address switchport fefd mode normal no shutdown FTOS(conf-if-gi-1/0)#do show fefd | grep 1/0 Gi 1/0 Normal 3 Unknown Debugging FEFD By entering the command debug fefd events in EXEC privilege mode, output is displayed whenever events occur that initiate or disrupt an FEFD enabled connection. Figure 25-13.
PAGE 581
During an RPM Failover In the event that an RPM failover occurs, FEFD will become operationally down on all enabled ports for approximately 8-10 seconds before automatically becoming operational again. Figure 25-15. FEFD state change during an RPM failover 02-05-2009 12:40:38 Local7.Debug 10.16.151.12 Feb 5 07:06:09: %RPM1-S:CP %RAM-6-FAILOVER_REQ: RPM failover request from active peer: User request. 02-05-2009 12:40:38 Local7.Debug 10.16.151.
PAGE 582
| Layer 2 www.dell.com | support.dell.
PAGE 583
26 Link Layer Discovery Protocol Link Layer Discovery Protocol is supported only on platforms: ces LLDP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. This chapter contains the following sections: • • • • 802.1AB (LLDP) Overview TIA-1057 (LLDP-MED) Overview 802.3AT (Power-via-MDI) Overview Configuring LLDP 802.1AB (LLDP) Overview Link Layer Discovery Protocol (LLDP)—defined by IEEE 802.
PAGE 584
www.dell.com | support.dell.com Figure 26-1. Type, Length, Value (TLV) Segment TLV Header TLV Type (1-127) TLV Length Value 9 bits 7 bits 0-511 octets Chassis ID Sub-type Chassis ID fnC0057mp 1- 255 octets 1 octet TLVs are encapsulated in a frame called an LLDP Data Unit (LLDPDU) (Figure 26-2), which is transmitted from one LLDP-enabled device to its LLDP-enabled neighbors. LLDP is a one-way protocol.
PAGE 585
Optional TLVs FTOS supports the following optional TLVs: Management TLVs • • • IEEE 802.1 and 802.3 Organizationally Specific TLVs TIA-1057 Organizationally Specific TLVs Management TLVs A Management TLV is an Optional TLVs sub-type. This kind of TLV contains essential management information about the sender. The five types are described in Table 26-2. Organizationally Specific TLVs Organizationally specific TLVs can be defined by a professional organization or a vendor.
PAGE 586
www.dell.com | support.dell.com Table 26-2. Optional TLV Types Type TLV Description 7 System capabilities Identifies the chassis as one or more of the following: repeater, bridge, WLAN Access Point, Router, Telephone, DOCSIS cable device, end station only, or other 8 Management address Indicates the network address of the management interface. FTOS does not currently support this TLV. IEEE 802.
PAGE 587
With regard to connected endpoint devices, LLDP-MED provides network connectivity devices with the ability to: • • • • manage inventory manage Power over Ethernet (PoE) or Power over Ethernet Plus (PoE+) identify physical location identify network policy LLDP-MED is designed for, but not limited to, VoIP endpoints. TIA Organizationally Specific TLVs The Dell Networking system is an LLDP-MED Network Connectivity Device (Device Type 4).
PAGE 588
www.dell.com | support.dell.com Table 26-3. Type TIA-1057 (LLDP-MED) Organizationally Specific TLVs (continued) Sub-type 127 11 127 12-255 TLV Description Inventory - Asset ID Indicates a user specified device number to manage inventory Reserved — LLDP-MED Capabilities TLV The LLDP-MED Capabilities TLV communicates the types of TLVs that the endpoint device and the network connectivity device support. LLDP-MED network connectivity devices must transmit the Network Policies TLV.
PAGE 589
Table 26-5.
PAGE 590
www.dell.com | support.dell.com Table 26-6. Type Network Policy Applications (continued) Application Description 7 Streaming Video Specify this application type for broadcast or multicast based video content distribution and other similar applications supporting streaming video services. This does not include video applications relying on TCP with buffering. 8 Video Signaling Specify this application type only if video control packets use a separate network policy than video data.
PAGE 591
802.3AT (Power-via-MDI) Overview Link Layer Discovery Protocol (LLDP)—defined by IEEE 802.1AB-2009—is a MAC client protocol that allows stations attached to a LAN to advertise to all other stations attached to the same LAN. Figure 26-7 shows the IEEE 802.3 LLDP frame format. Figure 26-7. IEEE 802.3 LLDP Frame Format • • • • Destination Address—Contains a MAC address. Source Address—Contains the 48-bit individual address of the station sending the frame.
PAGE 592
www.dell.com | support.dell.com Table 26-7. IEEE 802.3 Organizationally Specific TLVs IEEE 802.3 Subtype TLV Name 1 MAC/PHY Configuration/Status 2 Power Via Medium Dependent Interface (MDI) 3 Link Aggregation (deprecated) 4 Maximum Frame Size 5–255 Reserved Power-Via-MDI TLV The Power-Via-MDI TLV allows network management to advertise and discover the MDI power support capabilities of the sending LAN station. This TLV is also required to perform Data Link Layer classification.
PAGE 593
PD sends five pieces of information in the Power-via-MDI TLV: • • • • • Power Class: FTOS honors and displays it in the show power inline EXEC command (the PD requested power value must be within the class maximum watts limit). Type: FTOS honors this request only when it is Type1 or Type2 PD and displays it in the show power inline EXEC command. It does not honor Type1 or Type2 PSE requests. Priority: FTOS honors this and uses it for priority calculation.
PAGE 594
www.dell.com | support.dell.com • 802.1X controlled ports do not allow LLDPDUs until the connected device is authenticated. CONFIGURATION versus INTERFACE Configurations All LLDP configuration commands are available in PROTOCOL LLDP mode, which is a sub-mode of CONFIGURATION mode and INTERFACE mode. • • Configurations made at CONFIGURATION level are global, that is, they affect all interfaces on the system.
PAGE 595
Enabling LLDP LLDP is disabled by default. LLDP can be enabled and disabled globally or per interface. If LLDP is enabled globally, all up interfaces send periodic LLDPDUs. To enable LLDP: Step Task Command Command Mode 1 Enter Protocol LLDP mode. protocol lldp CONFIGURATION or INTERFACE 2 Enable LLDP. no disable PROTOCOL LLDP Disabling and Undoing LLDP • • Disable LLDP globally or for an interface using the command disable.
PAGE 596
www.dell.com | support.dell.com Step 2 Task Command Command Mode Advertise one or more TLVs. Include the keyword for each TLV you want to advertise. • For management TLVs: system-capabilities, advertise {management-tlv | dot1-tlv | dot3-tlv | med} PROTOCOL LLDP system-description • For 802.1 TLVs: port-protocol-vlan-id, • • For 802.
PAGE 597
Figure 26-11. Viewing LLDP Global Configurations R1(conf)#protocol lldp R1(conf-lldp)#show config ! protocol lldp advertise dot1-tlv port-protocol-vlan-id port-vlan-id advertise dot3-tlv max-frame-size advertise management-tlv system-capabilities system-description hello 10 no disable R1(conf-lldp)# Figure 26-12.
PAGE 598
www.dell.com | support.dell.com Figure 26-14.
PAGE 599
Figure 26-15.
PAGE 600
www.dell.com | support.dell.com Figure 26-16.
PAGE 601
Figure 26-17.
PAGE 602
www.dell.com | support.dell.com Figure 26-18.
PAGE 603
Table 26-8.
PAGE 604
www.dell.com | support.dell.com Table 26-9.
PAGE 605
Table 26-10. LLDP 802.
PAGE 606
www.dell.com | support.dell.com Table 26-11.
PAGE 607
Table 26-11.
PAGE 608
www.dell.com | support.dell.
PAGE 609
27 Multicast Listener Discovery Multicast Listener Discovery is supported only on platform: MLD Snooping is supported only on platform: e e Multicast Listener Discovery (MLD) is a Layer 3 protocol that IPv6 routers use to learn of the multicast receivers that are directly connected to them and the groups in which the receivers are interested. Multicast routing protocols (like PIM) use the information learned from MLD to route multicast traffic to all interested receivers.
PAGE 610
www.dell.com | support.dell.com • • Maximum Response Delay—the maximum amount of time that the Querier waits to receive a response to a General or Multicast-Address-Specific Query. The value is zero in reports and Done messages. Multicast Address — set to zero in General Queries, and set to the relevant multicast address in multicast-address-specific queries and done messages. Figure 27-1.
PAGE 611
Leaving a Multicast Group A receiver that is no longer interested in traffic for a particular group should leave the group by sending a Done message to the link-scope all-routers multicast address, FF02::02. When a Querier receives a Done message, it sends a Multicast-Address-Specific Query addressed to the relevant multicast group. Hosts still interested in receiving traffic for that group (according to the suppression mechanism) so that the group table entry is maintained.
PAGE 612
www.dell.com | support.dell.com Figure 27-3.
PAGE 613
• • Debug MLD MLD Snooping Change MLD Timer Values All non-queriers have a timer that is refreshed when it hears a General Query. If the timer expires, then the router can assume that the Querier is not present, and so it assumes the role of Querier. The Other Querier Present Interval, or Querier Timeout Interval, is the amount of time that passes before a non-querier router assumes that there is no longer a Querier on the link. Task Command Syntax Command Mode Adjust the querier-timeout value.
PAGE 614
www.dell.com | support.dell.com Last Member Query Interval The Querier sends a Multicast-Address-Specific Query upon receiving a Done message to ascertain whether there are any remain receivers for a group. The Last Listener Query Interval is the Maximum Response Delay for a Multicast-Address-Specific Query, and also the amount of time between Multicast-Address-Specific Query retransmissions.
PAGE 615
Display the MLD Group Table Task Command Syntax Command Mode Display MLD groups. Group information can be filtered, see the FTOS Command Line Reference for the options available with this command. show ipv6 mld {groups | interface} EXEC Privilege Clear MLD Groups Clear a specific group or all groups on an interface from the multicast routing table using the command clear ipv6 mld groups from EXEC Privilege mode. Change the MLD Version Task Command Syntax Command Mode Change the MLD version.
PAGE 616
www.dell.com | support.dell.com Enable MLD Snooping MLD is automatically enabled when you enable IPv6 PIM, but MLD Snooping must be explicitly enabled. Task Command Syntax Command Mode Enable MLD Snooping ipv6 mld snooping enable CONFIGURATION Disable MLD Snooping on a VLAN When MLD is enabled globally, it is by default enabled on all VLANs. Disable snooping on a VLAN, using the command no ipv6 mld snooping from INTERFACE VLAN mode.
PAGE 617
View the ports that are connected to multicast routers using the command show ipv6 mld snooping mrouter from EXEC Privilege mode. Enable Snooping Explicit Tracking The switch can be a querier, and therefore also has the option of updating the group table through explicit-tracking (see Explicit Tracking). Whether the switch is the Querier or not, if snooping is enabled, the switch tracks all MLD joins.
PAGE 618
www.dell.com | support.dell.com Figure 27-4. Port Inheritance on Mixed-mode VLANs Snooping Table VLAN 10 1 2 MLDv2 IGMP (*,G) 1 (*,G) 1, 3 (S,G) 1*, 3 3 4 exclude (*,G) include (S,G) In Figure 27-4, the host on Port 1 sends an exclude—that is, exclude nothing—report to join group G and receive traffic from all transmitting sources for the group. FTOS creates a (*,G) entry and lists Port 1 in the outgoing interface list.
PAGE 619
28 Multicast Source Discovery Protocol Multicast Source Discovery Protocol is supported only on platform e MSDP addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Multicast Source Discovery Protocol (MSDP) is a Layer 3 protocol that connects IPv4 PIM-SM domains. A domain in the context of MSDP is contiguous set of routers operating PIM within a common boundary defined by an exterior gateway protocol, such as BGP.
PAGE 620
Multicast Source Discovery Protocol + + P 3 MPC IG Receiver OS PF + PI M PC 2 Source MP IG 4/1 AS Y Area 0 R4 4/31 2/1 + PI M AS X Area 0 OS PF www.dell.com | support.dell.com Figure 28-1. BGP R2 2/11 3/21 3/41 R3 P Pe MSD 1/21 1/2 R1 ersh ip RP RP1 1/1 PC 1 Receiver RPs advertise each (S,G) in its domain in Type, Length, Value (TLV) format. The total number of TLVs contained in the SA is indicated in the “Entry Count” field.
PAGE 621
Configuring Multicast Source Discovery Protocol Configuring MSDP is a three-step process: 1. Enable an exterior gateway protocol (EGP) with at least two routing domains. Figure 28-5 and MSDP Sample Configurations show the OSPF-BGP configuration used in this chapter for MSDP. Otherwise, see Chapter 32, Open Shortest Path First (OSPFv2 and OSPFv3) and Chapter 10, Border Gateway Protocol IPv4 (BGPv4). 2. Configure PIM-SM within each EGP routing domain.
PAGE 622
interface GigabitEthernet 1/1 ip pim sparse-mode ip address 10.11.3.1/24 no shutdown ! interface GigabitEthernet 1/2 ip address 10.11.2.1/24 no shutdown ! interface GigabitEthernet 1/21 ip pim sparse-mode ip address 10.11.1.12/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.1/32 no shutdown | Multicast Source Discovery Protocol 1/1 1/21 PC 1 : 10.11.3.2/24 R1 1/2 interface GigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.4.
PAGE 623
router ospf 1 network 10.11.2.0/24 area 0 network 10.11.1.0/24 area 0 network 192.168.0.1/32 area 0 network 10.11.3.0/24 area 0 router ospf 1 network 192.168.0.1/32 area 0 network 10.11.1.0/24 area 0 network 10.11.4.0/24 area 0 redistribute static redistribute connected redistribute bgp 100 R2_E300(conf)#do show run bgp ! router bgp 100 redistribute ospf 1 neighbor 192.168.0.3 remote-as 200 neighbor 192.168.0.3 ebgp-multihop 255 neighbor 192.168.0.3 update-source Loopback 0 neighbor 192.168.0.
PAGE 624
| Multicast Source Discovery Protocol M PI P GM +I R1 1/2 RP1 PC 2 Receiver: 239.0.0.1 1/1 1/21 ip multicast routing ! ip pim rp-address 192.168.0.1 group-address 224.0.0.0/4 AS 100 R2 2/31 R3 3/41 4/31 R4 AS 200 ip multicast-routing ! ip pim rp-address 192.168.0.3 group-address 224.0.0.0/4 ip multicast-routing ! ip pim rp-address 192.168.0.3 group-address 224.0.0.0/4 4/1 P GM + I PC 3 Receiver: 239.0.0.1 RP2 3/21 M PI ip multicast-routing ! ip pim rp-address 192.168.0.
PAGE 625
R1_E600(conf)#do show ip msdp sa-cache MSDP Source-Active Cache - 1 entries GroupAddr SourceAddr RPAddr LearnedFrom Expire UpTime 239.0.0.1 10.11.4.2 192.168.0.1 local 95 16:49:25 (10.11.4.2, 239.0.0.1), uptime 1d16h, expires 00:03:12, flags: CTA Incoming interface: GigabitEthernet 1/21, RPF neighbor 10.11.1.21 Outgoing interface list: GigabitEthernet 1/1 Forward/Sparse 22:26:37/Never (*, 239.0.0.1), uptime 22:26:37, expires 00:00:00, RP 192.168.0.
PAGE 626
www.dell.com | support.dell.com Enable MSDP Enable MSDP by peering RPs in different administrative domains. Step Task Command Syntax Command Mode 1 Enable MSDP. ip multicast-msdp CONFIGURATION 2 PeerPIM systems in different administrative domains. ip msdp peer connect-source CONFIGURATION Figure 28-7. Configuring an MSDP Peer R3_E600(conf)#ip multicast-msdp R3_E600(conf)#ip msdp peer 192.168.0.1 connect-source Loopback 0 R3_E600(conf)#do show ip msdp summary Peer Addr 192.168.0.
PAGE 627
• • RPs can transmit SA messages periodically to prevent SA storms, and only sources that are in the cache are advertised in the SA to prevent transmitting multiple copies of the same source information. View the Source-active Cache Task Command Syntax Command Mode View the SA cache. show ip msdp sa-cache EXEC Privilege Figure 28-9. Displaying the MSDP Source-active Cache R3_E600#show ip msdp sa-cache MSDP Source-Active Cache - 1 entries GroupAddr SourceAddr RPAddr 239.0.0.1 10.11.4.2 192.168.0.
PAGE 628
www.dell.com | support.dell.com • • Task Command Syntax Command Mode Cache rejected sources. ip msdp cache-rejected-sa CONFIGURATION Accept Source-active Messages that fail the RFP Check A default peer is a peer from which active sources are accepted even though they fail the RFP check. • • • • 628 the peer RP is unreachable, or because of an SA message format error. | In Scenario 1 of Figure 28-10, all MSPD peers are up.
PAGE 629
Figure 28-10.
PAGE 630
www.dell.com | support.dell.com Task Command Syntax Command Mode Specify the forwarding-peer and originating-RP from which all active sources are accepted without regard for the the RPF check. If you do not specify an access list, the peer accepts all sources advertised by that peer. All sources from RPs denied by the ACL are subjected to the normal RPF check. ip msdp default-peer ip-address list CONFIGURATION Figure 28-11. Accepting Source-active Messages with FTOS(conf)#ip msdp peer 10.0.50.
PAGE 631
Prevent MSDP from Caching a Local Source You can prevent MSDP from caching an active source based on source and/or group. Since the source is not cached, it is not advertised to remote RPs. Task Command Syntax Command Mode OPTIONAL: Cache sources that are denied by the redistribute list in the rejected SA cache. ip msdp cache-rejected-sa CONFIGURATION Prevent the system from caching local SA entries based on source and group using an extended ACL.
PAGE 632
www.dell.com | support.dell.com Prevent MSDP from Caching a Remote Source Task Command Syntax Command Mode OPTIONAL: Cache sources that are denied by the SA filter in the rejected SA cache. ip msdp cache-rejected-sa CONFIGURATION Prevent the system from caching remote sources learned from a specific peer based on source and group. ip msdp sa-filter list out peer list ext-acl CONFIGURATION In Figure 28-14, R1 is advertising source 10.11.4.2.
PAGE 633
Prevent MSDP from Advertising a Local Source Task Command Syntax Command Mode Prevent an RP from advertising a source in the SA cache. ip msdp sa-filter list in peer list ext-acl CONFIGURATION In Figure 28-14, R1 stops advertising source 10.11.4.2. Since it is already in the SA cache of R3, the entry remains there until it expires. Figure 28-14. Preventing MSDP from Advertising a Local Source [Router 1] R1_E600(conf)#do show run msdp ! ip multicast-msdp ip msdp peer 192.168.0.
PAGE 634
www.dell.com | support.dell.com Log Changes in Peership States Task Command Syntax Command Mode Log peership state changes. ip msdp log-adjacency-changes CONFIGURATION Terminate a Peership MSDP uses TCP as its transport protocol. In a peering relationship, the peer with the lower IP address initiates the TCP session, while the peer with the higher IP address listens on port 639. Task Command Syntax Command Mode Terminate the TCP connection with a peer.
PAGE 635
Clear Peer Statistics Task Command Syntax Command Mode Reset the TCP connection to the peer and clear all peer statistics. clear ip msdp peer peer-address CONFIGURATION Figure 28-16. Clearing Peer Statistics R3_E600(conf)#do show ip msdp peer Peer Addr: 192.168.0.1 Local Addr: 192.168.0.
PAGE 636
www.dell.com | support.dell.com Debug MSDP Task Command Syntax Command Mode Display the information exchanged between peers. debug ip msdp CONFIGURATION Figure 28-17. Debugging MSDP R1_E600(conf)#do debug ip msdp All MSDP debugging has been turned on R1_E600(conf)#03:16:08 : MSDP-0: Peer 03:16:09 : MSDP-0: Peer 192.168.0.3, 03:16:27 : MSDP-0: Peer 192.168.0.3, 03:16:38 : MSDP-0: Peer 192.168.0.3, 03:16:39 : MSDP-0: Peer 192.168.0.3, 03:17:09 : MSDP-0: Peer 192.168.0.3, 03:17:10 : MSDP-0: Peer 192.
PAGE 637
MSDP with Anycast RP (10.11.4.2, 239.0.0.1), uptime 00:00:52, expires 00:03:20, flags: FTA Incoming interface: GigabitEthernet 2/1, RPF neighbor 0.0.0.0 Outgoing interface list: GigabitEthernet 2/11 Forward/Sparse 00:00:50/00:02:40 GigabitEthernet 2/31 Forward/Sparse 00:00:50/00:02:40 PI M AS X Area 0 + PI M PC 2 Source + MP IG PC 3 Receiver OS PF + Figure 28-18. MP IG 4/1 R4 4/31 OS PF + 2/1 BGP (*, 239.0.0.1), uptime 00:00:23, expires 00:00:00, RP 192.168.0.
PAGE 638
www.dell.com | support.dell.com Reducing Source-active Message Flooding RPs flood source-active messages to all of their peers away from the RP. When multiple RPs exist within a domain, the RPs forward received active source information back to the originating RP, which violates the RFP rule. You can prevent this unnecessary flooding by creating a mesh-group. A mesh in this context is a topology in which each RP in a set of RPs has a peership with all other RPs in the set.
PAGE 639
Figure 28-19. R1 Configuration for MSDP with Anycast RP ip multicast-routing ! interface GigabitEthernet 1/1 ip pim sparse-mode ip address 10.11.3.1/24 no shutdown ! interface GigabitEthernet 1/2 ip address 10.11.2.1/24 no shutdown ! interface GigabitEthernet 1/21 ip pim sparse-mode ip address 10.11.1.12/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.1/32 no shutdown ! interface Loopback 1 ip address 192.168.0.11/32 no shutdown ! router ospf 1 network 10.11.2.
PAGE 640
www.dell.com | support.dell.com Figure 28-20. 640 R2 Configuration for MSDP with Anycast RP ip multicast-routing ! interface GigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.4.1/24 no shutdown ! interface GigabitEthernet 2/11 ip pim sparse-mode ip address 10.11.1.21/24 no shutdown ! interface GigabitEthernet 2/31 ip pim sparse-mode ip address 10.11.0.23/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.1/32 no shutdown ! interface Loopback 1 ip address 192.168.0.
PAGE 641
Figure 28-21. R3 Configuration for MSDP with Anycast RP ip multicast-routing ! interface GigabitEthernet 3/21 ip pim sparse-mode ip address 10.11.0.32/24 no shutdown interface GigabitEthernet 3/41 ip pim sparse-mode ip address 10.11.6.34/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.3/32 no shutdown ! router ospf 1 network 10.11.6.0/24 area 0 network 192.168.0.
PAGE 642
www.dell.com | support.dell.com 642 MSDP Sample Configurations The following figures show the running-configurations for the routers shown in figures Figure 28-5, Figure 28-4, Figure 28-5, Figure 28-6. Figure 28-22. MSDP Sample Configuration: R1 Running-config ip multicast-routing ! interface GigabitEthernet 1/1 ip pim sparse-mode ip address 10.11.3.1/24 no shutdown ! interface GigabitEthernet 1/2 ip address 10.11.2.1/24 no shutdown ! interface GigabitEthernet 1/21 ip pim sparse-mode ip address 10.11.1.
PAGE 643
Figure 28-23. MSDP Sample Configuration: R2 Running-config ip multicast-routing ! interface GigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.4.1/24 no shutdown ! interface GigabitEthernet 2/11 ip pim sparse-mode ip address 10.11.1.21/24 no shutdown ! interface GigabitEthernet 2/31 ip pim sparse-mode ip address 10.11.0.23/24 no shutdown ! interface Loopback 0 ip address 192.168.0.2/32 no shutdown ! router ospf 1 network 10.11.1.0/24 area 0 network 10.11.4.0/24 area 0 network 192.168.0.
PAGE 644
www.dell.com | support.dell.com Figure 28-24. 644 MSDP Sample Configuration: R3 Running-config ip multicast-routing ! interface GigabitEthernet 3/21 ip pim sparse-mode ip address 10.11.0.32/24 no shutdown ! interface GigabitEthernet 3/41 ip pim sparse-mode ip address 10.11.6.34/24 no shutdown ! interface ManagementEthernet 0/0 ip address 10.11.80.3/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.3/32 no shutdown ! router ospf 1 network 10.11.6.0/24 area 0 network 192.168.0.
PAGE 645
Figure 28-25. MSDP Sample Configuration: R4 Running-config ip multicast-routing ! interface GigabitEthernet 4/1 ip pim sparse-mode ip address 10.11.5.1/24 no shutdown ! interface GigabitEthernet 4/22 ip address 10.10.42.1/24 no shutdown ! interface GigabitEthernet 4/31 ip pim sparse-mode ip address 10.11.6.43/24 no shutdown ! interface Loopback 0 ip address 192.168.0.4/32 no shutdown ! router ospf 1 network 10.11.5.0/24 area 0 network 10.11.6.0/24 area 0 network 192.168.0.
PAGE 646
www.dell.com | support.dell.
PAGE 647
29 Multiple Spanning Tree Protocol Multiple Spanning Tree Protocol is supported on platforms: ces MSTP addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Multiple Spanning Tree Protocol (MSTP)—specified in IEEE 802.1Q-2003—is an RSTP-based spanning tree variation that improves on PVST+. MSTP allows multiple spanning tree instances and allows you to map many VLANs to one spanning tree instance to reduce the total number of required instances.
PAGE 648
www.dell.com | support.dell.com FTOS supports three other variations of Spanning Tree, as shown in Table 44. Table 29-1. FTOS Supported Spanning Tree Protocols Dell Networking Term IEEE Specification Spanning Tree Protocol 802.1d Rapid Spanning Tree Protocol 802.1w Multiple Spanning Tree Protocol 802.1s Per-VLAN Spanning Tree Plus Third Party Implementation Information • • • • • The FTOS MSTP implementation is based on IEEE 802.
PAGE 649
Enable Multiple Spanning Tree Globally MSTP is not enabled by default. To enable MSTP: Step Task Command Syntax Command Mode 1 Enter PROTOCOL MSTP mode. protocol spanning-tree mstp CONFIGURATION 2 Enable MSTP. no disable PROTOCOL MSTP Verify that MSTP is enabled using the show config command from PROTOCOL MSTP mode, as shown in Figure 29-2. Figure 29-2.
PAGE 650
www.dell.com | support.dell.com Figure 29-3. Mapping VLANs to MSTI Instances FTOS(conf)#protocol spanning-tree mstp FTOS(conf-mstp)#msti 1 vlan 100 FTOS(conf-mstp)#msti 2 vlan 200-300 FTOS(conf-mstp)#show config ! protocol spanning-tree mstp no disable MSTI 1 VLAN 100 MSTI 2 VLAN 200-300 All bridges in the MSTP region must have the same VLAN-to-instance mapping. View to which instance a VLAN is mapped using the command show spanning-tree mst vlan from EXEC Privilege mode, as shown in Figure 29-6.
PAGE 651
Influence MSTP Root Selection MSTP determines the root bridge, but you can assign one bridge a lower priority to increase the probability that it will become the root bridge. To change the bridge priority: Task Command Syntax Command Mode Assign a number as the bridge priority. A lower number increases the probability that the bridge becomes the root bridge.
PAGE 652
www.dell.com | support.dell.com To change the region name or revision: Task Command Syntax Command Mode Change the region name. name name PROTOCOL MSTP Change the region revision number. • Range: 0 to 65535 • Default: 0 revision number PROTOCOL MSTP View the current region name and revision using the command show spanning-tree mst configuration from EXEC Privilege mode, as shown in Figure 29-6. Figure 29-6.
PAGE 653
Task Command Syntax Command Mode Change the hello-time parameter. Note: With large configurations (especially those with more ports) Dell Networking recommends that you increase the hello-time. Range: 1 to 10 Default: 2 seconds hello-time seconds PROTOCOL MSTP Change the max-age parameter. Range: 6 to 40 Default: 20 seconds max-age seconds PROTOCOL MSTP Change the max-hops parameter.
PAGE 654
www.dell.com | support.dell.com Modify Interface Parameters You can adjust two interface parameters to increase or decrease the probability that a port becomes a forwarding port: • • Port cost is a value that is based on the interface type. The greater the port cost, the less likely the port will be selected to be a forwarding port. Port priority influences the likelihood that a port will be selected to be a forwarding port in case that several ports have the same port cost.
PAGE 655
Configure an EdgePort The EdgePort feature enables interfaces to begin forwarding traffic approximately 30 seconds sooner. In this mode an interface forwards frames by default until it receives a BPDU that indicates that it should behave otherwise; it does not go through the Learning and Listening states. The bpduguard shutdown-on-violation option causes the interface hardware to be shutdown when it receives a BPDU.
PAGE 656
www.dell.com | support.dell.com Configure a Root Guard Use the Root Guard feature in a Layer 2 MSTP network to avoid bridging loops. You enable root guard on a per-port or per-port-channel basis. FTOS Behavior: The following conditions apply to a port enabled with root guard: • Root guard is supported on any MSTP-enabled port or port-channel interface except when used as a stacking port.
PAGE 657
Configure a Loop Guard The Loop Guard feature provides protection against Layer 2 forwarding loops (STP loops) caused by a hardware failure, such as a cable failure or an interface fault. When a cable or interface fails, a participating STP link may become unidirectional (STP requires links to be bidirectional) and an STP port does not receive BPDUs. When an STP blocking port does not receive BPDUs, it transitions to a forwarding state. This condition can create a loop in the network.
PAGE 658
www.dell.com | support.dell.com Flush MAC Addresses after a Topology Change FTOS has an optimized MAC address flush mechanism for RSTP, MSTP, and PVST+ that flushes addresses only when necessary, which allows for faster convergence during topology changes. However, you may activate the flushing mechanism defined by 802.1Q-2003 using the command tc-flush-standard, which flushes MAC addresses upon every topology change notification.
PAGE 659
MSTP Sample Configurations The running-configurations in Figure 29-11, Figure 29-12, and Figure 29-12 support the topology shown in Figure 29-10. The configurations are from FTOS systems. An S50 system using SFTOS, configured as shown Figure 29-14, could be substituted for an FTOS router in this sample following topology and MSTP would function as designed. Figure 29-10.
PAGE 660
www.dell.com | support.dell.com Figure 29-11.
PAGE 661
Figure 29-12.
PAGE 662
www.dell.com | support.dell.com Figure 29-13.
PAGE 663
Figure 29-14.
PAGE 664
www.dell.com | support.dell.com Debugging and Verifying MSTP Configuration Display BPDUs using the command debug spanning-tree mstp bpdu from EXEC Privilege mode. Display MSTP-triggered topology change messages debug spanning-tree mstp events. Figure 29-15. Displaying BPDUs and Events FTOS#debug spanning-tree mstp bpdu 1w1d17h : MSTP: Sending BPDU on Gi 1/31 : ProtId: 0, Ver: 3, Bpdu Type: MSTP, Flags 0x68 CIST Root Bridge Id: 32768:0001.e806.953e, Ext Path Cost: 20000 Regional Bridge Id: 32768:0001.
PAGE 665
Figure 29-16. Sample Output for show running-configuration spanning-tree mstp command FTOS#show run spanning-tree mstp ! protocol spanning-tree mstp name Tahiti revision 123 MSTI 1 VLAN 100 MSTI 2 VLAN 200,300 Figure 29-17. Displaying BPDUs and Events - Debug Log of Successful MSTP Configuration FTOS#debug spanning-tree mstp bpdu MSTP debug bpdu is ON FTOS# 4w0d4h : MSTP: Sending BPDU on Gi 2/21 : ProtId: 0, Ver: 3, Bpdu Type: MSTP, Flags 0x6e CIST Root Bridge Id: 32768:0001.e806.
PAGE 666
www.dell.com | support.dell.
PAGE 667
30 Multicast Features Multicast Features are supported on platforms: ces Multicast is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later.
PAGE 668
www.dell.com | support.dell.com Prior to enabling any multicast protocols, you must enable multicast routing. Task Command Syntax Command Mode Enable multicast routing. ip multicast-routing CONFIGURATION Multicast with ECMP Dell Networking multicast uses Equal-cost Multi-path (ECMP) routing to load-balance multiple streams across equal cost links.
PAGE 669
Implementation Information • Because protocol control traffic in FTOS is redirected using the MAC address, and multicast control traffic and multicast data traffic might map to the same MAC address, FTOS might forward data traffic with certain MAC addresses to the CPU in addition to control traffic. As the upper five bits of an IP Multicast address are dropped in the translation, 32 different multicast group IDs all map to the same Ethernet address. For example, 224.0.0.
PAGE 670
www.dell.com | support.dell.com Limit the Number of Multicast Routes Task Command Syntax Command Mode Limit the total number of multicast routes on the system. ip multicast-limit CONFIGURATION Range: 1-50000 Default: 15000 When the limit is reached, FTOS does not process any IGMP or MLD joins to PIM—though it still processes leave messages—until the number of entries decreases below 95% of the limit.
PAGE 671
Prevent a Host from Joining a Group You can prevent a host from joining a particular group by blocking specific IGMP reports. Create an extended access list containing the permissible source-group pairs. Use the command ip igmp access-group access-list-name from INTERFACE mode to apply the access list. Note: For rules in IGMP access lists, source is the multicast source, not the source of the IGMP packet.
PAGE 672
| Multicast Features ip igmp snooping enable interface Vlan 400 ip pim sparse-mode ip address 10.11.4.1/24 untagged GigabitEthernet 1/2 ip igmp access-group igmpjoinfilR2G2 no shutdown (*, 239.0.0.1), uptime 00:00:06, expires 00:00:00, RP 10.11.12.2, flags: SCJ Incoming interface: GigabitEthernet 1/21, RPF neighbor 10.11.12.2 Outgoing interface list: Vlan 400 Forward/Sparse 00:00:06/Never interface GigabitEthernet 2/31 ip pim sparse-mode ip address 10.11.23.
PAGE 673
Rate Limit IGMP Join Requests If you expect a burst of IGMP Joins, protect the IGMP process from overload by limiting that rate at which new groups can be joined using the command ip igmp group-join-limit from INTERFACE mode. Hosts whose IGMP requests are denied will use the retry mechanism built-in to IGMP so that they’re membership is delayed rather than permanently denied. View the enable status of this feature using the command show ip igmp interface from EXEC Privilege mode.
PAGE 674
| Multicast Features (10.11.5.2, 239.0.0.2), uptime 00:00:33, expires 00:03:07, flags: CT Incoming interface: GigabitEthernet 1/31, RPF neighbor 10.11.13.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:00:40/Never (*, 239.0.0.2), uptime 00:00:40, expires 00:00:00, RP 10.11.12.2, flags: SCJ Incoming interface: GigabitEthernet 1/21, RPF neighbor 10.11.12.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:00:40/Never (10.11.5.2, 239.0.0.
PAGE 675
Using a Static Multicast MAC Address Using a Static Multicast MAC Address is supported on platform c When a multicast source and multicast receivers are in the same VLAN, you can configure a router so that multicast traffic is switched only to the ports assigned to a VLAN that is associated with a static multicast MAC address. This task improves router performance by limiting the output ports to which multicast data is sent.
PAGE 676
www.dell.com | support.dell.com To display the current configuration of Layer 2 multicast switching on a router, enter the show mac-address-table static multicast [vlan vlan-id | multicast-mac-address [vlan vlan-id]] command in EXEC mode. Static MAC addresses configured for Layer 2 multicast forwarding with an associated VLAN and assigned output ports are displayed as shown in Figure 30-4. Figure 30-4.
PAGE 677
IPv6 Multicast Policies IPv6 Multicast Policies is available only on platform: • • • • e Limit the Number of IPv6 Multicast Routes Prevent an IPv6 Neighbor from Forming an Adjacency Prevent an IPv6 Source from Registering with the RP Prevent an IPv6 PIM Router from Processing an IPv6 Join Limit the Number of IPv6 Multicast Routes You can limit the total number of IPv6 multicast routes on the system. The maximum number of multicast entries allowed on each line card is determined by the CAM profile.
PAGE 678
www.dell.com | support.dell.com Prevent an IPv6 Source from Registering with the RP Task Command Syntax Command Mode Configured on the source DR, prevent the source DR from sending register packets to the RP for specific sources and groups.
PAGE 679
• MTRACE Transit—when a Dell Networking system is an intermediate router between the source and destination in an MTRACE query, FTOS computes the RPF neighbor for the source, fills in the request, and forwards the request to the RPF neighbor. While computing the RPF neighbor, static mroutes and mBGP routes are preferred over unicast routes. When a Dell Networking system is the last hop to the destination, FTOS sends a response to the query.
PAGE 680
www.dell.com | support.dell.com • • Allocate More Buffer Memory for Multicast WRED Allocate More Bandwidth to Multicast using Egress WFQ Allocate More Buffer Memory for Multicast WRED Allocate more buffer memory to multicast WRED (Weighted Random Early Detection) for bursty multicast traffic that might temporarily become oversubscribed. For example, the example WRED profile in Figure 41-14 allocates multicast traffic a minimum of 40 megabytes (out of 80 megabytes) of buffer memory and up to 60 megabytes.
PAGE 681
31 Object Tracking IPv4/IPv6 Object Tracking is available on platforms: c e s (S50 only) This chapter covers the following information: • • • Object Tracking Overview Object Tracking Configuration Displaying Tracked Objects Object tracking allows FTOS client processes, such as VRRP, to monitor tracked objects (for example, interface or link status) and take appropriate action when the state of an object changes. Note: In release 8.4.1.0, object tracking is supported only on VRRP.
PAGE 682
www.dell.com | support.dell.com You can create a tracked object to monitor the metric of the default route 0.0.0.0/0. After you configure the default route as a tracked object, you can configure the VRRP group to track the state of the route. In this way, the VRRP priority of the router with the better metric as determined by OSPF automatically becomes master of the VRRP group.
PAGE 683
Tracking Layer 3 Interfaces You can create an object that tracks the Layer 3 state (IPv4 or IPv6 routing status) of an interface. • • The Layer 3 status of an interface is UP only if the Layer 2 status of the interface is UP and the interface has a valid IP address. The Layer 3 status of an interface goes DOWN when its Layer 2 status goes down or the IP address is removed from the routing table.
PAGE 684
www.dell.com | support.dell.com • If the scaled metric for a route is greater than or equal to the DOWN threshold or the route is not entered in the routing table, the state of a route is DOWN. The UP and DOWN thresholds are user-configurable for each tracked route. The default UP threshold is 254; the default DOWN threshold is 255. The notification of a change in the state of a tracked object is sent when a metric value crosses a configured threshold.
PAGE 685
You can assign a unique priority-cost value from 1 to 254 to each tracked VRRP object or group interface. The priority cost is subtracted from the VRRP group priority if a tracked VRRP object is in a DOWN state. If a VRRP group router acts as owner-master, the run-time VRRP group priority remains fixed at 255 and changes in the state of a tracked object have no effect. For more information on how to track a VRRP object, see Track an Interface or Object.
PAGE 686
www.dell.com | support.dell.com To configure object tracking on the status of a Layer 2 interface, use the following commands. To remove object tracking on a Layer 2 interface, enter the no track object-id command. Step 1 Task Command Syntax Command Mode Configure object tracking on the line-protocol state of a Layer 2 interface. track object-id interface interface CONFIGURATION line-protocol Valid object IDs are from 1 to 65535.
PAGE 687
For an IPv4 interface, a routing object only tracks the UP/DOWN status of the specified IPv4 interface (track interface ip-routing command). • • The status of an IPv4 interface is UP only if the Layer 2 status of the interface is UP and the interface has a valid IP address. The Layer 3 status of an IPv4 interface goes DOWN when its Layer 2 status goes down (for a Layer 3 VLAN, all VLAN ports must be down) or the IP address is removed from the routing table.
PAGE 688
www.dell.com | support.dell.com Figure 31-4.
PAGE 689
The tracking process uses a protocol-specific resolution value to convert the actual metric in the routing table to a scaled metric in the range 0 to 255. The resolution value is user-configurable and calculates the scaled metric by dividing a route's cost by the resolution value set for the route type: • • • • For ISIS, you can set the resolution in the range 1 to 1000, where the default is 10. For OSPF, you can set the resolution in the range 1 to 1592, where the default is 1.
PAGE 690
www.dell.com | support.dell.com Figure 31-5. Command Example: track ip route reachability FTOS(conf)#track 104 ip route 10.0.0.0/8 reachability FTOS(conf-track-104)#delay up 20 down 10 FTOS(conf-track-104)#end FTOS#show track 104 Track 104 IP route 10.0.0.0/8 reachability Reachability is Down (route not in route table) 2 changes, last change 00:02:49 Tracked by: FTOS#configure FTOS(conf)#track 4 ip route 3.1.1.0/24 reachability vrf vrf1 Figure 31-6.
PAGE 691
Step 3 4 5 Task Command Syntax Command Mode (Optional) Configure the time delay used before communicating a change in the UP and/or DOWN status of a tracked route. delay {[up seconds] [down seconds]} OBJECT TRACKING (Optional) Identify the tracked object with a text description. (Optional) Configure the metric threshold for the UP and/or DOWN routing status to be tracked for the specified route. Valid delay times are from 0 to 180 seconds. Default: 0.
PAGE 692
www.dell.com | support.dell.
PAGE 693
Figure 31-11. Command Example: show track resolution FTOS#show track resolution IP Route Resolution ISIS 1 OSPF 1 IPv6 Route Resolution ISIS 1 OSPF 1 Figure 31-12. Command Example: show track vrf FTOS#show track vrf red Track 5 IP route 192.168.0.
PAGE 694
| Object Tracking www.dell.com | support.dell.
PAGE 695
32 Open Shortest Path First (OSPFv2 and OSPFv3) ces Open Shortest Path First version 3 (OSPF for IPv6) is supported on platforms c e Open Shortest Path First version 2 (OSPF for IPv4) is supported on platforms OSPF for IPv4 is supported on the E-Series ExaScale platform with FTOS 8.1.1.0; OSPF for IPv6 is supported on E-Series ExaScale with FTOS version 8.2.1.0 and later.
PAGE 696
www.dell.com | support.dell.com Protocol Overview Open Shortest Path First (OSPF) routing is a link-state routing protocol that calls for the sending of Link-State Advertisements (LSAs) to all other routers within the same Autonomous System (AS) Areas. Information on attached interfaces, metrics used, and other variables is included in OSPF LSAs. As OSPF routers accumulate link-state information, they use the SPF algorithm (Shortest Path First algorithm) to calculate the shortest path to each node.
PAGE 697
Figure 32-1. Autonomous System Areas Router M Router K Router F Router E Router L Area 200 Router D Router C Router G Area 100 Area 0 Router H Router B Router A Router I Router J Area 300 Area Types The Backbone of the network is Area 0. It is also called Area 0.0.0.0 and is the core of any Autonomous System (AS). All other areas must connect to Area 0. Areas can be defined in such a way that the backbone is not contiguous.
PAGE 698
www.dell.com | support.dell.com A Stub Area (SA) does not receive external route information, except for the default route. These areas do receive information from inter-area (IA) routes. Note that all routers within an assigned Stub area must be configured as stubby, and no generate LSAs that do not apply. For example, a Type 5 LSA is intended for external areas and the Stubby area routers may not generate external LSAs. Stubby areas cannot be traversed by a virtual link.
PAGE 699
Figure 32-2.
PAGE 700
www.dell.com | support.dell.com Area Border Router (ABR) Within an AS, an Area Border (ABR) connects one or more areas to the Backbone. The ABR keeps a copy of the link-state database for every area it connects to, so it may keep multiple copies of the link state database. An Area Border Router (ABR) takes information it has learned on one of its attached areas and can summarize it before sending it out on other areas it is connected to.
PAGE 701
Link-State Advertisements (LSAs) A Link-State Advertisement (LSA) communicates the router's local routing topology to all other local routers in the same area. • • OSPFv3 can treat LSAs as having link-local flooding scope, or store and flood them as if they are understood, while ignoring them in their own SPF algorithms. OSPFv2 always discards unknown LSA types.
PAGE 702
www.dell.com | support.dell.com For all LSA types, there are 20-byte LSA headers. One of the fields of the LSA header is the Link-State ID. Each router link is defined as one of four types: type 1, 2, 3, or 4. The LSA includes a link ID field that identifies, by the network number and mask, the object this link connects to. Depending on the type, the link ID has different meanings.
PAGE 703
Figure 32-3. Priority and Costs Example Router 2 Priority 180 Cost 50 Router 1 Priority 200 Cost 21 Router 3 Priority 100 Cost 25 Router 4 Priority 150 Cost 20 Router 1 selected by the system as DR. Router 2 selected by the system as BDR. If R1 fails, the system subtracts 21 fromR1 s priority number. R1 s new pr iority is 179. R2 as both the selected BDR and the now-highest priority, becomes the DR. If R3 fails, the system subtracts R2 s new priority is130. 50 fromits priority.
PAGE 704
www.dell.com | support.dell.com • • NSSA External (type 7) Opaque Link-local (type 9) Graceful Restart c e and s platforms in Helper and Restart modes. Graceful Restart for OSPFv3 is supported only on et platforms in Helper and Restart modes. Graceful Restart for OSPFv2 is supported on When a router goes down without a Graceful Restart, there is a possibility for loss of access to parts of the network due to ongoing network topology changes.
PAGE 705
• period. You reconfigure OSPFv3 graceful restart to a “restarting-only” role when you enable the helper-reject role on an interface. OSPFv3 supports the helper-reject role on a per-interface basis. Configuring helper-reject role on an OSPFv2 router or OSPFv3 interface enables the restarting-only role globally on the router or locally on the interface. In a helper-reject role, OSPF does not participate in the graceful restart of an adjacent OSPFv2/v3 router.
PAGE 706
www.dell.com | support.dell.com Each OSPFv2 process has a unique process ID and must have an associated Router ID. There must be an equal number of interfaces must be in Layer-3 mode for the number of processes created. For example, if 5 OSPFv2 processes are created on a system, there must be at least 5 interfaces assigned in Layer-3 mode. Each OSPFv2 process is independent.
PAGE 707
Figure 32-4. Enabling RFC-2328 Compliant OSPF Flooding 00:10:41 : OSPF(1000:00): Printed only for ACK packets Rcv. v:2 t:5(LSAck) l:64 Acks 2 rid:2.2.2.2 aid:1500 chk:0xdbee aut:0 auk: keyid:0 from:Vl 1000 LSType:Type-5 AS External id:160.1.1.0 adv:6.1.0.0 seq:0x8000000c LSType:Type-5 AS External id:160.1.2.0 adv:6.1.0.0 seq:0x8000000c 00:10:41 : OSPF(1000:00): Rcv. v:2 t:5(LSAck) l:64 Acks 2 rid:2.2.2.2 aid:1500 chk:0xdbee aut:0 auk: keyid:0 from:Vl 100 LSType:Type-5 AS External id:160.1.1.0 adv:6.1.0.
PAGE 708
www.dell.com | support.dell.com To ensure equal intervals between the routers, manually set the dead interval of the Dell Networking router to match the Cisco configuration. Use the command “ip ospf dead-interval ” in interface mode: Figure 32-6. Command Example: ip ospf intervals FTOS(conf)#int gi 2/2 FTOS(conf-if-gi-2/2)#ip ospf hello-interval 20 FTOS(conf-if-gi-2/2)#ip ospf dead-interval 80 FTOS(conf-if-gi-2/2)# Figure 32-7.
PAGE 709
2. Enable OSPF globally. Assign network area and neighbors. 3. Add interfaces or configure other attributes.
PAGE 710
www.dell.com | support.dell.com Return to CONFIGURATION mode to enable the OSPF process. The OSPF Process ID is the identifying number assigned to the OSPF process, and the Router ID is the IP address associated with the OSPF process. . Command Syntax Command Mode Usage router ospf process-id [vrf {vrf name}] CONFIGURATION Enable the OSPFv2 process globally. Range: 0-65535 vrf name: Enter the VRF key word and instance name to tie the OSPF instance to the VRF.
PAGE 711
Enable Multi-Process OSPF Multi-Process OSPF allows multiple OSPFv2 processes on a single router. The following list shows the number of processes supported on each platform type. • • • The E-Series supports up to 30 OSPFv2 processes. The C-Series supports up to 6 OSPFv2 processes. The S-Series supports up to 4 OSPFv2 processes. Follow the same steps as above, when configuring a single OSPF process. Repeat them as often as necessary for the desired number of processes.
PAGE 712
www.dell.com | support.dell.com In CONFIGURATION ROUTER OSPF mode, assign the Router ID. The Router ID is not required to be the router’s IP address. Dell Networking recommends using the IP address as the Router ID for easier management and troubleshooting. Command Syntax Command Mode Usage router-id ip address CONFIG-ROUTER-O SPF-id Assign the Router ID for the OSPFv2 process. IP Address: A.B.C.D Use the no router ospf process-id command syntax in the CONFIGURATION mode to disable OSPF.
PAGE 713
Enable OSPFv2 on interfaces Each interface must have OSPFv2 enabled on it. It must be configured for Layer 3 protocol, and not be shutdown. OSPFv2 can also be assigned to a loopback interface as a virtual interface. OSPF functions and features, such as MD5 Authentication, Grace Period, Authentication Wait Time, etc, are assigned on a per interface basis. Note: If using features like MD5 Authentication, ensure all the neighboring routers are also configured for MD5.
PAGE 714
www.dell.com | support.dell.com Figure 32-10. Command Example: show ip ospf process-id interface FTOS>show ip ospf 1 interface GigabitEthernet 12/17 is up, line protocol is up Internet Address 10.2.2.1/24, Area 0.0.0.0 Process ID 1, Router ID 11.1.2.1, Network Type BROADCAST, Cost: 1 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 11.1.2.1, Interface address 10.2.2.1 Backup Designated Router (ID) 0.0.0.0, Interface address 0.0.0.
PAGE 715
Configure stub areas OSPF supports different types of LSAs to help reduce the amount of router processing within the areas. Type 5 LSAs are not flooded into stub areas; the Area Border Router (ABR) advertises a default route into the stub area to which it is attached. Stub area routers use the default route to reach external destinations To ensure connectivity in your OSPFv2 network, never configure the backbone area as a stub area.
PAGE 716
www.dell.com | support.dell.
PAGE 717
Enable passive interfaces A passive interface is one that does not send or receive routing information. Enabling passive interface suppresses routing updates on an interface. Although the passive interface will neither send nor receive routing updates, the network on that interface will still be included in OSPF updates sent via other interfaces. Use the following command in the ROUTER OSPF mode to suppress the interface’s participation on an OSPF interface.
PAGE 718
www.dell.com | support.dell.com Figure 32-13. Command Example: show ip ospf process-id interface FTOS#show ip ospf 34 int GigabitEthernet 0/0 is up, line protocol is down Internet Address 10.1.2.100/24, Area 1.1.1.1 Process ID 34, Router ID 10.1.2.100, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State DOWN, Priority 1 Designated Router (ID) 10.1.2.100, Interface address 0.0.0.0 Backup Designated Router (ID) 0.0.0.0, Interface address 0.0.0.
PAGE 719
Figure 32-14 shows the convergence settings when fast-convergence is enabled and Figure 32-15 shows settings when fast-convergence is disabled. These displays appear with the show ip ospf command. Figure 32-14. Command Example: show ip ospf process-id (fast-convergence enabled) FTOS(conf-router_ospf-1)#fast-converge 2 FTOS(conf-router_ospf-1)#ex FTOS(conf)#ex FTOS#show ip ospf 1 Routing Process ospf 1 with ID 192.168.67.
PAGE 720
www.dell.com | support.dell.com Use any or all of the following commands in CONFIGURATION INTERFACE mode to change OSPFv2 parameters on the interfaces: Command Syntax Command Mode Usage ip ospf cost CONFIG-INTERFACE Change the cost associated with OSPF traffic on the interface. Cost: 1 to 65535 (default depends on the interface speed). ip ospf dead-interval seconds CONFIG-INTERFACE Change the time interval the router waits before declaring a neighbor dead.
PAGE 721
Figure 32-16. Changing the OSPF Cost Value on an Interface FTOS(conf-if)#ip ospf cost 45 FTOS(conf-if)#show config ! interface GigabitEthernet 0/0 ip address 10.1.2.100 255.255.255.0 no shutdown ip ospf cost 45 FTOS(conf-if)#end FTOS#show ip ospf 34 interface The change is made on the interface and it is reflected in the OSPF configuration GigabitEthernet 0/0 is up, line protocol is up Internet Address 10.1.2.100/24, Area 2.2.2.2 Process ID 34, Router ID 10.1.2.
PAGE 722
www.dell.com | support.dell.com • helper-reject neighbors—the router ID of each restart router that does not receive assistance from the • • configured router. mode—the situation or situations that trigger a graceful restart. role—the role or roles the configured router can perform. Note: By default, OSPFv2 graceful restart is disabled. You enable OSPFv2 graceful restart in CONFIGURATION ROUTER OSPF mode.
PAGE 723
Figure 32-17. Command Example: show run ospf FTOS#show run ospf ! router ospf 1 graceful-restart grace-period 300 graceful-restart role helper-only graceful-restart mode unplanned-only graceful-restart helper-reject 10.1.1.1 graceful-restart helper-reject 20.1.1.1 network 10.0.2.0/24 area 0 FTOS# Use the following command to disable OSPFv2 graceful-restart after you have enabled it.
PAGE 724
www.dell.com | support.dell.com Use the following command in CONFIGURATION ROUTER OSPF mode to configure virtual links. Command Syntax Command Mode Usage area area-id virtual-link router-id [hello-interval seconds | retransmit-interval seconds | transmit-delay seconds | dead-interval seconds | authentication-key key | message-digest-key keyid md5 key] CONFIG-ROUTEROSPF-id Configure the optional parameters of a virtual link: • Area ID: assigned earlier (0-65535 or A.B.C.
PAGE 725
Command Syntax Command Mode Usage seq sequence-number {deny |permit} ip-prefix [ge min-prefix-length] [le max-prefix-length] CONFIG- PREFIX LIST Create a prefix list with a sequence. number and a deny or permit action. The optional parameters are: ge min-prefix-length: is the minimum prefix length to be matched (0 to 32). le max-prefix-length: is the maximum prefix length to be matched (0 to 32).
PAGE 726
www.dell.com | support.dell.com To view the current OSPF configuration, use the show running-config ospf command in the EXEC mode or the show config command in the ROUTER OSPF mode Figure 32-19. Command Example: show config FTOS(conf-router_ospf)#show config ! router ospf 34 network 10.1.2.32 0.0.0.255 area 2.2.2.2 network 10.1.3.24 0.0.0.255 area 3.3.3.3 distribute-list dilling in FTOS(conf-router_ospf)# Troubleshooting OSPFv2 FTOS has several tools to make troubleshooting easier.
PAGE 727
Use the show running-config ospf command to see the state of all the enabled OSPFv2 processes. Command Syntax Command Mode Usage show running-config ospf EXEC Privilege View the summary of all OSPF process IDs enables on the router. Figure 32-20. Command Example: show running-config ospf FTOS#show run ospf ! router ospf 3 ! router ospf 4 router-id 4.4.4.4 network 4.4.4.0/28 area 1 ! router ospf 5 ! router ospf 6 ! router ospf 7 mib-binding ! router ospf 8 ! router ospf 90 area 2 virtual-link 4.4.4.
PAGE 728
www.dell.com | support.dell.com Use the following command in EXEC Privilege mode to configure the debugging options of an OSPFv2 process: Command Syntax Command Mode Usage debug ip ospf process-id [event | packet | spf] EXEC Privilege View debug messages. To view debug messages for a specific OSPF process ID, enter debug ip ospf process-id. If you do not enter a process ID, the command applies to the first OSPF process.
PAGE 729
Sample Configurations for OSPFv2 The following configurations are examples for enabling OSPFv2. These are not comprehensive directions. They are intended to give you a some guidance with typical configurations. You can copy and paste from these examples to your CLI. Be sure you make the necessary changes to support your own IP Addresses, Interfaces, Names, etc. Basic OSPFv2 Router Topology The following illustration is a sample basic OSPFv2 topology.
PAGE 730
www.dell.com | support.dell.com Configuration Task List for OSPFv3 (OSPF for IPv6) Open Shortest Path First version 3 (OSPF for IPv6) is supported on platforms ce The configuration options of OSPFv3 are the same as those for OSPFv2, but may be configured with differently labeled commands. Process IDs and areas need to be specified. Interfaces and addresses need to be included in the process. Areas can be defined as stub or totally stubby.
PAGE 731
Enable IPv6 Unicast Routing Command Syntax Command Mode Usage ipv6 unicast routing CONFIGURATION Enables IPv6 unicast routing globally. Assign IPv6 addresses on an interface Command Syntax Command Mode Usage ipv6 address ipv6 address CONF-INT-type slot/port Assign IPv6 address to the interface. IPv6 addresses are normally written as eight groups of four hexadecimal digits, where each group is separated by a colon (:).
PAGE 732
www.dell.com | support.dell.com Assign OSPFv3 Process ID and Router ID Globally Command Syntax Command Mode Usage ipv6 router ospf {process ID} CONFIGURATION Enable the OSPFv3 process globally and enter OSPFv3 mode. Range: 0-65535 router-id {number} CONF-IPV6-ROUTER-OSPF Assign the Router ID for this OSPFv3 process number: IPv4 address Format: A.B.C.D Note: The router-id for an OSPFv3 router is entered as an IPv4 IP address.
PAGE 733
Configure Passive-Interface Use the following command to suppress the interface’s participation on an OSPFv3 interface. This command stops the router from sending updates on that interface. Command Syntax Command Mode Usage passive-interface {type slot/port} CONF-IPV6-ROUTER-OSPF Specify whether some or all some of the interfaces will be passive. Interface identifies the specific interface that will be passive.
PAGE 734
www.dell.com | support.dell.com Redistribute routes You can add routes from other routing instances or protocols to the OSPFv3 process. With the redistribute command syntax, you can include RIP, static, or directly connected routes in the OSPF process. Command Syntax Command Mode Usage redistribute {bgp | connected | static} [metric metric-value | metric-type type-value] [route-map map-name] [tag tag-value] CONF-IPV6-ROUTER-OSPF Specify which routes will be redistributed into OSPF process.
PAGE 735
Enable OSPFv3 graceful restart Graceful Restart for OSPFv3 is supported only on platform information on the feature. et. Refer to Graceful Restart for more By default, OSPFv3 graceful restart is disabled and functions only in a helper role to help restarting neighbor routers in their graceful restarts when it receives a Grace LSA.
PAGE 736
www.dell.com | support.dell.com To display information on the use and configuration of OSPFv3 graceful restart, enter any of the following commands: Command Syntax Command Mode Usage show run ospf EXEC Privilege Display the graceful-restart configuration for OSPFv2 and OSPFv3 (Figure 32-23). show ipv6 ospf database grace-lsa EXEC Privilege Display the Type-11 Grace LSAs sent and received on an OSPFv3 router (Figure 32-24).
PAGE 737
Figure 32-24. Command Example: show ipv6 ospf database database-summary FTOS#show ipv6 ospf database database-summary ! OSPFv3 Router with ID (200.1.1.
PAGE 738
www.dell.com | support.dell.com OSPFv3 Authentication Using IPsec OSPFv3 Authentication Using IPsec is supported only on platform: et Starting in release 8.4.2.0, OSPFv3 uses the IP Security (IPsec) to provide authentication for OSPFv3 packets. IPsec authentication ensures security in the transmission of OSPFv3 packets between IPsec-enabled routers. IPsec is a set of protocols developed by the IETF to support secure exchange of packets at the IP layer.
PAGE 739
OSPFv3 Authentication using IPsec: Configuration Notes OSPFv3 authentication using IPsec is implemented according to the specifications in RFC 4552, including: • • • • To use IPsec, you configure an authentication (using AH) or encryption (using ESP) security policy on an interface or in an OSPFv3 area. Each security policy consists of a security policy index (SPI) and the key used to validate OSPFv3 packets. After IPsec is configured for OSPFv3, IPsec operation is invisible to the user.
PAGE 740
www.dell.com | support.dell.com • • • Configuring IPsec Authentication for an OSPFv3 Area Configuring IPsec Encryption for an OSPFv3 Area Displaying OSPFv3 IPsec Security Policies Configuring IPsec Authentication on an Interface Prerequisite: Before you enable IPsec authentication on an OSPFv3 interface, you must first enable IPv6 unicast routing globally, configure an IPv6 address and enable OSPFv3 on the interface, and assign it to an area (see Configuration Task List for OSPFv3 (OSPF for IPv6)).
PAGE 741
Configuring IPsec Encryption on an Interface Prerequisite: Before you enable IPsec encryption on an OSPFv3 interface, you must first enable IPv6 unicast routing globally, configure an IPv6 address and enable OSPFv3 on the interface, and assign it to an area (see Configuration Task List for OSPFv3 (OSPF for IPv6)).
PAGE 742
www.dell.com | support.dell.com To remove an IPsec encryption policy from an interface, enter the no ipv6 ospf encryption ipsec spi number command. To remove null encryption on an interface to allow the interface to inherit the encryption policy configured for the OSPFv3 area, enter the no ipv6 ospf encryption null command. To display the configuration of IPsec encryption policies on the router, enter the show crypto ipsec policy command.
PAGE 743
To display the configuration of IPsec authentication policies on the router, enter the show crypto ipsec policy command. Configuring IPsec Encryption for an OSPFv3 Area Prerequisite: Before you enable IPsec encryption in an OSPFv3 area, you must first enable OSPFv3 globally on the router (see Configuration Task List for OSPFv3 (OSPF for IPv6)).
PAGE 744
www.dell.com | support.dell.com Note that when you configure encryption with the area encryption command, you enable both IPsec encryption and authentication. However, when you enable authentication on an area with the area authentication command, you do not enable encryption at the same time. If you have enabled IPsec authentication in an OSPFv3 area with the area authentication command, you cannot use the area encryption command in the area at the same time.
PAGE 745
Figure 32-26. Command Example: show crypto ipsec policy FTOS#show crypto ipsec policy Crypto IPSec client security policy data Policy name Policy refcount Inbound ESP SPI Outbound ESP SPI Inbound ESP Auth Key Outbound ESP Auth Key Inbound ESP Cipher Key Outbound ESP Cipher Key Transform set : : : : : : : : : In this encryption policy, the keys OSPFv3-1-502 are not encrypted.
PAGE 746
www.dell.com | support.dell.com To display the IPsec security associations (SAs) used on OSPFv3 interfaces, enter the following command: Command Syntax Command Mode Usage show crypto ipsec sa ipv6 [interface interface] EXEC Privilege Displays security associations set up for OSPFv3 links in IPsec authentication and encryption policies on the router.
PAGE 747
Figure 32-27.
PAGE 748
www.dell.com | support.dell.com Troubleshooting OSPFv3 FTOS has several tools to make troubleshooting easier. Be sure to check the following, as these are typical issues that interrupt the OSPFv3 process. Note that this is not a comprehensive list, just some examples of typical troubleshooting checks.
PAGE 749
Use the following command in EXEC Privilege mode to configure the debugging options of an OSPFv3 process: Command Syntax Command Mode Usage debug ipv6 ospf [event | packet] {type slot/port} EXEC Privilege View debug messages for all OSPFv3 interfaces. • event: View OSPF event messages. • packet: View OSPF packets. • For a Gigabit Ethernet interface, enter the keyword GigabitEthernet followed by the slot/port information (e.g. passive-interface gi 2/1).
PAGE 750
www.dell.com | support.dell.
PAGE 751
33 PIM Dense-Mode PIM Dense-Mode is supported on platforms: ces PIM-Dense Mode (PIM-DM) is a multicast protocol that directs routers to forward multicast traffic to all subnets until the router receives a request to stop; this behavior is the opposite of PIM-Sparse Mode, which does not forward multicast traffic to a subnet until the traffic is specifically requested using a PIM Join message.
PAGE 752
www.dell.com | support.dell.com Figure 33-1. Multicast Flooding in a PIM-DM Network Source Group Address: 239.192.0.1 Hello R1 Adjacency R2 Receiver PIM-DM 001 R4 R3 Refusing Multicast Traffic If a PIM-DM router has no receivers for a group, it refuses multicast traffic by sending a PIM Prune message to address 224.0.0.13 out of the source interface. The upstream neighbor receives the prune message and determines if it has any remaining neighbors downstream.
PAGE 753
When a router receives a prune message, it flags the relevant (S,G) entry and sets a timer. If the timer expires, it begins flooding traffic out of the interface, and downstream routers must again evaluate whether to prune itself from the tree. To prevent the timer from expiring, while the source is sending traffic for the (S,G), the first-hop router periodically sends an (S,G) state-refresh messages down the entire SPT.
PAGE 754
www.dell.com | support.dell.com Configure PIM-DM Configuring PIM-DM is a two-step process: 1. Enable multicast routing using the command ip multicast-routing from CONFIGURATION mode. 2. Enable PIM-DM on an interface. See page 754. Related Configuration Tasks • • Clear the PIM TIB using the command clear ip pim tib from EXEC Privilege mode. Debug PIM-DM by displaying control activity (packets, events, timers, etc.) using the command debug ip pim from EXEC Privilege mode.
PAGE 755
Figure 33-4. Enabling PIM-DM R1_E600(conf-if-range-gi-1/0,gi-1/12,gi-1/13)#show config ! interface GigabitEthernet 1/0 description Connection to Ixia ip address 2.1.0.1/24 ip pim dense-mode no shutdown ! interface GigabitEthernet 1/12 ip address 2.1.1.1/24 ip pim dense-mode no shutdown ! interface GigabitEthernet 1/13 ip address 2.1.2.1/24 ip pim dense-mode no shutdown R1_E600(conf-if-range-gi-1/0,gi-1/12,gi-1/13)#router rip R1_E600(conf-router_rip)#show config ! router rip network 2.0.0.
PAGE 756
www.dell.com | support.dell.com Figure 33-6. 756 Viewing PIM Neighbors Command Example R1_E600(conf)#do show ip pim neighbor Neighbor Interface Address 2.1.1.2 Gi 1/12 2.1.2.2 Gi 1/13 R1_E600(conf)# Uptime/Expires Ver DR Prio/Mode GR 01:43:51/00:01:35 02:00:46/00:01:41 v2 v2 0 0 / D / D Display the PIM routing table using the command show ip pim tib from EXEC privilege mode, as shown in Figure 33-7.
PAGE 757
Figure 33-7. Viewing the PIM Multicast Routing Table ------------------------------------- Router 1 ---------------------------------------------R1_E600(conf)#do show ip pim tib PIM Multicast Routing Table Flags: D - Dense, S - Sparse, C - Connected, L - Local, P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT, M - MSDP created entry, A - Candidate for MSDP Advertisement K - Ack-Pending State Timers: Uptime/Expires Interface state: Interface, next-Hop, State/Mode (*, 239.192.0.
PAGE 758
| PIM Dense-Mode www.dell.com | support.dell.
PAGE 759
34 PIM Sparse-Mode PIM Sparse-Mode is supported on platforms: ces PIM-SM is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. PIM-Sparse Mode (PIM-SM) is a multicast protocol that forwards multicast traffic to a subnet only upon request using a PIM Join message; this behavior is the opposite of PIM-Dense Mode, which forwards multicast traffic to all subnets until it receives a request to stop.
PAGE 760
www.dell.com | support.dell.com Protocol Overview To distribute the same traffic to multiple receivers, PIM-SM creates a tree extending from a root, called the Rendezvous Point (RP), down branches that extend to the nodes which have requested the traffic. Nodes requesting the same traffic belong to the same multicast group. Initially, a single PIM-SM tree called a shared tree to distribute traffic.
PAGE 761
Sending Multicast Traffic With PIM-SM, all multicast traffic must initially originate from the RP. A source must unicast traffic to the RP so that the RP can learn about the source and create an SPT to it. Then the last-hop DR may create an SPT directly to the source. 1. The source gateway router (first-hop DR) receives the multicast packets and creates an (S,G) entry in its multicast routing table.
PAGE 762
www.dell.com | support.dell.com 3. Enable PIM-SM on an interface. See page 762.
PAGE 763
Figure 34-2. Viewing PIM Neighbors Command Example FTOS#show ip pim neighbor Neighbor Interface Address 127.87.5.5 Gi 4/11 127.87.3.5 Gi 4/12 127.87.50.5 Gi 7/13 FTOS# Uptime/Expires Ver 01:44:59/00:01:16 01:45:00/00:01:16 00:03:08/00:01:37 v2 v2 v2 DR Prio/Mode 1 / S 1 / DR 1 / S Display the PIM routing table using the command show [ip | ipv6] pim tib from EXEC privilege mode, as shown in Figure 34-3. Figure 34-3.
PAGE 764
www.dell.com | support.dell.com Configure the expiry time for a particular (S,G) entry: Step Task Command Syntax Command Mode 1 Create an Extended ACL ip access-list extended access-list-name CONFIGURATION 2 Specify the source and group to which the timer will be applied using extended ACLs with permit rules only. [seq sequence-number] permit ip CONFIG-EXT-NACL 3 Set the expiry time for a specific (S,G) entry (Figure 34-4).
PAGE 765
Figure 34-5. Electing a Rendezvous Point FTOS#sh run int loop0 ! interface Loopback 0 ip address 1.1.1.1/32 ip pim sparse-mode no shutdown FTOS#sh run pim ! ip pim rp-address 1.1.1.1 group-address 224.0.0.0/4 Override Bootstrap Router Updates PIM-SM routers need to know the address of the RP for each group for which they have (*,G) entry. This address is obtained automatically through the bootstrap router (BSR) mechanism or a static RP configuration.
PAGE 766
www.dell.com | support.dell.com IP Version Task Command Syntax Command Mode IPv6 Override bootstrap router RP election results with your static RP configuration. ipv6 pim rp-address CONFIGURATION IPv6 Display the assigned RP for a group. show ipv6 pim rp EXEC Privilege IPv6 Display the assigned RP for a group range (group-to-RP mapping).
PAGE 767
Configure a Designated Router Multiple PIM-SM routers might be connected to a single LAN segment. One of these routers is elected to act on behalf of directly connected hosts. This router is the Designated Router (DR). The DR is elected using hello messages. Each PIM router learns about its neighbors by periodically sending a hello message out of each PIM-enabled interface. Hello messages contain the IP address of the interface out of which it is sent and a DR priority value.
PAGE 768
www.dell.com | support.dell.com IP Version Task Command Syntax Command Mode IPv6 Filter inbound and outbound Bootstrap Router messages per interface. ipv6 pim bsr-border INTERFACE Remove candidate RP advertisements. clear ip pim rp-mapping EXEC PRIVILEGE Set a Threshold for Switching to the SPT Set a Threshold for Switching to the SPT is available only on platform: e Initially, a single PIM-SM tree called a shared tree to distribute traffic.
PAGE 769
FTOS supports PIM-SM graceful restart based on the GenID. Per RFC 4601, hello messages should contain a Generation_Identifier option, which contains a randomly generated value (GenID) that is regenerated each time PIM forwarding is started or restarted on the interface, including when the router restarts. When a router receives from a neighbor a hello message with a new GenID, any old hello information about that neighbor should be discarded and superseded by the information from the new hello message.
PAGE 770
www.dell.com | support.dell.com To prevent these delivery errors you must statically map the potential incoming interfaces for the (*,G) entries via the CLI. When you create this mapping, (*,G) entries are programmed in hardware. Packets are then fast forwarded starting with the first packet, and the potential for these delivery errors is avoided. Step 1 Task Command Syntax Command Mode Create a standard access-list that permits one or more IGMP groups.
PAGE 771
• Table 34-1. It is recommended that you do not enable IGMP snooping on a PIM-SM snooping-enabled VLAN interface unless until it is necessary for VLAN operation.
PAGE 772
www.dell.com | support.dell.com Feature Overview PIM-SM snooping functions in a Layer 2 network in which multiple routers are interconnected by a switch, such as an IXP where Internet service providers (ISPs) exchange Internet traffic between their networks. By default, the switch floods multicast traffic to all VLAN member ports, regardless of whether there are multicast receivers downstream that are joined to a multicast group.
PAGE 773
• In the downstream PIM TIB, states and timers are maintained for each VLAN and member port. The downstream outgoing-interface timers for each valid (*,G) and (S,G) entry are started for each VLAN/ port and upstream neighbor combination: (port,*,G,neighbor) or (port,S,G,neighbor), where port is a downstream port and neighbor is the upstream neighbor. • A timer is removed when a timer times out or a prune message is received for a specific VLAN member port.
PAGE 774
www.dell.com | support.dell.com PIM-SM Snooping Example Figure 34-8 shows an example with PIM-SM snooping enabled. When Router A sends a join message to Router B, the switches forward the join message only to Router B without flooding the message to other connected routers, such as Routers C and D. Figure 34-8.
PAGE 775
Similarly, in Figure 34-8, when PIM-SM snooping is enabled and multicast data is sent to VLAN members of group G, the switches forward the data traffic from the server attached to Router B only to the router (Router A) in the multicast group that should receive it. Without PIM-SM snooping, the switches would flood the data to all connected routers, including Routers C and D. Figure 34-9.
PAGE 776
www.dell.com | support.dell.com PIM-SM Snooping Configuration You can enable PIM-SM snooping globally on a switch or on individual VLANs. PIM-SM snooping is not enabled by default and does not require an IP address, PIM-DM, or PIM-SM. PIM-SM snooping and PIM multicast routing are mutually exclusive: PIM-SM snooping cannot be enabled on a switch/router if PIM-SM or PIM-DM is enabled.
PAGE 777
Verify PIM-SM Snooping To display information about PIM-SM snooping operation, enter one of the following show commands: Task Command Command Mode Display information about PIM neighbors discovered by PIM-SM snooping. show ip pim snooping neighbor [vlan vlan-id] EXEC Privilege Figure 34-10 Display information about PIM group members and states stored in the tree information base (TIB) that was discovered by PIM-SM snooping.
PAGE 778
www.dell.com | support.dell.com Figure 34-11. PIM-SM snooping: show ip pim snooping tib FTOS#show ip pim snooping tib PIM Multicast Snooping Table Flags: J/P - (*,G) Join/Prune, j/p - (S,G) Join/Prune SGR-P - (S,G,R) Prune Timers: Uptime/Expires * : Inherited port (*, 225.1.2.1), uptime 00:00:01, expires 00:02:59, RP 165.87.70.1, flags: J Incoming interface: Vlan 2, RPF neighbor 0.0.0.0 Outgoing interface list: GigabitEthernet 4/11 RPF 165.87.32.
PAGE 779
Figure 34-13.
PAGE 780
www.dell.com | support.dell.com Figure 34-14. PIM-SM snooping: show ip mroute snooping FTOS#show ip mroute snooping IPv4 Multicast Snooping Table (*, 224.0.0.0), uptime 17:46:23 Incoming vlan: Vlan 2 Outgoing interface list: GigabitEthernet 4/13 (*, 225.1.2.1), uptime 00:04:16 Incoming vlan: Vlan 2 Outgoing interface list: GigabitEthernet 4/11 GigabitEthernet 4/13 (165.87.1.7, 225.1.2.
PAGE 781
35 PIM Source-Specific Mode PIM Source-Specific Mode is supported on platforms: ces PIM-SSM is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. PIM-Source-Specific Mode (PIM-SSM) is a multicast protocol that forwards multicast traffic from a single source to a subnet. In the other versions of Protocol Independent Multicast (PIM), a receiver subscribes to a group only.
PAGE 782
| PIM Source-Specific Mode (10.11.5.2, 239.0.0.2), uptime 00:00:36, expires 00:03:14, flags: CT Incoming interface: GigabitEthernet 1/31, RPF neighbor 10.11.13.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:02:12/Never interface Vlan 400 ip pim sparse-mode ip address 10.11.4.1/24 untagged GigabitEthernet 1/2 ip igmp version 3 no shutdown interface GigabitEthernet 2/31 ip pim sparse-mode ip address 10.11.23.1/24 no shutdown RP 2/1 R1 3/21 3/1 Source 1 10.11.5.
PAGE 783
Implementation Information • • • • • The Dell Networking implementation of PIM-SSM is based on RFC 3569. C-Series supports a maximum of 31 PIM interfaces and 4K multicast entries including (*,G), and (S,G) entries. There is no limit on the number of PIM neighbors C-Series can have. S-Series supports a maximum of 31 PIM interfaces and 2K multicast entries including (*,G), and (S,G) entries. There is no limit on the number of PIM neighbors S-Series can have.
PAGE 784
www.dell.com | support.dell.com Enable PIM-SSM To enable PIM-SSM: Step Task Command Syntax Command Mode 1 Create an ACL that uses permit rules to specify what range of addresses should use SSM. You must at least include one rule, permit 232.0.0.0/8, which is the default range for PIM-SSM. [ip | ipv6] access-list standard name CONFIGURATION 2 Enter the command ip pim ssm-range and specify the ACL you created.
PAGE 785
• When an extended ACL is associated with this command, FTOS displays an error message. If you apply an extended ACL before you create it, FTOS accepts the configuration, but when the ACL is later defined, FTOS ignores the ACL and the stated mapping has no effect. Display the source to which a group is mapped using the command show ip igmp ssm-map [group], as shown in Figure 35-4.
PAGE 786
| PIM Source-Specific Mode interface Vlan 400 ip pim sparse-mode ip address 10.11.4.1/24 untagged GigabitEthernet 1/2 ip igmp version 3 no shutdown ip igmp snooping enable (10.11.5.2, 239.0.0.2), uptime 00:00:33, expires 00:00:00, flags: CJ Incoming interface: GigabitEthernet 1/31, RPF neighbor 10.11.13.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:00:33/Never (10.11.5.2, 239.0.0.1), uptime 00:01:50, expires 00:03:28, flags: CT Incoming interface: GigabitEthernet 1/31, RPF neighbor 10.11.
PAGE 787
Figure 35-4. Configuring PIM-SSM with IGMPv2 R1(conf)#do show run pim ! ip pim rp-address 10.11.12.2 group-address 224.0.0.0/4 ip pim ssm-range ssm R1(conf)#do show run acl ! ip access-list standard map seq 5 permit host 239.0.0.2 ! ip access-list standard ssm seq 5 permit host 239.0.0.2 R1(conf)#ip igmp ssm-map map 10.11.5.2 R1(conf)#do show ip igmp groups Total Number of Groups: 2 IGMP Connected Group Membership Group Address Interface Mode 239.0.0.2 Vlan 300 IGMPv2-Compat Member Ports: Gi 1/1 239.0.0.
PAGE 788
| PIM Source-Specific Mode www.dell.com | support.dell.
PAGE 789
36 Power over Ethernet and Power over Ethernet Plus cs Power over Ethernet Plus (PoE+) is supported only on platform: c Power over Ethernet (PoE) is supported only on platforms: This chapter contains the following major sections: • • • Configuring PoE/PoE+ Power Additional PoE Ports on the S-Series Deploying VOIP Power over Ethernet (PoE), as described by IEEE 802.3af specifies that a maximum of 15.
PAGE 790
www.dell.com | support.dell.com Table 36-1 describes the classes of powered devices defined by IEEE 802.3af and 802.3at: Table 36-1. Classes of Powered Devices Class Power Range (Watts) Classification Current (mA) 0 0.44 to 12.95 < 5.0 1 0.44 to 3.84 10.5 2 3.84 to 6.49 18.5 3 6.49 to 12.95 28 PoE+ only 4 12.95 to 25.5 40 Note: Class 4 is meant for IEEE802.3at compliant devices which require >12.95 Watts.
PAGE 791
Table 36-2.
PAGE 792
www.dell.com | support.dell.com On the C-Series, if the Power Supply 1200W-AC is installed, then each PSU used for PoE (units 4-7 on the C300, and 3-4 on the C150) provides 1200 Watts of power. However, each actually makes available 1478.40 Watts for PoE. This is possible because each unit, once installed, borrows 278.40 Watts from the system redundancy power supply. If a power supply used for PoE is removed, PoE ports are shut down so that the system redundancy PSU retains its capability.
PAGE 793
Enabling PoE/PoE+ on a Port PoE/PoE+ is disabled by default. Enable PoE/PoE+ on a port from INTERFACE mode using the command power inline {auto [max_milliwatts] | static [max_milliwatts]}. • • • • The power inline auto command allows the port to determine the amount of power that a connected Class 0–4 powered device requires, and supply it. See Table 36-1. The power inline static command without the qualifier guarantees 15.4W to the powered device for PoE and 30.0W for PoE+.
PAGE 794
www.dell.com | support.dell.com Table 36-4 describes the fields that the show power inline command displays: Table 36-4. show power inline Field Description Field Port Number Interface Displays the line card slot and port number. Admin Displays the PoE/PoE+ mode of the port. The mode can be either auto or static. See the power budget command in the Power Over Ethernet (PoE) chapter of the FTOS Command Reference for the S-Series.
PAGE 795
View the total power consumption of the chassis using the show power detail command from EXEC privilege mode. Figure 36-3. PoE/PoE+ Consumed, Allocated, and Available with show power detail Command FTOS#show power detail Catalog slot Name Id Logic Power Inline Power Inline Power Consumed Allocated Consumed (Watts) (Watts) (Watts) --------------------------------------------------------------------------E48VB 1 100 0.00 0.00 RPM 0 100 RPM 1 100 E48IB 6 100 0.00 0.00 E48VB 7 100 0.00 0.
PAGE 796
www.dell.com | support.dell.com Upgrade the PoE Controller Follow these steps to upgrade the PoE controller. Note: You cannot upgrade the PoE controller, when any other upgrade is in progress. Note: Upgrading the PoE controller may take few minutes to complete. The CLI is blocked until the upgrade is complete. Step 1 Task Command Mode Upgrade the PoE controller.
PAGE 797
FTOS# show revision -- RPM 0 -RPM FPGA Required FPGA version : 5.0 : 5.0 -- RPM 1 -RPM FPGA Required FPGA version : 5.0 : 5.0 -- Line card 0 -48 Port 1G LCM FPGA Required FPGA version : 3.6 : 3.6 -- Line card 1 -48 Port 1G LCM FPGA Required FPGA version : 3.6 : 3.6 -- Line card 2 -48 Port 1G LCM POEPLUS FPGA : 0.1 Required FPGA version : 0.1 PoE-Controller version : 2.39 -- Line card 3 -48 Port 1G LCM FPGA Required FPGA version : 3.6 : 3.
PAGE 798
www.dell.com | support.dell.com FTOS uses the following four parameters, in order, for defining the power priority for a port: 1. the power-inline mode: static or auto 2. the power-inline priority configuration 3. the LLDP-MED priority sent by the PD in the Extended Power-via-MDI TLV or the priority sent by the PD in the IEEE 802.3at power-via-mdi TLV 4. the port’s slot and port number FTOS maintains a sorted list of PoE/PoE+ ports based on these four parameters.
PAGE 799
static: Ports configured in static mode reserve a fixed power allocation whether a device is connected or not. By default 15.4W is allocated for PoE and 30.0W for PoE+, but this is user-configurable with the max_milliwatts option. No dynamic PoE/PoE+ class detection is performed on static ports, and Extended Power via MDI TLVs or IEEE 802.3at power-via-mdi TLVs have no effect. Extended Power-via-MDI TLV The PD sends three pieces of information in the LLDP-MED Extended Power-via-MDI TLV: 1.
PAGE 800
www.dell.com | support.dell.com 2. When you configure a port with power inline auto with the power limit option max_milliwatts, power is only allocated after you connect a device to the port. • • • If the maximum power for the device class is less than the power limit you specified, FTOS allocates the required amount and returns the remaining amount to the budget. If there is not enough power in the budget, the configuration is maintained and the port waits for power to become available.
PAGE 801
The second result in this scenario is true even if a powered device is not connected to the port. Power can be allocated to a port, thus subtracting it from the power budget and making it unavailable to other ports, but that power does not have to be consumed. Manage Power Priorities PoE/PoE+ -enabled ports have power access priorities based first on their configuration and then by line card and port number. The default prioritization is presented in Table 36-6.
PAGE 802
www.dell.com | support.dell.com Recover from a Failed Power Supply If ports are PoE/PoE+ -enabled, and a PSU fails, power might be terminated on some ports to compensate for the power loss. This does not affect PoE/PoE+ individual port configurations. For C-Series, use the show power supply command to display PSU status (Figure 36-4).
PAGE 803
When a failed PSU is replaced and there is sufficient power for PoE/PoE+ , power is automatically re-supplied for previously configured PoE/PoE+ ports, and power is supplied first to ports with the highest priority. Figure 36-6. Order of PoE/Poe+ Re-Supply 0 1 Re-s upp ly 2 Power Additional PoE Ports on the S-Series By default, 320 Watts is available for PoE on the S50V and S25V models of the S-Series.
PAGE 804
www.dell.com | support.dell.com Figure 36-7 shows a basic configuration for a deployment in which the end workstation plugs into an IP phone for its Ethernet connection. Figure 36-7. Office VOIP Deployment Create VLANs for an Office VOIP Deployment The phone requires one tagged VLAN for VOIP service and one untagged VLAN for PC data, as shown in Figure 36-7.
PAGE 805
Configure LLDP-MED for an Office VOIP Deployment VOIP deployments may optionally use LLDP-MED. LLDP-MED advertises VLAN, dot1P, and DSCP configurations on the switch so that you do not need to manually configure every phone with this information. See Chapter 26, Link Layer Discovery Protocol. Based on the configuration in Figure 36-9, the phone will initiate a DHCP request on the advertised voice VLAN, VLAN 200. Figure 36-9.
PAGE 806
www.dell.com | support.dell.com Honor the incoming dot1p value On the C-Series, if you know traffic originating from the phone is tagged with a dot1p value of 5, you might make the associated queue a strict priority queue, as shown in Figure 36-11; on the C-Series, FTOS maps dot1p priority 5 to queue 2. Figure 36-11.
PAGE 807
Step 2 3 4 Task Command Command Mode Create an input policy-map containing all three class-maps, and assign each class-map a different service queue. policy-map-input CONFIGURATION service-queue POLICY-MAP-IN Create two input QoS policies, one each for PC data and voice signaling. Assign a different bandwidth weight to each policy. qos-policy-out CONFIGURATION bandwidth-weight QOS-POLICY-IN Create an output policy map containing both QoS policies, and assign them to different service queues.
PAGE 808
www.dell.com | support.dell.com Figure 36-13. 808 Classifying VOIP Traffic and Applying QoS Policies for an Office VOIP Deployment FTOS#sh run acl ! ip access-list extended pc-subnet seq 5 permit ip 201.1.1.0/24 any ! ip access-list extended phone-signalling seq 5 permit ip 192.1.1.0/24 host 192.1.1.1 ! ip access-list extended phone-subnet seq 5 permit ip 192.1.1.
PAGE 809
37 Policy-based Routing Policy-based Routing is supported on platforms: ces PBR is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. PBR is supported on the E-Series TeraScale, C-Series, and S-Series platforms in FTOS 8.4.2.0 and later.
PAGE 810
ps ps Mb Operations Mb ps ps Mb Mb ps Mb Internet ps 45 10 1.5 With 3 separate internet connections from the Edge Routers, bandwidth can be allotted to meet each department's needs. Some departments will need higher-speed internet access while others will require less bandwidth. Customer Support Sales 1.5 Marketing 10 Engineering Mb Finance PBR Example 45 www.dell.com | support.dell.com Figure 37-1.
PAGE 811
2. If the specified next-hops are not reachable, then the normal routing table is used to forward the traffic. 3. FTOS supports multiple next-hop entries in the redirect lists. 4. Redirect-Lists are applied at Ingress. Implementing Policy-based Routing with FTOS Non-contiguous bitmasks for PBR Non-contiguous bitmasks for PBR allows more granular and flexible control over routing policies. Network addresses that are in the middle of a subnet can be included or excluded.
PAGE 812
www.dell.com | support.dell.com Configuration Task List for Policy-based Routing To enable the PBR: 1. 2. 3. Create a Redirect List Create a Rule for a Redirect-list Apply a Redirect-list to an Interface using a Redirect-group Create a Redirect List Use the following command in CONFIGURATION mode: Command Syntax Command Mode Purpose ip redirect-list redirect-list-name CONFIGURATION Create a redirect list by entering the list name.
PAGE 813
Create a Rule for a Redirect-list Use the following command in CONFIGURATION REDIRECT-LIST mode to set the rules for the redirect list. You can enter the command multiple times and create a sequence of redirect rules. Use the seq nn redirect version of the command to organize your rules.
PAGE 814
www.dell.com | support.dell.com Figure 37-4. Creating a Rule Example FTOS(conf-redirect-list)#redirect ? A.B.C.D Forwarding router's address sonet SONET interface IP address of forwarding router FTOS(conf-redirect-list)#redirect 3.3.3.3 ? <0-255> An IP protocol number icmp Internet Control Message Protocol ip Any Internet Protocol tcp Transmission Control Protocol udp User Datagram Protocol FTOS(conf-redirect-list)#redirect 3.3.3.3 ip ? A.B.C.
PAGE 815
PBR Exceptions (Permit) Use the command permit to create an exception to a redirect list. Exceptions are used when a forwarding decision should be based on the routing table rather than a routing policy. FTOS assigns the first available sequence number to a rule configured without a sequence number and inserts the rule into the PBR CAM region next to the existing entries. Since the order of rules is important, ensure that you configure any necessary sequence numbers.
PAGE 816
www.dell.com | support.dell.com Apply a Redirect-list to an Interface using a Redirect-group IP redirect lists are supported on physical interfaces as well as VLAN and port-channel interfaces. Note: When you apply a redirect-list on a port-channel on the E-Series, when traffic is redirected to the next hop and the destination port-channel is shut down, the traffic is dropped. However, on the C-Series, the traffic redirected to the destination port-channel is sometimes switched.
PAGE 817
Show Redirect List Configuration To view the configuration redirect list configuration, use the following command in EXEC mode: Command Syntax Command Mode Purpose show ip redirect-list redirect-list-name EXEC View the redirect list configuration and the associated interfaces. show cam pbr show cam-usage EXEC View the redirect list entries programmed in the CAM. List the redirect list configuration using the show ip redirect-list redirect-list-name command.
PAGE 818
www.dell.com | support.dell.com Figure 37-12. Showing CAM PBR Configuration Example FTOS(conf-if-gi-8/1)#do show cam pbr l 8 p0 TCP Flag: Bit 5 - URG, Bit 4 - ACK, Bit 3 - PSH, Bit 2 - RST, Bit 1 - SYN, Bit 0 - FIN Cam Port VlanID Proto Tcp Index Flag Src Dst Port Port SrcIp DstIp Next-hop MAC -------------------------------------------------------------------------------------------------------------------------------06080 0 N/A IP 0x0 0 0 200.200.200.200 200.200.200.200 199.199.199.
PAGE 819
Figure 37-13. PBR Sample Illustration Customer Support 192.168.1.0 /24 192.168.2.0 /24 10.0.0.0 /16 10.1.0.0 /16 GigE 2/11 EDGE_ROUTER 1.5 Mbps 10 Mbps 45 Mbps 10.44.44.13 10.22.22.
PAGE 820
www.dell.com | support.dell.com Figure 37-14. PBR Sample Configuration Create the Redirect-List GOLD. EDGE_ROUTER(conf-if-gi-3/23)#ip redirect-list GOLD EDGE_ROUTER(conf-redirect-list)#description Route GOLD traffic to ISP_GOLD. EDGE_ROUTER(conf-redirect-list)#$direct 10.99.99.254 ip 192.168.1.0/24 any EDGE_ROUTER(conf-redirect-list)#$redirect 10.99.99.254 ip 192.168.2.
PAGE 821
38 Port Monitoring Port Monitoring is supported on platforms: ces Port Monitoring is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Port Monitoring is a feature that copies all incoming or outgoing packets on one port and forwards (mirrors) them to another port. The source port is the monitored port (MD) and the destination port is the monitoring port (MG). Port Monitoring functionality is different between platforms, but the behavior is the same, with highlighted exceptions.
PAGE 822
www.dell.com | support.dell.com • A source port (MD) can only be monitored by one destination port (MG). The following error is displayed if you try to assign a monitored port to more than one monitoring port.
PAGE 823
E-Series TeraScale The E-Series TeraScale system supports 1 monitoring session per port-pipe. E-Series TeraScale supports a maximum of 28 port pipes. On the E-Series TeraScale, FTOS supports a single source-destination statement in a monitor session (Message 2). E-Series TeraScale supports only one source and one destination port per port-pipe (Message 3). Therefore, the E-Series TeraScale supports as many monitoring sessions as there are port-pipes in the system.
PAGE 824
www.dell.com | support.dell.com Port Monitoring on C-Series and S-Series The C-Series and S-Series support multiple source-destination statements in a monitor session, but there may only be one destination port in a monitoring session (Message 4). Message 4 One Destination Port in a Monitoring Session Error Message on C-Series and S-Series % Error: Only one MG port is allowed in a session.
PAGE 825
Figure 38-3. Number of Monitoring Ports on the C-Series and S-Series FTOS(conf)#mon ses 300 FTOS(conf-mon-sess-300)#source gig 0/17 destination gig 0/4 direction tx % Error: Exceeding max MG ports for this MD port pipe.
PAGE 826
www.dell.com | support.dell.com Figure 38-5. Port Monitoring Configurations on the C-Series and S-Series Line Card 0 Port-Pipe 0 Monitor Session 0 MD MD MG MD MD MG Line Card 1 Port-Pipe 0 Port-Pipe 1 MD Monitor Session 1 Monitor Session 2 Port-Pipe 1 MD MG MG Port Monitoring 003 FTOS Behavior: On the C-Series and S-Series, all monitored frames are tagged if the configured monitoring direction is transmit (TX), regardless of whether the monitored port (MD) is a Layer 2 or Layer 3 port.
PAGE 827
Configuring Port Monitoring To configure port monitoring: Step Command Syntax Command Mode Task 1 show interface EXEC Privilege Verify that the intended monitoring port has no configuration other than no shutdown, as shown in Figure 38-6. 2 monitor session CONFIGURATION Create a monitoring session using the command monitor session from CONFIGURATION mode, as shown in Figure 38-6.
PAGE 828
www.dell.com | support.dell.com Figure 38-7.
PAGE 829
Figure 38-8. Configuring Flow-based Monitoring FTOS(conf)#monitor session 0 FTOS(conf-mon-sess-0)#flow-based enable FTOS(conf)#ip access-list ext testflow FTOS(config-ext-nacl)#seq 5 permit icmp any any count bytes monitor FTOS(config-ext-nacl)#seq 10 permit ip 102.1.1.
PAGE 830
www.dell.com | support.dell.com Remote port mirroring uses the analyzers shown in the aggregation network in Site A. The VLAN traffic on monitored links from the access network is tagged and assigned to a dedicated L2 VLAN. Monitored links are configured in two source sessions shown with orange and green circles. Each source session uses a separate reserved VLAN to transmit mirrored packets (mirrored source-session traffic is shown with an orange or green circle with a blue border).
PAGE 831
• • • • • You can configure any switch in the network with source ports and destination ports, and allow it to function in an intermediate transport session for a reserved VLAN at the same time for multiple remote-port mirroring sessions. You can enable and disable individual mirroring sessions. BPDU monitoring is not required to use remote port mirroring.
PAGE 832
www.dell.com | support.dell.com • - The VLAN consists of more than 128 ports. - You add a port to a VLAN, which has already been configured in a source session, and the newly added port exceeds the 128-port limit. - You configure a range of VLANs in a source session and the combined number of ports in the VLANs exceeds 128. • You can use ACLs on a source port. In a flow-based source session, packets sent from the RPM are not monitored.
PAGE 833
Configure a dedicated L2 VLAN for Remote Port Mirroring Step Command Syntax Command Mode Task 1 interface vlan vlan-id CONFIGURATION Create a VLAN to transport mirrored traffic in remote port mirroring. Valid vlan-id values are 1 to 4094. The default VLAN ID is not supported. 2 mode remote-port-mirroring VLAN INTERFACE Configure the dedicated L2 VLAN to be used to transport mirrored traffic in remote port mirroring.
PAGE 834
www.dell.com | support.dell.
PAGE 835
Configure a Destination Session on Multiple Switches Step Command Syntax Command Mode Task 1 monitor session session-id CONFIGURATION Configure the destination session for remote port mirroring and enter Monitor Session configuration mode.
PAGE 836
www.dell.com | support.dell.com Displaying Remote-Port Mirroring Configurations To display the current configuration of remote port mirroring for a specified session, enter the show config command in MONITOR SESSION configuration mode.
PAGE 837
Sample Configuration: Remote Port Mirroring Remote port mirroring requires a source session (monitored ports on different source switches), a reserved tagged VLAN for transporting mirrored traffic (configured on source, intermediate, and destination switches), and a destination session (destination ports connected to analyzers on destination switches). Figure 38-10 shows a sample configuration of remote port mirroring on a source switch.
PAGE 838
www.dell.com | support.dell.com Figure 38-12 shows a sample configuration of remote port mirroring on a destination switch. Note that in the show monitor session output of a destination session, the source is the reserved VLAN (for example, remote-vlan 22) and the destination is the destination port (for example, Gi 4/73) to which an analyzer is attached. Figure 38-12.
PAGE 839
39 Private VLANs Private VLANs is available on platforms: cs Private VLANs (PVLANs) provide Layer 2 isolation between ports within the same VLAN. That is, peer-to-peer communication is restricted or blocked. This is done by dividing the VLAN, into subdomains, and then restricting or blocking traffic flow between them.
PAGE 840
www.dell.com | support.dell.com There are three types of ports in PVLAN: • • • Host Ports—these ports are the ones that Private VLAN aims to isolate. They are connected to end-stations. Promiscuous Ports—these ports are members of the primary VLAN, and function as gateways to the primary and secondary VLANs. Trunk Ports—trunk ports carry tagged traffic between switches. They have promiscuous and trunk ports as members. Figure 39-2.
PAGE 841
Related Configuration Tasks • Private VLAN show Commands Configure PVLAN Ports You must assign switchports a PVLAN Port role—host, promiscuous, or trunk—before you can add them to a primary or secondary VLAN. • • • Host ports may not be a part of a non-private (regular) VLAN. Promiscuous ports may be a member of more than one primary VLAN, but may not be a member of a regular VLAN. Trunk ports may be a member of a regular VLAN.
PAGE 842
www.dell.com | support.dell.com Place the Secondary VLANs in a Primary VLAN A primary VLAN is a port-based VLAN that is specifically designated as a private VLAN. Doing so enables the VLAN to be divided into secondary VLANs. Step Task Command Syntax Command Mode 1 Access INTERFACE VLAN mode for the VLAN that you want to make the primary VLAN. interface vlan vlan-id CONFIGURATION 2 Designate a VLAN as a primary VLAN.
PAGE 843
40 Per-VLAN Spanning Tree Plus Per-VLAN Spanning Tree Plus is supported platforms: ces Port Monitoring is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Per-VLAN Spanning Tree Plus (PVST+) is a variation of Spanning Tree—developed by a third party— that allows you to configure a separate Spanning Tree instance for each VLAN. For more information on Spanning Tree, see Chapter 52, Spanning Tree Protocol. Figure 40-1.
PAGE 844
www.dell.com | support.dell.com FTOS supports three other variations of Spanning Tree, as shown in Table 40-1. Table 40-1. FTOS Supported Spanning Tree Protocols Dell Networking Term IEEE Specification Spanning Tree Protocol 802.1d Rapid Spanning Tree Protocol 802.1w Multiple Spanning Tree Protocol 802.1s Per-VLAN Spanning Tree Plus Third Party Implementation Information • • • • The FTOS implementation of PVST+ is based on IEEE Standard 802.1d. The FTOS implementation of PVST+ uses IEEE 802.
PAGE 845
Enable PVST+ When you enable PVST+, FTOS instantiates STP on each active VLAN. To enable PVST+ globally: Step Task Command Syntax Command Mode 1 Enter PVST context. protocol spanning-tree pvst PROTOCOL PVST 2 Enable PVST+. no disable PROTOCOL PVST Disable PVST+ Task Command Syntax Command Mode Disable PVST+ globally. disable PROTOCOL PVST Disable PVST+ on an interface, or remove a PVST+ parameter configuration.
PAGE 846
Load Balancing with PVST+ STI 2 root STI 1: VLAN 100 STI 2: VLAN 200 STI 3: VLAN 300 R2 vlan 100 bridge-priority 4096 2/32 Blocking 3/22 X R3 STI 3 root vlan 100 bridge-priority 4096 3/12 2/12 Forwarding www.dell.com | support.dell.com Figure 40-3. 1/22 X X 1/32 STI 1 root R1 vlan 100 bridge-priority 4096 The bridge with the bridge value for bridge priority is elected root.
PAGE 847
Figure 40-4. Display the PVST+ Forwarding Topology FTOS_E600(conf)#do show spanning-tree pvst vlan 100 VLAN 100 Root Identifier has priority 4096, Address 0001.e80d.b6d6 Root Bridge hello time 2, max age 20, forward delay 15 Bridge Identifier has priority 4096, Address 0001.e80d.b6d6 Configured hello time 2, max age 20, forward delay 15 We are the root of VLAN 100 Current root has priority 4096, Address 0001.e80d.
PAGE 848
www.dell.com | support.dell.com Modify Global PVST+ Parameters The root bridge sets the values for forward-delay, and hello-time and overwrites the values set on other PVST+ bridges. • • • Forward-delay is the amount of time an interface waits in the Listening State and the Learning State before it transitions to the Forwarding State. Hello-time is the time interval in which the bridge sends Bridge Protocol Data Units (BPDUs).
PAGE 849
Table 40-2 lists the default values for port cost by interface. Table 40-2. PVST+ Default Port Cost Values Port Cost Default Value 100-Mb/s Ethernet interfaces 200000 1-Gigabit Ethernet interfaces 20000 10-Gigabit Ethernet interfaces 2000 Port Channel with 100 Mb/s Ethernet interfaces 180000 Port Channel with 1-Gigabit Ethernet interfaces 18000 Port Channel with 10-Gigabit Ethernet interfaces 1800 Note: The FTOS implementation of PVST+ uses IEEE 802.1s costs as the default costs.
PAGE 850
www.dell.com | support.dell.com To enable EdgePort on an interface, use the following command: Task Enable EdgePort on an interface. Command Mode spanning-tree pvst edge-port INTERFACE [bpduguard | shutdown-on-violation] The EdgePort status of each interface is given in the output of the command show spanning-tree pvst, as shown in Figure 40-4.
PAGE 851
Configure a Root Guard Use the Root Guard feature in a Layer 2 PVST+ network to avoid bridging loops. You enable root guard on a per-port or per-port-channel basis. FTOS Behavior: The following conditions apply to a port enabled with root guard: • Root guard is supported on any PVST-enabled port or port-channel interface except when used as a stacking port.
PAGE 852
www.dell.com | support.dell.com Configure a Loop Guard The Loop Guard feature provides protection against Layer 2 forwarding loops (STP loops) caused by a hardware failure, such as a cable failure or an interface fault. When a cable or interface fails, a participating STP link may become unidirectional (STP requires links to be bidirectional) and an STP port does not receive BPDUs. When an STP blocking port does not receive BPDUs, it transitions to a forwarding state.
PAGE 853
PVST+ in Multi-vendor Networks Some non-Dell Networking systems which have hybrid ports participating in PVST+ transmit two kinds of BPDUs: an 802.1D BPDU and an untagged PVST+ BPDU. Dell Networking systems do not expect PVST+ BPDU (tagged or untagged) on an untagged port. If this happens, FTOS places the port in error-disable state. This behavior might result in the network not converging. To prevent FTOS from executing this action, use the command no spanning-tree pvst err-disable cause invalid-pvst-bpdu.
PAGE 854
www.dell.com | support.dell.com Task Command Syntax Command Mode Augment the Bridge ID with the VLAN ID. extend system-id PROTOCOL PVST FTOS(conf-pvst)#do show spanning-tree pvst vlan 5 brief VLAN 5 Executing IEEE compatible Spanning Tree Protocol Root ID Priority 32773, Address 0001.e832.73f7 Root Bridge hello time 2, max age 20, forward delay 15 Bridge ID Priority 32773 (priority 32768 sys-id-ext 5), Address 0001.e832.
PAGE 855
PVST+ Sample Configurations Figure 40-7, Figure 40-8, and Figure 40-9 provide the running configurations for the topology shown in Figure 40-3. Figure 40-7.
PAGE 856
www.dell.com | support.dell.com Figure 40-8.
PAGE 857
41 Quality of Service Quality of Service (QoS) is supported on platforms: ces Differentiated service is accomplished by classifying and queuing traffic, and assigning priorities to those queues. The E-Series has eight unicast queues per port and 128 multicast queues per-port pipe. Traffic is queued on ingress and egress. By default, on ingress, all data traffic is mapped to Queue 0, and all control traffic is mapped to Queue 7. On egress control traffic is mapped across all eight queues.
PAGE 858
www.dell.com | support.dell.com Table 41-1.
PAGE 859
Figure 41-1. Dell Networking QoS Architecture Marking (DiffServ, 802.1p, Exp) Ingress Packet Processing Packet Classification (ACL) Rate Policing Buffers Class-based Queues Switching Rate Limiting Buffers Class-based Queues Egress Congestion Management (WFQ Scheduling) Egress Packet Processing Traffic Shaping Congestion Avoidance (WRED) Implementation Information Dell Networking QoS implementation complies with IEEE 802.1p User Priority Bits for QoS Indication.
PAGE 860
www.dell.com | support.dell.com Port-based QoS Configurations You can configure the following QoS features on an interface: • • • • • Set dot1p Priorities for Incoming Traffic Configure Port-based Rate Policing Configure Port-based Rate Limiting Configure Port-based Rate Shaping Broadcast Storm Control Set dot1p Priorities for Incoming Traffic Change the priority of incoming traffic on the interface using the command dot1p-priority from INTERFACE mode, as shown in Figure 41-2.
PAGE 861
Honor dot1p Priorities on Ingress Traffic By default FTOS does not honor dot1p priorities on ingress traffic. Use the command service-class dynamic dot1p from INTERFACE mode to honor dot1p priorities on ingress traffic, as shown in Figure 41-3. You can configure this feature on physical interfaces and port-channels, but you cannot configure it on individual interfaces in a port channel.
PAGE 862
www.dell.com | support.dell.com Configure Port-based Rate Policing Rate policing ingress traffic on an interface using the command rate police from INTERACE mode, as shown in Figure 41-4. If the interface is a member of a VLAN, you may specify the VLAN for which ingress packets are policed. FTOS Behavior: On the C-Series and S-Series, rate shaping is effectively rate limiting because of its smaller buffer size. On the E-Series: — 802.
PAGE 863
Configure Port-based Rate Limiting Configure Port-based Rate Limiting is supported only on platform e FTOS Behavior: On the C-Series and S-Series, rate shaping is effectively rate limiting because of its smaller buffer size. On the E-Series: — 802.1Q-priority tagged frames are sometimes not rate-limited according to the configured rate-limit value.
PAGE 864
www.dell.com | support.dell.com Configure Port-based Rate Shaping Rate shaping buffers, rather than drops, traffic exceeding the specified rate until the buffer is exhausted. If any stream exceeds the configured bandwidth on a continuous basis, it can consume all of the buffer space that is allocated to the port. Apply rate shaping to outgoing traffic on a port using the command rate shape from INTERFACE mode, as shown in Figure 41-8.
PAGE 865
Policy-based QoS Configurations Policy-based QoS configurations consist of the components shown in Figure 41-9. Figure 41-9.
PAGE 866
www.dell.com | support.dell.com 2. Once you create a class-map, FTOS places you in CLASS MAP mode. From this mode, specify your match criteria using the command match ip, as shown in Figure 41-10. Match-any class maps allow up to five ACLs, and match-all class-maps allow only one ACL. 3. After you specify your match criteria, link the class-map to a queue using the command service-queue from POLICY MAP mode, as shown in Figure 41-10. Figure 41-10.
PAGE 867
Determine the order in which ACLs are used to classify traffic When you link class-maps to queues using the command service-queue, FTOS matches the class-maps according to queue priority (queue numbers closer to 0 have lower priorities). For example, in Figure 41-10, class-map cmap2 is matched against ingress packets before cmap1. ACLs acl1 and acl2 have overlapping rules because the address range 20.1.1.0/24 is within 20.0.0.0/8. Therefore, (without the keyword order) packets within the range 20.1.1.
PAGE 868
www.dell.com | support.dell.com FTOS Behavior: An explicit “deny any" rule in a Layer 3 ACL used in a (match any or match all) class-map creates a "default to Queue 0" entry in the CAM, which causes unintended traffic classification. Below, traffic is classified in two Queues, 1 and 2. Class-map ClassAF1 is “match any,” and ClassAF2 is “match all”.
PAGE 869
Create a QoS Policy There are two types of QoS policies: input and output. Input QoS policies regulate Layer 3 and Layer 2 ingress traffic. The regulation mechanisms for input QoS policies are rate policing and setting priority values. There are two types of input QoS policies: Layer 3 and Layer 2. • • Layer 3 QoS input policies allow you to rate police and set a DSCP or dot1p value. Layer 2 QoS input policies allow you to rate police and set a dot1p value.
PAGE 870
www.dell.com | support.dell.com Figure 41-12. Marking DSCP Values for Egress Packets FTOS#config FTOS(conf)#qos-policy-input my-input-qos-policy FTOS(conf-qos-policy-in)#set ip-dscp 34 % Info: To set the specified DSCP value 34 (100-010 b) the QoS policy must be mapped to queue 4 (100 b).
PAGE 871
Configure policy-based rate shaping Rate shape egress traffic using the command rate-shape from QOS-POLICY-OUT mode. Output QoS policy can be applied to an output policy map with a policy aggregate or to an specific queue. Per queue rate shaping is supported on C-Series and S-Series only; see Create Output Policy Maps.
PAGE 872
www.dell.com | support.dell.com Table 41-4 shows an example of choosing bandwidth weights for all four queues to achieve a target bandwidth allocation. Table 41-4. Assigning Bandwidth Weights for the C-Series and S-Series Weight Equivalent Percentage Target Allocation 0 1 0.44% 1% 1 64 28.44% 25% 2 128 56.89% 60% 3 32 14.
PAGE 873
Apply an input QoS policy to an input policy map Apply an input QoS policy to an input policy map using the command policy-aggregate from POLICY-MAP-IN mode. Honor DSCP values on ingress packets FTOS provides the ability to honor DSCP values on ingress packets using Trust DSCP feature. Enable this feature using the command trust diffserv from POLICY-MAP-IN mode. Table 41-5 lists the standard DSCP definitions, and indicates to which queues FTOS maps DSCP values.
PAGE 874
www.dell.com | support.dell.com Honoring dot1p values on ingress packets FTOS provides the ability to honor dot1p values on ingress packets with the Trust dot1p feature. Enable Trust dot1p using the command trust dot1p from POLICY-MAP-IN mode. Table 41-6 specifies the queue to which the classified traffic is sent based on the dot1p value. Table 41-6.
PAGE 875
In the following configuration, packets are classified to queues using the three class maps: ! policy-map-input input-policy service-queue 1 class-map qos-BE1 service-queue 3 class-map qos-AF3 service-queue 4 class-map qos-AF4 ! class-map match-any qos-AF3 match ip dscp 24 match ip access-group qos-AF3-ACL ! class-map match-any qos-AF4 match ip dscp 32 match ip access-group qos-AF4-ACL ! class-map match-all qos-BE1 match ip dscp 0 match ip access-group qos-BE1-ACL The packet classification logic for the ab
PAGE 876
www.dell.com | support.dell.com On the C-Series and S-Series all traffic is by default mapped to the same queue, Queue 0. If you honor dot1p on ingress, then you can create service classes based the queueing strategy in Table 41-6 using the command service-class dynamic dot1p from INTERFACE mode. You may apply this queuing strategy globally by entering this command from CONFIGURATION mode. • • All dot1p traffic is mapped to Queue 0 unless service-class dynamic dot1p is enabled on an interface or globally.
PAGE 877
Specify an aggregate QoS policy Specify an aggregate QoS policy using the command policy-aggregate from POLICY-MAP-OUT mode. Apply an output policy map to an interface Apply an input policy map to an interface using the command service-policy output from INTERFACE mode. You can apply the same policy map to multiple interfaces, and you can modify a policy map after you apply it.
PAGE 878
www.dell.com | support.dell.com Strict-priority Queueing You can assign strict-priority to one unicast queue, 1-7, using the command strict-priority from CONFIGURATION mode. Strict-priority means that FTOS dequeues all packets from the assigned queue before servicing any other queues. • • • The strict-priority supersedes bandwidth-percentage an bandwidth-weight percentage configurations. A queue with strict-priority can starve other queues in the same port-pipe.
PAGE 879
You can create a custom WRED profile or use on of the five pre-defined profiles listed in Table 41-7. Table 41-7. Pre-defined WRED Profiles Default Profile Minimum Name Threshold Maximum Threshold wred_drop 0 0 wred_ge_y 1024 2048 wred_ge_g 2048 4096 wred_teng_y 4096 8192 wred_teng_g 8192 16384 Create WRED Profiles To create a WRED profile: 1. Create a WRED profile using the command wred from CONFIGURATION mode. 2. The command wred places you in WRED mode.
PAGE 880
www.dell.com | support.dell.com WRED can be used in combination with storm control to regulate broadcast and unknown-unicast traffic. This feature is available through an additional option in command storm-control [broadcast | unknown-unicast] at CONFIGURATION. See the FTOS Command Line Reference for information on using this command. Using the command storm-control broadcast 50 out wred-profile, for example, first the total bandwidth that broadcast traffic can consume is reduced to 50% of line rate.
PAGE 881
Figure 41-15.
PAGE 882
www.dell.com | support.dell.com For example, if you configure 70% bandwidth to multicast, 80% bandwidth to one queue in unicast and 0 % to all remaining unicast queues, then first, FTOS assigns 70% bandwidth to multicast, then FTOS derives the 80% bandwidth for unicast from the remaining 30% of total bandwidth. Pre-calculating Available QoS CAM Space Pre-calculating Available QoS CAM Space is supported on platforms: ces Before version 7.3.
PAGE 883
• Status indicates whether or not the specified policy-map can be completely applied to an interface in the port-pipe. • Allowed indicates that the policy-map can be applied because the estimated number of CAM entries is less or equal to the available number of CAM entries. The number of interfaces in the port-pipe to which the policy-map can be applied is given in parenthesis.
PAGE 884
| Quality of Service www.dell.com | support.dell.
PAGE 885
42 Routing Information Protocol Routing Information Protocol is supported only on platforms: ce s RIP is supported on the S-Series following the release of FTOS version 7.8.1.0, and on the C-Series with FTOS versions 7.6.1.0 and after. RIP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Routing Information Protocol (RIP) is based on a distance-vector algorithm, it tracks distances or hop counts to nearby routers when establishing network connections.
PAGE 886
www.dell.com | support.dell.com RIP must receive regular routing updates to maintain a correct routing table. Response messages containing a router’s full routing table are transmitted every 30 seconds. If a router does not send an update within a certain amount of time, the hop count to that route is changed to unreachable (a route hop metric of 16 hops). Another timer sets the amount of time before the unreachable routes are removed from the routing table.
PAGE 887
Configuration Task List for RIP • • • • • • • • • Enable RIP globally (mandatory) Configure RIP on interfaces (optional) Control RIP routing updates (optional) Set send and receive version (optional) Generate a default route (optional) Control route metrics (optional) Summarize routes (optional) Control route metrics Debug RIP For a complete listing of all commands related to RIP, refer to the FTOS Command Reference. Enable RIP globally By default, RIP is not enabled in FTOS.
PAGE 888
www.dell.com | support.dell.com When the RIP process has learned the RIP routes, use the show ip rip database command in the EXEC mode to view those routes (Figure 385). Figure 42-2. show ip rip database Command Example (Partial) FTOS#show ip rip database Total number of routes in RIP database: 978 160.160.0.0/16 [120/1] via 29.10.10.12, 00:00:26, Fa 160.160.0.0/16 auto-summary 2.0.0.0/8 [120/1] via 29.10.10.12, 00:01:22, Fa 2.0.0.0/8 auto-summary 4.0.0.0/8 [120/1] via 29.10.10.12, 00:01:22, Fa 4.0.0.
PAGE 889
Control RIP routing updates By default, RIP broadcasts routing information out all enabled interfaces, but you can configure RIP to send or to block RIP routing information, either from a specific IP address or a specific interface. To control which devices or interfaces receive routing updates, you must configure a direct update to one router and configure interfaces to block RIP updates from other sources.
PAGE 890
www.dell.com | support.dell.com To add routes from other routing instances or protocols, use any of the following commands in the ROUTER RIP mode: Command Syntax Command Mode Purpose redistribute {connected | static} [metric metric-value] [route-map map-name] ROUTER RIP Include directly connected or user-configured (static) routes in RIP. • metric range: 0 to 16 • map-name: name of a configured route map.
PAGE 891
Figure 42-3 shows an example of the RIP configuration after the ROUTER RIP mode version command is set to RIPv2. When the ROUTER RIP mode version command is set, the interface (GigabitEthernet 0/0) participating in the RIP process is also set to send and receive RIPv2. Figure 42-3.
PAGE 892
www.dell.com | support.dell.com Figure 42-5.
PAGE 893
If you must perform routing between discontiguous subnets, disable automatic summarization. With automatic route summarization disabled, subnets are advertised. The command autosummary requires no other configuration commands. To disable automatic route summarization, in the ROUTER RIP mode, enter no autosummary. Note: If the ip split-horizon command is enabled on an interface, then the system does not advertise the summarized address.
PAGE 894
www.dell.com | support.dell.com To enable RIP debugging, use the following command in the EXEC privilege mode: Command Syntax Command Mode Purpose debug ip rip [interface | database | events | trigger] EXEC privilege Enable debugging of RIP. Figure 42-6 shows the confirmation when the debug function is enabled. Figure 42-6. debug ip rip Command Example FTOS#debug ip rip RIP protocol debug is ON FTOS# To disable RIP, use the no debug ip rip command.
PAGE 895
Configuring RIPv2 on Core 2 Figure 42-8. Configuring RIPv2 on Core 2 Core2(conf-if-gi-2/31)# Core2(conf-if-gi-2/31)#router rip Core2(conf-router_rip)#ver 2 Core2(conf-router_rip)#network 10.200.10.0 Core2(conf-router_rip)#network 10.300.10.0 Core2(conf-router_rip)#network 10.11.10.0 Core2(conf-router_rip)#network 10.11.20.0 Core2(conf-router_rip)#show config ! router rip network 10.0.0.
PAGE 896
www.dell.com | support.dell.com Figure 42-10.
PAGE 897
RIP Configuration on Core 3 Figure 42-12. RIP Configuration on Core 3 Core3(conf-if-gi-3/21)#router rip Core3(conf-router_rip)#version 2 Core3(conf-router_rip)#network 192.168.1.0 Core3(conf-router_rip)#network 192.168.2.0 Core3(conf-router_rip)#network 10.11.30.0 Core3(conf-router_rip)#network 10.11.20.0 Core3(conf-router_rip)#show config ! router rip network 10.0.0.0 network 192.168.1.0 network 192.168.2.
PAGE 898
www.dell.com | support.dell.com Figure 42-14.
PAGE 899
RIP Configuration Summary Figure 42-16. Summary of Core 2 RIP Configuration Using Output of show run Command ! interface GigabitEthernet 2/11 ip address 10.11.10.1/24 no shutdown ! interface GigabitEthernet 2/31 ip address 10.11.20.2/24 no shutdown ! interface GigabitEthernet 2/41 ip address 10.200.10.1/24 no shutdown ! interface GigabitEthernet 2/42 ip address 10.250.10.1/24 no shutdown router rip version 2 10.200.10.0 10.300.10.0 10.11.10.0 10.11.20.0 Figure 42-17.
PAGE 900
www.dell.com | support.dell.
PAGE 901
43 Remote Monitoring Remote Monitoring is supported on platform ces Remote Monitoring is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. This chapter describes the Remote Monitoring (RMON): • • Implementation Fault Recovery Remote Monitoring (RMON) is an industry-standard implementation that monitors network traffic by sharing network monitoring information.
PAGE 902
www.dell.com | support.dell.com Fault Recovery RMON provides the following fault recovery functions: Interface Down—When an RMON-enabled interface goes down, monitoring continues. However, all data values are registered as 0xFFFFFFFF (32 bits) or ixFFFFFFFFFFFFFFFF (64 bits). When the interface comes back up, RMON monitoring processes resumes. Note: A Network Management System (NMS) should be ready to interpret a down interface and plot the interface performance graph accordingly.
PAGE 903
Set rmon alarm To set an alarm on any MIB object, use the rmon alarm or rmon hc-alarm command in GLOBAL CONFIGURATION mode. To disable the alarm, use the no form of this command: Command Syntax Command Mode Purpose [no] rmon alarm number variable interval {delta | absolute} rising-threshold [value event-number] falling-threshold value event-number [owner string] CONFIGURATION Set an alarm on any MIB object. Use the no form of this command to disable the alarm.
PAGE 904
www.dell.com | support.dell.com Figure 43-1. rmon alarm Command Example FTOS(conf)#rmon alarm 10 1.3.6.1.2.1.2.2.1.20.1 20 delta rising-threshold 15 1 falling-threshold 0 owner nms1 Alarm Number MIB Variable Monitor Interval Counter Value Limit Triggered Event The above example configures RMON alarm number 10. The alarm monitors the MIB variable 1.3.6.1.2.1.2.2.1.20.1 (ifEntry.ifOutErrors) once every 20 seconds until the alarm is disabled, and checks the rise or fall of the variable.
PAGE 905
Figure 43-2. rmon event Command Example FTOS(conf)#rmon event 1 log trap eventtrap description “High ifOutErrors” owner nms1 The above configuration example creates RMON event number 1, with the description “High ifOutErrors”, and generates a log entry when the event is triggered by an alarm. The user nms1 owns the row that is created in the event table by this command. This configuration also generates an SNMP trap when the event is triggered using the SNMP community string “eventtrap”.
PAGE 906
www.dell.com | support.dell.com Configure RMON collection history To enable the RMON MIB history group of statistics collection on an interface, use the rmon collection history command in interface configuration mode. To remove a specified RMON history group of statistics collection, use the no form of this command.
PAGE 907
44 Rapid Spanning Tree Protocol Rapid Spanning Tree Protocol is supported on platforms: ces RSTP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Rapid Spanning Tree Protocol (RSTP) is a Layer 2 protocol—specified by IEEE 802.1w—that is essentially the same as Spanning-Tree Protocol (STP) but provides faster convergence and interoperability with switches configured with STP and MSTP.
PAGE 908
www.dell.com | support.dell.com • • • • • • • Modify Interface Parameters Configure an EdgePort Preventing Network Disruptions with BPDU Guard Influence RSTP Root Selection Configuring Spanning Trees as Hitless Fast Hellos for Link State Detection Flush MAC Addresses after a Topology Change Important Points to Remember • • • • RSTP is disabled by default. FTOS supports only one Rapid Spanning Tree (RST) instance.
PAGE 909
To configure the interfaces for Layer 2 and then enable them: Step Task Command Syntax Command Mode 1 If the interface has been assigned an IP address, remove it. no ip address INTERFACE 2 Place the interface in Layer 2 mode. switchport INTERFACE 3 Enable the interface. no shutdown INTERFACE Verify that an interface is in Layer 2 mode and enabled using the show config command from INTERFACE mode. Figure 44-2.
PAGE 910
www.dell.com | support.dell.com Figure 44-3. Verifying RSTP is Enabled FTOS(conf-rstp)#show config ! protocol spanning-tree rstp no disable FTOS(conf-rstp)# Indicates that Rapid Spanning Tree is enabled When you enable Rapid Spanning Tree, all physical and port-channel interfaces that are enabled and in Layer 2 mode are automatically part of the RST topology. • • Only one path from any bridge to any other bridge is enabled. Bridges block a redundant path by disabling one of the link ports.
PAGE 911
Figure 44-5. show spanning-tree rstp Command Example FTOS#show spanning-tree rstp Root Identifier has priority 32768, Address 0001.e801.cbb4 Root Bridge hello time 2, max age 20, forward delay 15, max hops 0 Bridge Identifier has priority 32768, Address 0001.e801.cbb4 Configured hello time 2, max age 20, forward delay 15, max hops 0 We are the root Current root has priority 32768, Address 0001.e801.
PAGE 912
www.dell.com | support.dell.com Figure 44-6. show spanning-tree rstp brief Command Example R3#show spanning-tree rstp brief Executing IEEE compatible Spanning Tree Protocol Root ID Priority 32768, Address 0001.e801.cbb4 Root Bridge hello time 2, max age 20, forward delay 15 Bridge ID Priority 32768, Address 0001.e80f.
PAGE 913
Table 44-2 displays the default values for RSTP. Table 44-2.
PAGE 914
www.dell.com | support.dell.com Modify Interface Parameters On interfaces in Layer 2 mode, you can set the port cost and port priority values. • • Port cost is a value that is based on the interface type. The default values are listed in Table 44-2. The greater the port cost, the less likely the port will be selected to be a forwarding port. Port priority influences the likelihood that a port will be selected to be a forwarding port in case that several ports have the same port cost.
PAGE 915
Verify that EdgePort is enabled on a port using the show spanning-tree rstp command from the EXEC privilege mode or the show config command from INTERFACE mode; Dell Networking recommends using the show config command, as shown in Figure 44-7. FTOS Behavior: Regarding bpduguard shutdown-on-violation behavior: 1 If the interface to be shutdown is a port channel then all the member ports are disabled in the hardware.
PAGE 916
www.dell.com | support.dell.com Influence RSTP Root Selection The Rapid Spanning Tree Protocol determines the root bridge, but you can assign one bridge a lower priority to increase the likelihood that it will be selected as the root bridge. To change the bridge priority, use the following command: Task Command Syntax Command Mode Assign a number as the bridge priority or designate it as the primary or secondary root. priority-value range: 0 to 65535.
PAGE 917
Fast Hellos for Link State Detection Fast Hellos for Link State Detection is available only on platform: s Use RSTP Fast Hellos to achieve sub-second link-down detection so that convergence is triggered faster. The standard RSTP link-state detection mechanism does not offer the same low link-state detection speed. RSTP Fast Hellos decrease the hello interval to the order of milliseconds and all timers derived from the hello timer are adjusted accordingly.
PAGE 918
www.dell.com | support.dell.com Configure a Root Guard Use the Root Guard feature in a Layer 2 RSTP network to avoid bridging loops. You enable root guard on a per-port or per-port-channel basis. FTOS Behavior: The following conditions apply to a port enabled with root guard: • Root guard is supported on any RSTP-enabled port or port-channel interface except when used as a stacking port.
PAGE 919
Configure a Loop Guard The Loop Guard feature provides protection against Layer 2 forwarding loops (STP loops) caused by a hardware failure, such as a cable failure or an interface fault. When a cable or interface fails, a participating STP link may become unidirectional (STP requires links to be bidirectional) and an STP port does not receive BPDUs. When an STP blocking port does not receive BPDUs, it transitions to a forwarding state. This condition can create a loop in the network.
PAGE 920
www.dell.com | support.dell.com 920 Displaying STP Guard Configuration To verify the STP guard configured on RSTP port or port-channel interfaces, enter the show spanning-tree rstp guard command. Refer to Chapter 52, Spanning Tree Protocol for information on how to configure and use the STP root guard, loop guard, and BPDU guard features. Figure 44-9 shows an example for an RSTP network (instance 0) in which: • • • Root guard is enabled on a port that is in a root-inconsistent state.
PAGE 921
45 Security Security features are supported on platforms ces This chapter discusses several ways to provide access security to the Dell Networking system. Platform-specific features are identified by the c, e or s icons (as shown below). Security features are supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later.
PAGE 922
www.dell.com | support.dell.
PAGE 923
Suppress AAA Accounting for null username sessions When AAA Accounting is activated, the FTOS software issues accounting records for all users on the system, including users whose username string, because of protocol translation, is NULL. An example of this is a user who comes in on a line where the AAA Authentication login method-list none command is applied.
PAGE 924
www.dell.com | support.dell.com No specific show command exists for TACACS+ accounting. To obtain accounting records displaying information about users currently logged in, perform the following task in Privileged EXEC mode: Command Syntax Command Mode Purpose show accounting CONFIGURATION Step through all active sessions and print all the accounting records for the actively accounted functions. Figure 45-1.
PAGE 925
Configure login authentication for terminal lines You can assign up to five authentication methods to a method list. FTOS evaluates the methods in the order in which you enter them in each list. If the first method list does not respond or returns an error, FTOS applies the next method list until the user either passes or fails the authentication. If the user fails a method list, FTOS does not apply the next method list.
PAGE 926
www.dell.com | support.dell.com To view the configuration, use the show config command in the LINE mode or the show running-config in the EXEC Privilege mode. Note: Dell Networking recommends that you use the none method only as a backup. This method does not authenticate users. The none and enable methods do not work with SSH. You can create multiple method lists and assign them to different terminal lines.
PAGE 927
To use local authentication for enable secret on console, while using remote authentication on VTY lines, perform the following steps: FTOS(config)# aaa authentication enable mymethodlist radius tacacs FTOS(config)# line vty 0 9 FTOS(config-line-vty)# enable authentication mymethodlist Server-side configuration TACACS+: When using TACACS+, Dell Networking sends an initial packet with service type SVC_ENABLE, and then, a second packet with just the password.
PAGE 928
www.dell.com | support.dell.com Privilege levels 2 through 14 are not configured and you can customize them for different users and access. After you configure other privilege levels, enter those levels by adding the level parameter after the enable command or by configuring a user name or password that corresponds to the privilege level. Refer to Configure a username and password for more information on configuring user names. By default, commands in FTOS are assigned to different privilege levels.
PAGE 929
To configure a username and password, use the following command in the CONFIGURATION mode: Command Syntax Command Mode Purpose username name [access-class access-list-name] [nopassword | password [encryption-type] password] [privilege level] CONFIGURATION Assign a user name and password. Configure the optional and required parameters: • name: Enter a text string up to 63 characters long. • access-class access-list-name: Enter the name of a configured IP ACL.
PAGE 930
www.dell.com | support.dell.com Configure custom privilege levels In addition to assigning privilege levels to the user, you can configure the privilege levels of commands so that they are visible in different privilege levels. Within FTOS, commands have certain privilege levels. With the privilege command, the default level can be changed or you can reset their privilege level back to the default.
PAGE 931
Step Command Syntax Command Mode Purpose 3 privilege mode {level level command | reset command} CONFIGURATION Configure level and commands for a mode or reset a command’s level. Configure the following required and optional parameters: • mode: Enter a keyword for the modes (exec, configure, interface, line, route-map, router) • level level range: 0 to 15. Levels 0, 1 and 15 are pre-configured. Levels 2 to 14 are available for custom configuration.
PAGE 932
www.dell.com | support.dell.com Figure 45-3. User john’s Login and the List of Available Commands apollo% telnet 172.31.1.53 Trying 172.31.1.53... Connected to 172.31.1.53. Escape character is '^]'.
PAGE 933
To move to a lower privilege level, enter the command disable followed by the level-number you wish to set for the user in the EXEC Privilege mode. If you enter disable without a level-number, your security level is 1. RADIUS Remote Authentication Dial-In User Service (RADIUS) is a distributed client/server protocol. This protocol transmits authentication, authorization, and configuration information between a central RADIUS server and a RADIUS client (the Dell Networking system).
PAGE 934
www.dell.com | support.dell.com 28 RADIUS_IDLE_TIMEOUT 61 RADIUS_NAS_PORT_TYPE 95 NAS_IPv6_ADDRESS 802.
PAGE 935
Idle Time Every session line has its own idle-time. If the idle-time value is not changed, the default value of 30 minutes is used. RADIUS specifies idle-time allow for a user during a session before timeout. When a user logs in, the lower of the two idle-time values (configured or default) is used.
PAGE 936
www.dell.com | support.dell.com • Monitor RADIUS (optional) For a complete listing of all FTOS commands related to RADIUS, refer to the Security chapter in the FTOS Command Reference. Note: RADIUS authentication and authorization are done in a single step. Hence, authorization cannot be used independent of authentication. However, if RADIUS authorization is configured and authentication is not, then a message is logged stating this.
PAGE 937
Specify a RADIUS server host When configuring a RADIUS server host, you can set different communication parameters, such as the UDP port, the key password, the number of retries, and the timeout.
PAGE 938
www.dell.com | support.dell.com To set global communication parameters for all RADIUS server hosts, use any or all of the following commands in the CONFIGURATION mode: Command Syntax Command Mode Purpose radius-server deadtime seconds CONFIGURATION Set a time interval after which a RADIUS host server is declared dead. • seconds range: 0 to 2147483647.
PAGE 939
• • • • • • Choose TACACS+ as the Authentication Method Monitor TACACS+ TACACS+ Remote Authentication and Authorization TACACS+ Remote Authentication and Authorization Specify a TACACS+ server host Choose TACACS+ as the Authentication Method For a complete listing of all commands related to TACACS+, refer to the Security chapter in the FTOS Command Reference.
PAGE 940
www.dell.com | support.dell.com Figure 45-4.
PAGE 941
Figure 45-5 demonstrates how to configure the access-class from a TACACS+ server. This causes the configured access-class on the VTY line to be ignored. If you have configured a deny10 ACL on the TACACS+ server, FTOS downloads it and applies it. If the user is found to be coming from the 10.0.0.0 subnet, FTOS also immediately closes the Telnet connection. Note, that no matter where the user is coming from, they see the login prompt. Figure 45-5.
PAGE 942
www.dell.com | support.dell.com To delete a TACACS+ server host, use the no tacacs-server host {hostname | ip-address} command. freebsd2# telnet 2200:2200:2200:2200:2200::2202 Trying 2200:2200:2200:2200:2200::2202... Connected to 2200:2200:2200:2200:2200::2202. Escape character is '^]'.
PAGE 943
FTOS supports both inbound and outbound SSH sessions using IPv4 or IPv6 addressing. Inbound SSH supports accessing the system through the management interface as well as through a physical Layer 3 interface. For details on command syntax, see the Security chapter in the FTOS Command Line Interface Reference. SCP is a remote file copy program that works with SSH and is supported by FTOS. Note: The Windows-based WinSCP client software is not supported for secure copying between a PC and an FTOS-based system.
PAGE 944
www.dell.com | support.dell.com Figure 45-6. Specifying an SSH version FTOS(conf)#ip ssh server version 2 FTOS(conf)#do show ip ssh SSH server : disabled. SSH server version : v2. Password Authentication : enabled. Hostbased Authentication : disabled. RSA Authentication : disabled. To disable SSH server functions, enter no ip ssh server enable.
PAGE 945
• ip ssh connection-rate-limit: Configure the maximum number of incoming SSH connections per minute. • • • • • • • • • • • ip ssh hostbased-authentication enable: Enable hostbased-authentication for the SSHv2 server. ip ssh key-size: Configure the size of the server-generated RSA SSHv1 key. ip ssh password-authentication enable: Enable password authentication for the SSH server. ip ssh pub-key-file: Specify the file to be used for host-based authentication.
PAGE 946
www.dell.com | support.dell.com Figure 45-8. Enabling SSH Password Authentication FTOS(conf)#ip ssh server enable % Please wait while SSH Daemon initializes ... done. FTOS(conf)#ip ssh password-authentication enable FTOS#sh ip ssh SSH server : enabled. Password Authentication : enabled. Hostbased Authentication : disabled. RSA Authentication : disabled. RSA Authentication of SSH The following procedure authenticates an SSH client based on an RSA key using RSA authentication.
PAGE 947
To configure host-based authentication: Step Task Command Syntax 1 Configure RSA Authentication. See RSA Authentication of SSH, above. 2 Create shosts by copying the public RSA key to the to the file shosts in the diretory .ssh, and write the IP address of the host to the file. Figure 45-10. Command Mode cp /etc/ssh/ssh_host_rsa_key.pub /.ssh/shosts Creating shosts admin@Unix_client# cd /etc/ssh admin@Unix_client# ls moduli sshd_config ssh_host_dsa_key.pub ssh_host_key.pub ssh_host_rsa_key.
PAGE 948
www.dell.com | support.dell.com Figure 45-12. Client-based SSH Authentication FTOS#ssh 10.16.127.201 ? -l User name option -p SSH server port option (default 22) -v SSH protocol version Troubleshooting SSH • You may not bind id_rsa.pub to RSA authentication while logged in via the console. In this case, Message 2 appears. Message 2 RSA Authentication Error %Error: No username set for this term.
PAGE 949
Trace Lists The Trace Lists feature is supported only on the E-Series: e You can log packet activity on a port to confirm the source of traffic attacking a system. Once the Trace list is enabled on the system, you view its traffic log to confirm the source address of the attacking traffic. In FTOS, Trace lists are similar to extended IP ACLs, except that Trace lists are not applied to an interface. Instead, Trace lists are enabled for all switched traffic entering the system.
PAGE 950
www.dell.com | support.dell.com Since traffic passes through the filter in the order of the filter’s sequence, you can configure the trace list by first entering the TRACE LIST mode and then assigning a sequence number to the filter.
PAGE 951
Step Command Syntax Command Mode Purpose 2 seq sequence-number {deny | permit} tcp {source mask | any | host ip-address} [operator port [port]] {destination mask | any | host ip-address} [operator port [port]] [established] [count [byte] | log] TRACE LIST Configure a trace list filter for TCP packets. • source: An IP address as the source IP address for the filter to match. • mask: a network mask • any: to match any IP source address • host ip-address: to match IP addresses in a host.
PAGE 952
www.dell.com | support.dell.com Figure 45-13. 952 Trace list Using seq Command Example FTOS(config-trace-acl)#seq 15 deny ip host 12.45.0.0 any log FTOS(config-trace-acl)#seq 5 permit tcp 121.1.3.45 0.0.255.255 any FTOS(config-trace-acl)#show conf ! ip trace-list dilling seq 5 permit tcp 121.1.0.0 0.0.255.255 any seq 15 deny ip host 12.45.0.
PAGE 953
Command Syntax Command Mode Purpose {deny | permit} tcp {source mask | any | host TRACE LIST Configure a deny or permit filter to examine TCP packets. Configure the following required and optional parameters: • source: An IP address as the source IP address for the filter to match. • mask: a network mask • any: to match any IP source address • host ip-address: to match IP addresses in a host. • destination: An IP address as the source IP address for the filter to match.
PAGE 954
www.dell.com | support.dell.com Figure 45-14. Trace List Example FTOS(config-trace-acl)#deny tcp host 123.55.34.0 any FTOS(config-trace-acl)#permit udp 154.44.123.34 0.0.255.255 host 34.6.0.0 FTOS(config-trace-acl)#show config ! ip trace-list nimule seq 5 deny tcp host 123.55.34.0 any seq 10 permit udp 154.44.0.0 0.0.255.255 host 34.6.0.
PAGE 955
VTY Line and Access-Class Configuration Various methods are available to restrict VTY access in FTOS. These depend on which authentication scheme you use — line, local, or remote: Table 45-1. VTY Access Authentication Method Username VTY access-class access-class support? support? Remote authorization support? Line YES NO NO Local NO YES NO TACACS+ YES NO YES (with FTOS 5.2.1.0 and later) RADIUS YES NO YES (with FTOS 6.1.1.
PAGE 956
www.dell.com | support.dell.com Figure 45-16.
PAGE 957
Figure 45-18.
PAGE 958
| Security www.dell.com | support.dell.
PAGE 959
46 Service Provider Bridging Service Provider Bridging is supported on platforms: ces This chapter contains the following major sections: • • • • • VLAN Stacking VLAN Stacking Packet Drop Precedence Dynamic Mode CoS for VLAN Stacking Layer 2 Protocol Tunneling Provider Backbone Bridging VLAN Stacking ces VLAN Stacking is supported on E-Series ExaScale ex with FTOS 8.2.1.0. and later. VLAN Stacking is supported on platforms: VLAN Stacking, also called Q-in-Q, is defined in IEEE 802.
PAGE 960
Figure 46-1. VLAN Stacking in a Service Provider Network TPID (0x9100) PCP DEI VID (VLAN 300) PCP TPID (0x8100) CFI (0) VID (VLAN Red) AN 1 00 tagged 100 AN 0 10 VL VL www.dell.com | support.dell.com In at the access point of a VLAN-stacking network, service providers add a VLAN tag, the S-Tag, to each frame before the 802.1Q tag. From this point, the frame is double-tagged. The service provider uses the S-Tag, to forward the frame traffic across its network.
PAGE 961
Configure VLAN Stacking Configuring VLAN-Stacking is a three-step process: 1. Create access and trunk ports. See page 961. 2. Assign access and trunk ports to a VLAN. See page 962. 3. Make the VLAN VLAN-stacking capable. Related Configuration Tasks • • • Configure the Protocol Type Value for the Outer VLAN Tag FTOS Options for Trunk Ports VLAN Stacking in Multi-vendor Networks Create Access and Trunk Ports An access port is a port on the service provider edge that directly connects to the customer.
PAGE 962
www.dell.com | support.dell.com Display the VLAN-Stacking configuration for a switchport using the command show config from INTERFACE mode, as shown in Figure 46-3. Figure 46-3.
PAGE 963
FTOS Options for Trunk Ports 802.1ad trunk ports may also be tagged members of a VLAN so that it can carry single and double-tagged traffic. You can enable trunk ports to carry untagged, single-tagged, and double-tagged VLAN traffic by making the trunk port a hybrid port. Step Task Command Syntax Command Mode 1 Configure a trunk port to carry untagged, single-tagged, and double-tagged traffic by making it a hybrid port. Note: Note: On the C-Series and S-Series, a trunk port can be added to an 802.
PAGE 964
www.dell.com | support.dell.com VLAN Stacking in Multi-vendor Networks The first field in the VLAN tag is the Tag Protocol Identifier (TPID), which is two bytes. In a VLAN-stacking network, once the frame is double tagged, the outer tag TPID must match the TPID of the next-hop system. While 802.1Q requires that the inner tag TPID is 0x8100, it does not require a specific value for the outer tag TPID.
PAGE 965
Figure 46-6.
PAGE 966
LUE TPID Mismatch and 0x8100 Match on the E-Series TeraScale TPID 0x9100 VLAN GREEN UE N BL VLA R1-E-Series TeraScale TPID: 0x9100 NB CE PROVIDER RVI SE X R2-E-Series TeraScale TPID: 0x8181 VLAN GREEN, VLAN VL AN Building D TPID 0x8100 VLA INTE RN ET www.dell.com | support.dell.com Figure 46-7.
PAGE 967
LUE First-byte TPID Match on the E-Series ExaScale TPID 0x9191 VLAN GREEN UE N BL VLA R1-E-Series TeraScale TPID: 0x9191 Building D NB CE PROVIDER RVI SE VLA INTE RN ET Figure 46-8. X R2-E-Series ExaScale TPID: 0x9100 VLAN R PURPLE VLAN GREEN, VLAN VL AN PU ED RP LE Building C VL AN D RE Table 46-1 details the outcome of matched and mis-matched TPIDs in a VLAN-stacking network with the E-Series. Table 46-1.
PAGE 968
www.dell.com | support.dell.com You can configure the first eight bits of the TPID using the command vlan-stack protocol-type. The TPID on the C-Series and S-Series systems is global. Ingress frames that do not match the system TPID are treated as untagged. This rule applies for both the outer tag TPID of a double-tagged frame and the TPID of a single-tagged frame.
PAGE 969
Single and Double-tag First-byte TPID Match on C-Series and S-Series VLA NB LUE DEFAULT VLAN Figure 46-10. TPID 0x8181 R2-C-Series w/ FTOS <8.2.1.0 ED TPID: 0x8181 VLAN R PURPLE VLAN GREEN, VLAN VLAN GREEN UE DEFAULT VLAN N BL R3-C-Series w/ FTOS >=8.2.1.0 VL VLA TPID: 0x8181 AN PU R1-C-Series w/ FTOS <8.2.1.
PAGE 970
www.dell.com | support.dell.com Table 46-2 details the outcome of matched and mismatched TPIDs in a VLAN-stacking network with the C-Series and S-Series. Table 46-2. C-Series and S-Series Behaviors for Mis-matched TPID Network Position Incoming Packet TPID System TPID Match Type Pre-8.2.1.0 8.2.1.
PAGE 971
Enable Drop Eligibility You must enable Drop Eligibility globally before you can honor or mark the DEI value. Task Command Syntax Command Mode Make packets eligible for dropping based on their DEI value. By default, packets are colored green, and DEI is marked 0 on egress. dei enable CONFIGURATION When Drop Eligibility is enabled, DEI mapping or marking takes place according to the defaults. In this case, the CFI is affected according to Table 46-3. Table 46-3.
PAGE 972
www.dell.com | support.dell.com Task Command Syntax FTOS#show interface dei-honor Default Drop precedence: Green Interface CFI/DEI Drop precedence ------------------------------------------------------------Gi 0/1 0 Green Gi 0/1 1 Yellow Gi 8/9 1 Red Gi 8/40 0 Yellow Mark Egress Packets with a DEI Value On egress, you can set the DEI value according to a different mapping than ingress (see Honor the Incoming DEI Value).
PAGE 973
Dynamic Mode CoS for VLAN Stacking Dynamic Mode CoS for VLAN Stacking is available only on platforms: cs One of the ways to ensure quality of service for customer VLAN-tagged frames is to use the 802.1p priority bits in the tag to indicate the level of QoS desired. When an S-Tag is added to incoming customer frames, the 802.1p bits on the S-Tag may be configured statically for each customer or derived from the C-Tag using Dynamic Mode CoS. Dynamic Mode CoS maps the C-Tag 802.1p value to a S-Tag 802.
PAGE 974
www.dell.com | support.dell.com FTOS Behavior: For Option A above, when there is a conflict between the queue selected by Dynamic Mode CoS (vlan-stack dot1p-mapping) and a QoS configuration, the queue selected by Dynamic Mode CoS takes precedence. However, rate policing for the queue is determined by QoS configuration.
PAGE 975
To map C-Tag dot1p values to S-Tag dot1p values and mark the frames accordingly: Step Task Command Syntax Command Mode Allocate CAM space to enable queuing frames according to the C-Tag or the S-Tag. vman-qos: mark the S-Tag dot1p and queue the frame according to the original C-Tag dot1p. This method requires half as many CAM entries as vman-qos-dual-fp. vman-qos-dual-fp: mark the S-Tag dot1p and queue the frame according to the S-Tag dot1p.
PAGE 976
SPANNI NG TR VLAN Stacking without L2PT INTE RN E T no spanning-tree ETWORK EN RE SPAN NIN G www.dell.com | support.dell.com Figure 46-13. T ING TREE ANN SP CE PROVIDER w/ I V R SE EE EE TR Building B no spanning-tree X BPDU w/ destination MAC address: 01-80-C2-00-00-00 Building A You might need to transport control traffic transparently through the intermediate network to the other region.
PAGE 977
VLAN Stacking with L2PT SPANNI NG TR Figure 46-14. INTE RN E E RE SPAN NIN G T no spanning-tree NETWORK EE EE TR ING TREE ANN SP PROVIDER w/ E C I RV SE BPDU w/ destination T MAC address: 01-01-e8-00-00-00 R1-E-Series R2 Non-Force10 System BPDU w/ destination MAC address: 01-80-C2-00-00-00 no spanning-tree Building B R3 Non-Force10 System BPDU w/ destination MAC address: 01-80-C2-00-00-00 Building A Implementation Information • • • L2PT is available for STP, RSTP, MSTP, and PVST+ BPDUs.
PAGE 978
www.dell.com | support.dell.com Enable Layer 2 Protocol Tunneling Step Task Command Syntax Command Mode 1 Verify that the system is running the default CAM profile; you must use this CAM profile for L2PT. show cam-profile EXEC Privilege 2 Enable protocol tunneling globally on the system. protocol-tunnel enable CONFIGURATION 3 Tunnel BPDUs the VLAN.
PAGE 979
Rate-limit BPDUs on the C-Series and S-Series CAM space is allocated in sections called Field Processor (FP) blocks. There are total 13 user-configurable FP blocks on the C-Series and S-Series. The default number of blocks for L2PT is 0; you must allocate at least one to enable BPDU rate-limiting. Step Task Command Syntax Command Mode 1 Create at least one FP group for L2PT. See CAM Allocation for details on this command. cam-acl l2acl CONFIGURATION 2 Save the running-config to the startup-config.
PAGE 980
www.dell.com | support.dell.com The same is true for GVRP. 802.1ad specifies that provider bridges participating in GVRP use a reserved destination MAC address called the Provider Bridge GVRP Address, 01-80-C2-00-00-0D, to exchange GARP PDUs instead of the GVRP Address, 01-80-C2-00-00-21, specified in 802.1Q. Only bridges in the service provider network use this destination MAC address so these bridges treat GARP PDUs originating from the customer network as normal data frames, rather than consuming them.
PAGE 981
47 sFlow ces sFlow is supported on E-Series ExaScale ex with FTOS 8.1.1.0. and later. sFlow is supported on platforms • • • • • • • • Enable and Disable sFlow sFlow Show Commands Configure Collectors Polling Intervals Sampling Rate Back-off Mechanism sFlow on LAG ports Extended sFlow Overview FTOS supports sFlow version 5. sFlow is a standard-based sampling technology embedded within switches and routers which is used to monitor network traffic.
PAGE 982
www.dell.com | support.dell.com Figure 47-1. sFlow Traffic Monitoring System sFlow Collector Switch/Router sFlow Datagrams sFlow Agent Poll Interface Counters Interface Counters Flow Samples Switch ASIC Implementation Information Dell Networking sFlow is designed so that the hardware sampling rate is per line card port-pipe and is decided based upon all the ports in that port-pipe.
PAGE 983
• • • • • • • • • • • FTOS exports all sFlow packets to the collector. A small sampling rate can equate to a large number of exported packets. A backoff mechanism will automatically be applied to reduce this amount. Some sampled packets may be dropped when the exported packet rate is high and the backoff mechanism is about to or is starting to take effect. The dropEvent counter, in the sFlow packet, will always be zero.
PAGE 984
www.dell.com | support.dell.com sFlow Show Commands FTOS includes the following sFlow display commands: • • • Show sFlow Globally Show sFlow on an Interface Show sFlow on a Line Card Show sFlow Globally Use the following command to view sFlow statistics: Command Syntax show sflow Command Mode EXEC Purpose Display sFlow configuration information and statistics. Figure 47-2 is a sample output from the show sflow command: Figure 47-2.
PAGE 985
Figure 47-3. Command Example: show sflow interface FTOS#show sflow interface gigabitethernet 1/16 Gi 1/16 Configured sampling rate :8192 Actual sampling rate :8192 Sub-sampling rate :2 Counter polling interval :15 Samples rcvd from h/w :33 Samples dropped for sub-sampling :6 The configuration, shown in Figure 47-2, is also displayed in the running configuration (Figure 47-4): Figure 47-4.
PAGE 986
www.dell.com | support.dell.com Configure Collectors The sflow collector command allows you to configure sFlow collectors to which sFlow datagrams are forwarded. You can configure up to two sFlow collectors (IPv4 or IPv6). If you configure two collectors, traffic samples are sent to both devices. e. IPv6 sFlow collectors and agents are supported on platforms: c e s.
PAGE 987
Sampling Rate Sampling Rate is supported on platform et. The sFlow sampling rate is the number of packets that are skipped before the next sample is taken. sFlow does not have time-based packet sampling. The sflow sample-rate command, when issued in CONFIGURATION mode, changes the default sampling rate. By default, the sampling rate of an interface is set to the same value as the current global default sampling rate.
PAGE 988
www.dell.com | support.dell.com Note: Sampling rate backoff can change the sampling rate value that is set in the hardware. This equation shows the relationship between actual sampling rate, sub-sampling rate, and the hardware sampling rate for an interface: Actual sampling rate = sub-sampling rate * hardware sampling rate Note the absence of a configured rate in the equation.
PAGE 989
Use the command sflow [extended-switch] [extended-router] [extended-gateway] enable command. By default packing of any of the extended information in the datagram is disabled. Use the command show sflow to confirm that extended information packing is enabled, as shown in Figure 47-6. Figure 47-6.
PAGE 990
www.dell.com | support.dell.com Important Points to Remember • • • • • The IP destination address has to be learned via BGP in order to export extended-gateway data, prior to FTOS version 7.8.1.0. If the IP destination address is not learned via BGP the Dell Networking system does not export extended-gateway data, prior to FTOS version 7.8.1.0. FTOS 7.8.1.
PAGE 991
48 Simple Network Management Protocol Simple Network Management Protocol is supported on platforms ces SNMP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Note: On Dell Networking routers, standard and private SNMP MIBs are supported, including all Get and a limited number of Set operations (such as set vlan and copy cmd). Protocol Overview Network management stations use Simple Network Management Protocol (SNMP) to retrieve or alter management data from network elements.
PAGE 992
www.dell.com | support.dell.com Configuring SNMP requires only a single step: 1. Create a community. See page 992.
PAGE 993
Message 1 SNMP Enabled 22:31:23: %RPM1-P:CP %SNMP-6-SNMP_WARM_START: Agent Initialized - SNMP WARM_START. View your SNMP configuration, using the command show running-config snmp from EXEC Privilege mode, as shown in Figure 48-1. Figure 48-1. Creating an SNMP Community FTOS#snmp-server community my-snmp-community ro 22:31:23: %RPM1-P:CP %SNMP-6-SNMP_WARM_START: Agent Initialized - SNMP WARM_START.
PAGE 994
www.dell.com | support.dell.com Task Command Figure 48-4. Reading the Value of Many Managed Objects at Once > snmpwalk -v 2c -c mycommunity 10.11.131.161 .1.3.6.1.2.1.1 SNMPv2-MIB::sysDescr.0 = STRING: Force10 Networks Real Time Operating System Software Force10 Operating System Version: 1.0 Force10 Application Software Version: E_MAIN4.7.6.350 Copyright (c) 1999-2007 by Force10 Networks, Inc. Build Time: Mon May 12 14:02:22 PDT 2008 SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.6027.1.3.
PAGE 995
Configure Contact and Location Information using SNMP You may configure system contact and location information from the Dell Networking system or from the management station using SNMP. To configure system contact and location information from the Dell Networking system: Task Command Command Mode Identify the system manager along with this person’s contact information (e.g E-mail address or phone number). You may use up to 55 characters.
PAGE 996
www.dell.com | support.dell.com Subscribe to Managed Object Value Updates using SNMP By default, the Dell Networking system displays some unsolicited SNMP messages (traps) upon certain events and conditions. You can also configure the system to send the traps to a management station. Traps cannot be saved on the system.
PAGE 997
Table 48-2. Dell Networking Enterprise-specific SNMP Traps Command Option Trap Examples envmon CARD_SHUTDOWN: %sLine card %d down - %s CARD_DOWN: %sLine card %d down - %s LINECARDUP: %sLine card %d is up CARD_MISMATCH: Mismatch: line card %d is type %s - type %s required.
PAGE 998
www.dell.com | support.dell.com Table 48-2. Dell Networking Enterprise-specific SNMP Traps Command Option Trap Examples stp (includes only STP notifications) %SPANMGR-5-STP_ROOT_CHANGE: STP root changed for vlan 1. My Bridge ID: 0:0001.e867.b1f8 Old Root: 0:0000.0000.0000 New Root: 0:0001.e867.b1f8. %SPANMGR-5-STP_NEW_ROOT: New Spanning Tree Root, Bridge ID Priority 32768, Address 0001.e801.fc35.
PAGE 999
• • copy configuration files from the Dell Networking system to a server copy configuration files from a server to the Dell Networking system All of these tasks can be performed using IPv4 or IPv6 addresses. The examples in this section use IPv4 addresses; IPv6 addresses can be substituted for the IPv4 addresses in all of the examples. The relevant MIBs for these functions are: Table 48-3.
PAGE 1000
www.dell.com | support.dell.com Table 48-3. MIB Objects for Copying Configuration Files via SNMP MIB Object OID Object Values Description copyServerAddress .1.3.6.1.4.1.6027.3.5.1.1.1.1.8 IP Address of the server The IP address of the server. • If the copyServerAddress is specified so must copyUserName, and copyUserPassword. copyUserName .1.3.6.1.4.1.6027.3.5.1.1.1.1.9 Username for the server. Username for for the FTP, TFTP, or SCP server.
PAGE 1001
• • the community name is public, and the file f10-copy-config.mib is in the current directory or in the snmpset tool path. Note: In Unix, enter the command snmpset for help using this command. Place the file f10-copy-config.mib the directory from which you are executing the snmpset command or in the snmpset tool path. Table 48-4. Copying Configuration Files via SNMP Task Copy the running-config to the startup-config using the following command from the Unix machine: snmpset -v 2c -c public -m .
PAGE 1002
www.dell.com | support.dell.com Table 48-4. Copying Configuration Files via SNMP Task • • server-ip-address must be preceded by the keyword a. values for copyUsername and copyUserPassword must be preceded by the keyword s. Figure 48-10. Copying Configuration Files via SNMP and FTP to a Remote Server > snmpset -v 2c -c private -m ./f10-copy-config.mib 10.10.10.10 copySrcFileType.110 i 2 copyDestFileName.110 s /home/startup-config copyDestFileLocation.110 i 4 copyServerAddress.110 a 11.11.11.
PAGE 1003
Dell Networking provides additional MIB Objects to view copy statistics. These are provided in Table 48-5. Table 48-5. MIB Objects for Copying Configuration Files via SNMP MIB Object OID Values Description copyState .1.3.6.1.4.1.6027.3.5.1.1.1.1.11 1= running 2 = successful 3 = failed Specifies the state of the copy operation. copyTimeStarted .1.3.6.1.4.1.6027.3.5.1.1.1.1.12 Time value Specifies the point in the up-time clock that the copy operation started. copyTimeCompleted .1.3.6.1.4.1.
PAGE 1004
www.dell.com | support.dell.com Figure 48-13 shows the command syntax using MIB object names, and Figure 48-14 shows the same command using the object OIDs. In both cases, the object is followed by same index number used in the snmpset command. Figure 48-13. Obtaining MIB Object Values for a Copy Operation using Object-name Syntax > snmpget -v 2c -c private -m ./f10-copy-config.mib 10.11.131.140 copyTimeCompleted.110 FORCE10-COPY-CONFIG-MIB::copyTimeCompleted.110 = Timeticks: (1179831) 3:16:38.
PAGE 1005
Figure 48-16. Assign a VLAN Alias using SNMP [Unix system output] > snmpset -v2c -c mycommunity 10.11.131.185 .1.3.6.1.2.1.17.7.1.4.3.1.1.1107787786 s "My VLAN" SNMPv2-SMI::mib-2.17.7.1.4.3.1.1.
PAGE 1006
www.dell.com | support.dell.com The table that the Dell Networking system sends in response to the snmpget request is a table that contains hexadecimal (hex) pairs, each pair representing a group of eight ports. • • • On the E-Series, 12 hex pairs represents a line card. Twelve pairs accommodates the greatest currently available line card port density, 96 ports. On the C-Series, 28 hex pairs represents a line card.
PAGE 1007
The value 40 is in the first set of 7 hex pairs, indicating that these ports are in Stack Unit 0. The hex value 40 is 0100 0000 in binary. As described above, the left-most position in the string represents Port 1. The next position from the left represents Port 2 and has a value of 1, indicating that Port 0/2 is in VLAN 10. The remaining positions are 0, so those ports are not in the VLAN.
PAGE 1008
www.dell.com | support.dell.com Figure 48-21. Adding Tagged Ports to a VLAN using SNMP >snmpset -v2c -c mycommunity 10.11.131.185 .1.3.6.1.2.1.17.7.1.4.3.1.2.1107787786 x "40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" .1.3.6.1.2.1.17.7.1.4.3.1.4.
PAGE 1009
Table 48-6. MIB Objects for Fetching Dynamic MAC Entries in the Forwarding Database MIB Object OID dot1dTpFdbTable .1.3.6.1.2.1.17.4.3 Description MIB List the learned unicast MAC addresses on the default VLAN. Q-BRIDGE MIB dot1qTpFdbTable .1.3.6.1.2.1.17.7.1.2. List the learned unicast MAC addresses on 2 non-default VLANs. dot3aCurAggFdb Table .1.3.6.1.4.1.6027.3.2. List the learned MAC addresses of aggregated 1.1.5 links (LAG).
PAGE 1010
www.dell.com | support.dell.com Use dot3aCurAggFdbTable to fetch the learned MAC address of a port-channel. The instance number is the decimal conversion of the MAC address concatenated with the port-channel number. Figure 48-24.
PAGE 1011
• • • the next 5 bits represent the slot number the next 1 bit is 0 for a physical interface and 1 for a logical interface the next 1 bit is unused For example, the index 72925242 is 100010110001100000000111010 in binary. The binary interface index for GigabitEthernet 1/21 of a 48-port 10/100/1000Base-T line card with RJ-45 interface is shown in Figure 48-27. Notice that the physical/logical bit and the final, unused bit are not given.
PAGE 1012
www.dell.com | support.dell.com Monitor Port-channels To check the status of a Layer 2 port-channel, use f10LinkAggMib (.1.3.6.1.4.1.6027.3.2). Below, Po 1 is a switchport and Po 2 is in Layer 3 mode. [senthilnathan@lithium ~]$ snmpwalk -v 2c -c public 10.11.1.1 .1.3.6.1.4.1.6027.3.2.1.1 SNMPv2-SMI::enterprises.6027.3.2.1.1.1.1.1.1 = INTEGER: 1 SNMPv2-SMI::enterprises.6027.3.2.1.1.1.1.1.2 = INTEGER: 2 SNMPv2-SMI::enterprises.6027.3.2.1.1.1.1.2.1 = Hex-STRING: 00 01 E8 13 A5 C7 SNMPv2-SMI::enterprises.6027.
PAGE 1013
Troubleshooting SNMP Operation When you use SNMP to retrieve management data from an SNMP agent on a Dell Networking router, take into account the following behavior: • • • When you query an IPv4 icmpMsgStatsInPkts object in the ICMP table by using the snmpwalk command, the output for echo replies may be incorrectly displayed. Use the show ip traffic command to correctly display this information under ICMP statistics in the command output.
PAGE 1014
www.dell.com | support.dell.
PAGE 1015
49 SONET/SDH SONET/SDH is supported on platform e SONET/SDH is supported on the E-Series ExaScale platform with FTOS 8.1.1.2 and later. FTOS supports two line cards with SONET—Packet-Over-SONET (POS) and PPP-over-SONET/SDH.
PAGE 1016
www.dell.com | support.dell.com • • • • Protection switching is not supported. POS interfaces cannot be mirrored ports. Configurable alarm thresholds (SF/SD BER, B1/B 2/B3 TC) are not supported. The CRC type and S1S0 flag cannot be changed. Configuring POS Interfaces POS interfaces require several configuration considerations, including • • • Encapsulation MTU Clock Settings Encapsulation The E-Series’ POS line card requires PPP encapsulation.
PAGE 1017
Configuring Maximum Transmission Unit (MTU) Maximum Transmission Unit is an integer value that represents the greatest number of bytes that any given interface on the system can handle. MTU settings allow the router to determine if a large packet needs to be fragmented before transmission. PPP must be enabled on a SONET interface before MTU can become configurable. MTU size can be changed in INTERFACE mode by entering the command mtu size. Figure 49-1.
PAGE 1018
www.dell.com | support.dell.com Figure 49-2. wanport command example interface TenGigabitEthernet 13/0 no ip address no shutdown FTOS(conf-if-te-13/0)# FTOS(conf-if-te-13/0)#wanport % Error: Port should be in shutdown mode, config ignored Te 13/0. FTOS(conf-if-te-13/0)# error FTOS(conf-if-te-13/0)#shutdown FTOS(conf-if-te-13/0)# due to no shutdown state Figure 49-3 displays the active alarms for the interface. Figure 49-3.
PAGE 1019
While performance monitoring provides advanced alert of link degradation, alarms indicate a failure. Fault management involves alarm monitoring and generation, reporting, logging, correlation, and clearing. E-Series POS and 10GE WAN interfaces support the SONET alarms shown in Table 49-1: • • • Section alarms—SLOS, SLOF Line alarms—AIS, RDI, FEBE(REI), SD, SF Path Alarms—AIS, RDI, FEBE(REI), LOP Since E-Series is Terminal Equipment (TE), it must support the alarms in Table 49-1. Table 49-1.
PAGE 1020
www.dell.com | support.dell.com Use the alarm-report command to configure the SONET alarms that a POS or 10 GE WAN interface can activate.Table 49-2 defines the alarms that you can enable. Task Command Syntax Specify which POS/SDH alarms to report to the remote SNMP server. alarm-report {lais | lrdi | pais | plop | prdi | sd-ber | sf-ber | slof | slos} Command Mode INTERFACE To view active alarms and defects, use the show controllers sonet command in EXEC Privilege mode.
PAGE 1021
SONET TRAP Example SONET Traps describes the traps and OIDs for SONET alarms that are reported on an SNMP trap receiver. Figure 49-4 shows an example of a SONET trap. Figure 49-4. SONET Trap example 2010-10-06 22:43:53 10.11.203.4 [10.11.203.4]: SNMPv2-MIB::sysUpTime.0 = Timeticks: (6057792) SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.6027.3.3.2.2.0.18 SNMPv2-SMI::enterprises.6027.3.3.1.2.1.1.3.0 = SNMPv2-SMI::enterprises.6027.3.3.1.2.1.1.2.0 = SNMPv2-SMI::enterprises.6027.3.3.1.2.1.1.4.
PAGE 1022
www.dell.com | support.dell.com Task Command Syntax Delay triggering the line or path alarms with a 100ms delay. delay triggers {line [lrdi | sd-ber | sf-ber] | path [pais | prdi] } Command Mode INTERFACE By default, certain alarms (LOS, LOF, LAIS, PLOP) bring the line protocol down immediately. Use this command, with the line option, to delay that trigger event by 100ms. By default, path alarms (AIS, RDI, LOP) do not cause (or trigger) the interface line protocol to go down.
PAGE 1023
SONET MIB Table 49-3 lists the managed objects supported in the SONET MIB, as defined in RFC 2558. Table 49-3. SONET MIB: Managed Objects SONET Managed Object Description sonetMediumType Sonet or SDH depending on the configuration sonetMediumTimeElapsed Time in seconds (up to 900 seconds) since the line card is up. Resets after 900 seconds has elapsed sonetMediumValidIntervals The number of previous intervals for which valid data has been stored.
PAGE 1024
www.dell.com | support.dell.com 1024 Table 49-4. | SONET Traps and OIDs (continued) Trap OID Trap Object SONET_L_RDI Line Remote Defect Indication 1.3.6.1.4.1.6027.3.3.2.2.0.10 alarm state (1.3.6.1.4.1.6027.3.3.1.2.1.1.3), alarm type(1.3.6.1.4.1.6027.3.3.1.2.1.1.2), ifindex(1.3.6.1.4.1.6027.3.3.1.2.1.1.4), slot(1.3.6.1.4.1.6027.3.3.1.2.1.1.5), port(1.3.6.1.4.1.6027.3.3.1.2.1.1.6) SONET_L_FEBE Line Far-end Background Block Errors 1.3.6.1.4.1.6027.3.3.2.2.0.11 alarm state (1.3.6.1.4.1.6027.3.3.1.
PAGE 1025
Table 49-4. SONET Traps and OIDs (continued) Trap OID Trap Object SONET_P_PSE 1.3.6.1.4.1.6027.3.3.2.2.0.22 alarm state (1.3.6.1.4.1.6027.3.3.1.2.1.1.3), alarm type(1.3.6.1.4.1.6027.3.3.1.2.1.1.2), ifindex(1.3.6.1.4.1.6027.3.3.1.2.1.1.4), slot(1.3.6.1.4.1.6027.3.3.1.2.1.1.5), port(1.3.6.1.4.1.6027.3.3.1.2.1.1.6) SONET_P_NSE 1.3.6.1.4.1.6027.3.3.2.2.0.23 alarm state (1.3.6.1.4.1.6027.3.3.1.2.1.1.3), alarm type(1.3.6.1.4.1.6027.3.3.1.2.1.1.2), ifindex(1.3.6.1.4.1.6027.3.3.1.2.1.1.4), slot(1.3.6.1.4.
PAGE 1026
| SONET/SDH www.dell.com | support.dell.
PAGE 1027
50 Stacking S-Series Switches Stacking S-Series Switches are supported on the S55. This chapter contains the following sections: • • • S-Series Stacking Overview Important Points to Remember S-Series Stacking Configuration Tasks S-Series Stacking Overview Up to eight S-Series systems can be interconnected so that all of the units function as a single unit. A stack is analogous to an E-Series or C-Series system with redundant RPMs and multiple line cards.
PAGE 1028
www.dell.com | support.dell.com Figure 50-1. S-Series Stack Manager Redundancy Stack#show redundancy -- Stack-unit Status ------------------------------------------------Mgmt ID: 0 Stack-unit ID: 1 Stack-unit Redundancy Role: Primary Stack-unit State: Active Stack-unit SW Version: 7.8.1.0 Link to Peer: Up -- PEER Stack-unit Status ------------------------------------------------Stack-unit State: Standby Peer stack-unit ID: 2 Stack-unit SW Version: 7.8.1.
PAGE 1029
Figure 50-2. Electing the Stack Manager Stack>show system brief Stack MAC : 00:01:e8:d5:f9:6f -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Standby online S50V S50V 7.8.1.0 52 1 Management online S50N S50N 7.8.1.0 52 2 Member online S50V S50V 7.8.1.
PAGE 1030
www.dell.com | support.dell.com Figure 50-3. Adding a Standalone with a Lower MAC Address to a Stack— Before -------------------------------STANDALONE BEFORE CONNECTION---------------------------------Standalone#show system brief Stack MAC : 00:01:e8:d5:ef:81 -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Management online S50V S50V 7.8.1.
PAGE 1031
Figure 50-4. Adding a Standalone with a Lower MAC Address and Equal Priority to a Stack—After -------------------------------STANDALONE AFTER CONNECTION---------------------------------Standalone#%STKUNIT0-M:CP %POLLMGR-2-ALT_STACK_UNIT_STATE: Alternate Stack-unit is present 00:20:20: %STKUNIT0-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 1 present 00:20:22: %STKUNIT0-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 2 present Going for reboot.
PAGE 1032
www.dell.com | support.dell.com Figure 50-5. Before Adding a Standalone with a Lower MAC Address but Higher Priority to a Stack— -------------------------------STANDALONE BEFORE CONNECTION---------------------------------Standalone#show system brief Stack MAC : 00:01:e8:d5:ef:81 -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Member not present S50V 1 Member not present S50N 2 Management online S50V S50V 7.8.1.
PAGE 1033
Figure 50-6.
PAGE 1034
www.dell.com | support.dell.com Figure 50-7.
PAGE 1035
You may stack any combination of S-Series models that have the same FTOS version. Figure 50-8 shows two common stacking topologies, ring and cascade (also called daisy-chain). A ring topology provides some performance gains and stack integrity. Figure 50-8.
PAGE 1036
www.dell.com | support.dell.com To display the status of the stacking ports, including the topology: Task Command Syntax Command Mode Display the stacking ports. show system stack-ports EXEC Privilege Figure 50-9 shows a daisy-chain topology. Figure 50-10 shows the same stack converted to a ring by connecting stack-port 2/51 to 0/51; you may rearrange the stacking cables without triggering a unit reset, so long as the stack manager is never disconnected from the stack. Figure 50-9.
PAGE 1037
Figure 50-11. A A A Stacking Cable Redundancy B B Stacking Cable Redundancy B Stacking 002 LED Status Indicators on an S-Series Stack The stack unit is displayed in an LED panel on the front of each switch.
PAGE 1038
www.dell.com | support.dell.com To manually assign a new unit a position in the stack: Step Task Command Syntax Command Mode 1 While the unit is unpowered, install stacking modules in the new unit. 2 On the stack, determine the next available stack-unit number, and the management prioritity of the management unit. show system brief show system stack-unit EXEC Privilege 3 Create a virtual unit and assign it the next available stack-unit number.
PAGE 1039
Figure 50-13. Adding a Stack Unit with a Conflicting Stack Number—After ------------------------STANDALONE AFTER CONNECTION---------------------------------00:08:45: %STKUNIT1-M:CP %POLLMGR-2-ALT_STACK_UNIT_STATE: Alternate Stack-unit is present 00:08:45: %STKUNIT1-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 0 present 00:08:47: %STKUNIT1-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 2 present Going for reboot.
PAGE 1040
www.dell.com | support.dell.com Figure 50-15. Adding a Stack Unit with a Conflicting Stack Number—After ------------------------STANDALONE AFTER CONNECTION---------------------------------01:38:34: %STKUNIT0-M:CP %POLLMGR-2-ALT_STACK_UNIT_STATE: Alternate Stack-unit is present 01:38:34: %STKUNIT0-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 1 present 01:38:34: %STKUNIT0-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 2 presentGoing for reboot. Reason is Stack merge Going for reboot.
PAGE 1041
Figure 50-16.
PAGE 1042
www.dell.com | support.dell.com Figure 50-17. Removing a Stack Member—After ----------------------------STANDALONE AFTER DISCONNECTION---------------------------------Standalone(stack-member-2)# Going for reboot.
PAGE 1043
Split an S-Series Stack To split a stack, unplug the desired stacking cables.You may do this at any time, whether the stack is powered or unpowered, and the units are online or offline. Each portion of the split stack retains the startup and running configuration of the original stack. For a parent stack that is split into two child stacks, A and B, each with multiple units: • • • • If one of the new stacks receives the primary and the secondary management units, it is unaffected by the split.
PAGE 1044
www.dell.com | support.dell.com Create a Virtual Stack Unit on an S-Series Stack Use virtual stack units to configure ports on the stack before adding a new unit, or to prevent FTOS from assigning a particular stack-number. Task Command Syntax Command Mode Create a virtual stack unit. stack-unit provision CONFIGURATION Display Information about an S-Series Stack Task Command Syntax Command Mode Display for stack-identity, status, and hardware information on every unit in a stack (Figure 50-18).
PAGE 1045
Figure 50-18. Displaying Information about an S-Series Stack—show system FTOS#show system Stack MAC : 00:01:e8:d5:f9:6f -- Unit 0 -Unit Type Status Next Boot Required Type Current Type Master priority Hardware Rev Num Ports Up Time FTOS Version Jumbo Capable POE Capable Burned In MAC No Of MACs : : : : : : : : : : : : : : Member Unit online online S50V - 48-port E/FE/GE with POE (SB) S50V - 48-port E/FE/GE with POE (SB) 0 2.0 52 30 min, 7 sec 7.8.1.
PAGE 1046
www.dell.com | support.dell.com Figure 50-19. Displaying Information about an S-Series Stack—show system brief FTOS#show system brief Stack MAC : 00:01:e8:d5:f9:6f -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Member online S50V S50V 7.8.1.0 52 1 Management online S50N S50N 7.8.1.0 52 2 Standby online S50V S50V 7.8.1.
PAGE 1047
Influence Management Unit Selection on an S-Series Stack Stack Priority is the system variable that FTOS uses to determine which units in the stack will be the primary and secondary management units. If multiple units tie for highest priority, then the unit with the highest MAC address prevails.
PAGE 1048
www.dell.com | support.dell.com Task Command Syntax Command Mode Reload a stack-unit reset stack-unit 0-7 EXEC Privilege Reload a member unit, from the unit itself reset-self EXEC Privilege Reset a stack-unit when the unit is in a problem state. reset stack-unit 0-7 hard EXEC Privilege Monitor an S-Series Stack with SNMP S-Series supports the following tables in f10-ss-chassis.
PAGE 1049
Figure 50-21. Recovering from a Stack Link Flapping Error --------------------------------------MANAGMENT UNIT----------------------------------------Error: Stack Port 50 has flapped 5 times within 10 seconds.Shutting down this st ack port now. Error: Please check the stack cable/module and power-cycle the stack. 10:55:20: %STKUNIT1-M:CP %KERN-2-INT: Error: Stack Port 50 has flapped 5 times w ithin 10 seconds.Shutting down this stack port now.
PAGE 1050
www.dell.com | support.dell.com Figure 50-23. Recovering from a Card Mismatch State on an S-Series Stack -----------------------------------STANDALONE UNIT BEFORE-----------------------------------Standalone#show system brief Stack MAC : 00:01:e8:d5:ef:81 -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Management online S50V S50V 7.8.1.
PAGE 1051
51 Broadcast Storm Control Broadcast Storm Control is supported on platforms: ces This chapter contains the following configuration topics: • • • Layer 3 Broadcast Storm Control Layer 2 Broadcast Storm Control Multicast Storm Control Storm Control Overview FTOS Storm Control is a preventative measure against unexpectedly high rates of broadcast or multicast packets; these traffic bursts are called storms.
PAGE 1052
www.dell.com | support.dell.com Implementation Information • • • • Storm Control is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. The percentage of storm control is calculated based on the advertised rate of the line card, not by the speed setting of the interface. Do not apply per-VLAN QoS on an interface that has Storm Control enabled either on an interface or globally.
PAGE 1053
Enable Broadcast Storm Control on an Interface Enabling Storm control on an interface affects only ingress broadcasts. Task Command Syntax Command Mode On the E-Series, suppress Layer 3 all-hosts and subnet broadcasts on ingress if they exceed a user-defined limit. storm-control broadcast percentage partial-percentage [in | out] INTERFACE On the C-Series and S-Series, suppress Layer 3 all-host and subnet broadcasts on ingress if they exceed a user-defined limit.
PAGE 1054
www.dell.com | support.dell.com Task Command Syntax Command Mode On the E-Series, suppress unknown-unicast packets if they exceed a user-defined limit. storm-control unknown-unicast percentage partial-percentage [in | out] CONFIGURATION On the C-Series and S-Series, unknown-unicast packets on ingress if they exceed a user-defined limit.
PAGE 1055
FTOS#show storm-control broadcast gigabitethernet 11/11 Broadcast storm control configuration Interface Direction Percentage Wred Profile -------------------------------------------------------------Gi 11/11 Ingress 5.6 Gi 11/11 FTOS# Egress 5.6 - The following example displays the output of the show storm-control broadcast command on a C-Series platform.
PAGE 1056
| Broadcast Storm Control www.dell.com | support.dell.
PAGE 1057
52 Spanning Tree Protocol Spanning Tree Protocol is supported on platforms: ces STP is supported on the E-Series ExaScale platform with FTOS 8.1.1.2 and later. Protocol Overview Spanning Tree Protocol (STP) is a Layer 2 protocol—specified by IEEE 802.1d—that eliminates loops in a bridged topology by enabling only a single path through the network.
PAGE 1058
www.dell.com | support.dell.
PAGE 1059
Configuring Interfaces for Layer 2 Mode All interfaces on all switches that will participate in Spanning Tree must be in Layer 2 mode and enabled. Figure 52-1.
PAGE 1060
www.dell.com | support.dell.com Enabling Spanning Tree Protocol Globally Spanning Tree Protocol must be enabled globally; it is not enabled by default. To enable Spanning Tree globally for all Layer 2 interfaces: Step Task Command Syntax Command Mode 1 Enter the PROTOCOL SPANNING TREE mode. protocol spanning-tree 0 CONFIGURATION 2 Enable Spanning Tree.
PAGE 1061
Figure 52-4. Spanning Tree Enabled Globally root R1 R2 1/3 Forwarding 2/1 1/4 Blocking 2/2 1/1 1/2 3/1 3/2 3/3 3/4 R3 2/3 2/4 Port 290 (GigabitEthernet 2/4) is Blocking Port path cost 4, Port priority 8, Port Identifier 8.290 Designated root has priority 32768, address 0001.e80d.2462 Designated bridge has priority 32768, address 0001.e80d.2462 Designated port id is 8.
PAGE 1062
www.dell.com | support.dell.com Confirm that a port is participating in Spanning Tree using the show spanning-tree 0 brief command from EXEC privilege mode. Figure 52-6. show spanning-tree brief Command Example FTOS#show spanning-tree 0 brief Executing IEEE compatible Spanning Tree Protocol Root ID Priority 32768, Address 0001.e80d.2462 We are the root of the spanning tree Root Bridge hello time 2, max age 20, forward delay 15 Bridge ID Priority 32768, Address 0001.e80d.
PAGE 1063
Modifying Global Parameters You can modify Spanning Tree parameters. The root bridge sets the values for forward-delay, hello-time, and max-age and overwrites the values set on other bridges participating in Spanning Tree. Note: Dell Networking recommends that only experienced network administrators change the Spanning Tree parameters. Poorly planned modification of the Spanning Tree parameters can negatively impact network performance. Table 52-2 displays the default values for Spanning Tree. Table 52-2.
PAGE 1064
www.dell.com | support.dell.com View the current values for global parameters using the show spanning-tree 0 command from EXEC privilege mode. See Figure 52-5. Modifying Interface STP Parameters You can set the port cost and port priority values of interfaces in Layer 2 mode. • • Port cost is a value that is based on the interface type. The greater the port cost, the less likely the port will be selected to be a forwarding port.
PAGE 1065
To enable PortFast on an interface: Task Enable PortFast on an interface. Command Syntax Command Mode spanning-tree stp-id portfast INTERFACE [bpduguard [shutdown-on-violation]] Verify that PortFast is enabled on a port using the show spanning-tree command from the EXEC privilege mode or the show config command from INTERFACE mode; Dell Networking recommends using the show config command, as shown in Figure 52-7. Figure 52-7.
PAGE 1066
www.dell.com | support.dell.com Figure 52-8 shows a scenario in which an edgeport might unintentionally receive a BPDU. The port on the Dell Networking system is configured with Portfast. If the switch is connected to the hub, the BPDUs that the switch generates might trigger an undesirable topology change. If BPDU Guard is enabled, when the edge port receives the BPDU, the BPDU will be dropped, the port will be blocked, and a console message will be generated.
PAGE 1067
Figure 52-8.
PAGE 1068
www.dell.com | support.dell.com To change the bridge priority or specify that a bridge is the root or secondary root: Task Command Syntax Command Mode Assign a number as the bridge priority or designate it as the root or secondary root. priority-value range: 0 to 65535. The lower the number assigned, the more likely this bridge will become the root bridge. The default is 32768. • The primary option specifies a bridge priority of 8192. • The secondary option specifies a bridge priority of 16384.
PAGE 1069
In STP topology 2 (Figure 52-10 upper right), STP is enabled on device D on which a software bridge application is started to connect to the network. Because the priority of the bridge in device D is lower than the root bridge in Switch A, device D is elected as root, causing the link between Switches A and B to enter a blocking state. Network traffic then begins to flow in the directions indicated by the BPDU arrows in the topology.
PAGE 1070
www.dell.com | support.dell.com Figure 52-10.
PAGE 1071
Root Guard Configuration You enable STP root guard on a per-port or per-port-channel basis. FTOS Behavior: The following conditions apply to a port enabled with STP root guard: • Root guard is supported on any STP-enabled port or port-channel interface except when used as a stacking port.
PAGE 1072
www.dell.com | support.dell.com Configuring Spanning Trees as Hitless Configuring Spanning Trees as Hitless is supported only on platforms: ce You can configure Spanning Tree (STP), Rapid Spanning Tree (RSTP), Multiple Spanning Tree (MSTP), and Per-Vlan Spanning Tree (PVST+) to be hitless (all or none must be configured as hitless). When configured as hitless, critical protocol state information is synchronized between RPMs so that RPM failover is seamless, and no topology change is triggered.
PAGE 1073
As shown in STP topology 3 (Figure 52-12 bottom middle), after you enable loop guard on an STP port or port-channel on Switch C, if no BPDUs are received and the max-age timer expires, the port transitions from a blocked state to a loop-inconsistent state (instead of to a forwarding state). Loop guard blocks the STP port so that no traffic is transmitted and no loop is created. As soon as a BPDU is received on an STP port in a loop-inconsistent state, the port returns to a blocking state.
PAGE 1074
www.dell.com | support.dell.com Figure 52-12.
PAGE 1075
Loop Guard Configuration You enable STP loop guard on a per-port or per-port channel basis. FTOS Behavior: The following conditions apply to a port enabled with loop guard: • Loop guard is supported on any STP-enabled port or port-channel interface.
PAGE 1076
www.dell.com | support.dell.com 1076 Displaying STP Guard Configuration To verify the STP guard configured on port or port-channel interfaces, enter the show spanning-tree 0 guard [interface interface] command. Figure 52-13 shows an example for an STP network (instance 0) in which: • • • Root guard is enabled on a port that is in a root-inconsistent state. Loop guard is enabled on a port that is in a listening state.
PAGE 1077
53 System Time and Date Chapter 53, System Time and Date settings, and Network Time Protocol are supported on platforms: es c Time and Date and NTP are supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. System times and dates can be set and maintained through the Network Time Protocol (NTP). They are also set through FTOS CLIs and hardware settings.
PAGE 1078
www.dell.com | support.dell.com NTP is designed to produce three products: clock offset, roundtrip delay, and dispersion, all of which are relative to a selected reference clock. • • • Clock offset represents the amount to adjust the local clock to bring it into correspondence with the reference clock. Roundtrip delay provides the capability to launch a message to arrive at the reference clock at a specified time. Dispersion represents the maximum error of the local clock relative to the reference clock.
PAGE 1079
Figure 53-1. NTP Fields Source Port (123) Destination Port (123) Length NTP Packet Payload Checksum Range: +32 to -32 Status Leap Indicator Code: 00: No Warning 01: +1 second 10: -1 second 11: reserved Type Precision Est. Error Est.
PAGE 1080
www.dell.com | support.dell.com Enable NTP NTP is disabled by default. To enable it, specify an NTP server to which the Dell Networking system will synchronize. Enter the command multiple times to specify multiple servers. You may specify an unlimited number of servers at the expense of CPU resources. Task Command Command Mode Specify the NTP server to which the Dell Networking system will synchronize. You may specify an IPv4 or IPv6 address, or hostname that resolves to an IPv4 or IPv6 address.
PAGE 1081
Set the Hardware Clock with the Time Derived from NTP Task Command Command Mode Periodically update the system hardware clock with the time value derived from NTP. ntp update-calendar CONFIGURATION Figure 53-4.
PAGE 1082
www.dell.com | support.dell.com To disable NTP on an interface, use the following command in the INTERFACE mode: Command Syntax Command Mode Purpose ntp disable INTERFACE Disable NTP on the interface. To view whether NTP is configured on the interface, use the show config command in the INTERFACE mode. If ntp disable is not listed in the show config command output, then NTP is enabled. (The show config command displays only non-default configuration information.
PAGE 1083
Configure NTP authentication NTP authentication and the corresponding trusted key provide a reliable means of exchanging NTP packets with trusted time sources. NTP authentication begins when the first NTP packet is created following the configuration of keys. NTP authentication in FTOS uses the MD5 algorithm and the key is embedded in the synchronization packet that is sent to an NTP time source. FTOS Behavior: FTOS versions 8.2.1.
PAGE 1084
www.dell.com | support.dell.com Command Syntax Command Mode Purpose ntp server ip-address [key keyid] [prefer] [version number] CONFIGURATION Configure an NTP server. Configure the IP address of a server and the following optional parameters: • key keyid: Configure a text string as the key exchanged between the NTP server and client. • prefer: Enter the keyword to set this NTP server as the preferred server. • version number: Enter a number 1 to 3 as the NTP version.
PAGE 1085
• • • • • • • • Root Delay (sys.rootdelay, peer.rootdelay, pkt.rootdelay): This is a signed fixed-point number indicating the total roundtrip delay to the primary reference source at the root of the synchronization subnet, in seconds. Note that this variable can take on both positive and negative values, depending on clock precision and skew. Root Dispersion (sys.rootdispersion, peer.rootdispersion, pkt.
PAGE 1086
www.dell.com | support.dell.com Set the time and date for the switch hardware clock Command Syntax Command Mode Purpose calendar set time month day year EXEC Privilege Set the hardware clock to the current time and date. time: Enter the time in hours:minutes:seconds. For the hour variable, use the 24-hour format, for example, 17:15:00 is 5:15 pm. month: Enter the name of one of the 12 months in English. You can enter the name of a day to change the order of the display to time day month year.
PAGE 1087
The software clock runs only when the software is up. The clock restarts, based on the hardware clock, when the switch reboots. Command Syntax Command Mode Purpose clock set time month day year EXEC Privilege Set the system software clock to the current time and date. time: Enter the time in hours:minutes:seconds. For the hour variable, use the 24-hour format, for example, 17:15:00 is 5:15 pm. month: Enter the name of one of the 12 months in English.
PAGE 1088
www.dell.com | support.dell.com Set the timezone Coordinated Universal Time (UTC) is the time standard based on the International Atomic Time standard, commonly known as Greenwich Mean time. When determining system time, you must include the differentiator between UTC and your local timezone. For example, San Jose, CA is the Pacific Timezone with a UTC offset of -8. Command Syntax Command Mode Purpose clock timezone timezone-name offset CONFIGURATION Set the clock to the appropriate timezone.
PAGE 1089
Set Daylight Saving Time Once Set a date (and time zone) on which to convert the switch to daylight savings time on a one-time basis. Command Syntax Command Mode Purpose clock summer-time time-zone date start-month start-day start-year start-time end-month end-day end-year end-time [offset] CONFIGURATION Set the clock to the appropriate time zone and daylight savings time. time-zone: Enter the three-letter name for the time zone. This name is displayed in the show clock output.
PAGE 1090
www.dell.com | support.dell.com Command Syntax Command Mode Purpose FTOS(conf)#clock summer-time pacific date Mar 14 2009 00:00 Nov 7 2009 00:00 FTOS(conf)#02:02:13: %RPM0-P:CP %CLOCK-6-TIME CHANGE: Summertime configuration changed from "none" to "Summer time starts 00:00:00 Pacific Sat Mar 14 2009;Summer time ends 00:00:00 pacific Sat Nov 7 2009" Set Recurring Daylight Saving Time Set a date (and time zone) on which to convert the switch to daylight savings time on a specific day every year.
PAGE 1091
Command Syntax Command Mode Purpose start-year: Enter a four-digit number as the year. Range: 1993 to 2035 start-time: Enter the time in hours:minutes. For the hour variable, use the 24-hour format, example, 17:15 is 5:15 pm. end-week: If you entered a start-week, Enter the one of the following as the week that daylight savings ends: • • • week-number: enter a number from 1-4 as the number of the week to end daylight savings time.
PAGE 1092
www.dell.com | support.dell.
PAGE 1093
54 Uplink Failure Detection (UFD) Uplink Failure Detection (UFD) is supported on platform: s (S50 only) Feature Description Uplink Failure Detection (UFD) provides detection of the loss of upstream connectivity and, if used with NIC teaming, automatic recovery from a failed link. A switch provides upstream connectivity for devices, such as servers. If a switch loses its upstream connectivity, downstream devices also lose their connectivity.
PAGE 1094
www.dell.com | support.dell.com Figure 54-1. Uplink Failure Detection R1 R1 R1 X (A) S1 (B) S2 Server X S1 (C) S2 Server S1 X S2 Server How Uplink Failure Detection Works UFD creates an association between upstream and downstream interfaces. The association of uplink and downlink interfaces is called an uplink-state group. An interface in an uplink-state group can be a physical interface or a port-channel (LAG) aggregation of physical interfaces.
PAGE 1095
Figure 54-2. Uplink Failure Detection Example Core Network Layer 3 Network When an upstream port-channel link goes down ... UFD brings down a downstream link in the same uplinkstate group ... X X Primary links: Backup links: Uplink-state groups: Server traffic is diverted over a backup link to upstream devices. If only one of the upstream interfaces in an uplink-state group goes down, a specified number of downstream ports associated with the upstream interface are put into a link-down state.
PAGE 1096
www.dell.com | support.dell.com Important Points to Remember When you configure Uplink Failure Detection, the following conditions apply: • You can configure up to sixteen uplink-state groups. By default, no uplink-state groups are created. An uplink-state group is considered to be operationally up if it has at least one upstream interface in the link-up state. An uplink-state group is considered to be operationally down if it has no upstream interfaces in the link-up state.
PAGE 1097
Configuring Uplink Failure Detection To configure Uplink Failure Detection, follow these steps: Step 1 Command Syntax and Mode Description uplink-state-group group-id Creates an uplink-state group and enabling the tracking of upstream links on the switch/router. Valid group-id values are 1 to 16. To delete an uplink-state group, enter the no uplink-state-group group-id command.
PAGE 1098
www.dell.com | support.dell.com Step 5 Command Syntax and Mode Description description text (Optional) Enters a text description of the uplink-state group. Maximum length: 80 alphanumeric characters. Command Mode: UPLINK-STATE-GROUP 6 no enable Command Mode: UPLINK-STATE-GROUP (Optional) Disables upstream-link tracking without deleting the uplink-state group. Default: Upstream-link tracking is automatically enabled in an uplink-state group.
PAGE 1099
Message 1 shows the Syslog messages displayed when you clear the UFD-disabled state from all disabled downstream interfaces in an uplink-state group by entering the clear ufd-disable uplink-state-group group-id command. All downstream interfaces return to an operationally up state.
PAGE 1100
www.dell.com | support.dell.com 1100 Displaying Uplink Failure Detection To display information on the Uplink Failure Detection feature, enter any of the following show commands: | Show Command Syntax Description show uplink-state-group [group-id] [detail] Command Mode: EXEC Displays status information on a specified uplink-state group or all groups. Valid group-id values are 1 to 16.
PAGE 1101
Figure 54-3.
PAGE 1102
www.dell.com | support.dell.com Figure 54-4.
PAGE 1103
Sample Configuration: Uplink Failure Detection Figure 54-7 shows a sample configuration of Uplink Failure Detection on a switch/router in which you: • • • • • • Configure uplink-state group 3. Add downstream links Gigabitethernet 0/1, 0/2, 0/5, 0/9, 0/11, and 0/12. Configure two downstream links to be disabled if an upstream link fails. Add upstream links Gigabitethernet 0/3 and 0/4. Add a text description for the group. Verify the configuration with various show commands. Figure 54-7.
PAGE 1104
www.dell.com | support.dell.
PAGE 1105
55 Upgrade Procedures Find the upgrade procedures Go to the FTOS Release Notes for your system type to see all the requirements to upgrade to the desired FTOS version. Follow the procedures in the FTOS Release Notes for the software version you wish to upgrade to. Get Help with upgrades Direct any questions or concerns about FTOS Upgrade Procedures to Dell Networking Technical Support Center. You can reach Technical Support: • • • On the Web: support.dell.com By email: Dell-Force10_Technical_Support@Dell.
PAGE 1106
| Upgrade Procedures www.dell.com | support.dell.
PAGE 1107
56 VLAN VLANs are supported on platforms: ces This chapter contains the following configuration topics: • • • • • • • Create a VLAN Assign Interfaces to VLANs Enable Routing between VLANs Use a Native VLAN on Trunk Ports Change the Default VLAN ID Set the Null VLAN as the Default VLAN Enable VLAN Interface Counters Virtual LAN Overview A Local Area Network (LAN) is a collection of devices in the same broadcast domain.
PAGE 1108
www.dell.com | support.dell.com Virtual LANs (VLANs) are a cost-effective method of segmenting and organizing a network. A single switch can be divided into multiple broadcast domains so that devices can be grouped and isolated; each logical segment is virtual LAN. Applying VLANs reduces broadcast traffic, introduces flexibility in the placement of devices on the network, and increases network security by allowing separate policies to be applied to each group.
PAGE 1109
VLAN Tagging Since a port may belong to more than one VLAN, the switch must be able to identify the VLAN two which a broadcast frame belongs. For this case, IEEE 802.1Q defines a method of marking frames to indicate the VLAN on which the frame originated. The marker, called a VLAN tag, is 4 bytes and is inserted after the source MAC in the Ethernet frame header, as shown in Figure 56-2.
PAGE 1110
www.dell.com | support.dell.com Figure 56-4. Switch Behavior for Tagged/Untagged Port Mismatch ports on either side of the link are untagged so traffic is forwarded but on the default VLAN tagged tagged tagged untagged untagged X (no config) X untagged tagged untagged (no config) ports on either side of the link are untagged so traffic is forwarded but on the default VLAN Default VLAN The Default VLAN and is part of the system startup configuration, and is by default VLAN 1.
PAGE 1111
• • Set the Null VLAN as the Default VLAN Enable VLAN Interface Counters Related Protocols and Topics The following protocols and topics are premised on VLANs, and contain more information about the utility of VLANs: • • • • 802.1X Chapter 17, GARP VLAN Registration Protocol. Chapter 46, Service Provider Bridging Chapter 40, Per-VLAN Spanning Tree Plus. Create a VLAN A VLAN is created when you assign it a VLAN ID. Task Command Syntax Command Mode Create a VLAN.
PAGE 1112
www.dell.com | support.dell.com Assign Interfaces to VLANs A port may either be an untagged member of a single VLAN, or a tagged member of perhaps multiple VLANs. • • Untagged Ports — ports that do not append an 802.1Q VLAN tag to frames on egress, and do not accept tagged frames on ingress (tagged frames are dropped). Untagged ports must be connected to VLAN-unaware devices. Tagged Ports — ports that append an 802.
PAGE 1113
Step Task Command Syntax Command Mode FTOS#show vlan Codes: * - Default VLAN, G - GVRP VLANs * NUM 1 2 Status Inactive Active 3 Active Q Ports T T T T T Po1(So 0/0-1) Gi 3/0 Po1(So 0/0-1) Gi 3/1 Po1(So 0/0-1) 4 Active FTOS(conf)#int vlan 4 FTOS(conf-if-vlan)#untagged gi 3/2 FTOS(conf-if-vlan)#show config ! interface Vlan 4 no ip address untagged GigabitEthernet 3/2 FTOS#show vlan Codes: * - Default VLAN, G - GVRP VLANs * NUM 1 2 Status Inactive Active 3 Active 4 Active Q Ports T T T T U
PAGE 1114
www.dell.com | support.dell.com Figure 56-5. Communicating between VLANs VLAN 100 10.11.100.1/24 VLAN 200 10.11.200.1/24 Task Command Syntax Command Mode Assign an IP address to a VLAN interface. ip address address/mask INTERFACE VLAN Use a Native VLAN on Trunk Ports Traditionally, a port may either be an untagged member of a single VLAN or a tagged member of multiple VLANs. However, FTOS allows you to make a port an untagged member and a tagged member of VLANs, concurrently.
PAGE 1115
To configure a port so that it has a native VLAN: Step 1 Task Command Remove any Layer 2 or Layer 3 configurations from the interface. Command Mode INTERFACE If the port has any configurations on it when you enter the command portmode hybrid, FTOS rejects the configuration, citing the following message: % Error: Port is in Layer-2 mode . 2 Configure the interface for hybrid mode. portmode hybrid INTERFACE 3 Configure the interface for switchport mode.
PAGE 1116
www.dell.com | support.dell.com 1116 Enable VLAN Interface Counters Use a Native VLAN on Trunk Ports is available only on platform: ex Note: VLAN egress counters might be higher than expected because source-suppression drops are counted. | Task Command Syntax Command Mode Configure ingress, egress or both counters for VLAN interfaces.
PAGE 1117
57 Virtual Routing and Forwarding (VRF) Virtual Routing and Forwarding (VRF) (VRF) is supported only on platform: e VRF allows a physical router to partition itself into multiple Virtual Routers (VRs). The control and data plane are isolated in each VR so that traffic does NOT flow across VRs.Virtual Routing and Forwarding (VRF) allows multiple instances of a routing table to co-exist within the same router at the same time.
PAGE 1118
www.dell.com | support.dell.com Figure 57-1. VRF Network Example Edge Routers Customer Edge Routers Customer Edge Routers Provider Edge Routers Network without VRF Provider Edge Router with VRF Customer Edge Routers Provider Edge Router with VRF Customer Edge Routers Network with VRF VRF Configuration Notes On E-Series routers, Dell Networking VRF supports up to 15 VRF instances: 1 to 14 and the default VRF (0).
PAGE 1119
Only Layer 3 interfaces can belong to a VRF. VRF is supported on following types of interface: • • • • • physical Ethernet interfaces physical Sonet interfaces port-channel interfaces (static & dynamic using LACP) VLAN interfaces loopback interfaces VRF supports route redistribution between routing protocols (including static routes) only when the routes are within the same VRF. FTOS uses both the VRF name and VRF ID to manage VRF instances.
PAGE 1120
www.dell.com | support.dell.com Table 57-1. Feature/Capability Supported? Note Layer 3 (IPv4/IPv6) ACLs, TraceLists, PBR, QoS on physical interfaces and LAGs ACLs supported on all VRF ports. TraceLists are common for entire line card (except on ExaScale). PBR supported on default-VRF only. QoS supported on all VRF ports. IPv4 ARP and IPv6 Neighbor Discovery Yes ARP is VRF-aware. IPv6 is supported only for default-VRF.
PAGE 1121
• On an E-Series Exascale platform, use the cam-profile command to set the CAM size. Then select and enable VRF microcode for use with the VRF CAM-profile template, and reload the system to activate the profile. You can set the CAM size to 40M (default) which supports both IPv4 and IPv6 or 10M which supports only IPv4. Note: Any physical (port or port channel) or VLAN interface assigned to a VRF uses two CAM entries instead of one for each route and host entry.
PAGE 1122
www.dell.com | support.dell.com Table 57-3. IPv4-v6-VRF CAM Profiles (Single CAM card) CAM Profile Table Allocation (K) EgIPv4ACL 11K Reserved 2K IPv6FIB 18K IPv6ACL 4K IPv6Flow 3K EgIPv6ACL 1K DHCP DHCP requests are not forwarded across VRF instances. The DHCP client and server must be on the same VRF instance. IP addressing Starting in release 8.4.1.0, you can configure identical or overlapping IP subnets on different interfaces if each interface belongs to a different VRF instance.
PAGE 1123
Load the VRF CAM Profile On an E-series Terascale platform, select the IPv4 or IPv6 CAM profile used to support VRF and reload the system to activate the profile. Step Task Command Syntax Command Mode 1 Select the appropriate CAM profile for your system. cam-profile [ipv4-vrf microcode ipv4-vrf | ipv4-v6-vrf microcode ipv4-v6-vrf] default-vrf | vrf-name CONFIGURATION 2 Reload the system to implement the new CAM profile.
PAGE 1124
www.dell.com | support.dell.com Task Command Syntax Command Mode Create a non-default VRF instance by specifying a name and VRF ID number, and enter VRF configuration mode. The default VRF 0 is automatically configured when a router with VRF loaded in CAM boots up. ip vrf vrf-name vrf-id CONFIGURATION VRF ID range: 1 to 14 and 0 (default VRF) Note: Starting in FTOS 8.4.2.
PAGE 1125
View VRF instance information To display information about VRF configuration, enter the show ip vrf command. Task Command Syntax Command Mode Display the interfaces assigned to a VRF instance. To display information on all VRF instances (including the default VRF 0), do not enter a value for vrf-name.
PAGE 1126
www.dell.com | support.dell.com Connect an OSPF process to a VRF instance OSPF routes are supported on all VRF instances. Refer to Chapter 32, Open Shortest Path First (OSPFv2 and OSPFv3) for complete OSPF configuration information. Assign an OSPF process to a VRF instance . Return to CONFIGURATION mode to enable the OSPF process. The OSPF Process ID is the identifying number assigned to the OSPF process, and the Router ID is the IP address associated with the OSPF process..
PAGE 1127
Figure 57-2. Set up OSPF and static routes cam-profile ipv4-vrf microcode ipv4-vrf ip vrf default-vrf 0 ip vrf blue 1 ip vrf orange 2 ip vrf green 3 7/0 9/18 7/1 7/2 3/0 R1 router ospf 1 vrf blue router-id 1.0.0.1 network 1.0.0.0/24 area 0 network 10.0.0.0/24 area 0 router ospf 2 vrf orange router-id 2.0.0.1 network 2.0.0.0/24 area 0 network 20.0.0.0/24 area 0 ip route vrf green 31.0.0.0/24 3.0.0.2 3/0 R2 9/19 9/20 router ospf 1 vrf blue router-id 1.0.0.2 network 11.0.0.0/24 area 0 network 1.0.0.
PAGE 1128
www.dell.com | support.dell.com Figure 57-3. Set up VRF interfaces interface GigabitEthernet 9/18 ip vrf forwarding blue ip address 11.0.0.1/24 no shutdown interface GigabitEthernet 7/0 ip vrf forwarding blue ip address 10.0.0.1/24 no shutdown interface GigabitEthernet 9/19 ip vrf forwarding orange ip address 21.0.0.1/24 no shutdown interface GigabitEthernet 7/1 ip vrf forwarding orange ip address 20.0.0.1/24 no shutdown interface GigabitEthernet 9/20 ip vrf forwarding green ip address 31.0.0.
PAGE 1129
The following example relates to the configuration shown in Figure 57-2 and Figure 57-3. ROUTER 1 cam-profile ipv4-vrf microcode ipv4-vrf ! ip vrf default-vrf 0 ! ip vrf blue 1 ! ip vrf orange 2 ! ip vrf green 3 ! interface TenGigabitEthernet 3/0 no ip address switchport no shutdown ! interface GigabitEthernet 7/0 ip vrf forwarding blue ip address 10.0.0.1/24 no shutdown ! interface GigabitEthernet 7/1 ip vrf forwarding orange ip address 20.0.0.
PAGE 1130
www.dell.com | support.dell.com ROUTER 1 continued router ospf 1 vrf blue router-id 1.0.0.1 network 1.0.0.0/24 area 0 network 10.0.0.0/24 area 0 ! router ospf 2 vrf orange router-id 2.0.0.1 network 2.0.0.0/24 area 0 network 20.0.0.0/24 area 0 ! ip route vrf green 31.0.0.0/24 3.0.0.
PAGE 1131
ROUTER 2 continued interface Vlan 192 ip vrf forwarding orange ip address 2.0.0.2/24 tagged TenGigabitEthernet 3/0 no shutdown ! interface Vlan 256 ip vrf forwarding green ip address 3.0.0.2/24 tagged TenGigabitEthernet 3/0 no shutdown ! router ospf 1 vrf blue router-id 1.0.0.2 network 11.0.0.0/24 area 0 network 1.0.0.0/24 area 0 passive-interface GigabitEthernet 9/18 ! router ospf 2 vrf orange router-id 2.0.0.2 network 21.0.0.0/24 area 0 network 2.0.0.
PAGE 1132
www.dell.com | support.dell.com . ROUTER 1 continued FTOS#show ip ospf 1 neighbor Neighbor ID Pri State 1.0.0.2 1 FULL/DR FTOS#sh ip ospf 2 neighbor Neighbor ID Pri State 2.0.0.2 1 FULL/DR FTOS#show ip route vrf blue Dead Time Address 00:00:32 1.0.0.2 Interface Area Vl 128 0 Dead Time Address 00:00:37 2.0.0.
PAGE 1133
The following shows the output of the show commands on Router 2. ROUTER 2 FTOS#show ip vrf VRF-Name VRF-ID Interfaces default-vrf 0 blue 1 orange Gi Te Gi Gi Gi Gi Gi Gi Gi Ma Ma Nu Vl Gi Vl 2 1/0-89, 3/0-3, 4/0-89, 5/0-89, 6/0-89, 9/0-17,21-47, 11/0-47, 12/0-47, 13/0-47, 0/0, 1/0, 0, 1 9/18, 128 Gi 9/19, Vl 192 Gi 9/20, Vl 256 green 3 FTOS#show ip ospf 1 neighbor Neighbor ID Pri State 1.0.0.1 1 FULL/BDR ! FTOS#sh ip ospf 2 neighbor Neighbor ID Pri State 2.0.0.
PAGE 1134
www.dell.com | support.dell.
PAGE 1135
58 Virtual Router Redundancy Protocol (VRRP) IPv4 Virtual Router Redundancy Protocol (VRRP) is available on platforms: IPv6 VRRP (VRRP version 3) is available on platforms: ces ces This chapter covers the following information: • • • • • VRRP Overview VRRP Benefits VRRP Implementation VRRP Configuration Sample Configurations Virtual Router Redundancy Protocol (VRRP) is designed to eliminate a single point of failure in a statically routed network.
PAGE 1136
www.dell.com | support.dell.com Figure 58-1 shows a typical network configuration using VRRP. Instead of configuring the hosts on the network 10.10.10.0 with the IP address of either Router A or Router B as their default router; their default router is the IP Address configured on the virtual router. When any host on the LAN segment wants to access the Internet, it sends packets to the IP address of the virtual router. In Figure 58-1 below, Router A is configured as the MASTER router.
PAGE 1137
VRRP Benefits With VRRP configured on a network, end-station connectivity to the network is not subject to a single point-of-failure. End-station connections to the network are redundant and they are not dependent on IGP protocols to converge or update routing tables.
PAGE 1138
www.dell.com | support.dell.com Note: 1500 VRRP groups are supported in FTOS Release 6.3.1.0 and later. The recommendations in Table 58-1 may vary depending on various factors like ARP broadcasts, IP broadcasts, or STP before changing the advertisement interval. When the number of packets processed by RP2/CP/FP processor increases or decreases based on the dynamics of the network, the advertisement intervals in may increase or decrease accordingly.
PAGE 1139
VRRP Configuration By default, VRRP is not configured. The following list specifies the configuration tasks for VRRP: • • • • • • • Create a Virtual Router (mandatory) Assign Virtual IP addresses (mandatory) Set VRRP Group (Virtual Router) Priority (optional) Configure VRRP Authentication (optional) Disable Preempt (optional) Change the Advertisement interval (optional) Track an Interface or Object (optional) For a complete listing of all commands related to VRRP, refer to FTOS Command Line Interface.
PAGE 1140
www.dell.com | support.dell.com Figure 58-3. Command Example Display: show config for the Interface FTOS(conf-if-gi-1/1)#show conf ! interface GigabitEthernet 1/1 ip address 10.10.10.1/24 ! vrrp-group 111 no shutdown FTOS(conf-if-gi-1/1)# Note that the interface has an IP Address and is enabled Assign Virtual IP addresses Virtual routers contain virtual IP addresses configured for that VRRP Group (VRID).
PAGE 1141
• • If the virtual IP address and the interface’s primary/secondary IP address are the same, the priority on that VRRP group is automatically set to 255. The interface then becomes the MASTER/OWNER router of the VRRP group and the interface’s physical MAC address is changed to that of the owner VRRP group’s MAC address. (You can also configure a priority for the group even if the group is owned.
PAGE 1142
www.dell.com | support.dell.com Figure 58-6 shows the same VRRP group configured on multiple interfaces on different subnets. Note: show vrrp displays all of the active IPv4 groups, and show ipv6 vrrp displays all of the active IPv6 groups. Figure 58-6. Command Example Display: show vrrp Same VRRP Group (VRID) FTOS#do show vrrp -----------------GigabitEthernet 1/1, VRID: 111, Net: 10.10.10.1 State: Master, Priority: 255, Master: 10.10.10.
PAGE 1143
Set VRRP Group (Virtual Router) Priority Setting a Virtual Router priority to 255 ensures that router is the “owner” virtual router for the VRRP group. VRRP elects the MASTER router by choosing the router with the highest priority. The default priority for a Virtual Router is 100. The higher the number, the higher the priority. If the MASTER router fails, VRRP begins the election process to choose a new MASTER router based on the next-highest priority.
PAGE 1144
www.dell.com | support.dell.com Configure VRRP Authentication Note: Authentication is not available for IPv6 VRRP. Simple authentication of VRRP packets ensures that only trusted routers participate in VRRP processes. When authentication is enabled, FTOS includes the password in its VRRP transmission, and the receiving router uses that password to verify the transmission.
PAGE 1145
Disable Preempt The preempt command is enabled by default, and it forces the system to change the MASTER router if another router with a higher priority comes online. Prevent the BACKUP router with the higher priority from becoming the MASTER router by disabling preempt. Note: All virtual routers in the VRRP group must be configured the same: all configured with preempt enabled or configured with preempt disabled.
PAGE 1146
www.dell.com | support.dell.com Change the Advertisement interval By default, the MASTER router transmits a VRRP advertisement to all members of the VRRP group every 1 second, indicating it is operational and is the MASTER router. If the VRRP group misses 3 consecutive advertisements, then the election process begins and the BACKUP virtual router with the highest priority transitions to MASTER.
PAGE 1147
Track an Interface or Object In previous releases, you could set FTOS to track the state of an interface for a specified virtual group. Starting in release 8.4.1.0, you can track additional objects for a virtual group, such as Layer 3 interfaces (IPv4 and IPv6), IPv4/IPv6 route reachability, and thresholds of IPv4/IPv6 route metrics. For information on how to track supported objects, refer to Chapter 31, Object Tracking.
PAGE 1148
www.dell.com | support.dell.com To track an interface or configured object for a virtual group, use the track command in the VRRP mode: Task Command Syntax Command Mode Monitor an interface or a configured object and, optionally, reconfigure the cost value to be subtracted from the VRRP group priority if the status of the tracked object goes DOWN. track {interface | object-id} [priority-cost cost] Valid object IDs are from 1 to 65535. Cost range: 1-254.
PAGE 1149
Figure 58-16. Command Example: show track FTOS#show track Track 2 IPv6 route 2040::/64 metric threshold Metric threshold is Up (STATIC/0/0) 5 changes, last change 00:02:16 Metric threshold down 255 up 254 First-hop interface is GigabitEthernet 13/2 Tracked by: VRRP GigabitEthernet 7/30 IPv6 VRID 1 Track 3 IPv6 route 2050::/64 reachability Reachability is Up (STATIC) 5 changes, last change 00:02:16 First-hop interface is GigabitEthernet 13/2 Tracked by: VRRP GigabitEthernet 7/30 IPv6 VRID 1 Figure 58-17.
PAGE 1150
www.dell.com | support.dell.com VRRP on a VRF Interface VRRP is supported with Virtual Routing and Forwarding (VRF) only on platform: e Starting in release 8.4.1.0, you can configure the VRRP feature on interfaces that belong to a non-default Virtual Routing and Forwarding (VRF) instance on E-Series routers. In previous releases, the VRRP feature was not supported on interfaces that were configured for VRF. For a sample VRRP configuration on a VRF interface, see VRRP in VRF Configuration.
PAGE 1151
Note: On E-Series routers, the VRID used by the VRRP protocol changes according to whether VRF microcode is loaded or not: • When VRF microcode is not loaded in CAM, the VRID for a VRRP group is the same as the VRID number configured with the vrrp-group or vrrp-ipv6-group command: Figure 58-19. VRID used when VRF microcode is not loaded FTOS(conf)#interface GigabitEthernet 3/0e FTOS(conf-if-gi-3/0)#ip address 1.1.1.1/24 FTOS(conf-if-gi-3/0)#vrrp-group 111 FTOS(conf-if-gi-3/0-vrid-111)#virtual-ip 1.1.1.
PAGE 1152
www.dell.com | support.dell.com Sample Configurations VRRP for IPv4 Configuration The configuration in Figure 58-21 shows how to enable IPv4 VRRP. This example does not contain comprehensive directions and is intended to provide guidance for only a typical VRRP configuration. You can copy and paste from the example to your CLI. Be sure you make the necessary changes to support your own IP addresses, interfaces, names, etc.
PAGE 1153
Figure 58-22. Configure VRRP for IPv4 Router 2 R2(conf)#int gi 2/31 R2(conf-if-gi-2/31)#ip address 10.1.1.1/24 R2(conf-if-gi-2/31)#vrrp-group 99 R2(conf-if-gi-2/31-vrid-99)#priority 200 R2(conf-if-gi-2/31-vrid-99)#virtual 10.1.1.3 R2(conf-if-gi-2/31-vrid-99)#no shut R2(conf-if-gi-2/31)#show conf ! interface GigabitEthernet 2/31 ip address 10.1.1.1/24 ! vrrp-group 99 priority 200 virtual-address 10.1.1.
PAGE 1154
www.dell.com | support.dell.com VRRP for IPv6 Configuration 1154 Figure 58-22 shows an example of a VRRP for IPv6 configuration in which the IPv6 VRRP group consists of two routers. This example does not contain comprehensive directions and is intended to provide guidance for only a typical VRRP configuration. You can copy and paste from the example to your CLI. Be sure you make the necessary changes to support your own IP addresses, interfaces, names, etc.
PAGE 1155
Figure 58-23. VRRP for IPv6 Topology Master State: Although both R2 and R3 have the same priority (100), R2 is the master in the VRRP group because the R2 interface has a higher IPv6 address.
PAGE 1156
www.dell.com | support.dell.com Figure 58-24.
PAGE 1157
VRRP in VRF Configuration The example in this section shows how to enable VRRP operation in a VRF virtualized network for the following scenarios: • • Multiple VRFs on physical interfaces running VRRP Multiple VRFs on VLAN interfaces running VRRP To view a VRRP in VRF configuration, use the show commands described in Displaying a VRRP in VRF Configuration. Non-VLAN Scenario Figure 58-25. VRRP in VRF: Non-VLAN Example Switch-1 VRID 11 Node IP 10.10.1.5 Virtual IP 10.10.1.2 Switch-2 VRID 11 Node IP 10.
PAGE 1158
www.dell.com | support.dell.com Both Switch-1 and Switch-2 have three VRF instances defined: VRF-1, VRF-2, and VRF-3. Each VRF has a separate physical interface to a LAN switch and an upstream VPN interface to connect to the Internet. Both Switch-1 and Switch-2 use VRRP groups on each VRF instance in order that there is one master and one backup router for each VRF. In VRF-1 and VRF-2, Switch-2 serves as owner-master of the VRRP group and Switch-1 serves as the backup.
PAGE 1159
Figure 58-27. VRRP in VRF: Switch-2 Non-VLAN Configuration Switch-2 S2(conf)#ip vrf default-vrf 0 ! S2(conf)#ip vrf VRF-1 1 ! S2(conf)#ip vrf VRF-2 2 ! S2(conf)#ip vrf VRF-3 3 ! S2(conf)#interface GigabitEthernet 12/1 S2(conf-if-gi-12/1)#ip vrf forwarding VRF-1 S2(conf-if-gi-12/1)#ip address 10.10.1.2/24 S2(conf-if-gi-12/1)#vrrp-group 11 % Info: The VRID used by the VRRP group 11 in VRF 1 will be 177. S2(conf-if-gi-12/1-vrid-101)#priority 255 S2(conf-if-gi-12/1-vrid-101)#virtual-address 10.10.1.
PAGE 1160
www.dell.com | support.dell.com Figure 58-28. 1160 VRRP in VRF: Switch-1 VLAN Configuration Switch-1 S1(conf)#ip vrf VRF-1 1 ! S1(conf)#ip vrf VRF-2 2 ! S1(conf)#ip vrf VRF-3 3 ! S1(conf)#interface GigabitEthernet 12/4 S1(conf-if-gi-12/4)#no ip address S1(conf-if-gi-12/4)#switchport S1(conf-if-gi-12/4)#no shutdown ! S1(conf-if-gi-12/4)#interface vlan 100 S1(conf-if-vl-100)#ip vrf forwarding VRF-1 S1(conf-if-vl-100)#ip address 10.10.1.
PAGE 1161
Figure 58-29. VRRP in VRF: Switch-2 VLAN Configuration Switch-2 S2(conf)#ip vrf VRF-1 1 ! S2(conf)#ip vrf VRF-2 2 ! S2(conf)#ip vrf VRF-3 3 ! S2(conf)#interface GigabitEthernet 12/4 S2(conf-if-gi-12/4)#no ip address S2(conf-if-gi-12/4)#switchport S2(conf-if-gi-12/4)#no shutdown ! S2(conf-if-gi-12/4)#interface vlan 100 S2(conf-if-vl-100)#ip vrf forwarding VRF-1 S2(conf-if-vl-100)#ip address 10.10.1.
PAGE 1162
www.dell.com | support.dell.com Displaying a VRRP in VRF Configuration To display information on a VRRP group that is configured on an interface that belongs to a VRF instance, enter the show running-config track [interface interface] command: Figure 58-30. Command Example: show running-config track interface FTOS#show running-config interface gigabitethernet 13/4 interface GigabitEthernet 13/4 ip vrf forwarding red ip address 192.168.0.1/24 vrrp-group 4 virtual-address 192.168.0.
PAGE 1163
59 FTOS XML Feature FTOS XML Feature is supported on platforms: ce This chapter describes the FTOS XML Feature in the following major sections: • • • • • • • XML Functionality The Form of XML Requests and Responses The Configuration Request and Response The “Show” Request and Response Configuration Task List XML Error Conditions and Reporting Using display xml as a Pipe Option XML Functionality Through SSH/Telnet client sessions, FTOS XML provides a way of interfacing with the system by entering XML-for
PAGE 1164
www.dell.com | support.dell.com — show linecard all — show sfm slot ID — show logging 1-65535 — — — — show logging reverse show sfm show sfm all show version — show running-config—Only the full report is supported, no options. — show interfaces—All the options are supported except rate: The Form of XML Requests and Responses To send an XML-formatted command through a Telnet or SSH client session, you first use the terminal xml command to inform FTOS that you wish to switch to XML mode.
PAGE 1165
Response Format Similarly, every response from FTOS begins with the XML declaration, followed by a “Response” tag: :: :: What goes between the Response tags depends on the type of response, as discussed next.
PAGE 1166
www.dell.com | support.dell.com The “Show” Request and Response To generate an XML request that encapsulates a “show” command (to request a report), you use the tag instead of the tag as the Operation type. The schema of a show request allows only one , as shown here for the show linecard command. (Note that “show line all” demonstrates that you can use both an abbreviated form of the command and options, just as in the standard CLI):
PAGE 1167
Run an FTOS XML session Use the following procedure to start, run, and close an FTOS XML session: Step Command Syntax Command Mode Purpose terminal xml EXEC Privilege Invoke XML interface in Telnet and SSH client sessions. 2 [Construct input to the CLI by following the XML request schema, as described in The Form of XML Requests and Responses.] FTOS XML Cut and paste your XML request from a text editor or other type of XML presentation tool, or type your XML request line by line.
PAGE 1168
www.dell.com | support.dell.com Figure 59-2. Example of a Successful XML Session FTOS# terminal xml FTOS(xml)# Enter XML request with CTRL-Y or empty line Clear XML request with CTRL-C Exit XML mode with CTRL-Z: ip access standard test1
PAGE 1169
Configure a standard ACL To configure a standard ACL with XML, first enter FTOS XML mode, and then construct a configuration request, as described above. An example of a complete standard ACL configuration request message is: ip access list standard ToOspf seq 5 deny any seq 10 deny 10.2.0.0 /16 seq 15 deny 10.3.0.
PAGE 1170
www.dell.com | support.dell.com Create an egress ACL and apply rules to the ACL To create an egress ACL and apply rules to the ACL in one single XML request, first enter FTOS XML mode, and then construct the configuration request (see Run an FTOS XML session). The following example shows a configuration request message that accomplishes this task:
PAGE 1171
• • • — Invalid CLI commands or keywords — Invalid range of data specified in the CLI command XML_SCHEMA_ERROR—This error is caused by: — Invalid XML method or operation tags — Invalid object hierarchy or value out of range APPLICATION_ERROR—This error is caused by a failure to process the request, or a problem on the FTOS task. NO_ERROR—The XML request processed successfully.
PAGE 1172
www.dell.com | support.dell.com XML schema error This following XML request has transposed the and tag sets: ip access standard test2 The XML response to that malformed request is:
PAGE 1173
The second command in this XML request also makes an invalid request: ip access standard test1 no permit host 2.2.3.4 log count bytes The error response contains a of “APPLICATION_ERROR”, of “APPLICATION_ERROR” and a of “% Error: Access-list entry does not exist.
PAGE 1174
www.dell.com | support.dell.com Figure 59-3. 1174 Example: show linecard 0 | display xml FTOS>#show linecard 0 | display xml 0 online online EXW2PF3 - 2-port 10GE LAN/WAN PHY line card with XFP optics (EF3) EXW2PF3 - 2-port 10GE LAN/WAN PHY line card with XFP optics (EF3) 1.
PAGE 1175
60 C-Series Debugging and Diagnostics In addition to standard manageability features such as LEDs, SNMP alarms and traps, and Syslogging, the C-Series supports several diagnostic and debugging features that are crucial to isolating and resolving support issues during the operations and maintenance phase.
PAGE 1176
www.dell.com | support.dell.com Switch Fabric overview The switch fabric is formed through the installed RPMs and line cards via C-Series Switch Fabric (CSF) ASICs. Each RPM includes four CSFs, each of which provides eight Backplane Data (BDP) links, one link for each line card slot. In total, an RPM provides 32 BDP links of forwarding capacity. Each line card includes two CSFs.
PAGE 1177
FTOS Switch Agent (SWAGT) monitors the IDP and BDP links on the line cards. FTOS Link Monitoring task continually polls the status of the IDP and BDP links. If it finds an open link, the system brings down the link and reports the condition via a message similar to the one shown in Message 1.
PAGE 1178
www.dell.com | support.dell.com Figure 60-3. show sfm Command Example FTOS#show sfm Switch Fabric -- SFM 0 -Status Module Type Up Time -- SFM 1 -Status State: up : active : SFM - Switch Fabric Module : 1 day, 6 hr, 0 min : not present Use the FTOS Syslogging feature to monitor the overall status of the switch fabric. Changes in switch fabric status are reported via messages similar those in Message 2.
PAGE 1179
Table 60-2. Poll Manager Syslog Message Description Message Description POLLMGR-2-POLLMGR_RP M_ECC_ERR_DETECT Indicates that the system detected a single-bit ECC memory error in the RPM CPU memory (SDRAM). The system tracks the number of multi-bit errors and resets the system after a certain number of such errors are recorded. Upon reset, the system writes a failure trace file to the TRACE_LOG directory for analysis by Dell Networking.
PAGE 1180
www.dell.com | support.dell.com Inter-CPU timeouts The CP monitors the health status of the other processors using heartbeat messaging exchange. FTOS automatically saves critical information about the IPC failure to NVRAM. Such information includes: • • • • Status counters on the internal Ethernet interface Traffic profile of the inter-CPU bus Kernel drops High CPU exception conditions Upon the next boot, this information is uploaded to a file in the CRASH_LOG directory.
PAGE 1181
FTOS actually saves up to three persistent files depending upon the type of failure.
PAGE 1182
www.dell.com | support.dell.com Figure 60-5. show environment rpm Command Example FTOS#show environment rpm -- RPM Environment Status -Slot Status Temp Voltage -------------------------------------0 active 33C ok 1 not present Recognize an overtemperature condition An overtemperature condition occurs, for one of two reasons: • • The card genuinely is too hot. A sensor has malfunctioned. Inspect cards adjacent to the one reporting the condition to discover the cause.
PAGE 1183
2. Check air flow through the system. On the C-Series, air flows sideways from right to left. Ensure the air ducts are clean and that all fans are working correctly. 3. Once the software has determined that the temperature levels are within normal limits, the card can be re-powered safely. Use the power-on command in EXEC mode to bring the line card back online. In addition, Dell Networking requires that you install blanks in all slots without a line card to control airflow for adequate system cooling.
PAGE 1184
www.dell.com | support.dell.com The TRACE_LOG_DIR/TRACE_CURR_BOOT directory can be reached by FTP or by using the show file command from the flash://TRACE_LOG_DIR directory. Note: At reload this directory is renamed to flash:/TRACE_LOG_DIR/TRACE_LAST_BOOT and a new empty flash:/TRACE_LOG_DIR/TRACE_CURR_BOOT directory is created. Automatic trace log updates The system automatically saves trace files to the internal flash.
PAGE 1185
To manually write the contents of an RPM log to the internal flash: Task Command Syntax Command Mode Write the RPM trace log to flash. upload trace-log cp [cmd-history | hw-trace | sw-trace EXEC Privilege ] To manually write the contents of a line card log to the internal flash: Task Command Syntax Command Mode Write the line card trace log to flash. upload trace-log linecard [0-7] | [hw-trace | sw-traceupload trace-log cp | [cmd-history | hw-trace | EXEC Privilege sw-trace ] Figure 60-7.
PAGE 1186
www.dell.com | support.dell.com When the trace messages are being saved on reload, Message 9 is displayed. Message 9 Saving Trace Messages Starting to save trace messages… Done. The CP and LP trace file names at chassis reload are: • • CP: reload_traceRPM0_CP LP: reload_traceLP[0-7] Figure 60-8. TRACE_LAST_BOOT Directory example FTOS#cd /flash/TRACE_LOG_DIR/TRACE_LAST_BOOT FTOS#dir hw_traceLP0.0 hw_traceLP2.3 hw_traceRPM0_CP.3 hw_traceLP0.1 hw_traceLP2.4 hw_traceRPM0_CP.4 hw_traceLP2.0 hw_traceRPM0_CP.
PAGE 1187
Figure 60-9. Command Example: show command-history FTOS#show command-history [6/16 16:22:3]: CMD-(CLI):[enable]by default from console [6/16 16:22:6]: CMD-(CLI):[show cam-profile]by default from console [6/16 16:38:9]: CMD-(TEL0):[enable]by admin from vty0 (10.11.48.30) [6/16 16:38:10]: CMD-(CLI):[show qos statistics]by default from console [6/16 16:38:21]: CMD-(TEL0):[show command-history]by admin from vty0 (10.11.48.
PAGE 1188
www.dell.com | support.dell.com Figure 60-11.
PAGE 1189
Table 60-3. show hardware Commands Command Description show hardware cpu data-plane View driver-level statistics for the data-plane port on the CPU for the specified line card or RPM. show hardware unit Views advanced counters, statistics, and register information for the FP and CSF ASICs. Recognizing a High CPU Condition A high CPU condition exist when any of the messages in Message 10 appear.
PAGE 1190
www.dell.com | support.dell.com Monitoring hardware components with SNMP The SNMP traps and OIDs in Table 60-4 provide information on C-Series hardware components. Table 60-4. SNMP Traps and OIDs OID String OID Name Description .1.3.6.1.4.1.6027.3.1.1.3.8 chRPMMajorAlarmStatus Fault status of the major alarm LED on the RPM .1.3.6.1.4.1.6027.3.1.1.3.9 chRPMMinorAlarmStatus Fault status of the minor alarm LED on the RPM .1.3.6.1.4.1.6027.3.1.1.4.0.
PAGE 1191
Table 60-4. SNMP Traps and OIDs OID String OID Name Description .1.3.6.1.4.1.6027.3.1.1.2.1.1.2 chSysPowerSupplyOperStatus Each entry in the chSysPowerSupplyTable includes a set of objects which describe the status of a particular power supply. .1.3.6.1.4.1.6027.3.1.1.4.0.13 chAlarmPowerSupplyDown Trap generated when the power supply status changes to non-operational .1.3.6.1.4.1.6027.3.1.1.4.0.17 chAlarmPowerSupplyClear Trap generated when the power supply status changes to operational. .1.3.
PAGE 1192
www.dell.com | support.dell.com Offline diagnostics Note: As the SFM on the C-Series is a logical concept only, the FORCE10-CHASSIS-MIB SFM-related SNMP alarms and traps are not used. The offline diagnostics test suite is useful for isolating faults and debugging hardware. Diagnostics are invoked from the FTOS CLI. While diagnostics are running, the status can be monitored via the CLI. The tests results are written to a file in flash memory and can be displayed on screen.
PAGE 1193
• The complete diagnostics test suite normally runs for 4 to 6 minutes; the 48-port 1-Gigabit line card takes slightly longer than the 4-port 10-Gigabit line card. Take the line card offline Place the line card in an offline state using the offline linecard command, as shown in Figure 60-12. Figure 60-12.
PAGE 1194
www.dell.com | support.dell.com Figure 60-15. show diag linecard Command Example FTOS#show diag linecard 5 Diag status of Linecard slot 5: ------------------------------------------------------------Card is currently offline. Card alllevels diag issued at THU FEB 08, 2018 04:10:06 PM. Current diag status: Card diags are in progress. -------------------------------------------------------------00:54:19 : Diagnostic test results are stored on file: flash:/TestReport -LC-5.
PAGE 1195
Figure 60-16. Viewing Offline Diagnostics Test Results FTOS#show diag linecard 5 Diag status of Linecard slot 5: ------------------------------------------------------------------Card is currently offline. Card alllevels diag issued at THU FEB 08, 2018 04:10:05 PM. Current diag status: Card diags are done. Duration of execution: 3 min 35 sec. Diagonostic test results located: flash:/TestReport-LC-5.
PAGE 1196
www.dell.com | support.dell.com Figure 60-17. Viewing Offline Diagnostics Test Results (continued) Test 107 - NVRAM Address Line test .................................. PASS Test 108 - NVRAM Data Line Test ..................................... PASS Test 110 - NVRAM Read Write test .................................... PASS .Test 111 - FLASH Write Read test .................................... PASS Test 112 - FPGA Registers Verification Test ......................... PASS Test 113 - FPGA Level1 Test ......
PAGE 1197
Buffer tuning Buffer Tuning allows you to modify the way your switch allocates buffers from its available memory, and helps prevent packet drops during a temporary burst of traffic. The C-Series and S-Series ASICs implement the key functions of queuing, feature lookups, and forwarding lookups in hardware. • • Forwarding Processor (FP) ASICs provide Ethernet MAC functions, queueing and buffering, as well as store feature and forwarding tables for hardware-based lookup and forwarding decisions.
PAGE 1198
www.dell.com | support.dell.com • Available packet pointers (2k per interface). Each packet is managed in the buffer using a unique packet pointer. Thus, each interface can manage up to 2k packets. You can configure dynamic buffers per port on both 1G and 10G FPs and per queue on CSFs. By default, the FP dynamic buffer allocation is 10 times oversubscribed.
PAGE 1199
Buffer tuning commands Task Command Command Mode Define a buffer profile for the FP queues. buffer-profile fp fsqueue CONFIGURATION Define a buffer profile for the CSF queues. buffer-profile csf csqueue CONFIGURATION Change the dedicated buffers on a physical 1G interface. buffer dedicated BUFFER PROFILE Change the maximum amount of dynamic buffers an interface can request. buffer dynamic BUFFER PROFILE Change the number of packet-pointers per queue.
PAGE 1200
www.dell.com | support.dell.com FTOS Behavior: When you remove a buffer-profile using the command no buffer-profile [fp | csf] from CONFIGURATION mode, the buffer-profile name still appears in the output of show buffer-profile [detail | summary]. After a line card reset, the buffer profile correctly returns to the default values, but the profile name remains.
PAGE 1201
Figure 60-20. Displaying Buffer Profile Allocations FTOS#show running-config interface tengigabitethernet 2/0 ! interface TenGigabitEthernet 2/0 no ip address mtu 9252 switchport no shutdown buffer-policy myfsbufferprofile FTOS#sho buffer-profile detail int gi 0/10 Interface Gi 0/10 Buffer-profile fsqueue-fp Dynamic buffer 1256.00 (Kilobytes) Queue# Dedicated Buffer Buffer Packets (Kilobytes) 0 3.00 256 1 3.00 256 2 3.00 256 3 3.00 256 4 3.00 256 5 3.00 256 6 3.00 256 7 3.
PAGE 1202
www.dell.com | support.dell.com Use a pre-defined buffer profile FTOS provides two pre-defined buffer profiles, one for single queue (i.e non-QoS) applications, and one for four queue (i.e QoS) applications. Task Command Syntax Command Mode Apply one of two pre-defined buffer profiles for all port-pipes in the system. buffer-profile global [1Q|4Q] CONFIGURATION You must reload the system for the global buffer-profile to take effect (Message 12).
PAGE 1203
Figure 60-21.
PAGE 1204
www.dell.com | support.dell.
PAGE 1205
61 E-Series TeraScale Debugging and Diagnostics This chapter addresses E-Series TeraScale Debugging and Diagnostics TeraScale platforms. Refer to Chapter 63, E-Series ExaScale Debugging and Diagnostics for information relating to that platform. In addition to the FTOS high availability features, E-Series and FTOS support several diagnostics and debug features that are integral components to delivering maximum uptime.
PAGE 1206
www.dell.com | support.dell.com • • • • Write the contents of the trace buffer Recognize a high CPU condition Configure an action upon a hardware error Core dumps Note: These diagnostics and debugability features are available on TeraScale systems only, unless specifically noted. Overview The FTOS diagnostics and debugging features are a proactive approach to maximizing system uptime and reducing meantime to resolution (MTTR) when a problem occurs.
PAGE 1207
Figure 61-1. Dataplane Loopback If three consecutive packets are lost, an error message is logged and then one of the following happens: • The RPM-SFM runtime loopback test failure initiates an SFM walk whenever it is enabled, feasible and necessary. The system automatically places each SFM (in sequential order) in an offline state, runs the loopback test, and then places the SFM back in an active state. This continues until the system determines a working SFM combination.
PAGE 1208
www.dell.com | support.dell.com • An SFM walk will not be able to identify multiple faulty SFMs, faulty linecards, or faulty RPM. In this case, the following event is logged. Message 2 SFM walk Event Log %TSM-2-RPM_LOOPBACK_FAIL: RPM-SFM dataplane loopback test failed %TSM-2-SFM_WALK_START: Automatic SFM walk-through started %TSM-2-SFM_WALK_FAIL: Automatic SFM walk-through failed to identify single faulty SFM • If a line card runtime loopback test fails, the system does not launch an SFM walk.
PAGE 1209
Task Command Mode Disable the automatic SFM walk that is launched after an RPM-SFM runtime loopback test failure. To re-enable the automatic SFM walk, use the no dataplane-diag disable sfm-walk command. dataplane-diag disable sfm-walk CONFIGURATION Note: Disabling the sfm-walk command prevents the sfm-bringdown command from taking effect.
PAGE 1210
www.dell.com | support.dell.com Task Command Mode Execute a manual dataplane loopback test: • all-loopback – Both the RPM and the line card dataplane loopback test is done. • rpm-loopback – Only the RPM dataplane loopback test is done. This test can be run when the switch fabric is in either an operational or a non-operational state.
PAGE 1211
Note: Execute this command only during an offline diagnostics; this command may bring down the switch fabric. When there are a full set of SFMs online, powering down one SFM will reduce the total bandwidth supported by the chassis, and may affect data flow. A warning message is issued at the command line that requires user confirmation to proceed with the command (Figure 61-3). Figure 61-3. power-off sfm command with data traffic warning message FTOS#power-off sfm 0 SFM0 is active.
PAGE 1212
www.dell.com | support.dell.com Reset the SFM When the SFM is taken offline due to an error condition, you can execute the reset sfm command and initiate a manual recovery. Task Command Mode Reset a specific SFM module (power-off and then power-on). reset sfm slot-number EXEC When an error is detected on an SFM module, this command is a manual recovery mechanism. Since this command can be used with live traffic running, the switch fabric will not go down if the switch fabric is in an UP state.
PAGE 1213
The PCDFO polling feature monitors data received over the switch fabric. When a DFO error is detected, no automatic action is initiated by the system. The message issued is similar to: Message 4 PCDFO error message %RPM1-P:CP %CHMGR-2-SFM_PCDFO: PCDFO error detected for SFM4 The following graphic illustrates the E600 and E1200 switch fabric architecture. Each ingress and egress Buffer and Traffic Management (BTM) ASIC maintains nine channel connections to the TeraScale Switch Fabric (TSF) ASIC.
PAGE 1214
www.dell.com | support.dell.com For the transient case, PCDFO errors are not reported to the log. The hardware system automatically recovers from the error state, and the dataplane continues to function properly. In persistent case, PCDFO errors will appear in the log, and the error state is likely to remain if not handled. With PCDFO error data alone, it is impossible to arrive at a conclusion which will pinpoint the cause for PCDFO error or reason for packets drop.
PAGE 1215
The three CPUs use Fast Ethernet connections to communicate to each other and to the line card CPUs using Inter-Processor Communication (IPC). The CP monitors the health status of the other processors using heartbeat messaging exchange. Message 6 CP monitor %RPM1-P:CP %RPM0-S:CP %RPM0-S:CP %RPM0-P:CP %IPC-2-STATUS: target rp2 not responding %RAM-6-FAILOVER_REQ: RPM failover request from active peer: Auto failover on failure %RAM-6-ELECTION_ROLE: RPM0 is transitioning to Primary RPM.
PAGE 1216
www.dell.com | support.dell.com In a dual RPM system, the two RPMs send synchronization messages via inter-RPM communication (IRC). As described in the High Availability chapter, an RPM failover can be triggered by loss of the heartbeat (similar to a keepalive message) between the two RPMs.
PAGE 1217
Show hardware commands The show hardware command tree consists of privileged EXEC commands created or changed specially for use with the E-Series. These commands display information from a hardware sub-component, such as the Buffer and Traffic Management (BTM) ASIC and the Forwarding and Packet Classification (FPC) ASIC. They should be used only under the guidance of Dell Networking technical support staff. The following table lists the show hardware commands.
PAGE 1218
www.dell.com | support.dell.com • • • • total run count total failure count consecutive failure count error code The diagnostics tests are grouped into three levels: Level 0—Check the inventory of devices. Verify the existence of devices (e.g., device ID test). Level 1—Verify the devices are accessible via designated paths (e.g., line integrity tests). Test the internal parts (e.g., registers) of devices. Level 2—Perform on-board loopback tests on various data paths (e.g., data port-pipe and Ethernet).
PAGE 1219
3. Execute the show diag command to view a report of the test results. FTOS#show diag linecard 4 Diag status of Linecard slot 4: ------------------------------------------------------------------Card is currently offline. Card level0 diag issued at TUE Mar 27, 2007 05:19:35 AM. Current diag status: Card diags are done (FAIL). Duration of execution: 0 min 0 sec.
PAGE 1220
www.dell.com | support.dell.com To enable Parity Error Correction: Step Task Command Command Mode 1 Verify that the line card has sufficient memory to enable this feature, as shown in Figure 61-8. show processes memory lp EXEC Privilege 2 Enable Parity Error Correction hardware monitor linecard asic fpc parity-correction CONFIGURATION 3 Reload the linecard. reset linecard EXEC Privilege FTOS displays Message 8 on the console, when you enable Parity Error Correction.
PAGE 1221
The line card status does not reflect transient errors until FTOS encounters five recoverable or 50 phantom transient errors on a card within an hour, as shown in Figure 61-9. The text “Last Event” indicates the last type of parity error (transient or real) that occurred. Use SNMP to poll the number of transient errors using the objects chSysCardParityPhantomError and chSysCardParityRecoverableError.
PAGE 1222
www.dell.com | support.dell.com Trace logs In addition to the syslog buffer, FTOS buffers trace messages which are continuously written by various FTOS software tasks to report hardware and software events and status information. Each trace message provides the date, time, and name of the FTOS process. All messages are stored in a ring buffer and can be saved to a file either manually or automatically upon failover.
PAGE 1223
Manual reload condition When the chassis is reloaded manually (through the CLI), trace messages in all of the buffers (software and hardware) in CP and linecards are saved to the flash as reload_traceRPM0_CP and reload_traceLP1 in flash:/TRACE_LOG_DIR/TRACE_CURR_BOOT. After reload, you can see these files in flash:/ TRACE_LOG_DIR/TRACE_LAST_BOOT. When the trace messages are being saved on reload, Message 13 is displayed. Message 13 Saving Trace Messages Starting to save trace messages… Done.
PAGE 1224
www.dell.com | support.dell.com Figure 61-10. show command-history Command Example FTOS#show command-history [12/5 10:57:8]: CMD-(CLI):service password-encryption [12/5 10:57:12]: CMD-(CLI):hostname Force10 [12/5 10:57:12]: CMD-(CLI):ip telnet server enable [12/5 10:57:12]: CMD-(CLI):line console 0 [12/5 10:57:12]: CMD-(CLI):line vty 0 9 [12/5 10:57:13]: CMD-(CLI):boot system rpm0 primary flash://FTOS-CB-1.1.1.2E2.
PAGE 1225
Recognize a high CPU condition A high CPU condition exists when any of the messages in Message 14 appear. Message 14 High CPU Condition Feb 13 13:56:16: %RPM1-S:CP %CHMGR-5-TASK_CPU_THRESHOLD: Cpu usage above threshold for task "sysAdmTsk"(100.00%) in CP. Feb 13 13:56:20: %RPM1-S:CP %CHMGR-5-CPU_THRESHOLD: Overall cp cpu usage above threshold. Cpu5SecUsage (100) Feb 13 13:56:20: %RPM1-S:CP %CHMGR-5-TASK_CPU_THRESHOLD_CLR: Cpu usage drops below threshold for task "sysAdmTsk"(0.00%) in CP.
PAGE 1226
www.dell.com | support.dell.
PAGE 1227
Kernel core dump—The E-Series supports kernel core dumps for CP and for RP1/RP2 using a naming convention of f10{cp|rp{1|2}}.kcore.gz. RP kernel core dumps are enabled by default. New files are written in flash until space is exhausted, in which case the write is aborted. CP kernel core dumps are disabled by default. Enable them using the command logging coredump cp from CONFIGURATION mode. If you use the keyword cp with this command, the system creates a file, named f10cp.kcore.
PAGE 1228
www.dell.com | support.dell.com Line card core dumps are disabled by default. To enable line card core dumps and specify the shutdown mode: Step 1 Task Command Syntax Command Mode Enable line card core dumps and specify the shutdown mode. logging coredump linecard {all | {0-13}} [port-shutdown | no-port-shutdown] EXEC Privilege Note: In the absence of port-shutdown and no-port-shutdown, the option no-port-shutdown is applied.
PAGE 1229
62 S-Series Debugging and Diagnostics The chapter contains the following major sections: • • • • • • • Offline diagnostics Trace logs Hardware watchdog timer Buffer tuning Troubleshooting packet loss Application core dumps Mini core dumps Offline diagnostics The offline diagnostics test suite is useful for isolating faults and debugging hardware.
PAGE 1230
www.dell.com | support.dell.com Important Points to Remember • You can only perform offline diagnostics on an offline standalone unit or offline member unit of a stack of three or more. You cannot perform diagnostics on the management or standby unit in a stack of two or more (Message 1). Message 1 Offline Diagnostics on Master/Standby Error Running Diagnostics on master/standby unit is not allowed on stack. • • • • Perform offline diagnostics on one stack member at a time.
PAGE 1231
Figure 62-2. Verifying the Offline/Online Status of an S-Series Stack Unit FTOS#show system brief | no-more Stack MAC : 00:01:e8:d6:02:39 -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Standby online S25V S25V 4.7.7.220 28 1 Management offline S50N S50N 4.7.7.220 52 2 Member online S25P S25P 4.7.7.
PAGE 1232
www.dell.com | support.dell.com Figure 62-3. Running Offline Diagnostics on an S-Series Standalone Unit FTOS#diag stack-unit 1 alllevels Warning - diagnostic execution will cause multiple link flaps on the peer side - advisable to shut directly connected ports Proceed with Diags [confirm yes/no]: yes 00:03:35: %S50N:1 %DIAGAGT-6-DA_DIAG_STARTED: Starting diags on stack unit 1 00:03:35 : Approximate time to complete these Diags ...
PAGE 1233
Figure 62-5. Viewing the Results of Offline Diagnostics on a Standalone Unit FTOS#show file flash://TestReport-SU-0.txt **********************************S-Series Diagnostics******************** Stack Unit Board Serial Number : DL267160098 CPU Version : MPC8541, Version: 1.1 PLD Version : 5 Diag image based on build : E_MAIN4.7.7.206 Stack Unit Board Voltage levels - 3.300000 V, 2.500000 V, 1.800000 V, 1.250000 V, 1.200000 V, 2.
PAGE 1234
www.dell.com | support.dell.com Auto Save on Crash or Rollover Exception information on for master or standby units is stored in the flash:/TRACE_LOG_DIR directory. This directory contains files that save trace information when there has been a task crash or timeout. On a master unit, the TRACE_LOG_DIR files can be reached by FTP or by using the show file command from the flash://TRACE_LOG_DIR directory.
PAGE 1235
1. CSF – Output queues going from the CSF. 2. FP Uplink—Output queues going from the FP to the CSF IDP links. 3. Front-End Link—Output queues going from the FP to the front-end PHY. All ports support eight queues, 4 for data traffic and 4 for control traffic. All 8 queues are tunable. Physical memory is organized into cells of 128 bytes. The cells are organized into two buffer pools— dedicated buffer and dynamic buffer.
PAGE 1236
www.dell.com | support.dell.com Figure 62-6. Buffer Tuning Points CSF Unit 3 1 IDP Switch Links 2 FP Unit 1 3 Front-end Links PHY PHY Deciding to tune buffers Dell Networking recommends exercising caution when configuring any non-default buffer settings, as tuning can significantly affect system performance. The default values work for most cases. As a guideline, consider tuning buffers if traffic is very bursty (and coming from several interfaces).
PAGE 1237
Buffer tuning commands Task Command Command Mode Define a buffer profile for the FP queues. buffer-profile fp fsqueue CONFIGURATION Define a buffer profile for the CSF queues. buffer-profile csf csqueue CONFIGURATION Change the dedicated buffers on a physical 1G interface. buffer dedicated BUFFER PROFILE Change the maximum amount of dynamic buffers an interface can request. buffer dynamic BUFFER PROFILE Change the number of packet-pointers per queue.
PAGE 1238
www.dell.com | support.dell.com Figure 62-7. Display the Default Buffer Profile FTOS#show buffer-profile detail interface gigabitethernet 0/1 Interface Gi 0/1 Buffer-profile Dynamic buffer 194.88 (Kilobytes) Queue# Dedicated Buffer Buffer Packets (Kilobytes) 0 2.50 256 1 2.50 256 2 2.50 256 3 2.50 256 4 9.38 256 5 9.38 256 6 9.38 256 7 9.38 256 Figure 62-8.
PAGE 1239
Using a pre-defined buffer profile FTOS provides two pre-defined buffer profiles, one for single-queue (i.e non-QoS) applications, and one for four-queue (i.e QoS) applications. Task Command Mode Apply one of two pre-defined buffer profiles for all port pipes in the system. buffer-profile global [1Q|4Q] CONFIGURATION You must reload the system for the global buffer profile to take effect (Message 3).
PAGE 1240
www.dell.com | support.dell.com Figure 62-9.
PAGE 1241
Figure 62-10.
PAGE 1242
www.dell.com | support.dell.com Figure 62-11.
PAGE 1243
Figure 62-12.
PAGE 1244
www.dell.com | support.dell.com Displaying Stack Port Statistics The show hardware stack-unit stack-port command displays input and output statistics for a stack-port interface, as shown in Figure 62-14. Figure 62-14.
PAGE 1245
Application core dumps Application core dumps are disabled by default. A core dump file can be very large. Due to memory requirements the file can only be sent directly to an FTP server. It is not stored on the local flash. Enable full application core dumps with the following: Task Command Syntax Command Mode Enable RPM core dumps and specify the shutdown mode. You may specify an IPv4 or IPv6 address for the server.
PAGE 1246
www.dell.com | support.dell.com Figure 62-16.
PAGE 1247
A Standards Compliance This appendix contains the following sections: • • • IEEE Compliance RFC and I-D Compliance MIB Location Note: Unless noted, when a standard cited here is listed as supported by FTOS, FTOS also supports predecessor standards. One way to search for predecessor standards is to use the http://tools.ietf.org/ website. Click on “Browse and search IETF documents”, enter an RFC number, and inspect the top of the resulting document for obsolescence citations to related RFCs.
PAGE 1248
www.dell.com | support.dell.com • • • Dell Networking — PVST+ SFF-8431 — SFP+ Direct Attach Cable (10GSFP+Cu) MTU — 9,252 bytes RFC and I-D Compliance The following standards are supported by FTOS, and are grouped by related protocol. The columns showing support by platform indicate which version of FTOS first supports the standard. Note: Checkmarks () in the E-Series column indicate that FTOS support was added before FTOS version 7.5.1.
PAGE 1249
General IPv4 Protocols FTOS support, per platform RFC# Full Name E-Series E-Series S-Series C-Series TeraScale ExaScale 791 Internet Protocol 7.6.1 7.5.1  8.1.1 792 Internet Control Message Protocol 7.6.1 7.5.1  8.1.1 826 An Ethernet Address Resolution Protocol 7.6.1 7.5.1  8.1.1 1027 Using ARP to Implement Transparent Subnet Gateways 7.6.1 7.5.1  8.1.1 1035 DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION (client) 7.6.1 7.5.1  8.1.
PAGE 1250
www.dell.com | support.dell.com General IPv6 Protocols 1250 FTOS support, per platform | RFC# Full Name 1886 E-Series E-Series TeraScale ExaScale S-Series C-Series DNS Extensions to support IP version 6 7.8.1 7.8.1  8.2.1 1981 (Partial) Path MTU Discovery for IP version 6 7.8.1 7.8.1  8.2.1 2460 Internet Protocol, Version 6 (IPv6) Specification 7.8.1 7.8.1  8.2.1 2461 (Partial) Neighbor Discovery for IP Version 6 (IPv6) 7.8.1 7.8.1  8.2.
PAGE 1251
Border Gateway Protocol (BGP) FTOS support, per platform S-Series C-Series E-Series TeraScale E-Series ExaScale RFC# Full Name 1997 BGP Communities Attribute 7.8.1 7.7.1  8.1.1 2385 Protection of BGP Sessions via the TCP MD5 Signature Option 7.8.1 7.7.1  8.1.1 2439 BGP Route Flap Damping 7.8.1 7.7.1  8.1.1 2545 Use of BGP-4 Multiprotocol Extensions for IPv6 Inter-Domain Routing 7.8.1  8.2.1 2796 BGP Route Reflection: An Alternative to Full Mesh Internal BGP (IBGP) 7.8.
PAGE 1252
www.dell.com | support.dell.com Intermediate System to Intermediate System (IS-IS) FTOS support, per platform E-Series TeraScale E-Series ExaScale OSI IS-IS Intra-Domain Routing Protocol (ISO DP 10589)  8.1.1 1195 Use of OSI IS-IS for Routing in TCP/IP and Dual Environments  8.1.1 2763 Dynamic Hostname Exchange Mechanism for IS-IS  8.1.1 2966 Domain-wide Prefix Distribution with Two-Level IS-IS  8.1.
PAGE 1253
Multiprotocol Label Switching (MPLS) FTOS support, per platform S-Series C-Series E-Series TeraScale E-Series ExaScale RFC# Full Name 2702 Requirements for Traffic Engineering Over MPLS 8.3.1 3031 Multiprotocol Label Switching Architecture 8.3.1 3032 MPLS Label Stack Encoding 8.3.1 3209 RSVP-TE: Extensions to RSVP for LSP Tunnels 8.3.1 3630 Traffic Engineering (TE) Extensions to OSPF Version 2 8.3.
PAGE 1254
www.dell.com | support.dell.com Multicast FTOS support, per platform S-Series C-Series E-Series TeraScale E-Series ExaScale Host Extensions for IP Multicasting 7.8.1 7.7.1  8.1.1 2236 Internet Group Management Protocol, Version 2 7.8.1 7.7.1  8.1.1 2710 Multicast Listener Discovery (MLD) for IPv6  8.2.1 3376 Internet Group Management Protocol, Version 3 3569 An Overview of Source-Specific Multicast (SSM) 3618 RFC# Full Name 1112 7.8.1 7.7.1  8.1.1 7.8.1 SSM for IPv4 7.7.
PAGE 1255
Network Management FTOS support, per platform S-Series C-Series E-Series TeraScale E-Series ExaScale Structure and Identification of Management Information for TCP/IP-based Internets 7.6.1 7.5.1  8.1.1 1156 Management Information Base for Network Management of TCP/IP-based internets 7.6.1 7.5.1  8.1.1 1157 A Simple Network Management Protocol (SNMP) 7.6.1 7.5.1  8.1.1 1212 Concise MIB Definitions 7.6.1 7.5.1  8.1.
PAGE 1256
www.dell.com | support.dell.com Network Management (continued) 1256 FTOS support, per platform | S-Series C-Series E-Series TeraScale E-Series ExaScale Coexistence Between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework 7.6.1 7.5.1  8.1.1 2578 Structure of Management Information Version 2 (SMIv2) 7.6.1 7.5.1  8.1.1 2579 Textual Conventions for SMIv2 7.6.1 7.5.1  8.1.1 2580 Conformance Statements for SMIv2 7.6.1 7.5.1  8.1.
PAGE 1257
Network Management (continued) FTOS support, per platform C-Series E-Series ExaScale Full Name 3815 Definitions of Managed Objects for the Multiprotocol Label Switching (MPLS), Label Distribution Protocol (LDP) 5060 Protocol Independent Multicast MIB 7.8.1 7.8.1 7.7.1 8.1.1 ANSI/TIA-1057 The LLDP Management Information Base extension module for TIA-TR41.4 Media Endpoint Discovery information 7.7.1 7.6.1 7.6.1 8.1.1 draft-grant-tacacs -02 The TACACS+ Protocol 7.6.1 7.5.1  8.1.1 7.8.
PAGE 1258
www.dell.com | support.dell.com Network Management (continued) FTOS support, per platform RFC# Full Name S-Series FORCE10-CS-C HASSIS-MIB Dell Networking C-Series Enterprise Chassis MIB FORCE10-IF-EX TENSION-MIB Dell Networking Enterprise IF Extension MIB (extends the Interfaces portion of the MIB-2 (RFC 1213) by providing proprietary SNMP OIDs for other counters displayed in the ”show interfaces” output) 7.6.1 FORCE10-LINK AGG-MIB Dell Networking Enterprise Link Aggregation MIB 7.6.
PAGE 1259
MIB Location Dell Force10 MIBs are under the Force10 MIBs subhead on the Documentation page of iSupport: https://www.force10networks.com/csportal20/KnowledgeBase/Documentation.aspx You also can obtain a list of selected MIBs and their OIDs at the following URL: https://www.force10networks.com/csportal20/MIBs/MIB_OIDs.aspx Some pages of iSupport require a login. To request an iSupport account, go to: https://www.force10networks.com/CSPortal20/Support/AccountRequest.
PAGE 1260
| Standards Compliance www.dell.com | support.dell.