Configuration manual

ManualsBrandsDell ManualsNetworkingForce10 S25-01-GE-24P

FTOS Configuration Guide

FTOS 8.4.2.6

E-Series TeraScale. C-Series,

S-Series (S50/S25)

Summary of content (1312 pages)

PAGE 1
FTOS Configuration Guide FTOS 8.4.2.6 E-Series TeraScale.
PAGE 2
Notes, Cautions, and Warnings NOTE: A NOTE indicates important information that helps you make better use of your computer. CAUTION: A CAUTION indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING indicates a potential for property damage, personal injury, or death. Information in this publication is subject to change without notice. © 2011 Dell Force10. All rights reserved.
PAGE 3
1 About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Conventions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 4
www.dell.com | support.dell.com Change System Logging Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .65 Display the Logging Buffer and the Logging Configuration . . . . . . . . . . . . . . . . . . . . . . .66 Configure a UNIX Logging Facility Level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .68 Synchronize Log Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 5
6 802.3ah . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95 Link Layer OAM Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .95 Link Layer OAMPDUs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .96 Link Layer OAM Operational Modes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .97 Link Layer OAM Discovery . . . . . .
PAGE 6
www.dell.com | support.dell.com MAC Authentication Bypass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .129 MAB in Single-host and Multi-Host Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .130 MAB in Multi-Supplicant Authentication Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . .130 Dynamic CoS with 802.1X . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 7
Configuring BFD for VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .200 Configuring BFD for Port-Channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .203 Configuring Protocol Liveness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .205 Troubleshooting BFD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .205 10 Border Gateway Protocol IPv4 (BGPv4) . . . . . . . . . .
PAGE 8
www.dell.com | support.dell.com Boot Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 When to Use CAM Profiling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .289 Important Points to Remember . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .290 Differences Between EtherScale and TeraScale . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 9
Enabling the Archive Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .318 Archiving a Configuration File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .319 Viewing the Archive Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .319 Replacing the Current Running Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 10
www.dell.com | support.dell.com 16 Force10 Resilient Ring Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 351 Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .351 Ring Status . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 352 Multiple FRRP Rings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 11
Enabling GVRP on a Layer 2 Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .392 Configuring GVRP Registration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .392 Configuring a GARP Timer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .393 19 High Availability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395 Component Redundancy . . . . . .
PAGE 12
www.dell.com | support.dell.com Disabling Multicast Flooding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .429 Specifying a Port as Connected to a Multicast Router . . . . . . . . . . . . . . . . . . . . . .429 Configuring the Switch as Querier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .429 Fast Convergence after MSTP Topology Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . .430 Designating a Multicast Router Interface . . . .
PAGE 13
Configure MTU Size on an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .469 Port-pipes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 470 Auto-Negotiation on Ethernet Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .471 View Advanced Interface Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 14
www.dell.com | support.dell.com IPv6 Neighbor Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .509 IPv6 Neighbor Discovery of MTU packets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .510 Advertise Neighbor Prefixes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .510 QoS for IPv6 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 15
LACP Configuration Commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .559 LACP Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .560 Monitor and Debugging LACP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .562 Shared LAG State Tracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .562 Configure Shared LAG State Tracking . . . . . . . .
PAGE 16
www.dell.com | support.dell.com 27 Link Layer Discovery Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 599 802.1AB (LLDP) Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .599 Protocol Data Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .599 Optional TLVs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 17
MLD Snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 627 Enable MLD Snooping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .628 Disable MLD Snooping on a VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .628 Configure the Switch as a Querier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .628 Disable Multicast Flooding . . . . . . . . . . .
PAGE 18
www.dell.com | support.dell.com Create Multiple Spanning Tree Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .661 Influence MSTP Root Selection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .663 Interoperate with Non-FTOS Bridges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .663 Modify Global Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 19
33 Open Shortest Path First (OSPFv2 and OSPFv3) . . . . . . . . . . . . . . . . . . . . . . . 707 Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .708 Autonomous System (AS) Areas . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .708 Area Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 Networks and Neighbors . . . . . . . . . . . . . . . .
PAGE 20
www.dell.com | support.dell.com Configure Passive-Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .745 Redistribute routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .746 Configure a default route . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .746 Enable OSPFv3 graceful restart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 21
36 PIM Source-Specific Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 793 Implementation Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .795 Important Points to Remember . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .795 Configure PIM-SM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .795 Related Configuration Tasks . .
PAGE 22
www.dell.com | support.dell.com Configuring Port Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .835 Flow-based Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .836 Remote Port Mirroring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .837 Remote Port Mirroring Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 23
Configure Port-based Rate Shaping . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .872 Policy-based QoS Configurations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .873 Classify Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .873 Create a QoS Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .877 Create Policy Maps . . . . . . . . . . .
PAGE 24
www.dell.com | support.dell.com SNMP Traps for Root Elections and Topology Changes . . . . . . . . . . . . . . . . . . . . . . .924 Fast Hellos for Link State Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .925 Configure a Root Guard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .926 Configure a Loop Guard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 25
VLAN Stacking Packet Drop Precedence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .978 Enable Drop Eligibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .979 Honor the Incoming DEI Value . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .979 Mark Egress Packets with a DEI Value . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .980 Dynamic Mode CoS for VLAN Stacking . . . . . . . . . . . . .
PAGE 26
www.dell.com | support.dell.com Subscribe to Managed Object Value Updates using SNMP . . . . . . . . . . . . . . . . . . . .1004 Copy Configuration Files Using SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1006 Manage VLANs using SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1013 Create a VLAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1013 Assign a VLAN Alias . . . . . . . .
PAGE 27
Manage Redundancy on an S-Series Stack . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1055 Reset a Unit on an S-Series Stack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1055 Monitor an S-Series Stack with SNMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1056 Troubleshoot an S-Series Stack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1056 Recover from Stack Link Flaps . . . . . . . . . . . . . . . . . . . . .
PAGE 28
www.dell.com | support.dell.com Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1084 Implementation Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1085 Configuring Network Time Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1085 Enable NTP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 29
Enable VLAN Interface Counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1122 58 Virtual Routing and Forwarding (VRF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1123 VRF Configuration Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1124 CAM Profiles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1126 DHCP . . . . . . . . . . . . . . . . . . .
PAGE 30
www.dell.com | support.dell.com Summary of XML Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1176 Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1176 Examples of Error Conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1177 Using display xml as a Pipe Option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 31
System health checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1212 Runtime dataplane loopback check . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1212 Disable RPM-SFM walk . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1214 RPM-SFM bring down . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1215 Manual loopback test . . . . . . . . . . . . . . . . .
PAGE 32
www.dell.com | support.dell.com SFM channel monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1243 Respond to PCDFO events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1244 Inter-CPU timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1245 Software debugging commands . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 33
Application core dumps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1287 Mini core dumps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1287 65 Standards Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1289 IEEE Compliance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
PAGE 34
| www.dell.com | support.dell.
PAGE 35
1 About this Guide Objectives This guide describes the protocols and features supported by the Dell Force10 Operating System (FTOS) and provides configuration instructions and examples for implementing them. It supports the system platforms E-Series, C-Series, and S-Series. The E-Series ExaScale platform is supported with FTOS version 8.1.1.0. and later. Though this guide contains information on protocols, it is not intended to be a complete reference.
PAGE 36
www.dell.com | support.dell.com Conventions This document uses the following conventions to describe command syntax: Convention Description keyword Keywords are in bold and should be entered in the CLI as listed. parameter Parameters are in italics and require a number or word to be entered in the CLI. {X} Keywords and parameters within braces must be entered in the CLI. [X] Keywords and parameters within brackets are optional.
PAGE 37
2 Configuration Fundamentals The FTOS Command Line Interface (CLI) is a text-based interface through which you can configure interfaces and protocols. The CLI is largely the same for the E-Series, C-Series, and S-Series with the exception of some commands and command outputs. The CLI is structured in modes for security and management purposes. Different sets of commands are available in each mode, and you can limit user access to modes using privilege levels.
PAGE 38
www.dell.com | support.dell.com CLI Modes Different sets of commands are available in each mode. A command found in one mode cannot be executed from another mode (with the exception of EXEC mode commands preceded by the command do; see The do Command on page 42). You can set user access rights to commands and command modes using privilege levels; for more information on privilege levels and security options, refer to Chapter 9, Security, on page 627.
PAGE 39
Figure 2-2.
PAGE 40
Prompt Access Command EXEC Force10> Access the router through the console or Telnet. EXEC Privilege Force10# • • CONFIGURATION Force10(conf)# • • From EXEC mode, enter the command enable. From any other mode, use the command end. From EXEC privilege mode, enter the command configure. From every mode except EXEC and EXEC Privilege, enter the command exit. Note: Access all of the following modes from CONFIGURATION mode.
PAGE 41
Table 2-1.
PAGE 42
www.dell.com | support.dell.com The do Command Enter an EXEC mode command from any CONFIGURATION mode (CONFIGURATION, INTERFACE, SPANNING TREE, etc.) without returning to EXEC mode by preceding the EXEC mode command with the command do. Figure 2-4 illustrates the do command. Note: The following commands cannot be modified by the do command: enable, disable, exit, and configure. Figure 2-4.
PAGE 43
Obtaining Help Obtain a list of keywords and a brief functional description of those keywords at any CLI mode using the ? or help command: • Enter ? at the prompt or after a keyword to list the keywords available in the current mode. • ? after a prompt lists all of the available keywords. The output of this command is the same for the help command. Figure 2-6.
PAGE 44
www.dell.com | support.dell.com • • • Table 2-2. The UP and DOWN arrow keys display previously entered commands (see Command History). The BACKSPACE and DELETE keys erase the previous letter. Key combinations are available to move quickly across the command line, as described in Table 2-2. Short-Cut Keys and their Actions Key Combination Action CNTL-A Moves the cursor to the beginning of the command line. CNTL-B Moves the cursor back one character. CNTL-D Deletes character at cursor.
PAGE 45
Filtering show Command Outputs Filter the output of a show command to display specific information by adding | [except | find | grep | no-more | save] specified_text after the command. The variable specified_text is the text for which you are filtering and it IS case sensitive unless the ignore-case sub-option is implemented. Starting with FTOS 7.8.1.0, the grep command accepts an ignore-case sub-option that forces the search to case-insensitive.
PAGE 46
www.dell.com | support.dell.com • find displays the output of the show command beginning from the first occurrence of specified text Figure 2-11 shows this command used in combination with the command show linecard all. Figure 2-11.
PAGE 47
3 Getting Started This chapter contains the following major sections: • • • • • • Default Configuration on page 48 Configure a Host Name on page 49 Access the System Remotely on page 49 Configure the Enable Password on page 52 Configuration File Management on page 52 File System Management on page 57 When you power up the chassis, the system performs a Power-On Self Test (POST) during which Route Processor Module (RPM), Switch Fabric Module (SFM), and line card status LEDs blink green.
PAGE 48
www.dell.com | support.dell.com Figure 3-1. Completed Boot Process ######## ####### ### ### ## ### ### ### ### ### ## ###### ### ## ### ### ## ### ### ### ### ### ### ### ##### ######### ######## ### ### #### ### ### ### ### #### ### ######### ### ### #### ### ### #### #### ### ### ##### ## ### ### ###### ######## ### ### ######## ######## ### ### ######## ######## .*************. .# #### #######. .#. ###### ###########. .##. ## ### #### ###. *#.
PAGE 49
Configure a Host Name The host name appears in the prompt. The default host name is force10. • • Host names must start with a letter and end with a letter or digit. Characters within the string can be letters, digits, and hyphens. To configure a host name: Step 1 Task Command Syntax Command Mode Create a new host name. hostname name CONFIGURATION Figure 3-2 illustrates the hostname command. Figure 3-2.
PAGE 50
www.dell.com | support.dell.com Configure the Management Port IP Address Assign IP addresses to the management ports in order to access the system remotely. Note: Assign different IP addresses to each RPM’s management port. To configure the management port IP address: Step 1 2 Task Command Syntax Command Mode Enter INTERFACE mode for the Management port. interface ManagementEthernet slot/port CONFIGURATION Assign an IPv4 or IPv6 address to the interface.
PAGE 51
To configure a username and password: Step 1 Task Command Syntax Command Mode Configure a username and password to access the system remotely. username username password [encryption-type] password encryption-type specifies how you are inputting the CONFIGURATION password, is 0 by default, and is not required. • • 0 is for inputting the password in clear text. 7 is for inputting a password that is already encrypted using a Type 7 hash.
PAGE 52
www.dell.com | support.dell.com Configure the Enable Password The EXEC Privilege mode is accessed by the enable command. Configure a password as a basic security measure. When using a console connection, EXEC Privilege mode is unrestricted by default; it cannot be reached by a VTY connection if no password is configured. There are two types of enable passwords: • enable password stores the password in the running/startup configuration using a DES encryption method.
PAGE 53
Copy Files to and from the System The command syntax for copying files is similar to UNIX. The copy command uses the format copy source-file-url destination-file-url. Note: See the FTOS Command Reference for a detailed description of the copy command. • • Table 3-1. To copy a local file to a remote system, combine the file-origin syntax for a local file location with the file-destination syntax for a remote file location shown in Table 3-1.
PAGE 54
www.dell.com | support.dell.com The usbflash and rpm0usbflash commands are supported on E-Series ExaScale platform only. Refer to the FTOS Release Notes for a list of approved USB vendors. • Figure 3-4 shows an example of using the copy command to save a file to an FTP server. Figure 3-4. Saving a file to a Remote System Local Location Remote Location Force10#copy flash://FTOS-EF-8.2.1.0.bin ftp://myusername:mypassword@10.10.10.10//FTOS/FTOS-EF-8.2.1.
PAGE 55
Task Command Syntax Command Mode Save the running-configuration to: the startup-configuration on the internal flash of the primary RPM copy running-config startup-config the internal flash on an RPM copy running-config rpm{0|1}flash://filename Note: The internal flash memories on the RPMs are synchronized whenever there is a change, but only if the RPMs are running the same version of FTOS. Note: FTOS supports IPv4 and IPv6 addressing for FTP, TFTP, and SCP (in the hostip field).
PAGE 56
www.dell.com | support.dell.com To view a list of files on the internal or external Flash: Step 1 Task Command Syntax Command Mode the internal flash of an RPM dir flash: EXEC Privilege the external flash of an RPM dir slot: View a list of files on: The output of the command dir also shows the read/write privileges, size (in bytes), and date of modification for each file, as shown in Figure 3-6. Figure 3-6.
PAGE 57
In the running-configuration file, if there is a difference between the timestamp on the “Last configuration change,” and “Startup-config last updated,” then you have made changes that have not been saved and will not be preserved upon a system reboot. Figure 3-7. Tracking Changes with Configuration Comments Force10#show running-config Current Configuration ... ! Version 8.2.1.
PAGE 58
www.dell.com | support.dell.com In Figure 3-9, the default storage location is changed to the external Flash of the primary RPM. File management commands then apply to the external Flash rather than the internal Flash. Figure 3-9.
PAGE 59
4 System Management System Management is supported on platforms: ces This chapter explains the different protocols or services used to manage the Dell Force10 system including: • • • • • • • • Configure Privilege Levels on page 59 Configure Logging on page 63 File Transfer Services on page 70 Terminal Lines on page 71 Lock CONFIGURATION mode on page 74 Recovering from a Forgotten Password on page 76 Recovering from a Forgotten Password on S-Series on page 78 Recovering from a Failed Start on page 79 Con
PAGE 60
www.dell.com | support.dell.com A user can access all commands at his privilege level and below. Removing a command from EXEC mode Remove a command from the list of available commands in EXEC mode for a specific privilege level using the command privilege exec from CONFIGURATION mode. In the command, specify a level greater than the level given to a user or terminal line, followed by the first keyword of each command to be restricted.
PAGE 61
Task Command Syntax Allow access to INTERFACE, LINE, ROUTE-MAP, and/or ROUTER mode. Specify all keywords in the command. privilege configure level level {interface | line | route-map | router} {command-keyword ||...|| command-keyword} Allow access to a CONFIGURATION, INTERFACE, LINE, ROUTE-MAP, and/or ROUTER mode command. privilege {configure |interface | line | route-map | router} level level {command ||...
PAGE 62
www.dell.com | support.dell.com Figure 4-1. 62 Create a Custom Privilege Level Force10(conf)#do show run priv ! privilege exec level 3 capture privilege exec level 3 configure privilege exec level 4 resequence privilege exec level 3 capture bgp-pdu privilege exec level 3 capture bgp-pdu max-buffer-size privilege configure level 3 line privilege configure level 3 interface Force10(conf)#do telnet 10.11.80.201 [telnet output omitted] Force10#show priv Current privilege level is 3.
PAGE 63
Apply a Privilege Level to a Username To set a privilege level for a user: Task Command Syntax Command Mode Configure a privilege level for a user. username username privilege level CONFIGURATION Apply a Privilege Level to a Terminal Line To set a privilege level for a terminal line: Task Command Syntax Command Mode Configure a privilege level for a terminal line.
PAGE 64
www.dell.com | support.dell.com Log Messages in the Logging Buffer All error messages, except those beginning with %BOOTUP (Message 1), are log in the internal buffer.
PAGE 65
Send System Messages to a Syslog Server Send system messages to a syslog server by specifying a server: Task Command Syntax Command Mode Specify the server to which you want to send system messages. You can configure up to eight syslog servers, which may be IPv4 and/or IPv6 addressed. logging {ip-address | ipv6-address | hostname} CONFIGURATION Configure a Unix System as a Syslog Server Configure a UNIX system as a syslog server by adding the following lines to /etc/syslog.
PAGE 66
www.dell.com | support.dell.com Task Command Syntax Command Mode Specify the size of the logging buffer. Note: When you decrease the buffer size, FTOS deletes all messages stored in the buffer. Increasing the buffer size does not affect messages in the buffer. logging buffered size CONFIGURATION Specify the number of messages that FTOS saves to its logging history table.
PAGE 67
Figure 4-2. show logging Command Example Force10#show logging syslog logging: enabled Console logging: level Debugging Monitor logging: level Debugging Buffer logging: level Debugging, 40 Messages Logged, Size (40960 bytes) Trap logging: level Informational %IRC-6-IRC_COMMUP: Link to peer RPM is up %RAM-6-RAM_TASK: RPM1 is transitioning to Primary RPM.
PAGE 68
www.dell.com | support.dell.com Configure a UNIX Logging Facility Level Facility is a message tag used to describe the application or process that submitted the log message. You can save system log messages with a UNIX system logging facility: Command Syntax Command Mode Purpose logging facility [facility-type] CONFIGURATION Specify one of the following parameters.
PAGE 69
Synchronize Log Messages You can configure a terminal line to hold all logs until all command inputs and outputs are complete so that log printing does not interfere when you are performing management tasks. Log synchronization also filters system messages for a specific line based on severity level and limits number of messages that are printed at once. Step 1 2 Task Command Syntax Command Mode Enter the LINE mode.
PAGE 70
www.dell.com | support.dell.com File Transfer Services You can configure the system to transfer files over the network using File Transfer Protocol (FTP).
PAGE 71
Note: You cannot use the change directory (cd) command until ftp-server topdir is configured. Display your FTP configuration using the command show running-config ftp from EXEC Privilege mode, as shown in Figure 4-4. Configure FTP client parameters When the system will be an FTP client, configure FTP client parameters: Task Command Syntax Command Mode Specify a source interface. ip ftp source-interface interface CONFIGURATION Configure a password.
PAGE 72
www.dell.com | support.dell.com Figure 4-5. Applying an Access List to a VTY Line Force10(config-std-nacl)#show config ! ip access-list standard myvtyacl seq 5 permit host 10.11.0.1 Force10(config-std-nacl)#line vty 0 Force10(config-line-vty)#show config line vty 0 access-class myvtyacl FTOS Behavior: Prior to FTOS version 7.4.2.0, in order to deny access on a VTY line, you must apply an ACL and AAA authentication to the line. Then users are denied access only after they enter a username and password.
PAGE 73
Step 3 Task Command Syntax Command Mode If you used the line authentication method in the method list you applied to the terminal line, configure a password for the terminal line. password LINE In Figure 4-6 VTY lines 0-2 use a single authentication method, line. Figure 4-6.
PAGE 74
www.dell.com | support.dell.com Figure 4-7. Configuring EXEC Timeout Force10(conf)#line con 0 Force10(config-line-console)#exec-timeout 0 Force10(config-line-console)#show config line console 0 exec-timeout 0 0 Force10(config-line-console)# Telnet to Another Network Device To telnet to another device: Task Command Syntax Telnet to the peer RPM. You do not need to configure the management port on the peer RPM to be able to telnet to it. telnet-peer-rpm Telnet to a device with an IPv4 or IPv6 address.
PAGE 75
A two types of locks can be set: auto and manual. • • Set an auto-lock using the command configuration mode exclusive auto from CONFIGURATION mode. When you set an auto-lock, every time a user is in CONFIGURATION mode all other users are denied access. This means that you can exit to EXEC Privilege mode, and re-enter CONFIGURATION mode without having to set the lock again. Set a manual lock using the command configure terminal lock from CONFIGURATION mode.
PAGE 76
www.dell.com | support.dell.com You can then send any user a message using the send command from EXEC Privilege mode. Alternatively you can clear any line using the command clear from EXEC Privilege mode. If you clear a console session, the user is returned to EXEC mode. Recovering from a Forgotten Password If you configure authentication for the console and you exit out of EXEC mode or your console session times out, you are prompted for a password to re-enter.
PAGE 77
Step Task Figure 4-12. Command Syntax Command Mode Renaming the startup-config RPM0-CP BOOT_ADMIN # dir flash: Directory of flash: 1 -rwx 11407411 Jun 09 2004 09:38:40 FTOS-EE3-5.3.1.1.bin 2 -rwx 4977 Jun 09 2004 09:38:38 startup-config.bak 7 Reload the system. reload BOOT_ADMIN 8 Copy startup-config.bak to the running config. copy flash://startup-config.bak running-config EXEC Privilege 9 Remove all authentication statements you might have for the console.
PAGE 78
www.dell.com | support.dell.com Step 9 Task Command Syntax Command Mode Save the running-config to the startup-config. The startup-config files on both RPMs will be synchronized. copy running-config startup-config EXEC Privilege Recovering from a Forgotten Password on S-Series If you configure authentication for the console and you exit out of EXEC mode or your console session times out, you are prompted for a password to re-enter.
PAGE 79
Recovering from a Failed Start A system that does not start correctly might be attempting to boot from a corrupted FTOS image or from a incorrect location. To resolve the problem, you can restart the system and interrupt the boot process to point the system to another boot location by using the boot change command, as described below.
PAGE 80
www.dell.com | support.dell.com Very similar to the options of the boot change command, the boot system command is available in CONFIGURATION mode on the C-Series and E-Series to set the boot parameters that, when saved to the startup configuration file, are stored in NVRAM and are then used routinely: Task Command Syntax Command Mode Configure the system to routinely boot from the designated location. After entering rpm0 or rpm1, enter one of the three keywords and then the file-url.
PAGE 81
5 802.1ag 802.1ag is available only on platform: s Ethernet Operations, Administration, and Maintenance (OAM) is a set of tools used to install, monitor, troubleshoot and manage Ethernet infrastructure deployments. Ethernet OAM consists of three main areas: 1. Service Layer OAM: IEEE 802.1ag Connectivity Fault Management (CFM) 2. Link Layer OAM: IEEE 802.3ah OAM 3.
PAGE 82
www.dell.com | support.dell.com There is a need for Layer 2 equivalents to manage and troubleshoot native Layer 2 Ethernet networks. With these tools, you can identify, isolate, and repair faults quickly and easily, which reduces operational cost of running the network. OAM also increases availability and reduces mean time to recovery, which allows for tighter service level agreements, resulting in increased revenue for the service provider.
PAGE 83
These roles define the relationships between all devices so that each device can monitor the layers under its responsibility. Maintenance points drop all lower-level frames and forward all higher-level frames. Figure 5-2.
PAGE 84
www.dell.com | support.dell.com Implementation Information • Since the S-Series has a single MAC address for all physical/LAG interfaces, only one MEP is allowed per MA (per VLAN or per MD level). Configure CFM Configuring CFM is a five-step process: 1. Configure the ecfmacl CAM region using the cam-acl command. See Configure Ingress Layer 2 ACL Sub-partitions. 2. Enable Ethernet CFM. See page 85. 3. Create a Maintenance Domain. See page 85. 4. Create a Maintenance Association. See page 86. 5.
PAGE 85
Enable Ethernet CFM Task Command Syntax Command Mode Spawn the CFM process. No CFM configuration is allowed until the CFM process is spawned. ethernet cfm CONFIGURATION Disable Ethernet CFM without stopping the CFM process. disable ETHERNET CFM Create a Maintenance Domain Connectivity Fault Management (CFM) divides a network into hierarchical maintenance domains, as shown in Figure 5-1. Step 1 Task Command Syntax Command Mode Create maintenance domain.
PAGE 86
www.dell.com | support.dell.com Create a Maintenance Association A Maintenance Association MA is a subdivision of an MD that contains all managed entities corresponding to a single end-to-end service, typically a VLAN. An MA is associated with a VLAN ID. Task Command Syntax Command Mode Create maintenance association. service name vlan vlan-id ECFM DOMAIN Create Maintenance Points Domains are comprised of logical entities called Maintenance Points.
PAGE 87
Task Command Syntax Command Mode Force10#show ethernet cfm maintenance-points local mep ------------------------------------------------------------------------------MPID Domain Name Level Type Port CCM-Status MA Name VLAN Dir MAC ------------------------------------------------------------------------------100 cfm0 test0 7 10 MEP DOWN Gi 4/10 00:01:e8:59:23:45 Enabled 200 cfm1 test1 6 20 MEP DOWN Gi 4/10 00:01:e8:59:23:45 Enabled 300 cfm2 test2 5 30 MEP DOWN Gi 4/10 00:01:e8:59:23:45 En
PAGE 88
www.dell.com | support.dell.com • MIP Database (MIP-DB): Every MIP must maintain a database of all other MEPs in the MA that have announced their presence via CCM Task Display the MEP Database.
PAGE 89
Continuity Check Messages Continuity Check Messages (CCM) are periodic hellos used to: • • • • discover MEPs and MIPs within a maintenance domain detect loss of connectivity between MEPs detect misconfiguration, such as VLAN ID mismatch between MEPs to detect unauthorized MEPs in a maintenance domain Continuity Check Messages (CCM) are multicast Ethernet frames sent at regular intervals from each MEP.
PAGE 90
www.dell.com | support.dell.com Enable CCM Step 1 Task Command Syntax Command Mode Enable CCM. no ccm disable ECFM DOMAIN Default: Disabled 2 Configure the transmit interval (mandatory). The interval specified applies to all MEPs in the domain. ccm transmit-interval seconds ECFM DOMAIN Default: 10 seconds Enable Cross-checking Task Command Syntax Command Mode Enable cross-checking. mep cross-check enable ETHERNET CFM Default: Disabled Start the cross-check operation for an MEP.
PAGE 91
Figure 5-4. Linktrace Message and Response MPLS Core MEP Lin MIP ktra c e m M essa MIP MIP ge L i n k t ra ce R e s p o n s e Link trace messages carry a unicast target address (the MAC address of an MIP or MEP) inside a multicast frame. The destination group address is based on the MD level of the transmitting MEP (01:80:C2:00:00:3[8 to F]).
PAGE 92
www.dell.com | support.dell.
PAGE 93
Three values are given within the trap messages: MD Index, MA Index, and MPID. You can reference these values against the output of show ethernet cfm domain and show ethernet cfm maintenance-points local mep.
PAGE 94
www.dell.com | support.dell.com Task Command Syntax Command Mode Display CFM statistics by port.
PAGE 95
6 802.3ah 802.3ah is available only on platform: s A metropolitan area network (MAN) is a set of LANs, geographically separated but managed by a single entity. If the distance is large—across a city, for example—connectivity between LANs is managed by a service provider. While LANs use Ethernet, service providers networks use an array of protocols (PPP and ATM), and a variety access technologies.
PAGE 96
www.dell.com | support.dell.com • Remote Loopback—directs the remote system to reflects back frames that the local system transmits so that an administrator can isolate a fault. Remote Failure Indication—notifies a peer of a critical link event. • Link Layer OAMPDUs Link Layer OAM is conducted using OAMPDUs, shown in Figure 6-1. OAM is a slow protocol and by requirement may transmit no more than 10 frames per second, transmits to a multicast destination MAC, and uses an Ethernet subtype. Figure 6-1.
PAGE 97
Link Layer OAM Operational Modes When participating in EFM OAM, system may operate in active or passive mode. • • Active mode—Active mode systems initiate discovery. Once the Discovery process completes, they can send any OAMPDU while connected to a peer in Active mode, and a subset of OAMPDUs if the peer is in Passive mode (see Table 6-1). Passive mode—Passive mode systems wait for an active mode system to initiate discovery, and do not send Variable Request or Loopback Control OAMPDUs.
PAGE 98
www.dell.com | support.dell.com Link Layer OAM Events Link Layer OAM defines a set of events that may impact link operation, and monitors the link for those events. If an event occurs, the detecting system notifies its peer. There are two types of events: • • Critical Link Events—There are three critical events; each has an associated flag which can be set in the OAMPDU when the event occurs. Critical link events are communicated to the peer using Remote Failure Indication.
PAGE 99
Configure Link Layer OAM Configuring Link Layer OAM is a two-step process: 1. Enable Link Layer OAM. See page 99. 2.
PAGE 100
www.dell.com | support.dell.com Task Command Syntax Command Mode Force10# show ethernet oam discovery interface Output format: Local client __________ Administrative configurations: Mode:active Unidirection:not supported Link monitor:supported (on) Remote loopback:not supported MIB retrieval:not supported Mtu size:1500 Operational status: Port status:operational Loopback status:no loopback PDU permission:any PDU revision:1 Remote client ___________ MAC address:0030.
PAGE 101
Adjust the OAMPDU Transmission Parameters Task Command Syntax Command Mode Specify a the maximum or minimum number of OAMPDUs to be sent per second. ethernet oam [max-rate value | min-rate value] INTERFACE Set the transmission mode to active or passive. ethernet oam mode {active | passive} Specify the amount of time that the system waits to receive an OAMPDU from a peer before considering it non-operational.
PAGE 102
www.dell.com | support.dell.com Set Threshold Values The available pre-defined errors fall under two categories: • • Symbol Errors—a symbol is an (electrical or optical) pulse on the physical medium that represents one or more bits. A symbol error occurs when a symbol degrades in transit so that the receiver is not able to decode it. Gigabit and 10-Gigabit Ethernet have and expect symbol rate, also called Baud. Frame Errors—frame errors are frames with a bad CRC.
PAGE 103
Frame Errors per Second Task Specify the high threshold value for frame errors, or disable the high threshold. Command Syntax Command Mode ethernet oam link-monitor frame threshold high INTERFACE {frames | none} Range: 1-65535 Default: None Specify the low threshold for frame errors. ethernet oam link-monitor frame threshold low frames Specify the time period for frame errors per second condition.
PAGE 104
www.dell.com | support.dell.com Task Command Syntax Command Mode Specify the time period for error second per time period condition. ethernet oam link-monitor frame-seconds window milliseconds INTERFACE Range: 100-900, in multiples of 100 Default: 1000 milliseconds Execute an Action upon Exceeding the High Threshold When an error exceeds the low threshold, an event notification is sent to the peer.
PAGE 105
Remote Loopback An active-mode device can place a passive peer into loopback mode by sending a Loopback Control OAMPDU. When in loopback mode: • • the remote peer returns unaltered all non-OAMPDU frames sent by the local peer, and all outbound data frames are discarded. Note: Control traffic egresses from loopback initiator and from interface in loopback mode. You must explicitly disable L2/L3 protocols to stop control traffic.
PAGE 106
www.dell.com | support.dell.com Display Link Layer OAM Configuration and Statistics Task Command Syntax Command Mode Display Link Layer OAM status per interface.
PAGE 107
Task Command Syntax Command Mode Force10# show ethernet oam statistics interface Counters: _________ Information OAMPDU Tx: 3439489 Information OAMPDU Rx: 9489 Unique Event Notification OAMPDU Tx: 0 Unique Event Notification OAMPDU x: 0 Duplicate Event Notification OAMPDU Tx: 0 Duplicate Event Notification OAMPDU Rx: 0 Loopback Control OAMPDU Tx: 0 Loopback Control OAMPDU Rx: 2 Variable Request OAMPDU Tx: 0 Variable Request OAMPDU Rx: 0 Variable Response OAMPDU Tx: 0 Var
PAGE 108
www.dell.com | support.dell.com Manage Link Layer OAM Enable MIB Retrieval Support/Function IEEE 802.3ah defines the Link OAM MIB in Sec 30A.20, “OAM entity managed object class”; all of the objects described there are supported. Note that 802.3ah does not include the ability to set/write remote MIB variables. You must enable MIB retrieval support and the MIB retrieval function. Task Command Syntax Command Mode Enable MIB retrieval support and/or the MIB retrieval function.
PAGE 109
7 802.1X 802.1X is supported on platforms: ces This chapter has the following sections: • • • • • • • • • • • • • • Protocol Overview on page 109 Configuring 802.1X on page 113 Important Points to Remember on page 114 Enabling 802.
PAGE 110
www.dell.com | support.dell.com 802.1X employs Extensible Authentication Protocol (EAP)* to transfer a device’s credentials to an authentication server (typically RADIUS) via a mandatory intermediary network access device, in this case, a Dell Force10 switch. The network access device mediates all communication between the end-user device and the authentication server so that the network remains secure.
PAGE 111
• The authentication-server selects the authentication method, verifies the information provided by the supplicant, and grants it network access privileges. Ports can be in one of two states: • • Ports are in an unauthorized state by default. In this state, non-802.1X traffic cannot be forwarded in or out of the port. The authenticator changes the port state to authorized if the server can authenticate the supplicant. In this state, network traffic can be forwarded normally.
PAGE 112
www.dell.com | support.dell.com Figure 7-2. 802.1X Authentication Process Supplicant Authenticator EAP over LAN (EAPOL) Authentication Server EAP over RADIUS Request Identity Response Identity Access Request Access Challenge EAP Request EAP Reponse Access Request Access {Accept | Reject} EAP {Sucess | Failure} EAP over RADIUS 802.1X uses RADIUS to shuttle EAP packets between the authenticator and the authentication server, as defined in RFC 3579.
PAGE 113
RADIUS Attributes for 802.1 Support Dell Force10 systems includes the following RADIUS attributes in all 802.1X-triggered Access-Request messages: Table 7-1. 802.1X Supported RADIUS Attributes Attribute Name Description 1 User-Name the name of the supplicant to be authenticated. 4 NAS-IP-Address 5 NAS-Port 24 State 30 Called-Station-Id 31 Calling-Station-Id relays the supplicant MAC address to the authentication server. 61 NAS-Port-Type NAS-port physical port type. 5 indicates Ethernet.
PAGE 114
www.dell.com | support.dell.com Important Points to Remember • • • • • FTOS supports 802.1X with EAP-MD5, EAP-OTP, EAP-TLS, EAP-TTLS, PEAPv0, PEAPv1, and MS-CHAPv2 with PEAP. All platforms support only RADIUS as the authentication server. On E-Series ExaScale, if the primary RADIUS server becomes unresponsive, the authenticator begins using a secondary RADIUS server, if configured. 802.1X is not supported on port-channels or port-channel members.
PAGE 115
To enable 802.1X: Step Task Command Syntax Command Mode 1 Enable 802.1X globally. dot1x authentication CONFIGURATION 2 Enter INTERFACE mode on an interface or a range of interfaces. interface [range] INTERFACE 3 Enable 802.1X on an interface or a range of interfaces. dot1x authentication INTERFACE Verify that 802.1X is enabled globally and at interface level using the command show running-config | find from EXEC Privilege mode, as shown in Figure 7-5. dot1x Figure 7-5. Verifying 802.
PAGE 116
www.dell.com | support.dell.com Configuring Request Identity Re-transmissions If the authenticator sends a Request Identity frame, but the supplicant does not respond, the authenticator waits 30 seconds and then re-transmits the frame. The amount of time that the authenticator waits before re-transmitting and the maximum number of times that the authenticator re-transmits are configurable.
PAGE 117
Figure 7-7 shows configuration information for a port for which the authenticator re-transmits an EAP Request Identity frame: • • After 90 seconds and a maximum of 10 times for an unresponsive supplicant Re-transmits an EAP Request Identity frame Figure 7-7.
PAGE 118
www.dell.com | support.dell.com To place a port in one of these three states: Step 1 Task Command Syntax Command Mode Place a port in the ForceAuthorized, ForceUnauthorized, or Auto state. dot1x port-control {force-authorized | force-unauthorized | auto} INTERFACE Default: auto Figure 7-8 shows configuration information for a port that has been force-authorized. Figure 7-8.
PAGE 119
To configure a maximum number of re-authentications: Step 1 Task Command Syntax Command Mode Configure the maximum number of times that the supplicant can be reauthenticated. dot1x reauth-max number INTERFACE Figure 7-9. Range: 1-10 Default: 2 Configuring a Reauthentiction Period Force10(conf-if-gi-2/1)#dot1x reauthentication interval 7200 Force10(conf-if-gi-2/1)#dot1x reauth-max 10 Force10(conf-if-gi-2/1)#do show dot1x interface gigabitethernet 2/1 802.
PAGE 120
www.dell.com | support.dell.com To terminate the authentication process due to an unresponsive authentication server: Step 1 Task Command Syntax Command Mode Terminate the authentication process due to an unresponsive authentication server. dot1x server-timeout seconds INTERFACE Range: 1-300.
PAGE 121
Dynamic VLAN Assignment with Port Authentication Dynamic VLAN Assignment with Port Authentication is supported on platforms: c s et FTOS supports dynamic VLAN assignment when using 802.1X. During 802.1x authentication, the existing VLAN configuration of a port assigned to a non-default VLAN is overwritten and the port is assigned to a specified VLAN. • • If 802.1x authentication is disabled on the port, the port is re-assigned to the previously-configured VLAN. If 802.
PAGE 122
www.dell.com | support.dell.com Figure 7-11 shows the configuration on a Dell Force10 switch that uses dynamic VLAN assignment with 802.1X before you connect the end-user device (black and blue text), and after you connect the device (red text). The blue text corresponds to the numbered steps on page 121. Note that the GigabitEthernet 1/11 port, on which dynamic VLAN assignment with 802.1X is configured, is initially an untagged member of VLAN 300. After a successful 802.
PAGE 123
Guest and Authentication-Fail VLANs Typically, the authenticator (Dell Force10 system) denies the supplicant access to the network until the supplicant is authenticated. If the supplicant is authenticated, the authenticator enables the port and places it in either the VLAN for which the port is configured, or the VLAN that the authentication server indicates in the authentication data. Note: Ports cannot be dynamically assigned to the default VLAN.
PAGE 124
www.dell.com | support.dell.com Configuring an Authentication-Fail VLAN If the supplicant fails authentication, the authenticator re-attempts to authenticate after a specified amount of time (30 seconds by default, see Configuring a Quiet Period after a Failed Authentication on page 116). You can configure the maximum number of times the authenticator re-attempts authentication after a failure (3 by default), after which the port is placed in the Authentication-fail VLAN.
PAGE 125
Multi-Host Authentication Multi-Host Authentication is available on platforms: c et s 802.1x assumes that a single end-user is connected to a single authenticator port, as shown in Figure 7-15; this one-to-one mode of authentication is called Single-host mode. If multiple end-users are connected to the same port, a many-to-one configuration, only the first end-user to respond to the identity request is authenticated.
PAGE 126
www.dell.com | support.dell.com When the host mode is changed on a port that is already authenticated: • • Single-host to Multi-host: all devices attached to the port that were previously blocked may access the network; the supplicant does not re-authenticate. Multi-host to Single-host: the port restarts the authentication process, and the first end-user to respond is authenticated and allowed access. Task Command Syntax Command Mode Configure Multi-host Authentication mode on a port.
PAGE 127
Task Command Syntax Command Mode Configure Single-host Authentication mode on a port. dot1x host-mode single-host INTERFACE Force10(conf-if-gi-2/1)#dot1x port-control force-authorized Force10(conf-if-gi-2/1)#do show dot1x interface gigabitethernet 2/1 802.
PAGE 128
www.dell.com | support.dell.com During the authentication process, the Dell Force10 system is able to learn the MAC address of the device though the EAPoL frames, and the VLAN assignment from the RADIUS server. With this information it creates an authorized-MAC to VLAN mapping table per port. Then, the system can tag all incoming untagged frames with the appropriate VLAN-ID based on the table entries. Task Command Syntax Command Mode Enable Multi-Supplicant Authentication mode on a port.
PAGE 129
MAC Authentication Bypass MAC Authentication Bypass is supported on platforms: cs MAC Authentication Bypass (MAB) enables you to provide MAC-based security by allowing only known MAC addresses within the network using a RADIUS server. 802.1X-enabled clients can authenticate themselves using the 802.1X protocol. Other devices that do not use 802.1X—like IP phones, printers, and IP fax machines—still need connectivity to the network. The guest VLAN provides one way to access the network.
PAGE 130
www.dell.com | support.dell.com MAB in Single-host and Multi-Host Mode In single-host and multi-host mode, the switch attempts to authenticate a supplicant using 802.1X. If 802.1X times out because the supplicant does not respond to the Request Identity frame and MAB is enabled, the switch attempts to authenticate the first MAC it learns on the port. Subsequently, for single-host mode, traffic from all other MACs is dropped; for multi-host mode, all traffic from all other MACs is accepted.
PAGE 131
Step Task Command Syntax Command Mode 3 (Optional) Use MAB authentication only— do not use 802.1X authentication first. If MAB fails the port or the MAC address is blocked, the port is placed in the guest VLAN (if configured). 802.1x authentication is not even attempted. Re-authentication is performed using 802.1X timers. dot1x auth-type mab-only INTERFACE 4 Display the 802.1X and MAB configuration. show dot1x interface EXEC Privilege Force10#show dot1x int Gi 2/32 802.
PAGE 132
www.dell.com | support.dell.com Dynamic CoS with 802.1X Dynamic CoS with 802.1X is supported on platforms: cs Class of Service (CoS) is a method of traffic management that groups similar types of traffic so that they are serviced differently. One way of classifying traffic is 802.1p, which uses the 3-bit Priority field in the VLAN tag to mark frames (other classification methods include ToS, ACL, and DSCP).
PAGE 133
FTOS Behavior: The following conditions are applied to the use of dynamic CoS with 802.1X authentication on C-Series and S-Series platforms: • In accordance with port-based QoS, incoming dot1p values can be mapped to only four priority values: 0, 2, 4, and 6. If the RADIUS server returns any other dot1p value (1, 3, 5, or 7), the value is not used and frames are forwarded on egress queue 0 without changing the incoming dot1p value.
PAGE 134
| 802.1X www.dell.com | support.dell.
PAGE 135
8 IP Access Control Lists (ACL), Prefix Lists, and Route-maps IP Access Control Lists, Prefix Lists, and Route-maps are supported on platforms: ces ces Egress IP ACLs are supported on platform: e Ingress IP ACLs are supported on platforms: Overview At their simplest, Access Control Lists (ACLs), Prefix lists, and Route-maps permit or deny traffic based on MAC and/or IP addresses. This chapter discusses implementing IP ACLs, IP Prefix lists and Route-maps.
PAGE 136
www.dell.com | support.dell.com • • • • • • • Assign an IP ACL to an Interface on page 149 Configuring Ingress ACLs on page 151 Configuring Egress ACLs on page 151 Configuring ACLs to Loopback on page 153 • Applying an ACL on Loopback Interfaces on page 153 IP Prefix Lists on page 155 ACL Resequencing on page 159 Route Maps on page 162 IP Access Control Lists (ACLs) In the Dell Force10 switch/routers, you can create two different types of IP ACLs: standard or extended.
PAGE 137
CAM optimization is supported on platforms cs CAM Profiling CAM optimization is supported on platforms et CAM profiling for ACLs is supported on E-Series TeraScale only. For complete information regarding E-Series TeraScale CAM profiles and configuration, refer to Chapter 11, Content Addressable Memory. For information regarding E-Series ExaScale CAM-profile templates and their support of ACLs, refer to Chapter 12, Content Addressable Memory for ExaScale.
PAGE 138
www.dell.com | support.dell.com User Configurable CAM Allocation User Configurable CAM Allocations are supported on platform c Allocate space for IPV6 ACLs on the C-Series by using the cam-acl command in CONFIGURATION mode. The CAM space is allotted in FP blocks. The total space allocated must equal 13 FP blocks. Note that there are 16 FP blocks, but the System Flow requires 3 blocks that cannot be reallocated.
PAGE 139
Figure 8-1.
PAGE 140
www.dell.com | support.dell.com Standard and Extended ACLs take up the same amount of CAM space. A single ACL rule uses 2 CAM entries whether it is identified as a Standard or Extended ACL. Determine the order in which ACLs are used to classify traffic When you link class-maps to queues using the command service-queue, FTOS matches the class-maps according to queue priority (queue numbers closer to 0 have lower priorities).
PAGE 141
• • • • • • Second and subsequent fragments are allowed because a Layer 4 rule cannot be applied to these fragments. If the packet is to be denied eventually, the first fragment would be denied and hence the packet as a whole cannot be reassembled. Implementing the required rules will use a significant number of CAM entries per TCP/UDP entry. For IP ACL, FTOS always applies implicit deny. You do not have to configure it.
PAGE 142
www.dell.com | support.dell.com In the following, TCP packets that are first fragments or non-fragmented from host 10.1.1.1 with TCP destination port equal to 24 are permitted. Additionally, all TCP non-first fragments from host 10.1.1.1 are permitted. All other IP packets that are non-first fragments are denied. Force10(conf)#ip access-list extended ABC Force10(conf-ext-nacl)#permit tcp host 10.1.1.1 any eq 24 Force10(conf-ext-nacl)#permit tcp host 10.1.1.
PAGE 143
A standard IP ACL uses the source IP address as its match criterion. Note: On E-Series ExaScale systems, TCP ACL flags are not supported in standard or extended ACLs with IPv6 microcode. An error message is shown if IPv6 microcode is configured and an ACL is entered with a TCP filter included.
PAGE 144
www.dell.com | support.dell.com Figure 8-4. Command example: seq Force10(config-std-nacl)#seq 25 deny ip host 10.5.0.0 any log Force10(config-std-nacl)#seq 15 permit tcp 10.3.0.0 /16 any Force10(config-std-nacl)#show config ! ip access-list standard dilling seq 15 permit tcp 10.3.0.0/16 any seq 25 deny ip host 10.5.0.0 any log Force10(config-std-nacl)# To delete a filter, use the no seq sequence-number command in the IP ACCESS LIST mode.
PAGE 145
Figure 8-6. Command Example: show ip accounting access-list Force10#show ip accounting access example interface gig 4/12 Extended IP access list example seq 10 deny tcp any any eq 111 seq 15 deny udp any any eq 111 seq 20 deny udp any any eq 2049 seq 25 deny udp any any eq 31337 seq 30 deny tcp any any range 12345 12346 seq 35 permit udp host 10.21.126.225 10.4.5.0 /28 seq 40 permit udp host 10.21.126.226 10.4.5.0 /28 seq 45 permit udp 10.8.0.0 /16 10.50.188.118 /31 range 1812 1813 seq 50 permit tcp 10.8.
PAGE 146
www.dell.com | support.dell.com Step Command Syntax Command Mode Purpose 2 seq sequence-number {deny | permit} {ip-protocol-number | icmp | ip | tcp | udp} {source mask | any | host ip-address} {destination mask | any | host ip-address} [operator port [port]] [count [byte] | log] [order] [monitor] [fragments] CONFIG-EXT-NACL Configure a drop or forward filter. • log and monitor options are supported on E-Series only.
PAGE 147
When you create the filters with a specific sequence number, you can create the filters in any order and the filters are placed in the correct order. Note: When assigning sequence numbers to filters, keep in mind that you might need to insert a new filter. To prevent reconfiguring multiple filters, assign sequence numbers in multiples of five or another number. Figure 8-7 illustrates how the seq command orders the filters according to the sequence number assigned.
PAGE 148
www.dell.com | support.dell.com Figure 8-8 illustrates an extended IP ACL in which the sequence numbers were assigned by the software. The filters were assigned sequence numbers based on the order in which they were configured (for example, the first filter was given the lowest sequence number). The show config command in the IP ACCESS LIST mode displays the two filters with the sequence numbers 5 and 10. Figure 8-8. Extended IP ACL Force10(config-ext-nacl)#deny tcp host 123.55.34.
PAGE 149
If a rule is simply appended, existing counters are not affected. Table 8-2. L2 and L3 ACL Filtering on Switched Packets L2 ACL Behavior L3 ACL Behavior Decision on Targeted Traffic Deny Deny Denied by L3 ACL Deny Permit Permitted by L3 ACL Permit Deny Denied by L2 ACL Permit Permit Permitted by L2 ACL Note: If an interface is configured as a “vlan-stack access” port, the packets are filtered by an L2 ACL only. The L3 ACL applied to such a port does not affect traffic.
PAGE 150
www.dell.com | support.dell.com To apply an IP ACL (standard or extended) to a physical or port channel interface, use these commands in the following sequence in the INTERFACE mode: Step Command Syntax Command Mode Purpose 1 interface interface slot/port CONFIGURATION Enter the interface number. 2 ip address ip-address INTERFACE Configure an IP address for the interface, placing it in Layer-3 mode.
PAGE 151
Step 3 Task View the number of packets matching the ACL using the show ip accounting access-list from EXEC Privilege mode. Configuring Ingress ACLs Ingress ACLs are applied to interfaces and to traffic entering the system.These system-wide ACLs eliminate the need to apply ACLs onto each interface and achieves the same results. By localizing target traffic, it is a simpler implementation. To create an ingress ACLs, use the ip access-group command (Figure 233) in the EXEC Privilege mode.
PAGE 152
www.dell.com | support.dell.com An egress ACL is used when users would like to restrict egress traffic. For example, when a DOS attack traffic is isolated to one particular interface, you can apply an egress ACL to block that particular flow from exiting the box, thereby protecting downstream devices. To create an egress ACLs, use the ip access-group command (Figure 234) in the EXEC Privilege mode.
PAGE 153
FTOS Behavior: VRRP hellos and IGMP packets are not affected when egress ACL filtering for CPU traffic is enabled. Packets sent by the CPU with the source address as the VRRP virtual IP address have the interface MAC address instead of VRRP virtual MAC address.
PAGE 154
www.dell.com | support.dell.com Step Command Syntax Command Mode Purpose [seq number] permit loopback-logging any any CONFIGURATION If you are applying an extended ACL, and it has a deny ip any any entry, this entry denies internally generated packets as well as packets received from external devices. To prevent internally generated packets from being dropped, make sure that the ACL you intend to apply has the following entry: [seq number] permit loopback-logging any any.
PAGE 155
IP Prefix Lists Prefix Lists are supported on platforms: ces IP prefix lists control routing policy. An IP prefix list is a series of sequential filters that contain a matching criterion (examine IP route prefix) and an action (permit or deny) to process routes. The filters are processed in sequence so that if a route prefix does not match the criterion in the first filter, the second filter (if configured) is applied.
PAGE 156
www.dell.com | support.dell.com The following list includes the configuration tasks for prefix lists: • • Configure a prefix list on page 156 Use a prefix list for route redistribution on page 158 For a complete listing of all commands related to prefix lists, refer to the FTOS Command Line Interface Reference document.
PAGE 157
If you are creating a standard prefix list with only one or two filters, you can let FTOS assign a sequence number based on the order in which the filters are configured. The FTOS assigns filters in multiples of five. To configure a filter without a specified sequence number, use these commands in the following sequence starting in the CONFIGURATION mode: Step 1 2 Command Syntax Command Mode Purpose ip prefix-list prefix-name CONFIGURATION Create a prefix list and assign it a unique name.
PAGE 158
www.dell.com | support.dell.com Figure 8-15. Command example: show ip prefix-list detail Force10>show ip prefix detail Prefix-list with the last deletion/insertion: filter_ospf ip prefix-list filter_in: count: 3, range entries: 3, sequences: 5 - 10 seq 5 deny 1.102.0.0/16 le 32 (hit count: 0) seq 6 deny 2.1.0.0/16 ge 23 (hit count: 0) seq 10 permit 0.0.0.0/0 le 32 (hit count: 0) ip prefix-list filter_ospf: count: 4, range entries: 1, sequences: 5 - 10 seq 5 deny 100.100.1.
PAGE 159
Figure 8-17. Command Example: show config in the ROUTER RIP Mode Force10(conf-router_rip)#show config ! router rip distribute-list prefix juba out network 10.0.0.0 Force10(conf-router_rip)#router ospf 34 To apply a filter to routes in OSPF, use either of the following commands in the ROUTER OSPF mode: Command Syntax Command Mode Purpose router ospf CONFIGURATION Enter OSPF mode distribute-list prefix-list-name in [interface] CONFIG-ROUTER-OSPF Apply a configured prefix list to incoming routes.
PAGE 160
www.dell.com | support.dell.com IPv4 and IPv6 ACLs and prefixes and MAC ACLs can be resequenced. No CAM writes happen as a result of resequencing, so there is no packet loss; the behavior is like Hot-lock ACLs. Note: ACL Resequencing does not affect the rules or remarks or the order in which they are applied. It merely renumbers them so that new rules can be placed within the list as desired. Table 8-3. ACL Resequencing Example (Insert New Rules) seq 5 permit any host 1.1.1.1 seq 6 permit any host 1.1.
PAGE 161
Figure 8-19. Resequencing ACLs Force10(config-ext-nacl)# show config ! ip access-list extended test remark 4 XYZ remark 5 this remark corresponds to permit any host 1.1.1.1 seq 5 permit ip any host 1.1.1.1 remark 9 ABC remark 10 this remark corresponds to permit ip any host 1.1.1.2 seq 10 permit ip any host 1.1.1.2 seq 15 permit ip any host 1.1.1.3 seq 20 permit ip any host 1.1.1.
PAGE 162
www.dell.com | support.dell.com Figure 8-20. Resequencing Remarks Force10(config-ext-nacl)# show config ! ip access-list extended test remark 4 XYZ remark 5 this remark corresponds to permit any host 1.1.1.1 seq 5 permit ip any host 1.1.1.1 remark 9 ABC remark 10 this remark corresponds to permit ip any host 1.1.1.2 seq 10 permit ip any host 1.1.1.2 seq 15 permit ip any host 1.1.1.3 seq 20 permit ip any host 1.1.1.
PAGE 163
Important Points to Remember • • • For route-maps with more than one match clause: • Two or more match clauses within the same route-map sequence have the same match commands (though the values are different), matching a packet against these clauses is a logical OR operation. • Two or more match clauses within the same route-map sequence have different match commands, matching a packet against these clauses is a logical AND operation.
PAGE 164
www.dell.com | support.dell.com To view the configuration, use the show config command in the ROUTE-MAP mode (Figure 8-21). Figure 8-21. Command Example: show config in the ROUTE-MAP Mode Force10(config-route-map)#show config ! route-map dilling permit 10 Force10(config-route-map)# You can create multiple instances of this route map by using the sequence number option to place the route maps in the correct order. FTOS processes the route maps with the lowest sequence number first.
PAGE 165
Figure 8-24. Command Example: show route-map Force10#show route-map dilling route-map dilling, permit, sequence 10 Match clauses: Set clauses: route-map dilling, permit, sequence 15 Match clauses: interface Loopback 23 Set clauses: tag 3444 Force10# To delete a route map, use the no route-map map-name command in the CONFIGURATION mode. Configure route map filters Within the ROUTE-MAP mode, there are match and set commands.
PAGE 166
www.dell.com | support.dell.com Also, if there are different instances of the same route-map, then it’s sufficient if a permit match happens in any instance of that route-map.
PAGE 167
Command Syntax Command Mode Purpose match ip address prefix-list-name CONFIG-ROUTE-MAP Match destination routes specified in a prefix list (IPv4). match ipv6 address prefix-list-name CONFIG-ROUTE-MAP Match destination routes specified in a prefix list (IPv6). match ip next-hop {access-list-name | prefix-list prefix-list-name} CONFIG-ROUTE-MAP Match next-hop routes specified in a prefix list (IPv4).
PAGE 168
www.dell.com | support.dell.com Command Syntax Command Mode Purpose set ipv6 next-hop ip-address CONFIG-ROUTE-MAP Assign an IPv6 address as the route’s next hop. set origin {egp | igp | incomplete} CONFIG-ROUTE-MAP Assign an ORIGIN attribute. set tag tag-value CONFIG-ROUTE-MAP Specify a tag for the redistributed routes. set weight value CONFIG-ROUTE-MAP Specify a value as the route’s weight. Use these commands to create route map instances.
PAGE 169
router ospf 34 default-information originate metric-type 1 redistribute static metric 20 metric-type 2 tag 0 route-map staticospf ! route-map staticospf permit 10 match interface GigabitEthernet 0/0 match metric 255 set level backbone Configure a route map for route tagging One method for identifying routes from different routing protocols is to assign a tag to routes from that protocol.
PAGE 170
www.dell.com | support.dell.com Figure 8-27.
PAGE 171
9 Bidirectional Forwarding Detection Bidirectional Forwarding Detection is supported only on platforms: BFD is supported on E-Series ExaScale ce ex with FTOS 8.2.1.0 and later. Protocol Overview Bidirectional Forwarding Detection (BFD) is a protocol that is used to rapidly detect communication failures between two adjacent systems. It is a simple and lightweight replacement for existing routing protocol link state detection mechanisms.
PAGE 172
www.dell.com | support.dell.com How BFD Works Two neighboring systems running BFD establish a session using a three-way handshake. After the session has been established, the systems exchange control packets at agreed upon intervals. In addition, systems send a control packet anytime there is a state change or change in a session parameter; these control packets are sent without regard to transmit and receive intervals. Note: FTOS does not support multi-hop BFD sessions.
PAGE 173
Version (4) IHL TOS Total Length Preamble Flags Start Frame Delimiter Frag Offset Destination MAC TTL (255) Source MAC Protocol Ethernet Type (0x8800) Header Checksum Version (1) State Range: 3784 Source Port Options Diag Code Dest IP Addr Padding Checksum UDP Packet Detect Mult My Discriminator Your Discriminator Random number generated by remote system to identify a session Required Min RX Interval Required Min Echo RX Interval Auth Type The minimum interval between Echo pac
PAGE 174
www.dell.com | support.dell.com Table 9-1. BFD Packet Fields Field Description Diagnostic Code The reason that the last session failed. State The current local session state. See BFD sessions. Flag A bit that indicates packet function. If the poll bit is set, the receiving system must respond as soon as possible, without regard to its transmit interval. The responding system clears the poll bit and sets the final bit in its response.
PAGE 175
BFD sessions BFD must be enabled on both sides of a link in order to establish a session. The two participating systems can assume either of two roles: • • Active—The active system initiates the BFD session. Both systems can be active for the same session. Passive—The passive system does not initiate a session. It only responds to a request for session initialization from the active system.
PAGE 176
www.dell.com | support.dell.com handshake. At this point, the discriminator values have been exchanged, and the transmit intervals have been negotiated. 4. The passive system receives the control packet, changes its state to Up. Both systems agree that a session has been established. However, since both members must send a control packet—that requires a response—anytime there is a state change or change in a session parameter, the passive system sends a final response indicating the state change.
PAGE 177
Figure 9-3. BFD State Machine current session state Up, Admin Down, Timer the packet received Down Init Down Admin Down, Timer Down Init Admin Down, Down, Timer Init, Up Up Up, Init Important Points to Remember • • • • • • • • BFD for line card ports is hitless, but is not hitless for VLANs since they are instantiated on the RPM. BFD is supported on C-Series and E-Series only. FTOS supports a maximum of 100 sessions per BFD agent.
PAGE 178
www.dell.com | support.dell.com Configuring BFD for Physical Ports BFD on physical ports is useful when no routing protocol is enabled. Without BFD, if the remote system fails, the local system does not remove the connected route until the first failed attempt to send a packet. When BFD is enabled, the local system removes the route as soon as it stops receiving periodic control packets from the remote system. Configuring BFD for a physical port is a two-step process: 1. Enable BFD globally. See page 178.
PAGE 179
Figure 9-5. Establishing a BFD Session for Physical Ports R2: ACTIVE Role R1: ACTIVE Role 4/24 2/1 Force10(config)# bfd enable Force10(config)# interface gigabitethernet 2/1 Force10(conf-if-gi-2/1)# ip address 2.2.2.2/24 Force10(conf-if-gi-2/1)# bfd neighbor 2.2.2.1 Force10(config)# bfd enable Force10(config)# interface gigabitethernet 4/24 Force10(conf-if-gi-2/1)# ip address 2.2.2.1/24 Force10(conf-if-gi-2/1)# bfd neighbor 2.2.2.
PAGE 180
www.dell.com | support.dell.com Figure 9-7. Viewing Session Details R1(conf-if-gi-4/24)#do show bfd neighbors detail Session Discriminator: 1 Neighbor Discriminator: 1 Local Addr: 2.2.2.1 Local MAC Addr: 00:01:e8:09:c3:e5 Remote Addr: 2.2.2.
PAGE 181
Figure 9-8. Changing Session Parameters for Physical Ports R1(conf-if-gi-4/24)#bfd interval 100 min_rx 100 multiplier 4 role passive R1(conf-if-gi-4/24)#do show bfd neighbors detail Session Discriminator: 1 Neighbor Discriminator: 1 Local Addr: 2.2.2.1 Local MAC Addr: 00:01:e8:09:c3:e5 Remote Addr: 2.2.2.
PAGE 182
www.dell.com | support.dell.com To re-enable BFD on an interface: Step 1 Task Command Syntax Command Mode Enable BFD on an interface. bfd enable INTERFACE Configuring BFD for Static Routes BFD gives systems a link state detection mechanism for static routes. With BFD, systems are notified to remove static routes from the routing table as soon as the link state change occurs, rather than having to wait until packets fail to reach their next hop.
PAGE 183
To establish a BFD session: Step 1 Task Command Syntax Command Mode Establish BFD sessions for all neighbors that are the next hop of a static route. ip route bfd CONFIGURATION Verify that sessions have been created for static routes using the command show bfd neighbors, as shown in Figure 9-10. View detailed session information using the command show bfd neighbors detail, as shown in Figure 9-8. Figure 9-10. Viewing Established Sessions for Static Routes R1(conf)#ip route 2.2.3.0/24 2.2.2.
PAGE 184
www.dell.com | support.dell.com To disable BFD for static routes: Step 1 Task Command Syntax Command Mode Disable BFD for static routes. no ip route bfd CONFIGURATION Configuring BFD for OSPF When using BFD with OSPF, the OSPF protocol registers with the BFD manager on the RPM. BFD sessions are established with all neighboring interfaces participating in OSPF.
PAGE 185
Figure 9-11. Establishing Sessions with OSPF Neighbors Force10(conf-if-gi-2/1)# ip address 2.2.2.2/24 Force10(conf-if-gi-2/1)# no shutdown Force10(conf-if-gi-2/1)# exit Force10(config)# router ospf 1 Force10(config-router_ospf )# network 2.2.2.0/24 area 0 Force10(config-router_ospf )# bfd all-neighbors Force10(conf-if-gi-2/2)# ip address 2.2.3.1/24 Force10(conf-if-gi-2/2)# no shutdown Force10(conf-if-gi-2/2)# exit Force10(config)# router ospf 1 Force10(config-router_ospf )# network 2.2.3.
PAGE 186
www.dell.com | support.dell.com Changing OSPF session parameters BFD sessions are configured with default intervals and a default role. The parameters that can be configured are: Desired TX Interval, Required Min RX Interval, Detection Multiplier, and system role. These parameters are configured for all OSPF sessions or all OSPF sessions on a particular interface; if you change a parameter globally, the change affects all OSPF neighbors sessions.
PAGE 187
Configuring BFD for BGP BFD for BGP is only supported on platforms: ec In a BGP core network, BFD provides rapid detection of communication failures in BGP fast-forwarding paths between internal BGP (iBGP) and external BGP (eBGP) peers for faster network reconvergence. BFD for BGP is supported on 1GE, 10GE, 40GE, port-channel, and VLAN interfaces. BFD for BGP does not support IPv6 and the BGP multihop feature. Prerequisites Before configuring BFD for BGP, you must first perform the following tasks: 1.
PAGE 188
www.dell.com | support.dell.com Note that the sample configuration shows alternative ways to establish a BFD session with a BGP neighbor: • • By establishing BFD sessions with all neighbors discovered by BGP (bfd all-neighbors command) By establishing a BFD session with a specified BGP neighbor (neighbor {ip-address | peer-group-name} bfd command) BFD packets originating from a router are assigned to the highest priority egress queue to minimize transmission delays.
PAGE 189
Step 5 Task Command Syntax Command Mode Configure parameters for a BFD session established with all neighbors discovered by BGP. bfd all-neighbors [interval millisecs min_rx millisecs multiplier value role {active | passive}] CONFIG-ROUTERBGP OR OR Establish a BFD session with a specified BGP neighbor or peer group using the default BFD session parameters.
PAGE 190
www.dell.com | support.dell.com • The neighbor inherits only the global timer values that are configured with the bfd all-neighbors command (interval, min_rx, and multiplier). If you explicitly enable (or disable) a peer group for BFD that has no BFD parameters configured (e.g. advertisement interval) using the neighbor peer-group-name bfd command, the peer group inherits any BFD settings configured with the bfd all-neighbors command.
PAGE 191
The following examples show the BFD for BGP output displayed for these show commands. Figure 9-14. Verifying a BFD for BGP Configuration: show running-config bgp Command R2# show running-config bgp ! router bgp 2 neighbor 1.1.1.2 remote-as 1 neighbor 1.1.1.2 no shutdown neighbor 2.2.2.2 remote-as 1 neighbor 2.2.2.2 no shutdown neighbor 3.3.3.2 remote-as 1 neighbor 3.3.3.2 no shutdown bfd all-neighbors Figure 9-15.
PAGE 192
www.dell.com | support.dell.com Figure 9-16. Verifying BFD Sessions with BGP Neighbors: show bfd neighbors detail Command R2# show bfd neighbors detail Session Discriminator: 9 Neighbor Discriminator: 10 Local Addr: 1.1.1.3 Local MAC Addr: 00:01:e8:66:da:33 Remote Addr: 1.1.1.
PAGE 193
Figure 9-17.
PAGE 194
www.dell.com | support.dell.com Figure 9-19. Displaying Routing Sessions with BGP Neighbors: show ip bgp neighbors Command R2# show ip bgp neighbors 2.2.2.2 BGP neighbor is 2.2.2.2, remote AS 1, external link BGP version 4, remote router ID 12.0.0.
PAGE 195
Configuring BFD for IS-IS BFD for IS-IS is supported on platform: e When using BFD with IS-IS, the IS-IS protocol registers with the BFD manager on the RPM. BFD sessions are then established with all neighboring interfaces participating in IS-IS. If a neighboring interface fails, the BFD agent on the line card notifies the BFD manager, which in turn notifies the IS-IS protocol that a link state change occurred. Configuring BFD for IS-IS is a two-step process: 1. Enable BFD globally.
PAGE 196
www.dell.com | support.dell.com To establish BFD with all IS-IS neighbors out of a single interface: Step 1 Task Command Syntax Command Mode Establish sessions with all IS-IS neighbors out of an interface. isis bfd all-neighbors INTERFACE View the established sessions using the command show bfd neighbors, as shown in Figure 9-21. Figure 9-21.
PAGE 197
Disabling BFD for IS-IS If BFD is disabled globally, all sessions are torn down, and sessions on the remote system are placed in a Down state. If BFD is disabled on an interface, sessions on the interface are torn down, and sessions on the remote system are placed in a Down state (Message 3 on page 181). Disabling BFD does not trigger a change in BFD clients; a final Admin Down packet is sent before the session is terminated.
PAGE 198
www.dell.com | support.dell.com Figure 9-22. Establishing Sessions with VRRP Neighbors VIRTUAL IP Address: 2.2.5.4 R1: BACKUP R2: MASTER 2/3 4/25 Force10(config-if-range-gi-4/25)# ip address 2.2.5.1/24 Force10(config-if-range-gi-4/25)# no shutdown Force10(config-if-range-gi-4/25)# vrrp-group 1 Force10(config-if-range-gi-4/25)# virtual-address 2.2.5.4 Force10(config-if-range-gi-4/25)# vrrp bfd all-neighbors Force10(config-if-range-gi-4/25)# vrrp bfd neighbor 2.2.5.
PAGE 199
Figure 9-23. Viewing Established Sessions for VRRP Neighbors R1(conf-if-gi-4/25)#vrrp bfd all-neighbors R1(conf-if-gi-4/25)#do show bfd neighbor * Ad Dn C I O R V - Active session role Admin Down CLI ISIS OSPF Static Route (RTM) VRRP LocalAddr * 2.2.5.1 RemoteAddr 2.2.5.2 VRRP BFD Sessions Enabled Interface State Rx-int Tx-int Mult Clients Gi 4/25 Down 1000 1000 3 V Session state information is also shown in the show vrrp command output, as shown in Figure 9-24. Figure 9-24.
PAGE 200
www.dell.com | support.dell.com To change parameters for a particular VRRP session: Step 1 Task Command Syntax Command Mode Change parameters for a particular VRRP session. vrrp bfd neighbor ip-address interval milliseconds min_rx milliseconds multiplier value role [active | passive] INTERFACE View session parameters using the command show bfd neighbors detail, as shown in Figure 9-8 on page 181. Disabling BFD for VRRP If any or all VRRP sessions are disabled, the sessions are torn down.
PAGE 201
There is one BFD Agent for VLANs and port-channels, which resides on RP2 as opposed to the other agents which are on the line card. Therefore, the 100 total possible sessions that this agent can maintain is shared for VLANs and port-channels. Configuring BFD for VLANs is a two-step process: 1. Enable BFD globally on all participating routers. See Enabling BFD globally on page 178. 2. Establish sessions with VLAN neighbors. See page 201. Related configuration tasks • • Change session parameters.
PAGE 202
www.dell.com | support.dell.com Figure 9-26. Viewing Established Sessions for VLAN Neighbors R2(conf-if-vl-200)#bfd neighbor 2.2.3.2 R2(conf-if-vl-200)#do show bfd neighbors * Ad Dn C I O R V - Active session role Admin Down CLI ISIS VLAN BFD OSPF Static Route (RTM) VRRP LocalAddr * 2.2.3.2 RemoteAddr 2.2.3.1 Sessions Enabled Interface State Rx-int Tx-int Mult Clients Vl 200 Up 100 100 3 C Changing session parameters BFD sessions are configured with default intervals and a default role.
PAGE 203
Configuring BFD for Port-Channels BFD on port-channels is analogous to BFD on physical ports. If no routing protocol is enabled, and a remote system fails, the local system does not remove the connected route until the first failed attempt to send a packet. If BFD is enabled, the local system removes the route when it stops receiving periodic control packets from the remote system.
PAGE 204
www.dell.com | support.dell.com To establish a session on a port-channel: Step 1 Task Command Syntax Establish a session on a port-channel. bfd neighbor ip-address Command Mode INTERFACE PORT-CHANNEL View the established sessions using the command show bfd neighbors, as shown in Figure 9-21. Figure 9-28. Viewing Established Sessions for VLAN Neighbors R2(conf-if-po-1)#bfd neighbors 2.2.2.
PAGE 205
To disable BFD for a port-channel: Step 1 Task Command Syntax Command Mode Disable BFD for a port-channel. no bfd enable INTERFACE PORT-CHANNEL Configuring Protocol Liveness Protocol Liveness is a feature that notifies the BFD Manager when a client protocol is disabled. When a client is disabled, all BFD sessions for that protocol are torn down. Neighbors on the remote system receive an Admin Down control packet and are placed in the Down state (Message 3 on page 181).
PAGE 206
www.dell.com | support.dell.com Figure 9-30. 206 debug bfd packet Command Output RX packet dump: 20 c0 03 18 00 00 00 01 86 a0 00 00 00:34:13 : Sent packet for TX packet dump: 20 c0 03 18 00 00 00 01 86 a0 00 00 00:34:14 : Received packet RX packet dump: 20 c0 03 18 00 00 00 01 86 a0 00 00 00:34:14 : Sent packet for TX packet dump: 00 05 00 00 00 04 00 01 86 a0 00 00 session with neighbor 2.2.2.2 on Gi 4/24 00 04 00 00 00 05 00 01 86 a0 00 00 for session with neighbor 2.2.2.
PAGE 207
10 Border Gateway Protocol IPv4 (BGPv4) Border Gateway Protocol IPv4 (BGPv4) version 4 (BGPv4) is supported on platforms: ces Platforms support BGP according to the following table: FTOS version Platform support 8.1.1.0 E-Series ExaScale 7.8.1.0 S-Series 7.7.1.0. C-Series pre-7.7.1.0 E-Series TeraScale ex s c et This chapter is intended to provide a general description of Border Gateway Protocol version 4 (BGPv4) as it is supported in the Dell Force10 Operating System (FTOS).
PAGE 208
www.dell.com | support.dell.
PAGE 209
A stub AS is one that is connected to only one other AS. A transit AS is one that provides connections through itself to separate networks. For example as seen in Figure 10-1, Router 1 can use Router 2 (the transit AS) to connect to Router 4. ISPs are always transit ASs, because they provide connections from one network to another. The ISP is considered to be “selling transit service” to the customer network, so thus the term Transit AS.
PAGE 210
www.dell.com | support.dell.com Figure 10-2. Full Mesh Examples 4 Routers 6 Routers 8 Routers The number of BGP speakers each BGP peer must maintain increases exponentially. Network management quickly becomes impossible. Sessions and Peers When two routers communicate using the BGP protocol, a BGP session is started. The two end-points of that session are Peers. A Peer is also called a Neighbor. Establishing a session Information exchange between peers is driven by events and timers.
PAGE 211
In order to make decisions in its operations with other BGP peers, a BGP peer uses a simple finite state machine that consists of six states: Idle, Connect, Active, OpenSent, OpenConfirm, and Established. For each peer-to-peer session, a BGP implementation tracks which of these six states the session is in. The BGP protocol defines the messages that each peer should exchange in order to change the session from one state to another. The first state is the Idle mode.
PAGE 212
Figure 10-3. Route Reflection Example Router A { eBGP Route eBGP Route Router B Router E { www.dell.com | support.dell.com To illustrate how these rules affect routing, see Figure 10-3 and the following steps.Routers B, C, D, E, and G are members of the same AS - AS100. These routers are also in the same Route Reflection Cluster, where Router D is the Route Reflector. Router E and H are client peers of Router D; Routers B and C and nonclient peers of Router D.
PAGE 213
BGP Attributes Routes learned via BGP have associated properties that are used to determine the best route to a destination when multiple paths exist to a particular destination. These properties are referred to as BGP attributes, and an understanding of how BGP attributes influence route selection is required for the design of robust networks.
PAGE 214
www.dell.com | support.dell.com Figure 10-4. BGP Best Path Selection No, or Not Resulting in a Single Route Highest Weight Highest Local Pref Locally Originated Path Shortest AS Path Lowest Origin Code Lowest MED Learned via EBGP Lowest NEXT-HOP Cost Tie Breakers Lowest Cluster ID List from Lowest Router ID from Lowest Neighbor Addr A Single Route is Selected and Installed in the Routing Table Best Path selection details 1. Prefer the path with the largest WEIGHT attribute. 2.
PAGE 215
• AS_CONFED_SEQUENCE has a path length of 1, no matter how many ASs are in the AS_CONFED_SEQUENCE. 5. Prefer the path with the lowest ORIGIN type (IGP is lower than EGP, and EGP is lower than INCOMPLETE). 6. Prefer the path with the lowest Multi-Exit Discriminator (MED) attribute. The following criteria apply: • • • This comparison is only done if the first (neighboring) AS is the same in the two paths; the MEDs are compared only if the first AS in the AS_SEQUENCE is the same for both paths.
PAGE 216
www.dell.com | support.dell.com Weight The Weight attribute is local to the router and is not advertised to neighboring routers. If the router learns about more than one route to the same destination, the route with the highest weight will be preferred. The route with the highest weight is installed in the IP routing table. Local Preference Local Preference (LOCAL_PREF) represents the degree of preference within the entire AS. The higher the number, the greater the preference for the route.
PAGE 217
One AS assigns the MED a value and the other AS uses that value to decide the preferred path. For this example, assume the MED is the only attribute applied. In Figure 10-6, AS100 and AS200 connect in two places. Each connection is a BGP session. AS200 sets the MED for its T1 exit point to 100 and the MED for its OC3 exit point to 50. This sets up a path preference through the OC3 link. The MEDs are advertised to AS100 routers so they know which is the preferred path. An MED is a non-transitive attribute.
PAGE 218
www.dell.com | support.dell.com Generally, an IGP indicator means that the route was derived inside the originating AS. EGP generally means that a route was learned from an external gateway protocol. An INCOMPLETE origin code generally results from aggregation, redistribution or other indirect ways of installing routes into BGP. In FTOS, these origin codes appear as shown in Figure 10-7. The question mark (?) indicates an Origin code of INCOMPLETE. The lower case letter (i) indicates an Origin code of IGP.
PAGE 219
Next Hop The Next Hop is the IP address used to reach the advertising router. For EBGP neighbors, the Next-Hop address is the IP address of the connection between the neighbors. For IBGP, the EBGP Next-Hop address is carried into the local AS. A Next Hop attribute is set when a BGP speaker advertises itself to another BGP speaker outside its local AS. It can also be set when advertising routes within an AS.
PAGE 220
www.dell.com | support.dell.com • • • If the redistribute command does not have any metric configured and BGP Peer out-bound route-map does have metric-type internal configured, BGP advertises the IGP cost as MED. If the redistribute command has metric configured (route-map set metric or redistribute route-type metric) and the BGP Peer out-bound route-map has metric-type internal configured, BGP advertises the metric configured in the redistribute command as MED.
PAGE 221
Where the 2-Byte format is 1-65535, the 4-Byte format is 1-4294967295. Enter AS Numbers using the traditional format. If the ASN is greater than 65535, the dot format is shown when using the show ip bgp commands. For example, an ASN entered as 3183856184 will appear in the show commands as 48581.51768; an ASN of 65123 is shown as 65123. To calculate the comparable dot format for an ASN from a traditional format, use ASN/65536. ASN%65536. Table 10-2.
PAGE 222
www.dell.com | support.dell.com ASDOT representation combines the ASPLAIN and ASDOT+ representations. AS Numbers less than 65536 appear in integer format (asplain); AS Numbers equal to or greater than 65536 appear using the decimal method (asdot+). For example, the AS Number 65526 appears as 65526, and the AS Number 65546 appears as 1.10. Dynamic AS Number Notation application FTOS 8.3.1.0 applies the ASN Notation type change dynamically to the running-config statements.
PAGE 223
Figure 10-10. config Dynamic changes when bgp asnotation command is disabled in the show running AS NOTATION DISABLED Force10(conf-router_bgp)#no bgp asnotation Force10(conf-router_bgp)#sho conf ! router bgp 100 bgp four-octet-as-support neighbor 172.30.1.250 local-as 65057 Force10(conf-router_bgp)#do sho ip bgp BGP table version is 28093, local router ID is 172.30.1.
PAGE 224
www.dell.com | support.dell.com Figure 10-11. Local-AS Scenario Router A AS 100 Router C AS 300 Router B AS 200 Before Migration Router A AS 100 AS 100 Router C AS 300 Router B Local AS 200 After Migration, with Local-AS enabled When you complete your migration, and you have reconfigured your network with the new information you must disable this feature. If the “no prepend” option is used, the local-as will not be prepended to the updates received from the eBGP peer.
PAGE 225
Local-as is prepended before the route-map to give an impression that update passed thru a router in AS 200 before it reached Router B. BGP4 Management Information Base (MIB) The FORCE10-BGP4-V2-MIB enhances FTOS BGP Management Information Base (MIB) support with many new SNMP objects and notifications (traps) defined in the draft-ietf-idr-bgp4-mibv2-05. To see these enhancements, download the MIB from the Dell Force10 website, www.force10networks.com.
PAGE 226
www.dell.com | support.dell.com • • • • • • • • • • • The AFI/SAFI is not used as an index to the f10BgpM2PeerCountersEntry table. The BGP peer's AFI/ SAFI (IPv4 Unicast or IPv6 Multicast) is used for various outbound counters. Counters corresponding to IPv4 Multicast cannot be queried.
PAGE 227
BGP Configuration To enable the BGP process and begin exchanging information, you must assign an AS number and use commands in the ROUTER BGP mode to configure a BGP neighbor. Defaults By default, BGP is disabled. By default, FTOS compares the MED attribute on different paths from within the same AS (the bgp always-compare-med command is not enabled). Note: In FTOS, all newly configured neighbors and peer groups are disabled.
PAGE 228
www.dell.com | support.dell.
PAGE 229
Use these commands in the following sequence, starting in the CONFIGURATION mode to establish BGP sessions on the router. Step 1 Command Syntax Command Mode Purpose router bgp as-number CONFIGURATION Assign an AS number and enter the ROUTER BGP mode. AS Number: 0-65535 (2-Byte) or 1-4294967295 (4-Byte) or 0.1-65535.65535 (Dotted format) Only one AS is supported per system If you enter a 4-Byte AS Number, 4-Byte AS Support is enabled automatically.
PAGE 230
www.dell.com | support.dell.com Enter show config in CONFIGURATION ROUTER BGP mode to view the BGP configuration. Use the show ip bgp summary command in EXEC Privilege mode to view the BGP status. Figure 10-12 shows the summary with a 2-Byte AS Number displayed; Figure 10-13 shows the summary with a 4-Byte AS Number displayed. Figure 10-12. Command example: show ip bgp summary (2-Byte AS Number displayed) R2#show ip bgp summary BGP router identifier 192.168.10.
PAGE 231
Figure 10-14 displays two neighbors, one is an external and the second one is an internal BGP neighbor. The first line of the output for each neighbor displays the AS number and states whether the link is an external or internal. The third line of the show ip bgp neighbors output contains the BGP State. If anything other than ESTABLISHED is listed, the neighbor is not exchanging information and routes.
PAGE 232
www.dell.com | support.dell.com Figure 10-15. Command example: show running-config bgp R2#show running-config bgp ! router bgp 65123 bgp router-id 192.168.10.2 network 10.10.21.0/24 network 10.10.32.0/24 network 100.10.92.0/24 network 192.168.10.0/24 bgp four-octet-as-support neighbor 10.10.21.1 remote-as 65123 neighbor 10.10.21.1 filter-list ISP1in neighbor 10.10.21.1 no shutdown neighbor 10.10.32.3 remote-as 65123 neighbor 10.10.32.3 no shutdown neighbor 100.10.92.9 remote-as 65192 neighbor 100.10.92.
PAGE 233
Task Command Syntax Command Mode Enable ASDOT AS Number representation. Figure 10-17 bgp asnotation asdot CONFIG-ROUTER-BGP Enable ASDOT+ AS Number representation.Figure 10-18 bgp asnotation asdot+ CONFIG-ROUTER-BGP Figure 10-16. Command example and output: bgp asnotation asplain Force10(conf-router_bgp)#bgp asnotation asplain Force10(conf-router_bgp)#sho conf ! router bgp 100 bgp four-octet-as-support neighbor 172.30.1.250 remote-as 18508 neighbor 172.30.1.250 local-as 65057 neighbor 172.30.1.
PAGE 234
www.dell.com | support.dell.com Configure Peer Groups To configure multiple BGP neighbors at one time, create and populate a BGP peer group. Another advantage of peer groups is that members of a peer groups inherit the configuration properties of the group and share same update policy. A maximum of 256 Peer Groups are allowed on the system. You create a peer group by assigning it a name, then adding members to the peer group. Once a peer group is created, you can configure route policies for it.
PAGE 235
When you add a peer to a peer group, it inherits all the peer group’s configured parameters.
PAGE 236
www.dell.com | support.dell.com Figure 10-20. Command example: show config (peer-group enabled Force10(conf-router_bgp)#neighbor zanzibar no shutdown Force10(conf-router_bgp)#show config ! router bgp 45 bgp fast-external-fallover bgp log-neighbor-changes neighbor zanzibar peer-group neighbor zanzibar no shutdown neighbor 10.1.1.1 remote-as 65535 neighbor 10.1.1.1 shutdown neighbor 10.14.8.60 remote-as 18505 neighbor 10.14.8.
PAGE 237
Figure 10-21. Command example: show ip bgp peer-group Force10>show ip bgp peer-group Peer-group zanzibar, remote AS 65535 BGP version 4 Minimum time between advertisement runs is 5 seconds For address family: IPv4 Unicast BGP neighbor is zanzibar, peer-group internal, Number of peers in this group 26 Peer-group members (* - outbound optimized): 10.68.160.1 10.68.161.1 10.68.162.1 10.68.163.1 10.68.164.1 10.68.165.1 10.68.166.1 10.68.167.1 10.68.168.1 10.68.169.1 10.68.170.1 10.68.171.1 10.68.172.1 10.68.
PAGE 238
www.dell.com | support.dell.com The BGP fast fall-over feature is configured on a per-neighbor or peer-group basis and is disabled by default.
PAGE 239
Figure 10-22. Command example: show ip bgp neighbors Force10#sh ip bgp neighbors BGP neighbor is 100.100.100.100, remote AS 65517, internal link Member of peer-group test for session parameters BGP version 4, remote router ID 30.30.30.
PAGE 240
www.dell.com | support.dell.com Figure 10-23. Command example: show ip bgp peer-group Force10#sh ip bgp peer-group Peer-group test Fall-over enabled BGP version 4 Minimum time between advertisement runs is 5 seconds For address family: IPv4 Unicast BGP neighbor is test Number of peers in this group 1 Peer-group members (* - outbound optimized): 100.100.100.100* Force10# router bgp 65517 neighbor test peer-group Fast Fall-Over neighbor test fall-over neighbor test no shutdown neighbor 100.100.100.
PAGE 241
Step Command Syntax Command Mode Purpose 3 neighbor peer-group-name no shutdown CONFIG-ROUTERBGP Enable the peer group. 4 neighbor peer-group-name remote-as as-number CONFIG-ROUTERBGP Create and specify a remote peer as a BGP neighbor. Only after the peer group responds to an OPEN message sent on the subnet does its BGP state change to ESTABLISHED. Once the peer group is ESTABLISHED, the peer group is the same as any other peer group.
PAGE 242
www.dell.com | support.dell.com Figure 10-24. Local-as information shown R2(conf-router_bgp)#show conf ! router bgp 65123 bgp router-id 192.168.10.2 network 10.10.21.0/24 network 10.10.32.0/24 network 100.10.92.0/24 network 192.168.10.0/24 bgp four-octet-as-support neighbor 10.10.21.1 remote-as 65123 neighbor 10.10.21.1 filter-list Laura in neighbor 10.10.21.1 no shutdown neighbor 10.10.32.3 remote-as 65123 neighbor 10.10.32.3 no shutdown neighbor 100.10.92.9 remote-as 65192 neighbor 100.10.92.
PAGE 243
Figure 10-25. Allowas-in information shown R2(conf-router_bgp)#show conf ! router bgp 65123 bgp router-id 192.168.10.2 network 10.10.21.0/24 network 10.10.32.0/24 network 100.10.92.0/24 network 192.168.10.0/24 bgp four-octet-as-support neighbor 10.10.21.1 remote-as 65123 neighbor 10.10.21.1 filter-list Laura in neighbor 10.10.21.1 no shutdown neighbor 10.10.32.3 remote-as 65123 neighbor 10.10.32.3 no shutdown neighbor 100.10.92.9 remote-as 65192 neighbor 100.10.92.9 local-as 6500 neighbor 100.10.92.
PAGE 244
www.dell.com | support.dell.com • • • Advertise to all BGP neighbors and peer-groups that the forwarding state of all routes has been saved. This prompts all peers to continue saving the routes they receive from your E-Series and to continue forwarding traffic. Bring the secondary RPM online as the primary and re-open sessions with all peers operating in “no shutdown” mode. Defer best path selection for a certain amount of time.
PAGE 245
Filter on an AS-Path attribute The BGP attribute, AS_PATH, can be used to manipulate routing policies. The AS_PATH attribute contains a sequence of AS numbers representing the route’s path. As the route traverses an Autonomous System, the AS number is prepended to the route. You can manipulate routes based on their AS_PATH to affect interdomain routing. By identifying certain AS numbers in the AS_PATH, you can permit or deny routes based on the number in its AS_PATH.
PAGE 246
www.dell.com | support.dell.com Step Command Syntax Command Mode Purpose 2 {deny | permit} filter CONFIG-AS-PATH Enter the parameter to match BGP AS-PATH for filtering. This is the filter that will be used to match the AS-path. The entries can be any format, letters, numbers, or regular expressions. This command can be entered multiple times if multiple filters are desired. See Table 10-4 for accepted expressions.
PAGE 247
Figure 10-27. Filtering with Regular Expression Force10(config)#router bgp 99 Force10(conf-router_bgp)#neigh AAA peer-group Force10(conf-router_bgp)#neigh AAA no shut Force10(conf-router_bgp)#show conf ! router bgp 99 neighbor AAA peer-group neighbor AAA no shutdown neighbor 10.155.15.2 remote-as 32 neighbor 10.155.15.2 shutdown Force10(conf-router_bgp)#neigh 10.155.15.
PAGE 248
www.dell.com | support.dell.com Table 10-4. Regular Expressions Regular Expression Definition ( ) (parenthesis) Specifies patterns for multiple use when followed by one of the multiplier metacharacters: asterisk *, plus sign +, or question mark ? [ ] (brackets) Matches any enclosed character; specifies a range of single characters - (hyphen) Used within brackets to specify a range of AS or community numbers. _ (underscore) Matches a ^, a $, a comma, a space, a {, or a }.
PAGE 249
Command Syntax Command Mode Purpose redistribute ospf process-id [match external {1 | 2} | match internal] [metric-type {external | internal}] [route-map map-name] ROUTER BGP or CONF-ROUTER_BGPv6_ AF Include specific OSPF routes in IS-IS. Configure the following parameters: • process-id range: 1 to 65535 • match external range: 1 or 2 • match internal • metric-type: external or internal. • map-name: name of a configured route map.
PAGE 250
www.dell.com | support.dell.com Use these commands in the following sequence, starting in the CONFIGURATION mode to configure an IP community list. Step Command Syntax Command Mode Purpose 1 ip community-list CONFIGURATION Create a Community list and enter the COMMUNITY-LIST mode.
PAGE 251
Figure 10-28.
PAGE 252
www.dell.com | support.dell.com Manipulate the COMMUNITY attribute In addition to permitting or denying routes based on the values of the COMMUNITY attributes, you can manipulate the COMMUNITY attribute value and send the COMMUNITY attribute with the route information. By default, FTOS does not send the COMMUNITY attribute. Use the following command in the CONFIGURATION ROUTER BGP mode to send the COMMUNITY attribute to BGP neighbors.
PAGE 253
Step Command Syntax Command Mode Purpose 3 exit CONFIG-ROUTE-MAP Return to the CONFIGURATION mode. 4 router bgp as-number CONFIGURATION Enter the ROUTER BGP mode. 5 neighbor {ip-address | peer-group-name} route-map map-name {in | out} CONFIG-ROUTER-BGP Apply the route map to the neighbor or peer group’s incoming or outgoing routes. To view the BGP configuration, use the show config command in CONFIGURATION ROUTER BGP mode.
PAGE 254
www.dell.com | support.dell.com Use any or all of the following commands in the CONFIGURATION ROUTER BGP mode to change how the MED attribute is used. Command Syntax Command Mode Purpose bgp always-compare-med CONFIG-ROUTERBGP Enable MED comparison in the paths from neighbors with different ASs. By default, this comparison is not performed.
PAGE 255
Step Command Syntax Command Mode Purpose 4 router bgp as-number CONFIGURATION Enter the ROUTER BGP mode. 5 neighbor {ip-address | peer-group-name} route-map map-name {in | out} CONFIG-ROUTER-BGP Apply the route map to the neighbor or peer group’s incoming or outgoing routes. To view the BGP configuration, use the show config command in the CONFIGURATION ROUTER BGP mode. To view a route map configuration, use the show route-map command in EXEC Privilege mode.
PAGE 256
www.dell.com | support.dell.com You can also use route maps to change this and other BGP attributes. For example, you can include the following command in a route map to specify the next hop address: Command Syntax Command Mode Purpose set weight weight CONFIG-ROUTE-MAP Sets weight for the route. • weight range: 0 to 65535 Enable multipath By default, the software allows one path to a destination. You can enable multipath to allow up to 16 parallel paths to a destination.
PAGE 257
Refer to Chapter 8, “IP Access Control Lists (ACL), Prefix Lists, and Route-maps,” on page 135 for configuration information on prefix lists, AS-PATH ACLs, and route maps. Note: When you configure a new set of BGP policies, always reset the neighbor or peer group by entering the clear ip bgp command in EXEC Privilege mode. Use these commands in the following sequence, starting in the CONFIGURATION mode to filter routes using prefix lists.
PAGE 258
www.dell.com | support.dell.com Use these commands in the following sequence, starting in the CONFIGURATION mode to filter routes using a route map. Step Command Syntax Command Mode Purpose route-map map-name [permit | deny] [sequence-number] CONFIGURATION Create a route map and assign it a name. 2 {match | set} CONFIG-ROUTE-MAP Create multiple route map filters with a match or set action.
PAGE 259
Step Command Syntax Command Mode Purpose 5 neighbor {ip-address | peer-group-name} filter-list as-path-name {in | out} CONFIG-ROUTER-B GP Filter routes based on the criteria in the configured route map. Configure the following parameters: • ip-address or peer-group-name: enter the neighbor’s IP address or the peer group’s name. • as-path-name: enter the name of a configured AS-PATH ACL. • in: apply the AS-PATH ACL map to inbound routes. • out: apply the AS-PATH ACL to outbound routes.
PAGE 260
www.dell.com | support.dell.com Aggregate routes FTOS provides multiple ways to aggregate routes in the BGP routing table. At least one specific route of the aggregate must be in the routing table for the configured aggregate to become active. Use the following command in the CONFIGURATION ROUTER BGP mode to aggregate routes.
PAGE 261
Use the following commands in the CONFIGURATION ROUTER BGP mode to configure BGP confederations. Command Syntax Command Mode Purpose bgp confederation identifier as-number CONFIG-ROUTERBGP Specifies the confederation ID. AS-number: 0-65535 (2-Byte) or 1-4294967295 (4-Byte) bgp confederation peers as-number [... as-number] CONFIG-ROUTERBGP Specifies which confederation sub-AS are peers. AS-number: 0-65535 (2-Byte) or 1-4294967295 (4-Byte) All Confederation routers must be either 4-Byte or 2-Byte.
PAGE 262
www.dell.com | support.dell.com Figure 10-31.
PAGE 263
To set dampening parameters via a route map, use the following command in CONFIGURATION ROUTE-MAP mode: Command Syntax Command Mode Purpose set dampening half-life reuse CONFIG-ROUTE-MAP Enter the following optional parameters to configure route dampening parameters: • half-life range: 1 to 45. Number of minutes after which the Penalty is decreased. After the router assigns a Penalty of 1024 to a route, the Penalty is decreased by half after the half-life period expires.
PAGE 264
www.dell.com | support.dell.com Use the following command in EXEC Privilege mode to clear information on route dampening and return suppressed routes to active state. Command Syntax Command Mode Purpose clear ip bgp dampening [ip-address mask] EXEC Privilege Clear all information or only information on a specific route. Use the following command in EXEC and EXEC Privilege mode to view statistics on route flapping.
PAGE 265
Change BGP timers Use either or both of the following commands in the CONFIGURATION ROUTER BGP mode to configure BGP timers. Command Syntax Command Mode Purpose neighbors {ip-address | peer-group-name} timers keepalive CONFIG-ROUTERBGP Configure timer values for a BGP neighbor or peer group. • keepalive range: 1 to 65535. Time interval, in seconds, between keepalive messages sent to the neighbor routers. (Default: 60 seconds) • holdtime range: 3 to 65536.
PAGE 266
www.dell.com | support.dell.com Use the clear ip bgp command in EXEC Privilege mode to reset a BGP connection using BGP soft reconfiguration. Command Syntax Command Mode Purpose neighbor {ipv4-address | ipv6-address | peer-group-name} soft-reconfiguration inbound CONFIG-ROUTERBGP Enable inbound soft-reconfiguration for the specified BGP neighbor. BGP stores all updates received by the neighbor but does not reset the peer session.
PAGE 267
Route map continue The BGP route map continue feature (in ROUTE-MAP mode) allows movement from one route-map entry to a specific route-map entry (the sequence number). If the sequence number is not specified, the continue feature moves to the next sequence number (also known as an implied continue). If a match clause exists, the continue feature executes only after a successful match occurs. If there are no successful matches, continue is ignored.
PAGE 268
www.dell.com | support.dell.com MBGP Configuration et c MBGP for IPv4 Multicast is supported on platform c et s MBGP is not supported on the E-Series ExaScale ex platform. MBGP for IPv6 unicast is supported on platforms Multiprotocol BGP (MBGP) is an enhanced BGP that carries IP multicast routes. BGP carries two sets of routes: one set for unicast routing and one set for multicast routing.
PAGE 269
BGP Regular Expression Optimization BGP policies that contain regular expressions to match against as-paths and communities might take a lot of CPU processing time, thus affect BGP routing convergence. Also, show bgp commands that get filtered through regular expressions can to take a lot of CPU cycles, especially when the database is large.
PAGE 270
www.dell.com | support.dell.com Command Syntax Command Mode Purpose debug ip bgp {ip-address | peer-group-name} soft-reconfiguration EXEC Privilege Enable soft-reconfiguration debug. Enable soft-reconfiguration debug. To enhance debugging of soft reconfig, use the following command only when route-refresh is not negotiated to avoid the peer from resending messages: bgp soft-reconfig-backup In-BGP is shown via the show ip protocols command. FTOS displays debug messages on the console.
PAGE 271
Figure 10-34. Viewing the Last Bad PDU from BGP Peers Force10(conf-router_bgp)#do show ip bgp neighbors 1.1.1.2 BGP neighbor is 1.1.1.2, remote AS 2, external link BGP version 4, remote router ID 2.4.0.
PAGE 272
www.dell.com | support.dell.com The buffer size supports a maximum value between 40 MB (the default) and 100 MB. The capture buffers are cyclic and reaching the limit prompts the system to overwrite the oldest PDUs when new ones are received for a given neighbor or direction. Setting the buffer size to a value lower than the current max, might cause captured PDUs to be freed to set the new limit. Note: Memory on RP1 is not pre-allocated, and is allocated only when a PDU needs to be captured.
PAGE 273
With full internet feed (205K) captured, approximately 11.8MB is required to store all of the PDUs, as shown in Figure 10-36. Figure 10-36. Required Memory for Captured PDUs Force10(conf-router_bgp)#do show capture bgp-pdu neighbor 172.30.1.250 Incoming packet capture enabled for BGP neighbor 172.30.1.250 Available buffer size 29165743, 192991 packet(s) captured using 11794257 bytes [. . .] Force10(conf-router_bgp)#do sho ip bg s BGP router identifier 172.30.1.
PAGE 274
www.dell.com | support.dell.com Figure 10-37. Sample Configuration Illustration Physical Links AS 99 Virtual Links GigE 1/21 10.0.1.21 /24 GigE 2/11 10.0.1.22 /24 Peer Group AAA e Pe Loopback ck 1 192.168.128.1 /24 Loopback 1 Lo 192.168.128.2 /24 19 rG u ro p GigE 1/31 10.0.3.31 /24 BB B er Pe GigE 3/11 10.0.3.33 /24 o Gr C CC p u GigE 3/21 10.0.2.3 /24 Loopback 1 192.168.128.3 /24 AS 100 274 | Border Gateway Protocol IPv4 (BGPv4) GigE 2/31 10.0.2.
PAGE 275
Figure 10-38. Enable BGP - Router 1 R1# conf R1(conf)#int loop 0 R1(conf-if-lo-0)#ip address 192.168.128.1/24 R1(conf-if-lo-0)#no shutdown R1(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.1/24 no shutdown R1(conf-if-lo-0)#int gig 1/21 R1(conf-if-gi-1/21)#ip address 10.0.1.21/24 R1(conf-if-gi-1/21)#no shutdown R1(conf-if-gi-1/21)#show config ! interface GigabitEthernet 1/21 ip address 10.0.1.21/24 no shutdown R1(conf-if-gi-1/21)#int gig 1/31 R1(conf-if-gi-1/31)#ip address 10.0.3.
PAGE 276
www.dell.com | support.dell.com Figure 10-39. Enable BGP - Router 2 R2# conf R2(conf)#int loop 0 R2(conf-if-lo-0)#ip address 192.168.128.2/24 R2(conf-if-lo-0)#no shutdown R2(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.2/24 no shutdown R2(conf-if-lo-0)#int gig 2/11 R2(conf-if-gi-2/11)#ip address 10.0.1.22/24 R2(conf-if-gi-2/11)#no shutdown R2(conf-if-gi-2/11)#show config ! interface GigabitEthernet 2/11 ip address 10.0.1.
PAGE 277
Figure 10-40. Enable BGP - Router 3 R3# conf R3(conf)# R3(conf)#int loop 0 R3(conf-if-lo-0)#ip address 192.168.128.3/24 R3(conf-if-lo-0)#no shutdown R3(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.3/24 no shutdown R3(conf-if-lo-0)#int gig 3/11 R3(conf-if-gi-3/11)#ip address 10.0.3.33/24 R3(conf-if-gi-3/11)#no shutdown R3(conf-if-gi-3/11)#show config ! interface GigabitEthernet 3/11 ip address 10.0.3.
PAGE 278
www.dell.com | support.dell.com Figure 10-41. Enable Peer Group - Router 1 R1#conf R1(conf)#router bgp 99 R1(conf-router_bgp)# network 192.168.128.0/24 R1(conf-router_bgp)# neighbor AAA peer-group R1(conf-router_bgp)# neighbor AAA no shutdown R1(conf-router_bgp)# neighbor BBB peer-group R1(conf-router_bgp)# neighbor BBB no shutdown R1(conf-router_bgp)# neighbor 192.168.128.2 peer-group AAA R1(conf-router_bgp)# neighbor 192.168.128.
PAGE 279
Figure 10-42.
PAGE 280
www.dell.com | support.dell.com Figure 10-43. Enable Peer Groups - Router 2 R2#conf R2(conf)#router bgp 99 R2(conf-router_bgp)# neighbor CCC peer-group R2(conf-router_bgp)# neighbor CC no shutdown R2(conf-router_bgp)# neighbor BBB peer-group R2(conf-router_bgp)# neighbor BBB no shutdown R2(conf-router_bgp)# neighbor 192.168.128.1 peer AAA R2(conf-router_bgp)# neighbor 192.168.128.1 no shut R2(conf-router_bgp)# neighbor 192.168.128.3 peer BBB R2(conf-router_bgp)# neighbor 192.168.128.
PAGE 281
Figure 10-44. Enable Peer Group - Router 3 R3#conf R3(conf)#router bgp 100 R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# neighbor R3(conf-router_bgp)# AAA peer-group AAA no shutdown CCC peer-group CCC no shutdown 192.168.128.2 peer-group BBB 192.168.128.2 no shutdown 192.168.128.1 peer-group BBB 192.168.128.
PAGE 282
www.dell.com | support.dell.com Figure 10-45.
PAGE 283
11 Content Addressable Memory Content Addressable Memory is supported on platforms c et s Note: Different platforms support varying levels of CAM adjustment. Be sure to read this chapter carefully prior to changing any CAM parameters. CAM configuration is for the E-Series ExaScale is documented separately in Chapter 12, Content Addressable Memory for ExaScale.
PAGE 284
www.dell.com | support.dell.com Content Addressable Memory Content Addressable Memory (CAM) is a type of memory that stores information in the form of a lookup table. On Dell Force10 systems, the CAM stores Layer 2 and Layer 3 forwarding information, access-lists (ACL), flows, and routing policies. On Dell Force10 systems, there are one or two CAM (Dual-CAM) modules per port-pipe depending on the type of line card.
PAGE 285
Table 11-1. CAM Profile Descriptions CAM Profile Description Default An all-purpose profile that allocates CAM space according to the way Dell Force10 systems are most commonly used. Available Microcodes: default, lag-hash-align, lag-hash-mpls, l2-switched-pbr eg-default For EG-series line cards only. EG series line cards have two CAM modules per Port-pipe.
PAGE 286
L2FIB L2ACL IPv4FIB IPv4ACL IPv4Flow EgL2ACL EgIPv4ACL Reserved IPv6FIB IPv6ACL IPv6Flow EgIPv6ACL CAM entries per partition Default 32K 2K 256K 12K 24K 1K 1K 8K 0 0 0 0 eg-default 32K 2K 512K 12K 24K 1K 1K 8K 32K 3K 4K 1K ipv4-320k 32K 2K 320K 12K 12K 1K 1K 4K 0 0 0 0 pv4-egacl-16k 32K 2K 192K 8K 24K 0 16K 8K 0 0 0 0 ipv6-extacl 32K 2K 192K 12K 8K 1K 1K 2K 6K 3K 4K 2K l2-ipv4-inacl 32K 33K 64K 27K 8K 2K 2K 2K 0 0 0 0
PAGE 287
Table 11-3. Microcode Descriptions Microcode Description lag-hash-mpls For hashing based on MPLS labels (up to five labels deep). With the default microcode, MPLS packets are distributed over a port-channel based on the MAC source and destination address. With the lag-hash-mpls microcode, MPLS packets are distributed across the port-channel based on IP source and destination address and IP protocol. This is applicable for MPLS packets with up to five labels.
PAGE 288
www.dell.com | support.dell.com Table 11-4. Layer 2 ACL CAM Sub-partition Sizes Partition % Allocated *PVST 50 QoS 12 L2PT 13 FRRP 5 You can re-configure the amount of space, in percentage, allocated to each sub-partition. As with the IPv4Flow partition, you can configure the Layer 2 ACL partition from EXEC Privilege mode or CONFIGURATION mode.
PAGE 289
Message 2 EH Line Card with EG Chassis Profile Error # Before reload: 01:09:56: %RPM0-P:CP %CHMGR-4-EH_PROFILE_WARN: If EH CAM profile is selected, non-EJ cards will be in problem state after reload # After reload: 00:04:46: %RPM0-P:CP %CHMGR-3-PROFILE_MISMATCH: Mismatch: line card 1 has mismatch CAM profile or microcode Figure 11-1.
PAGE 290
www.dell.com | support.dell.com • Optimize the VLAN ACL Group feature, which permits group VLANs for IP egress ACLs. See CAM profile for the VLAN ACL group feature on page 301. Important Points to Remember • • • • • • CAM Profiling is available on the E-Series TeraScale with FTOS versions 6.3.1.1 and later. Refer to Chapter 12, Content Addressable Memory for ExaScale for E-Series ExaScale CAM descriptions.
PAGE 291
To change the CAM profile on the entire system: Step 1 Task Command Syntax Command Mode Select a CAM profile. cam-profile profile microcode CONFIGURATION microcode Note: If selecting a cam-profile for VRF (cam-profile ipv4-vrf or ipv4-v6-vrf), implement the command in the CONFIGURATION mode only. If you use EXEC Privilege mode, the linecards may go into an error state. 2 Save the running-configuration.
PAGE 292
www.dell.com | support.dell.com The ipv6acl and vman-dual-qos allocations must be entered as a factor of 2 (2, 4, 6, 8, 10). All other profile allocations can use either even or odd numbered ranges. You must save the new CAM settings to the startup-config (write-mem or copy run start) then reload the system for the new settings to take effect.
PAGE 293
View CAM Profiles View the current CAM profile for the chassis and each component using the command show cam-profile, as shown in Figure 11-4. This command also shows the profile that will be loaded upon the next chassis or component reload. Figure 11-4.
PAGE 294
www.dell.com | support.dell.com Figure 11-6.
PAGE 295
Figure 11-7.
PAGE 296
www.dell.com | support.dell.com • The IPv4Flow configuration is applied to entire system when you enter the command cam-ipv4flow from CONFIGURATION mode, however, you must save the running-configuration to affect the change. The amount of space that is allocated among the sub-partitions must be equal to the amount of CAM space allocated to IPv4Flow by the selected CAM profile (see Table 11-1.); Message 3 is displayed if the total allocated space is not correct.
PAGE 297
Figure 11-8. Configuring IPv4Flow on the Entire System Force10(conf)#cam-ipv4flow default Force10#copy running-config startup-config File with same name already exist.
PAGE 298
www.dell.com | support.dell.com Table 11-6. Layer 2 ACL CAM Sub-partition Sizes (continued) Partition % Allocated L2PT 13 FRRP 5 You can re-configure the amount of space, in percentage, allocated to each sub-partition. • Apply the Ingress Layer 2 ACL configuration to entire system by entering the command cam-l2acl from CONFIGURATION mode, however, you must save the running-configuration to affect the change.
PAGE 299
Figure 11-9.
PAGE 300
www.dell.com | support.dell.com Figure 11-10.
PAGE 301
• If the packet has more than 5 MPLS labels, hashing is based on the source and destination MAC address. To enable this type of hashing, use the default CAM profile with the microcode lag-hash-mpls. LAG Hashing based on Bidirectional Flow To hash LAG packets such that both directions of a bidirectional flow (for example, VoIP or P2P file sharing) are mapped to the same output link in the LAG bundle, use the default CAM profile with the microcode lag-hash-align.
PAGE 302
www.dell.com | support.dell.com QoS CAM Region Limitation The default CAM profile allocates a partition within the IPv4Flow region to store QoS service policies. If the QoS CAM space is exceeded, messages similar to the ones in Message 5 are displayed.
PAGE 303
12 Content Addressable Memory for ExaScale This Content Addressable Memory for ExaScale chapter discusses CAM/SRAM profiles for the E-Series ExaScale ex platform. Refer to Chapter 11, Content Addressable Memory for information regarding the E-Series TeraScale, C-Series and S-Series platforms.
PAGE 304
www.dell.com | support.dell.com Static Random Access Memory Static Random Access Memory (SRAM) is a rapidly accessed memory that stores information in the form of a lookup table. On Dell Force10 systems, the SRAM stores multicast forwarding information, MPLS routing. Figure 12-1.
PAGE 305
Table 12-1 lists and describes the recommended CAM-profile templates. In general, non-default profiles allocate more space to particular regions to accommodate specific applications. The size of the partitions is measured in entries. The total CAM space is finite, therefor adding entries to one region necessarily decreases the number available to other regions. Table 12-1.
PAGE 306
www.dell.com | support.dell.com Table 12-2. Default CAM Profile Partition Size (continued) Partition Default 10M line card Default 40M line card IPv6ACL 0 6K IPv6Flow 0 6K EgIPv6ACL 0 1K Note: Note the following: • The L2FIB region includes the MAC learning region. • The L2ACL region includes the L2 ACL, FRRP, L2PT, L2 QoS, and L2 System Flow regions. • The IPv4Flow region includes multicast FIB, PBR, QoS, and System Flow regions.
PAGE 307
Table 12-3.
PAGE 308
www.dell.com | support.dell.com Table 12-4.
PAGE 309
The default microcode is used with all CAM-profile templates, except VRF. VRF uses its own microcode. A microcode is required for each CAM-profile. If you do not specify one, the default microcode is implemented. Table 12-5. Microcode Descriptions Microcode Description default Distributes CAM space for a typical deployment. Applies to the Default CAM-profile and the recommended CAM-profile templates. • Recommended for any user-defined CAM-profiles.
PAGE 310
www.dell.com | support.dell.com Figure 12-2.
PAGE 311
Select a pre-defined (Dell Force10 recommended) CAM-profile template. Step 1 Task Command Syntax Command Mode Select a CAM-profile template. cam-profile template [10M-CAM] CONFIGURATION template is the name of a pre-defined Dell Force10 CAM-profile template:10M-L2, 10M-L2-IPv6-Switching, 40M-L2-IPv6-IPv4, 40M-L2-IPv4Only, VRF, MAX-IPv4-FIB Note: Enter 10M-CAM to specify the 10M CAM line card. Otherwise, the system defaults to the 40M CAM line card settings.
PAGE 312
www.dell.com | support.dell.com Create new CAM-profile FTOS supports creating individual CAM-profiles, but Dell Force10 does not certify that these templates will function as expected. Follow these steps to create a new CAM-profile. Step 1 Task Command Syntax Command Mode Define a CAM-profile template. cam-profile template [10M-CAM] template is a 16 character string used as a template name CONFIGURATION Note: Enter 10M-CAM to specify the 10M CAM line card.
PAGE 313
Assign a microcode to the CAM-profile template Every CAM-profile template must have a microcode to control how packets go through the lookup tables and are forwarded through the system. The default microcode is used with all CAM-profile templates, except VRF. VRF uses its own microcode. Specifying a microcode is mandatory when selecting a CAM profile (though you are not required to change it) Task Command Syntax Command Mode Assign microcode to a defined CAM-profile template.
PAGE 314
www.dell.com | support.dell.com Figure 12-6.
PAGE 315
Figure 12-7.
PAGE 316
www.dell.com | support.dell.com Figure 12-8.
PAGE 317
13 Configuration Replace and Rollback Configuration Replace and Rollback is supported on platforms ce The E-Series ExaScale platform is supported with FTOS 8.1.1.0 and later. Configuration Replace and Rollback enables you to replace the current running-configuration with different configuration without restarting the chassis.
PAGE 318
www.dell.com | support.dell.com Configuring Configuration Replace and Rollback Configuring Configuration Replace and Rollback is a three-step process: 1. Enable the archive service. See page 318. 2. Archive a running-configuration. See page 319. 3. Replace the running-configuration with an archived configuration. See page 319.
PAGE 319
You do not have to enable the archive service again if you save the running configuration after completing task. If you reload the system or upgrade your FTOS version without saving the running configuration you must enable the archive service again. Archiving a Configuration File Archive the current running configuration file using the command archive config from EXEC Privilege mode. Figure 13-2.
PAGE 320
www.dell.com | support.dell.com 1. The hostname of the Dell Force10 system is changed from “R1” to “Force10.” 2. The running configuration is replaced with archive_0, in which the hostname is “R1.” Figure 13-3.
PAGE 321
Figure 13-5.
PAGE 322
www.dell.com | support.dell.com Figure 13-8.
PAGE 323
Figure 13-9. Configuring an Archive Time-period R1(conf-archive)#time-period 5 R1(conf-archive)#show config ! archive maximum 2 time-period 5 R1(conf-archive)# Copying and Deleting an Archive File Copy an archive file to another location using the command archive backup, as shown in Figure 13-10. Delete an archive file using the command archive delete from CONFIG ARCHIVE mode. Viewing and Editing the Contents of an Archive File You cannot view or edit the contents of archived files.
PAGE 324
www.dell.com | support.dell.com Figure 13-10.
PAGE 325
Figure 13-11.
PAGE 326
www.dell.com | support.dell.
PAGE 327
14 Dynamic Host Configuration Protocol Dynamic Host Configuration Protocol is available on platforms: ces This chapter contains the following sections: • • • • • • Protocol Overview on page 327 Implementation Information on page 330 Configuration Tasks on page 330 Configure the System to be a DHCP Server on page 330 Configure the System to be a Relay Agent on page 336 Configure Secure DHCP on page 337 Protocol Overview Dynamic Host Configuration Protocol (DHCP) is an application layer protocol that dyna
PAGE 328
www.dell.com | support.dell.com DHCP Packet Format and Options DHCP uses UDP as its transport protocol. The server listens on port 67 and transmits to port 68; the client listens on port 68 and transmits to port 67. The configuration parameters are carried as options in the DHCP packet in Type, Length, Value (TLV) format; many options are specified in RFC 2132.
PAGE 329
Assigning an IP Address using DHCP When a client joins a network: 1. The client initially broadcasts a DHCPDISCOVER message on the subnet to discover available DHCP servers. This message includes the parameters that the client requires and might include suggested values for those parameters. 2. Servers unicast or broadcast a DHCPOFFER message in response to the DHCPDISCOVER that offers to the client values for the requested parameters.
PAGE 330
www.dell.com | support.dell.com Implementation Information • • • The Dell Force10 implementation of DHCP is based on RFC 2131 and RFC 3046. DHCP is available on VLANs and Private VLANs. IP Source Address Validation is a sub-feature of DHCP Snooping; FTOS uses ACLs internally to implement this feature and as such, you cannot apply ACLs to an interface which has IP Source Address Validation.
PAGE 331
2. Configuration Parameter Storage and Management: DHCP servers also store and maintain other parameters that are sent to clients when requested. These parameters specify in detail how a client is to operate. 3. Lease Management: DHCP servers use leases to allocate addresses to clients for a limited time. The DHCP server maintains information about each of the leases, including lease length. 4.
PAGE 332
www.dell.com | support.dell.com To create an address pool: Step Task Command Syntax Command Mode 1 Access the DHCP server CLI context. ip dhcp server CONFIGURATION 2 Create an address pool and give it a name. pool name DHCP 3 Specify the range of IP addresses from which the DHCP server may assign addresses. • network is the subnet address. • prefix-length specifies the number of bits used for the network portion of the address you specify.
PAGE 333
Enable DHCP Server DHCP server is disabled by default. Step Task Command Syntax Command Mode 1 Enter the DHCP command-line context. ip dhcp server CONFIGURATION 2 Enable DHCP server. no disable DHCP Default: Disabled 3 Display the current DHCP configuration. show config DHCP In Figure 14-3, an IP phone is powered by PoE and has acquired an IP address from the Dell Force10 system, which is advertising LLDP-MED.
PAGE 334
www.dell.com | support.dell.com Address Resolution using NetBIOS WINS Windows Internet Naming Service (WINS) is a name resolution service that Microsoft DHCP clients use to correlate host names to IP addresses within a group of networks. Microsoft DHCP clients can be one of four types of NetBIOS nodes: broadcast, peer-to-peer, mixed, or hybrid.
PAGE 335
To create a manual binding: Step Task Command Syntax Command Mode 1 Create an address pool pool name DHCP 2 Specify the client IP address. host address DHCP 3 Specify the client hardware address or client-identifier. • hardware-address is the client MAC address. type is the protocol of the hardware platform. The default protocol is Ethernet. client-identifier is required for Microsoft clients instead of a hardware addresses.
PAGE 336
www.dell.com | support.dell.com DHCP Clear Commands Task Command Syntax Command Mode Clear DHCP binding entries for the entire binding table. clear ip dhcp binding EXEC Privilege Clear a DHCP binding entry for an individual IP address. clear ip dhcp binding ip address EXEC Privilege Clear a DHCP address conflict. clear ip dhcp conflict EXEC Privilege Clear DHCP server counters.
PAGE 337
Figure 14-4. Configuring Dell Force10 Systems as a DHCP Relay Device DHCP Server 10.11.2.5 Unicast Source IP : 10.11.1.5 Destination IP: 10.11.0.3 Source Port: 67 Destination Port: 68 Unicast Broadcast Source IP : 10.11.1.5 Destination IP: 255.255.255.255 Source Port: 67 Destination Port: 68 DHCP Server 10.11.1.5 1/4 Broadcast Source IP : 0.0.0.0 Destination IP: 255.255.255.255 Source Port: 68 Destination Port: 67 Relay Agent Address: 0.0.0.0 1/3 Unicast Source IP : 0.0.0.0 Destination IP: 10.11.1.
PAGE 338
www.dell.com | support.dell.com • • • DHCP Snooping on page 338 Dynamic ARP Inspection on page 341 Source Address Validation on page 343 Option 82 RFC 3046 (Relay Agent Information option, or Option 82) is used for class-based IP address assignment. The code for the Relay Agent Information option is 82, and is comprised of two sub-options, Circuit ID and Remote ID. • • Circuit ID is the interface on which the client-originated message is received.
PAGE 339
When DHCP Snooping is enabled, the relay agent builds a binding table—using DHCPACK messages— containing the client MAC address, IP addresses, IP address lease time, port, VLAN ID, and binding type. Every time the relay agent receives a DHCPACK on an trusted port, it adds an entry to the table.
PAGE 340
www.dell.com | support.dell.com Add a static entry in the binding table Task Command Syntax Command Mode Add a static entry in the binding table. ip dhcp snooping binding mac EXEC Privilege Clear the binding table Task Command Syntax Command Mode Delete all of the entries in the binding table clear ip dhcp snooping binding EXEC Privilege Display the contents of the binding table Task Command Syntax Command Mode Display the contents of the binding table.
PAGE 341
Drop DHCP packets on snooped VLANs only Binding table entries are deleted when a lease expires, or the relay agent encounters a DHCPRELEASE. Starting with FTOS Release 8.2.1.1, line cards maintain a list of snooped VLANs. When the binding table fills, DHCP packets are dropped only on snooped-VLANs, while such packets will be forwarded across non-snooped VLANs. Since DHCP packets are dropped, no new IP address assignments are made.
PAGE 342
www.dell.com | support.dell.com packets to it. Likewise, the attacker sends the gateway an ARP message containing the attacker’s MAC address and the client’s IP address. The gateway then thinks that the attacker is the client, and forwards all packets addressed to the client to it. As a result, the attacker is able to sniff all packets to and from the client.
PAGE 343
View the number of entries in the ARP database with the show arp inspection database command. Figure 14-8. Command example: show arp inspection database Force10#show arp inspection database Protocol Address Age(min) Hardware Address Interface VLAN CPU ---------------------------------------------------------------------------Internet 10.1.1.251 00:00:4d:57:f2:50 Gi 0/2 Vl 10 CP Internet 10.1.1.252 00:00:4d:57:e6:f6 Gi 0/1 Vl 10 CP Internet 10.1.1.253 00:00:4d:57:f8:e8 Gi 0/3 Vl 10 CP Internet 10.1.1.
PAGE 344
www.dell.com | support.dell.com • • DHCP MAC Source Address Validation on page 344 verifies a DHCP packet’s source hardware address matches the client hardware address field (CHADDR) in the payload. IP+MAC Source Address Validation on page 344 verifies that the IP source address and MAC source address are a legitimate pair. IP Source Address Validation IP Source Address Validation (SAV) prevents IP spoofing by forwarding only IP packets that have been validated against the DHCP binding table.
PAGE 345
IP Source Address Validation validates the IP source address of an incoming packet against the DHCP Snooping binding table. IP+MAC Source Address Validation ensures that the IP source address and MAC source address are a legitimate pair, rather validating each attribute individually. IP+MAC Source Address Validation cannot be configured with IP Source Address Validation. Step Task Command Syntax Command Mode 1 Allocate at least one FP block to the ipmacacl CAM region.
PAGE 346
www.dell.com | support.dell.
PAGE 347
15 Equal Cost Multi-Path This chapter describes how to configure: • • ECMP for Flow-based Affinity (E-Series), including the configurable hash algorithm Configurable ECMP Hash Algorithm (C- and S-Series) ECMP for Flow-based Affinity (E-Series) ECMP for Flow-based Affinity (E-Series) is available on platform: e The hashing algorithm on E-Series TeraScale and E-Series ExaScale are different: • • On ExaScale, the hashing algorithm is based on CRC, checksum, or XOR.
PAGE 348
www.dell.com | support.dell.com FTOS Behavior: In FTOS versions prior to 8.2.1.2, the ExaScale default hash-algorithm is 0. Beginning with version 8.2.1.2, the default hash-algorithm is 24. For information on the load-balancing criteria used by the hash algorithm to distribute traffic among ECMP paths and LAG members on an E-Series system, see E-Series load-balancing on page 452. Deterministic ECMP Next Hop Deterministic ECMP Next Hop arranges all ECMPs in order before writing them into the CAM.
PAGE 349
Task Specify the hash algorithm seed. Command Syntax Command Mode hash-algorithm seed value [linecard number] CONFIGURATION [port-set number] Range: 0 - 4095 In Figure 15-1, Core Router 1 is an E-Series TeraScale and Core Router 2 is an E-Series ExaScale. They have similar configurations and have routes for prefix P with two possible next-hops.
PAGE 350
www.dell.com | support.dell.com Configurable ECMP Hash Algorithm (C- and S-Series) Configurable ECMP Hash Algorithm (C- and S-Series) is available on platforms: cs On C-Series and S-Series, the hash-algorithm command is specific to ECMP groups and has a different default from the E-Series (see Configurable Hash Algorithm (E-Series)). The default ECMP hash configuration is crc-lower, which takes the lower 32 bits of the hash key to compute the egress port.
PAGE 351
16 Force10 Resilient Ring Protocol Force10 Resilient Ring Protocol is supported on platforms ce s The E-Series ExaScale platform is supported with FTOS 8.1.1.0 and later. Force10 Resilient Ring Protocol (FRRP) provides fast network convergence to Layer 2 switches interconnected in a ring topology, such as a Metropolitan Area Network (MAN) or large campuses.
PAGE 352
www.dell.com | support.dell.com Each Transit node is also configured with a Primary port and a Secondary port on the ring, but the port distinction is ignored as long as the node is configured as a Transit node. If the ring is complete, the Master node logically blocks all data traffic in the transmit and receive directions on the Secondary port to prevent a loop.
PAGE 353
If the Master node does not receive the Ring Health Frame (RHF) before the fail-period timer expires (a configurable timer), the Master node moves from the Normal state to the Ring-Fault state and unblocks its Secondary port. The Master node also clears its forwarding table and sends a control frame to all other nodes, instructing them to also clear their forwarding tables. Immediately after clearing its forwarding table, each node starts learning the new topology.
PAGE 354
www.dell.com | support.dell.com In the example shown in Figure 16-2, FRRP 101 is a ring with its own Control VLAN, and FRRP 202 has its own Control VLAN running on another ring. A Member VLAN that spans both rings is added as a Member VLAN to both FRRP groups. Switch R3 has two instances of FRRP running on it: one for each ring. The example topology that follows shows R3 assuming the role of a Transit node for both FRRP 101 and FRRP 202. Figure 16-2.
PAGE 355
• • • • • • • • • • Ring Status Check Frames are transmitted by the Master Node at specified intervals. Multiple physical rings can be run on the same switch. One Master node is supported per ring. All other nodes are Transit nodes. Each node has 2 member interfaces: Primary and Secondary. There is no limit to the number of nodes on a ring. The Master node ring port states are: blocking, pre-forwarding, forwarding, and disabled.
PAGE 356
www.dell.com | support.dell.com Table 16-1. FRRP Components Concept Explanation Ring Interface State Each interface (port) that is part of the ring maintains one of four states • • • • Blocking State: Accepts ring protocol packets but blocks data packets. LLDP, FEFD, or other Layer 2 control packets are accepted. Only the master node Secondary port can enter this state. Pre-Forwarding State: A transition state before moving to the Forward state.
PAGE 357
• • • The Control VLAN is used to carry any data traffic; it carries only RHFs. The Control VLAN cannot have members that are not ring ports. If multiple rings share one or more member VLANs, they cannot share any links between them. • Member VLANs across multiple rings are not supported in Master nodes. • Each ring has only one Master node; all others are transit nodes. FRRP Configuration These are the tasks to configure FRRP.
PAGE 358
www.dell.com | support.dell.com 358 • • • • • • • All VLANS must be in Layer 2 mode. Only ring nodes can be added to the VLAN. A Control VLAN can belong to one FRRP group only. Control VLAN ports must be tagged. All ports on the ring must use the same VLAN ID for the Control VLAN. A VLAN cannot be configured as both a Control VLAN and Member VLAN on the same ring. Only two interfaces can be members of a Control VLAN (the Master Primary and Secondary ports).
PAGE 359
Step Command Syntax Command Mode Purpose 5 member-vlan vlan-id {range} CONFIG-FRRP Identify the Member VLANs for this FRRP group VLAN-ID, Range: VLAN IDs for the ring’s Member VLANS. 6 no disable CONFIG-FRRP Enable FRRP Configure and add the Member VLANs Control and Member VLANS are configured normally for Layer 2. Their status as Control or Member is determined at the FRRP group commands. For complete information about configuring VLANS in Layer 2 mode, see Chapter 26, Layer 2.
PAGE 360
www.dell.com | support.dell.com Step Command Syntax Command Mode Purpose 3 interface primary int slot/port secondary int slot/port control-vlan vlan id CONFIG-FRRP Assign the Primary and Secondary ports, and the Control VLAN for the ports on the ring. Interface: • For a 10/100/1000 Ethernet interface, enter the keyword keyword GigabitEthernet followed by the slot/port information.
PAGE 361
Command Syntax Command Mode Purpose clear frrp EXEC PRIVELEGED Clear the counters associated with all FRRP groups Show FRRP configuration Use the following command to view the configuration for the FRRP group. Command Syntax Command Mode Purpose show configuration CONFIG-FRRP Show the configuration for this FRRP group Show FRRP information Use one of the following commands show general FRRP information.
PAGE 362
www.dell.com | support.dell.com Figure 16-3 is an example of a basic FRRP topology. Below the figure are the associated CLI commands. Figure 16-3.
PAGE 363
17 Force10 Service Agent Force10 Service Agent is supported on platforms: ce FTSA is supported on the E-Series ExaScale platform with FTOS 8.2.1.0 and later. Accurate and timely resolution of problems in your system or network requires gathering relevant data at the time a condition manifests, and getting that information to administrators as soon as possible.
PAGE 364
www.dell.com | support.dell.com Configure Force10 Service Agent The minimal FTSA configuration is four steps: 1. Enable FTSA. See page 364. 2. Specify the SMTP server to which FTSA will send E-mails upon a trigger event. See page 365. 3. Specify the source E-mail address that FTSA should use when generating E-mails. See page 365. 4. Enable the FTSA messaging service for the default recipient (see page 366,) or: a Configure a non-default recipient. See page 367. a Enable FTSA messaging for the recipient.
PAGE 365
Figure 17-1. Displaying the Default FTSA Configuration Force10(conf-callhome)#show config ! call-home no enable-all server Force10 recipient ftsa@force10networks.com keyadd Force10DefaultPublicKey encrypt no enable Specify an SMTP Server for FTSA To specify the SMTP server that will receive and forward the E-mail messages generated by FTSA: Task Command Syntax Command Mode Specify an SMTP server in the form smtp.domain-name.com.
PAGE 366
www.dell.com | support.dell.com FTSA Messaging Service The purpose of FTSA is to automatically send information about the switch to the network administrators or Dell Force10 TAC, so that when there is a network problem, the relevant information is collected at the time the problem manifests.
PAGE 367
You must still explicitly enable messaging for each recipient, including the default recipient. Each recipient has a (user-configurable) mnemonic label. FTOS creates a CLI context based on this label from which you can enable messaging and modify the E-mail parameters for the recipient. You can enter the context for a recipient by entering the command server label from the CALLHOME context. For example, the default label is Force10.
PAGE 368
www.dell.com | support.dell.com To add a recipient, you first create a mnemonic label for it. FTOS uses this label to create an FTOS context in which you can configure the E-mail parameters for the recipient. For example, the default recipient is Dell Force10 TAC and the label for this recipient is Force10. FTOS creates the context conf-callhome-Force10 in which you can configure the parameters for E-mails destined for Dell Force10 TAC only, as shown in Figure 17-2. Figure 17-2.
PAGE 369
Per-recipient, you have a choice of sending FTSA E-mails in clear text or with PGP5 encryption. Messages to the default recipient are configured for encryption using a public encryption key, as shown in Figure 17-2. Step Task Command Command Mode 1 Copy the encryption key file to the internal flash. The key Force10DefaultPublicKey for the default recipient is packed with FTOS, so enable encryption for it, proceed to Step 3.
PAGE 370
www.dell.com | support.dell.com Set the Frequency of FTSA Type 3 Messages When messaging is enabled, FTSA sends an E-mail every 24 hours containing inventory information to all recipients. There is no facility for setting the frequency for individual recipients. Task Command Command Mode Set the frequency at which FTSA generates inventory E-mails.
PAGE 371
Task Command Command Mode All E-mails are generated in XML format by default. For Type 5 messages only, you may generate E-mails in clear text format. The configuration is per action list. message-format {xml | text} CALLHOME ACTIONLIST FTOS Behavior: FTOS versions prior to 8.2.1.0 diverted Type 5 messages to the internal flash root directory when you enter the command log-only. Beginning in version 8.2.1.0, FTOS stores these messages in /CALL-HOME-LOGs on the internal flash.
PAGE 372
www.dell.com | support.dell.com Figure 17-5. FTSA Type 2 Message Type - 2 00:25:36.893 UTC Thu Feb 19 2009 0036232 Force10 0 FTSA periodically generates Type 3 messages, which contain the output of the command show inventory. Figure 17-6.
PAGE 373
Figure 17-7. FTSA Type 4 Messages ---------------------------------Message Body----------------------------------------- Type - 4 01:57:46.453 UTC Fri Feb 20 2009 0036232 Force10 0 ---------------------------------Message Attachment-----------------------------------Chassis Type : E300 Chassis Mode : TeraScale Software Version : 7.8.1.
PAGE 374
www.dell.com | support.dell.com 2. Create the list of actions that FTSA should take if any of the conditions exist. See Create a Policy Action List on page 377. 3. Create a policy and assign a test list and action list. See Create a Policy and Assign a Test and Action List on page 379. 4. Set optional policy parameters. See Additional Policy Configurations on page 380 Figure 17-8.
PAGE 375
Table 17-1.
PAGE 376
www.dell.com | support.dell.com Table 17-2. Custom Policy Test Conditions Condition Keyword Description OID Memory Usage memory-free Per-CPU free memory in Megabytes. chSysProcessorMemSize * (1 chRpmMemUsageUtil) memory-free-percent Per-CPU total free memory in percent. 1 - chRpmMemUsageUtil memory-used Per-CPU total memory usage in Megabytes. chSysProcessorMemSize * chRpmMemUsageUtil memory-used-percent Per-CPU total memory usage in percent.
PAGE 377
• • • • increase—If the difference between successive samples, calculated by subtracting the first value from the last, is greater than or equal to the previously sampled value, then the action list is executed. less-than—If the value of the probed system variable is less than the specified value, then the action list is executed. not-equal-to—If the value of the probed system variable is not the same as the specified value, then the action list is executed.
PAGE 378
www.dell.com | support.dell.com 378 Add actions to a policy action list Once you create a policy action list, FTOS enters the CALLHOME ACTIONLIST context. The list you created is initially empty. You may choose one of three pre-defined action lists and add an unlimited number of custom actions. Table 17-3.
PAGE 379
To add a pre-defined list of actions to your policy action list: Task Command Command Mode Add a pre-defined list of actions to your policy action list. default-action [exception | hardware | software] CALLHOME ACTIONLIST You may add an unlimited number of three types of custom actions: Task Command Command Mode Execute a recovery action when FTSA reaches the test-limit. You may reload the chassis or reset an RPM or linecard.
PAGE 380
www.dell.com | support.dell.com Additional Policy Configurations Task Command Command Mode Associate a Dell Force10 TAC case number with the policy. Configure a case number only if you already have a case open with Dell Force10 for the policy. This case number is included in action-list messages sent to Dell Force10. case-number number CALLHOME POLICY Delay the subsequent execution of the test list after a match occurs.
PAGE 381
Figure 17-9. Configuring an FTSA Policy for a Linecard Down call-home admin-email pubsadmin@training10.com smtp server-address 192.168.1.1 no enable-all server Force10 recipient pubslab@training10.
PAGE 382
www.dell.com | support.dell.com Figure 17-11. FTSA Type 5 Message for a Linecard Down Policy ---------------------------------Message Body----------------------------------------- Type - 5 23:19:37.
PAGE 383
Figure 17-12. FTSA Type 5 Message for a Linecard Down Policy (continued) show logging driverlog linecard 1 23:19:46.191 UTC Wed Feb 25 2009 show logging driverlog linecard 1 [output omitted] show logging driverlog linecard 4 23:19:46.
PAGE 384
www.dell.com | support.dell.com Figure 17-13. 384 FTSA Type 5 Message for a Linecard Down Policy (continued) remote-exec cp dhsTestCp 23:19:54.597 UTC Wed Feb 25 2009 remote-exec cp dhsTestCp [output omitted] remote-exec cp dhsTestCp 23:20:00.
PAGE 385
Figure 17-14. FTSA Type 5 Message for a BGP Peer Down Policy ---------------------------------Message Body----------------------------------------- Type - 5 17:14:28.
PAGE 386
www.dell.com | support.dell.com Figure 17-15. Configuring an FTSA Policy for an Excessive CRC-error Condition call-home admin-email pubsadmin@training10.com smtp server-address 192.168.1.1 no enable-all server Force10 recipient pubslab@training10.
PAGE 387
Figure 17-17. FTSA Type 5 Message for an Excessive CRC-error Condition ---------------------------------Message Body----------------------------------------- Type - 5 21:10:04.
PAGE 388
www.dell.com | support.dell.com Figure 17-18. 388 Call-home Debug All during Type 5 Message Generation #02:13:49 : CALL-HOME: Sending the following email 02:13:49 : From: pubsadmin@training10.com To: pubslab@training10.com Subject: Type - 5 Attachment: ramdisk:/crcerror-21_10_04.685.txt 02:13:49 : Message: Type - 5 21:10:04.
PAGE 389
18 GARP VLAN Registration Protocol GARP VLAN Registration Protocol is supported on platform ces GVRP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Typical VLAN implementation involves manually configuring each Layer 2 switch that participates in a given VLAN. GARP VLAN Registration Protocol (GVRP), defined by the IEEE 802.1q specification, is a Layer 2 network protocol that provides for automatic VLAN configuration of switches.
PAGE 390
www.dell.com | support.dell.com Figure 18-1. GVRP Compatibility Error Message Force10(conf)#protocol spanning-tree pvst Force10(conf-pvst)#no disable % Error: GVRP running. Cannot enable PVST. ......... Force10(conf)#protocol spanning-tree mstp Force10(conf-mstp)#no disable % Error: GVRP running. Cannot enable MSTP. ......... Force10(conf)#protocol gvrp Force10(conf-gvrp)#no disable % Error: PVST running. Cannot enable GVRP. % Error: MSTP running. Cannot enable GVRP.
PAGE 391
Figure 18-2. GVRP Configuration Overview GVRP is configured globally and on all VLAN trunk ports for the edge and core switches. Edge Switches Edge Switches Core Switches VLANs 70-80 VLANs 10-20 VLANs 10-20 VLANs 30-50 VLANs 70-80 VLANs 30-50 NOTES: VLAN 1 mode is always fixed and cannot be configured All VLAN trunk ports must be configured for GVRP All VLAN trunk ports must be configured as 802.1Q Basic GVRP configuration is a 2-step process: 1. Enable GVRP globally. See page 392. 2.
PAGE 392
www.dell.com | support.dell.com Figure 18-3. Enabling GVRP Globally Force10(conf)#protocol gvrp Force10(config-gvrp)#no disable Force10(config-gvrp)#show config ! protocol gvrp no disable Force10(config-gvrp)# Enabling GVRP on a Layer 2 Interface Enable GVRP on a Layer 2 interface using the command gvrp enable in INTERFACE mode, as shown in Figure 18-4.
PAGE 393
Based on the configuration in the example shown in Figure 18-5, the interface 1/21 will not be removed from VLAN 34 or VLAN 35 despite receiving a GVRP Leave message. Additionally, the interface will not be dynamically added to VLAN 45 or VLAN 46, even if a GVRP Join message is received. Figure 18-5.
PAGE 394
www.dell.com | support.dell.com 394 FTOS displays Message 1 if an attempt is made to configure an invalid GARP timer. Message 1 GARP Timer Error Force10(conf)#garp timers join 300 % Error: Leave timer should be >= 3*Join timer.
PAGE 395
19 High Availability High Availability is supported on platforms: ces High availability is a collection of features that preserves system continuity by maximizing uptime and minimizing packet loss during system disruptions. To support all the features within the HA collection, you should have the latest boot code. The following table lists the boot code requirements as of this FTOS release. Component Boot Code E-Series TeraScale RPM 2.4.2.1 E-Series TeraScale Line Card 2.3.2.
PAGE 396
www.dell.com | support.dell.com Component Redundancy Dell Force10 systems eliminates single points of failure by providing dedicated or load-balanced redundancy for each component. RPM Redundancy The current version of FTOS supports 1+1 hitless Route Processor Module (RPM) redundancy. The primary RPM performs all routing, switching, and control operations while the standby RPM monitors the primary RPM.
PAGE 397
Boot the chassis with dual RPMs When you boot the system with two RPMs installed, the RPM in slot R0 is the primary RPM by default. Both RPMs should be running the same version of FTOS. You can configure either RPM to be the primary upon the next chassis reboot using the command redundancy primary from CONFIGURATION mode. Version compatibility between RPMs In general, the two RPMs should have the same FTOS version.
PAGE 398
www.dell.com | support.dell.com Automatic and manual RPM failover RPM failover is the process of the standby RPM becoming the primary RPM. FTOS fails over to the standby RPM when: 1. communication is lost between the standby and primary RPMs 2. you request a failover via the CLI 3. you remove the primary RPM Use the command show redundancy from EXEC Privilege mode to display the reason for the last failover. Figure 19-1.
PAGE 399
Communication between RPMs E-Series RPMs have three CPUs: Control Processor (CP), Routing Processor 1 (RP1), and Routing Processor 2 (RP2). The CPUs use Fast Ethernet connections to communicate to each other and to the line card CPUs (LP) using Inter-Processor Communication (IPC). The CP monitors the health status of the other processors by sending a heartbeat message.
PAGE 400
www.dell.com | support.dell.com Table 19-2. Failover Behaviors Platform Failover Trigger Failover Behavior e RP task or kernel crash on the primary RPM CP on the primary RPM detects the RP IPC timeout and notifies the standby RPM. The standby RPM initiates a failover. FTOS saves an RP application or kernel core dump, the CP trace log, and the CP IPC-related system status. Then the new primary RPM reboots the failed RPM.
PAGE 401
RPM synchronization Data between the two RPMs is synchronized immediately after bootup. Once the two RPMs have done an initial full synchronization (block sync), thereafter FTOS only updates changed data (incremental sync). The data that is synchronized consists of configuration data, operational data, state and status, and statistics depending on the FTOS version.
PAGE 402
www.dell.com | support.dell.com Figure 19-3. Using the redundancy force-failover rpm Command to Copy Software between RPMs Force10#redundancy force-failover rpm Peer RPM's SW version is different but HA compatible. Failover can be done by warm or hitless upgrade. All linecards will be reset during warm upgrade.
PAGE 403
Online Insertion and Removal You can add, replace, or remove chassis components while the chassis is operating. This section contains the following sub-sections: • • RPM Online Insertion and Removal on page 403 Line Card Online Insertion and Removal on page 403 RPM Online Insertion and Removal Dell Force10 systems are functional with only one RPM. If a second RPM is inserted, it comes online as the standby RPM, as shown in Figure 19-4.
PAGE 404
www.dell.com | support.dell.com Figure 19-5.
PAGE 405
Replace a line card If you are replacing a line card with a line card of the same type, you may replace the card without any additional configuration. If you are replacing a line card with a line card of a different type, remove the card and then remove the existing line card configuration using the command no linecard. If you do not, FTOS reports a card mismatch (Message 6) when you insert the new card, and the installed line card has a card mismatch status.
PAGE 406
www.dell.com | support.dell.com Hitless behavior is defined in the context of an RPM failover only and does not include line card, SFM, and power module failures. • • On the E-Series: Failovers triggered by software exception, hardware exception, forced failover via the CLI, and manual removal of the primary RPM are all hitless. On the C-Series: Only failovers via the CLI are hitless. The system is not hitless in any other scenario.
PAGE 407
Runtime System Health Check Runtime System Health Check is supported on platform: e FTOS runs a system health check to detect data transfer errors within the system. FTOS performs the check during normal operation by interspersing among, test frames among the data frames that carry user and system data. One such check is a data plane loopback test.
PAGE 408
www.dell.com | support.dell.com Software Component Health Monitoring On each of the line cards and the RPM, there are a number of software components. FTOS performs a periodic health check on each of these components by querying the status of a flag, which the corresponding component resets within a specified time. If any health checks on the RPM fail, then the FTOS fails over to standby RPM. If any health checks on a line card fails, FTOS resets the card to bring it back to the correct state.
PAGE 409
• • The kernel is the central component of an operating system that manages system processors and memory allocation and makes these facilities available to applications. A kernel core dump is the contents of the memory in use by the kernel at the time of an exception. An application core dump is the contents of the memory allocated to a failed application at the time of an exception. System Log Event messages provide system administrators diagnostics and auditing information.
PAGE 410
www.dell.com | support.dell.com Table 19-4 show the warm upgrade and downtime impact, if any, which each step. Table 19-4. Control Plane and Data Plane Status during Warm Upgrade Download 6.3.1.1 to Reboot RPM1 to RPMs Upgrade Initiate Warm Failover Reboot RPM0 to Upgrade RPM 0 7.6.1.0 Primary 7.6.1.0 Primary 7.6.1.0 Secondary 7.7.1.0 Secondary RPM 1 7.6.1.0 Secondary 7.7.1.0 Secondary 7.7.1.0 Primary 7.7.1.0 Primary Line Cards 7.6.1.0 7.6.1.0 7.7.1.0 7.7.1.
PAGE 411
Figure 19-8. Determining your System Pre-requisites for Cache Boot Force10#show rpm -- RPM card 0 -Status : active Next Boot : online Card Type : RPM - Route Processor Module (LC-EF3-RPM) Hardware Rev : 2.2i Hardware Revision 2.1 or later Num Ports : 1 Up Time : 1 day, 4 hr, 25 min Last Restart : reset by user FTOS Version : 4.7.5.427 Jumbo Capable : yes Specified boot code version CP Boot Flash : A: 2.4.1.1 [booted] B: 2.4.1.1 RP1 Boot Flash: A: 2.4.1.1 B: 2.4.1.1 [booted] RP2 Boot Flash: A: 2.4.1.
PAGE 412
www.dell.com | support.dell.com Select the Cache Boot Image Select the FTOS image that you want to cache using the command upgrade system-image, as shown in Figure 19-9. Dell Force10 recommends using the keyword all with this command to avoid any mis-matched configurations. Note: The cache boot feature is not enabled by default; you must copy the running configuration to the startup configuration (copy running-config startup-config) after selecting a cache boot image in order to enable it. Figure 19-9.
PAGE 413
Figure 19-10. Viewing the Cache Boot Configuration Force10#show boot system all Current system image information in the system: ============================================= Type Boot Type A B ---------------------------------------------------------------CP DOWNLOAD BOOT 4.7.5.427 invalid RP1 DOWNLOAD BOOT 4.7.5.427 invalid RP2 DOWNLOAD BOOT 4.7.5.427 invalid linecard 0 DOWNLOAD BOOT 4.7.5.427 invalid linecard 1 is not present. linecard 2 is not present. linecard 3 is not present.
PAGE 414
www.dell.com | support.dell.com In-Service Modular Hot-Fixes In-Service Modular Hot-Fixes are supported on platforms: e In-Service Modular Hot-Fixes provides a tool whereby you can install a patch while the system is on-line and running. This feature allows a patch to be added to a running FTOS process to obtain debugging information or to resolve a software issue in a deployed system. There is no need to reload or reboot the system when the patch is inserted.
PAGE 415
Note: The show patch command can be used on both the primary and secondary RPMs, as shown here: Force10(standby)#show patch Patch version Module E.1.1.bgp.1.0 bgp E.2.1.l2mgr.1.
PAGE 416
www.dell.com | support.dell.com You can select which process may attempt to restart, and the number of consecutive restart attempts before failover, but by default, every process causes a system reload or RPM failover. Task Command Syntax Command Mode Enable Process Restartability for a process or task.
PAGE 417
FTOS Behavior: When debug tacacs or debug radius is enabled, and the respective process restarts, FTOS does not continue to print debug messages after the restart; you must execute debug tacacs or debug radius again. This is because debugging is not saved to the running configuration, rather, FTOS marks the process for debugging with a flag that is cleared during the restart.
PAGE 418
| High Availability www.dell.com | support.dell.
PAGE 419
20 Internet Group Management Protocol Table 20-1. FTOS Support for IGMP and IGMP Snooping Feature Platform IGMP version 1, 2, and 3 ces IGMP Snooping version 1, 2, and 3 ces Note: When both E-Series TeraScale and ExaScale are supported, only the e symbol is shown. If a feature is supported by one or the other chassis, the specific symbols are shown: e t for E-Series TeraScale or ex for E-Series ExaScale.
PAGE 420
www.dell.com | support.dell.com IGMP version 2 IGMP version 2 improves upon version 1 by specifying IGMP Leave messages, which allows hosts to notify routers that they no longer care about traffic for a particular group. Leave messages reduce the amount of time that the router takes to stop forwarding traffic for a group to a subnet (leave latency) after the last host leaves the group.
PAGE 421
Sending an Unsolicited IGMP Report A host does not have to wait for a general query to join a group. It may send an unsolicited IGMP Membership Report, also called an IGMP Join message, to the querier. Leaving a Multicast Group 1. A host sends a membership report of type 0x17 (IGMP Leave message) to the all routers multicast address 224.0.0.2 when it no longer cares about multicast traffic for a particular group. 2.
PAGE 422
www.dell.com | support.dell.com Figure 20-3. Version (4) IHL IGMP version 3 Membership Report Packet Format TOS (0xc0) Total Length Flags Frag Offset TTL (1) Protocol (2) Header Checksum Type Reserved Src IP Addr Dest IP Addr (224.0.0.
PAGE 423
Figure 20-4. IGMP Membership Reports: Joining and Filtering Membership Reports: Joining and Filtering 3 Interface Multicast Group Filter Source Source Address Timer Mode Timer 1/1 224.1.1.1 GMI Exclude None 1/1 224.1.1.1 Include 10.11.1.1 GMI 1/1 224.1.1.1 Include 10.11.1.1 GMI IGMP Group-and-Source Specific Query Non-Querier Querier Type: 0x11 Group Address: 244.1.1.1 Number of Sources: 1 Source Address: 10.11.1.1 1/1 10.11.1.
PAGE 424
www.dell.com | support.dell.com Figure 20-5. IGMP Membership Queries: Leaving and Staying in Groups Membership Queries: Leaving and Staying Non-Querier Querier Interface Multicast Group Filter Source Source Address Timer Mode Timer 1/1 224.1.1.1 Include 10.11.1.1 LQMT 10.11.1.2 LQMT Non-querier builds identical table and waits Other Querier Present Interval to assume Querier role 1/1 2/1 224.2.2.2 GMI Exclude None IGMP Group-and-Source Specific Query Type: 0x11 Group Address: 224.1.1.
PAGE 425
Figure 20-6. Viewing IGMP-enabled Interfaces Force10#show ip igmp interface gig 7/16 GigabitEthernet 7/16 is up, line protocol is up Internet address is 10.87.3.2/24 IGMP is enabled on interface IGMP query interval is 60 seconds IGMP querier timeout is 300 seconds IGMP max query response time is 10 seconds Last member query response interval is 199 ms IGMP activity: 0 joins, 0 leaves IGMP querying router is 10.87.3.
PAGE 426
www.dell.com | support.dell.com Figure 20-8. Viewing Static and Learned IGMP Groups Force10(conf-if-gi-1/0)#do sho ip igmp groups Total Number of Groups: 2 IGMP Connected Group Membership Group Address Interface Uptime 224.1.1.1 GigabitEthernet 1/0 00:00:03 224.1.2.1 GigabitEthernet 1/0 00:56:55 Expires Never 00:01:22 Last Reporter CLI 1.1.1.2 Adjusting Timers View the current value of all IGMP timers using the command show ip igmp interface from EXEC Privilege mode, as shown in Figure 20-6.
PAGE 427
2. When a router receives a query it compares the IP address of the interface on which it was received with the source IP address given in the query. If the receiving router IP address is greater than the source address given in the query, the router stops sending queries. By this method, the router with the lowest IP address on the subnet is elected querier and continues to send queries. 3.
PAGE 428
www.dell.com | support.dell.com IGMP Snooping Multicast packets are addressed with multicast MAC addresses, which represent a group of devices, rather than one unique device. Switches forward multicast frames out of all ports in a VLAN by default, even though there may be only some interested hosts, which is a waste of bandwidth.
PAGE 429
Figure 20-10. Enabling IGMP Snooping Force10(conf-if-vl-100)#show config ! interface Vlan 100 no ip address ip igmp snooping fast-leave shutdown Force10(conf-if-vl-100)# Disabling Multicast Flooding If the switch receives a multicast packet that has an IP address of a group it has not learned (unregistered frame), the switch floods that packet out of all ports on the VLAN.
PAGE 430
www.dell.com | support.dell.com • When enabled, IGMP snooping Querier starts after one query interval in case no IGMP general query (with IP SA lower than its VLAN IP address) is received on any of its VLAN members. Adjusting the Last Member Query Interval When the querier receives a leave message from a receiver, it sends a group-specific query out of the ports specified in the forwarding table. If no response is received, it sends another.
PAGE 431
21 Interfaces This chapter describes interface types, both physical and logical, and how to configure them with FTOS. 10/100/1000 Mbps Ethernet, Gigabit Ethernet, and 10 Gigabit Ethernet interfaces are supported on platforms ces SONET interfaces are only supported on platform e and are covered in the SONET/SDH chapter.
PAGE 432
www.dell.com | support.dell.
PAGE 433
Figure 21-1. show interfaces Command Example Force10#show interfaces tengigabitethernet 1/0 TenGigabitEthernet 1/0 is up, line protocol is up Hardware is Force10Eth, address is 00:01:e8:05:f3:6a Current address is 00:01:e8:05:f3:6a Pluggable media present, XFP type is 10GBASE-LR. Medium is MultiRate, Wavelength is 1310nm XFP receive power reading is -3.7685 Interface index is 67436603 Internet address is 65.113.24.
PAGE 434
www.dell.com | support.dell.com Figure 21-3. Interfaces listed in the show running-config Command (Partial) Force10#show running Current Configuration ...
PAGE 435
To confirm that the interface is enabled, use the show config command in the INTERFACE mode. To leave the INTERFACE mode, use the exit command or end command. The user can not delete a physical interface. Physical Interfaces The Management Ethernet interface, is a single RJ-45 Fast Ethernet port on the Route Processor Module (RPM) of the C-Series and E-Series, and provides dedicated management access to the system.
PAGE 436
www.dell.com | support.dell.com Overview of Layer Modes On all systems running FTOS, you can place physical interfaces, port channels, and VLANs in Layer 2 mode or Layer 3 mode. By default, VLANs are in Layer 2 mode. Table 21-1.
PAGE 437
For information on enabling and configuring Spanning Tree Protocol, see Chapter 10, Layer 2, on page 47. To view the interfaces in Layer 2 mode, use the command show interfaces switchport in the EXEC mode. Configure Layer 3 (Network) Mode When you assign an IP address to a physical interface, you place it in Layer 3 mode. Use the ip address command and no shutdown command in INTERFACE mode to enable Layer 3 mode on an individual interface.
PAGE 438
www.dell.com | support.dell.com Command Syntax Command Mode Purpose ip address ip-address mask [secondary] INTERFACE Configure a primary IP address and mask on the interface. The ip-address must be in dotted-decimal format (A.B.C.D) and the mask must be in slash format (/xx). Add the keyword secondary if the IP address is the interface’s backup IP address. You can only configure one (1) primary IP address per interface. You can configure up to 255 secondary IP addresses on a single interface.
PAGE 439
Management Interfaces Configure Management Interfaces on the E-Series and C-Series On the E-Series and C-Series, the dedicated Management interface is located on the RPM and provides management access to the system. You can configure this interface with FTOS, but the configuration options on this interface are limited. Gateway addresses and IP addresses cannot be configured if it appears in the main routing table of FTOS. In addition, Proxy ARP is not supported on this interface.
PAGE 440
www.dell.com | support.dell.com Important Things to Remember — virtual-ip • • • • • • virtual-ip is a CONFIGURATION mode command. You may enter an IPv4 or IPv6 address. When applied, the management port on the primary RPM assumes the virtual IP address.
PAGE 441
Displaying Information on a Management Interface To view information about the primary RPM management port, use the show interface Managementethernet command in EXEC or EXEC Privilege mode. If there are two RPMs on the system, you cannot view information on the interface. Figure 21-9.
PAGE 442
www.dell.com | support.dell.com VLAN Interfaces VLANs are logical interfaces and are, by default, in Layer 2 mode. Physical interfaces and port channels can be members of VLANs. For more information on VLANs and Layer 2, refer to Chapter 10, Layer 2, on page 47. See also Chapter 18, VLAN Stacking, on page 367. Note: To monitor VLAN interfaces, use the Management Information Base for Network Management of TCP/IP-based internets: MIB-II (RFC 1213).
PAGE 443
Loopback Interfaces A Loopback interface is a virtual interface in which the software emulates an interface. Packets routed to it are processed locally. Since this interface is not a physical interface, you can configure routing protocols on this interface to provide protocol stability. You can place Loopback interfaces in default Layer 3 mode.
PAGE 444
www.dell.com | support.dell.com Port Channel Interfaces Port channel interfaces support link aggregation, as described in IEEE Standard 802.3ad. This section covers the following topics: • • • • Port channel definition and standards on page 444 Port channel benefits on page 444 Port channel implementation on page 444 Configuration task list for port channel interfaces on page 446 Port channel definition and standards Link aggregation is defined by IEEE 802.
PAGE 445
• Dynamic—Port channels that are dynamically configured using Link Aggregation Control Protocol (LACP). For details, see Chapter 25, Link Aggregation Control Protocol. Table 21-2. Number of Port-channels per Platform Platform Port-channels Members/Channel E-Series 255 16 C-Series 128 8 S-Series: S50 and S25 52 8 S-Series: S55, S60 and S4810 128 8 Table 21-3. Maximum number of configurable Port-channels Platform Port-channels E-Series ExaScale 512 Members/Channel 64 Table 21-4.
PAGE 446
www.dell.com | support.dell.com The common speed is determined when the port channel is first enabled. At that time, the software checks the first interface listed in the port channel configuration. If that interface is enabled, its speed configuration becomes the common speed of the port channel. If the other interfaces configured in that port channel are configured with a different speed, FTOS disables them.
PAGE 447
The port channel is now enabled and you can place the port channel in Layer 2 or Layer 3 mode. Use the switchport command to place the port channel in Layer 2 mode or configure an IP address to place the port channel in Layer 3 mode. You can configure a port channel as you would a physical interface by enabling or configuring protocols or assigning access control lists.
PAGE 448
www.dell.com | support.dell.com Figure 21-13.
PAGE 449
Figure 21-15. Error Message Force10(conf-if-portch)#show config ! interface Port-channel 5 no ip address switchport channel-member GigabitEthernet 1/6 Force10(conf-if-portch)#int gi 1/6 Force10(conf-if)#ip address 10.56.4.4 /24 % Error: Port is part of a LAG Gi 1/6. Force10(conf-if)# Error message Reassign an interface to a new port channel An interface can be a member of only one port channel.
PAGE 450
www.dell.com | support.dell.com Figure 21-16.
PAGE 451
To add a port channel to a VLAN, use either of the following commands: Command Syntax Command Mode Purpose tagged port-channel id number INTERFACE VLAN Add the port channel to the VLAN as a tagged interface. An interface with tagging enabled can belong to multiple VLANs. untagged port-channel id number INTERFACE VLAN Add the port channel to the VLAN as an untagged interface. An interface without tagging enabled can belong to only one VLAN.
PAGE 452
www.dell.com | support.dell.com Load balancing through port channels FTOS uses hash algorithms for distributing traffic evenly over channel members in a port channel (LAG). The hash algorithm distributes traffic among ECMP paths and LAG members. The distribution is based on a flow, except for packet-based hashing. A flow is identified by the hash and is assigned to one link. In packet-based hashing, a single flow can be distributed on the LAG and uses one link.
PAGE 453
On the E-Series, to change the 5-tuple default to 3-tuple, MAC, or packet-based, use the following command in CONFIGURATION mode: Command Syntax Command Mode Purpose [no] load-balance [ip-selection {3-tuple | packet-based}] [mac] CONFIGURATION To designate a method to balance traffic over a port channel. By default, IP 5-tuple is used to distribute traffic over members port channel. ip-selection 3-tuple—Distribute IP traffic based on IP source address, IP destination address, and IP protocol type.
PAGE 454
www.dell.com | support.dell.com IPv4, IPv6, and non-IP traffic handling on the E-Series The table below presents the combinations of the load-balance command and their effect on traffic types. Table 21-7.
PAGE 455
Hash algorithm The load-balance command discussed above selects the hash criteria applied to port channels. If even distribution is not obtained with the load-balance command, the hash-algorithm command can be used to select the hash scheme for LAG, ECMP and NH-ECMP. The 12 bit Lag Hash can be rotated or shifted till the desired hash is achieved. The nh-ecmp option allows you to change the hash value for recursive ECMP routes independently of non-recursive ECMP routes.
PAGE 456
www.dell.com | support.dell.com • • dest-ip — uses destination IP address as part of the hash key lsb — always uses the least significant bit of the hash key to compute the egress port To change to another method, use the following command in the CONFIGURATION mode: Command Syntax Command Mode Purpose hash-algorithm ecmp {crc-upper} | {dest-ip} | {lsb} CONFIGURATION Change to another algorithm.
PAGE 457
The show configuration command is also available under the interface range mode. This command allows you to display the running configuration only for interfaces that are part of interface range. Bulk Configuration Examples The following are examples of using the interface range command for bulk configuration: • Create a single-range • Create a multiple-range • Exclude duplicate entries • Exclude a smaller port range • Overlap port ranges • Commas • Add ranges Create a single-range Figure 21-20.
PAGE 458
www.dell.com | support.dell.com Figure 21-23. Interface Range Prompt Excluding a Smaller Port Range Force10(conf)#interface range gigabitethernet 2/0 - 23 , gigab 2/1 - 10 Force10(conf-if-range-gi-2/0-23)# Overlap port ranges If overlapping port ranges are specified, the port range is extended to the smallest start port number and largest end port number: Figure 21-24.
PAGE 459
Interface Range Macros The user can define an interface-range macro to automatically select a range of interfaces for configuration. Before you can use the macro keyword in the interface-range macro command string, you must define the macro.
PAGE 460
www.dell.com | support.dell.com Choose an Interface-range Macro To use an interface-range macro in the interface range command, enter this command: Command Syntax Command Mode Purpose interface range macro name CONFIGURATION Selects the interfaces range to be configured using the values saved in a named interface-range macro. The example below shows how to change to the interface-range configuration mode using the interface-range macro named “test”.
PAGE 461
Figure 21-27. Command Example: monitor interface Force10#monitor interface gi 3/1 Force10 uptime is 1 day(s), 4 hour(s), 31 minute(s) Monitor time: 00:00:00 Refresh Intvl.
PAGE 462
www.dell.com | support.dell.com To test the condition of cables on 10/100/1000 BASE-T modules, use the tdr-cable-test command: Step 1 Command Syntax Command Mode Usage tdr-cable-test gigabitethernet / EXEC Privilege To test for cable faults on the GigabitEthernet cable. • Between two ports, the user must not start the test on both ends of the cable. • The user must enable the interface before starting the test. • The port should be enabled to run the test or the test prints an error message.
PAGE 463
• Changes made do not affect any ongoing debounces. The timer changes take affect from the next debounce onward. Assign a debounce time to an interface Command Syntax Command Mode Purpose link debounce time [milliseconds] INTERFACE Enter the time to delay link status change notification on this interface. Range: 100-5000 ms • • Figure 21-28.
PAGE 464
www.dell.com | support.dell.com When an E300 system boots up and a single SFM is active this configuration, any ports configured with this feature will be shut down. All other ports are booted up. Similarly, if an SFM fails (or is removed) in an E300 system with two SFM, ports configured with this feature will be shut down. All other ports are treated normally. When a second SFM is installed or replaced, all ports are booted up and treated as normally.
PAGE 465
Enable Link Dampening Enable link dampening using the command dampening from INTERFACE mode, as shown in Figure 21-30. Figure 21-30. Configuring Link Dampening R1(conf-if-gi-1/1)#show config ! interface GigabitEthernet 1/1 ip address 10.10.19.
PAGE 466
www.dell.com | support.dell.com Figure 21-33.
PAGE 467
The globally assigned 48-bit Multicast address 01-80-C2-00-00-01 is used to send and receive pause frames. To allow full duplex flow control, stations implementing the pause operation instruct the MAC to enable reception of frames with destination address equal to this multicast address. The PAUSE frame is defined by IEEE 802.3x and uses MAC Control frames to carry the PAUSE commands. Ethernet Pause Frames are supported on full duplex only.
PAGE 468
www.dell.com | support.dell.com Enable Pause Frames Note: On the C-Series and S-Series platforms, Ethernet Pause Frames TX should be enabled only after consulting with the Dell Force10 Technical Assistance Center. Ethernet Pause Frames flow control must be enabled on all ports on a chassis or a line card. If not, the system may exhibit unpredictable behavior. On the C-Series and S-Series systems, the flow-control sender and receiver must be on the same port-pipe.
PAGE 469
Configure MTU Size on an Interface If a packet includes a Layer 2 header, the difference in bytes between the link MTU and IP MTU must be large enough to include the Layer 2 header. For example, for VLAN packets, if the IP MTU is 1400 bytes, the Link MTU must 1422 bytes or greater to accommodate the 22-byte VLAN header: 1400-byte IP MTU + 22-byte VLAN Tag = 1422-byte link MTU On the E-Series and C-Series, you configure the Link MTU size on an interface by entering the mtu command.
PAGE 470
www.dell.com | support.dell.com Port-pipes A port pipe is a Dell Force10 specific term for the hardware path that packets follow through a system. Port pipes travel through a collection of circuits (ASICs) built into line cards and RPMs on which various processing events for the packets occur. One or two port pipes process traffic for a given set of physical interfaces or a port-set. The E300 only supports one port pipe per slot.
PAGE 471
Auto-Negotiation on Ethernet Interfaces Setting speed and duplex mode of Ethernet Interfaces By default, auto-negotiation of speed and duplex mode is enabled on 10/100/1000 Base-T Ethernet interfaces. Only 10GE interfaces do not support auto-negotiation. When using 10GE interfaces, verify that the settings on the connecting devices are set to no auto-negotiation. Note: Starting with FTOS 7.8.1.
PAGE 472
www.dell.com | support.dell.com Note: The show interfaces status command displays link status, but not administrative status. For link and administrative status, use show ip interface [interface | brief | linecard slot-number] [configuration]. Figure 21-34.
PAGE 473
Figure 21-36. Setting Auto-Negotiation Options Force10(conf)# int gi 0/0 Force10(conf-if)#neg auto Force10(conf-if-autoneg)# ? end Exit from configuration mode exit Exit from autoneg configuration mode mode Specify autoneg mode no Negate a command or set its defaults For details on the speed, duplex, and negotiation auto commands, see the Interfaces chapter of the FTOS Command Reference.
PAGE 474
www.dell.com | support.dell.com Figure 21-37.
PAGE 475
Figure 21-39.
PAGE 476
www.dell.com | support.dell.com Dynamic Counters By default, counting for the following four applications is enabled: • • • • IPFLOW IPACL L2ACL L2FIB For remaining applications, FTOS automatically turns on counting when the application is enabled, and is turned off when the application is disabled. Please note that if more than four counter-dependent applications are enabled on a port pipe, there is an impact on line rate performance.
PAGE 477
Clear interface counters The counters in the show interfaces command are reset by the clear counters command. This command does not clear the counters captured by any SNMP program.
PAGE 478
| Interfaces www.dell.com | support.dell.
PAGE 479
22 IPv4 Addressing IPv4 Addressing is supported on platforms ces IPv4 addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. FTOS supports various IP addressing features. This chapter explains the basics of Domain Name Service (DNS), Address Resolution Protocol (ARP), and routing principles and their implementation in FTOS.
PAGE 480
www.dell.com | support.dell.com At its most basic level, an IP address is 32-bits composed of network and host portions and represented in dotted decimal format. For example, 00001010110101100101011110000011 is represented as 10.214.87.131 For more information on IP addressing, refer to RFC 791, Internet Protocol. Implementation Information In FTOS, you can configure any IP address as a static route except IP addresses already assigned to interfaces. Note: FTOS versions 7.7.1.
PAGE 481
To assign an IP address to an interface, use these commands in the following sequence, starting in the CONFIGURATION mode: Step Command Syntax Command Mode Purpose interface interface CONFIGURATION Enter the keyword interface followed by the type of interface and slot/port information: • For a 1-Gigabit Ethernet interface, enter the keyword GigabitEthernet followed by the slot/port information. • For a Loopback interface, enter the keyword loopback followed by a number from 0 to 16383.
PAGE 482
www.dell.com | support.dell.com Force10#show ip int gi 0/8 GigabitEthernet 0/8 is up, line protocol is up Internet address is 10.69.8.1/24 Broadcast address is 10.69.8.
PAGE 483
Figure 22-3. show ip route static Command Example (partial) Force10#show ip route static Destination Gateway ----------------S 2.1.2.0/24 Direct, Nu 0 S 6.1.2.0/24 via 6.1.20.2, S 6.1.2.2/32 via 6.1.20.2, S 6.1.2.3/32 via 6.1.20.2, S 6.1.2.4/32 via 6.1.20.2, S 6.1.2.5/32 via 6.1.20.2, S 6.1.2.6/32 via 6.1.20.2, S 6.1.2.7/32 via 6.1.20.2, S 6.1.2.8/32 via 6.1.20.2, S 6.1.2.9/32 via 6.1.20.2, S 6.1.2.10/32 via 6.1.20.2, S 6.1.2.11/32 via 6.1.20.2, S 6.1.2.12/32 via 6.1.20.2, S 6.1.2.13/32 via 6.1.20.2, S 6.
PAGE 484
www.dell.com | support.dell.com To view the configured static routes for the management port, use the show ip management-route command in the EXEC privilege mode. Figure 22-4. show ip management-route Command Example Force10>show ip management-route Destination ----------1.1.1.0/24 172.16.1.0/24 172.31.1.0/24 Gateway ------172.31.1.250 172.31.1.
PAGE 485
Command Syntax Command Mode Purpose ip domain-lookup CONFIGURATION Enable dynamic resolution of host names. ip name-server ipv4-address [ipv4-address2 ... ipv4-address6] CONFIGURATION Specify up to 6 IPv4 or IPv6 name servers. The order you entered the servers determines the order of their use. You may have IPv4 and IPv6 name servers configured at the same time. ipv6 name-server ipv6-address [ipv6-address2 ... ipv6-address6] To view current bindings, use the show hosts command. Figure 22-5.
PAGE 486
www.dell.com | support.dell.com Command Syntax Command Mode Purpose ip domain-list name CONFIGURATION Configure names to complete unqualified host names. Configure this command up to 6 times to specify a list of possible domain names. FTOS searches the domain names in the order they were configured until a match is found or the list is exhausted. DNS with traceroute To configure your switch to perform DNS with traceroute, follow the steps below in the CONFIGURATION mode.
PAGE 487
ARP FTOS uses two forms of address resolution: ARP and Proxy ARP. Address Resolution Protocol (ARP) runs over Ethernet and enables endstations to learn the MAC addresses of neighbors on an IP network. Over time, FTOS creates a forwarding table mapping the MAC addresses to their corresponding IP address. This table is called the ARP Cache and dynamically learned addresses are removed after a defined period of time. For more information on ARP, see RFC 826, An Ethernet Address Resolution Protocol.
PAGE 488
www.dell.com | support.dell.com Command Syntax Command Mode Purpose arp ip-address mac-address interface CONFIGURATION Configure an IP address and MAC address mapping for an interface. • ip-address: IP address in dotted decimal format (A.B.C.D). • mac-address: MAC address in nnnn.nnnn.nnnn format • interface: enter the interface type slot/port information. These entries do not age and can only be removed manually. To remove a static ARP entry, use the no arp ip-address command syntax.
PAGE 489
Command Syntax Command Mode Purpose clear arp-cache [interface | ip ip-address] [no-refresh] EXEC privilege Clear the ARP caches for all interfaces or for a specific interface by entering the following information: • For a 1-Gigabit Ethernet interface, enter the keyword GigabitEthernet followed by the slot/port information. • For a port channel interface, enter the keyword port-channel followed by a number from 1 to 255 for TeraScale and ExaScale, 1 to 32 for EtherScale.
PAGE 490
www.dell.com | support.dell.com Beginning with version 8.3.1.0, when a Gratuitous ARP is received, FTOS installs an ARP entry on all 3 CPUs. Task Command Syntax Command Mode Enable ARP learning via gratuitous ARP. arp learn-enable CONFIGURATION ARP Learning via ARP Request In FTOS versions prior to 8.3.1.0, FTOS learns via ARP Requests only if the Target IP specified in the packet matches the IP address of the receiving router interface.
PAGE 491
Configurable ARP Retries In FTOS versions prior to 8.3.1.0 the number of ARP retries is set to 5 and is not configurable. After 5 retries, FTOS backs off for 20 seconds before it sends a new request. Beginning with FTOS version 8.3.1.0, the number of ARP retries is configurable. The backoff interval remains at 20 seconds. Task Command Syntax Command Mode Set the number of ARP retries. arp retries number CONFIGURATION Default: 5 Range: 5-20 Display all ARP entries learned via gratuitous ARP.
PAGE 492
www.dell.com | support.dell.com Enable ICMP unreachable messages By default, ICMP unreachable messages are disabled. When enabled ICMP unreachable messages are created and sent out all interfaces. To disable ICMP unreachable messages, use the no ip unreachable command.
PAGE 493
Configuring UDP Helper Configuring FTOS to direct UDP broadcast is a two-step process: 1. Enable UDP helper and specify the UDP ports for which traffic is forwarded. See Enabling UDP Helper on page 493. 2. Configure a broadcast address on interfaces that will receive UDP broadcast traffic. See Configuring a Broadcast Address on page 494. Important Points to Remember about UDP Helper • • • • The existing command ip directed broadcast is rendered meaningless if UDP helper is enabled on the same interface.
PAGE 494
www.dell.com | support.dell.com Configuring a Broadcast Address Configure a broadcast address on an interface using the command ip udp-broadcast-address, as shown in Figure 22-12. Figure 22-12. Configuring a Broadcast Address Force10(conf-if-vl-100)#ip udp-broadcast-address 1.1.255.255 Force10(conf-if-vl-100)#show config ! interface Vlan 100 ip address 1.1.0.1/24 ip udp-broadcast-address 1.1.255.
PAGE 495
UDP Helper with Broadcast-all Addresses When the destination IP address of an incoming packet is the IP broadcast address, FTOS rewrites the address to match the configured broadcast address. In Figure 22-14: 1. Packet 1 is dropped at ingress if no UDP helper address is configured. 2. If UDP helper (using the command ip udp-helper udp-port) is enabled, and the UDP destination port of the packet matches the UDP port configured, the system changes the destination address to the configured broadcast 1.1.255.
PAGE 496
www.dell.com | support.dell.com In Figure 22-15, Packet 1 has the destination IP address 1.1.1.255, which matches the subnet broadcast address of VLAN 101. If UDP helper is configured and the packet matches the specified UDP port, then the system changes the address to the configured IP broadcast address and floods the packet on VLAN 101. Packet 2 is sent from host on VLAN 101. It has a broadcast MAC address and a destination IP address of 1.1.1.255.
PAGE 497
UDP Helper with No Configured Broadcast Addresses • • If the incoming packet has a broadcast destination IP address, then the unaltered packet is routed to all Layer 3 interfaces. If the Incoming packet has a destination IP address that matches the subnet broadcast address of any interface, then the unaltered packet is routed to the matching interfaces. Troubleshooting UDP Helper Display debugging information using the command debug ip udp-helper, as shown in Figure 22-17. Figure 22-17.
PAGE 498
| IPv4 Addressing www.dell.com | support.dell.
PAGE 499
23 IPv6 Addressing IPv6 Addressing is supported on platforms: ces Note: The basic IPv6 commands are supported on all platforms. However, not all IPv6-based features are supported on all platforms and on all releases. Refer to Table 23-2 to see which FTOS version supports an IPv6 feature on each platform. IPv6 (Internet Protocol Version 6) is the successor to IPv4. Due to the extremely rapid growth in internet users, and IP addresses, IPv4 is reaching its maximum usage.
PAGE 500
www.dell.com | support.dell.com Some key changes in IPv6 are: • • • • Extended Address Space Stateless Autoconfiguration Header Format Simplification Improved Support for Options and Extensions Extended Address Space The address format is extended from 32 bits to 128 bits. This not only provides room for all anticipated needs, it allows for the use of a hierarchical address space structure to optimize global addressing.
PAGE 501
IPv6 Headers The IPv6 header has a fixed length of 40 bytes. This provides 16 bytes each for Source and Destination information, and 8 bytes for general header information. The IPv6 header includes the following fields: • • • • • • • • Version (4 bits) Traffic Class (8 bits) Flow Label (20 bits) Payload Length (16 bits) Next Header (8 bits) Hop Limit (8 bits) Source Address (128 bits) Destination Address (128 bits) IPv6 provides for Extension Headers. Extension Headers are used only if necessary.
PAGE 502
www.dell.com | support.dell.com Traffic Class (8 bits) The Traffic Class field deals with any data that needs special handling. These bits define the packet priority and are defined by the packet Source. Sending and forwarding routers use this field to identify different IPv6 classes and priorities. Routers understand the priority settings and handle them appropriately during conditions of congestion.
PAGE 503
Table 23-1. Next Header field values (continued) Value Description 59 No Next Header 60 Destinations option header Note: This is not a comprehensive table of Next Header field values. Refer to the Internet Assigned Numbers Authority (IANA) web page http://www.iana.org/assignments/protocol-numbers for a complete and current listing. Hop Limit (8 bits) The Hop Limit field shows the number of hops remaining for packet processing.
PAGE 504
www.dell.com | support.dell.com Hop-by-Hop Options header The Hop-by-Hop options header contains information that is examined by every router along the packet’s path. It follows the IPv6 header and is designated by the Next Header value 0 (zero) (Table 23-1). When a Hop-by-Hop Options header is not included, the router knows that it does not have to process any router specific information and immediately processes the packet to its final destination.
PAGE 505
• • • • • • 2001:0db8:0000:0000:0000:0000:1428:57ab 2001:0db8:0000:0000:0000::1428:57ab 2001:0db8:0:0:0:0:1428:57ab 2001:0db8:0:0::1428:57ab 2001:0db8::1428:57ab 2001:db8::1428:57ab IPv6 networks are written using Classless Inter-Domain Routing (CIDR) notation. An IPv6 network (or subnet) is a contiguous group of IPv6 addresses the size of which must be a power of two; the initial bits of addresses, which are identical for all hosts in the network, are called the network's prefix.
PAGE 506
www.dell.com | support.dell.com Implementing IPv6 with FTOS FTOS supports both IPv4 and IPv6, and both may be used simultaneously in your system. Note: Dell Force10 recommends that you use FTOS version 7.6.1.0 or later when implementing IPv6 functionality on an E-Series system. Table 23-2 lists the FTOS Version in which an IPv6 feature became available for each platform. The sections following the table give some greater detail about the feature.
PAGE 507
Table 23-2. FTOS and IPv6 Feature Support (continued) IS-IS for IPv6 7.5.1 8.2.1 8.4.2 8.4.2 Chapter 24, “Intermediate System to Intermediate System,” on page 523 in the FTOS Configuration Guide IPv6 IS-IS in the FTOS Command Line Reference Guide IS-IS for IPv6 support for redistribution 7.6.1 8.2.1 8.4.2 8.4.2 Chapter 24, “Intermediate System to Intermediate System,” on page 523 in the FTOS Configuration Guide IPv6 IS-IS in the FTOS Command Line Reference Guide ISIS for IPv6 support for 7.6.
PAGE 508
www.dell.com | support.dell.com Table 23-2. FTOS and IPv6 Feature Support (continued) PIM-SSM for IPv6 7.5.1 8.2.1 8.4.2 8.4.2 IPv6 Multicast in this chapter IPv6 PIM in the FTOS Command Line Reference Guide MLDv1/v2 7.4.1 8.2.1 8.4.2 8.4.2 IPv6 Multicast in this chapter Multicast IPv6 in the FTOS Command Line Reference Guide MLDv1 Snooping 7.4.1 8.2.1 8.4.2 8.4.2 IPv6 Multicast in this chapter Multicast IPv6 in the FTOS Command Line Reference Guide MLDv2 Snooping 8.3.1.0 8.3.1.0 8.
PAGE 509
Path MTU (Maximum Transmission Unit) defines the largest packet size that can traverse a transmission path without suffering fragmentation. Path MTU for IPv6 uses ICMPv6 Type-2 messages to discover the largest MTU along the path from source to destination and avoid the need to fragment the packet. The recommended MTU for IPv6 is 1280.
PAGE 510
www.dell.com | support.dell.com Figure 23-3. NDP Router Redistribution Router C Network 2001:db8::1428:57ab Send a Packet to Network 2001:db8::1428:57ab Router A Router B Local Link Packet Destination (2001:db8::1428:57ab) ICMPv6 Redirect (Data: Use Router C) Packet Destination (Destination 2001:db8::1428:57ab) IPv6 Neighbor Discovery of MTU packets With FTOS 8.3.1.0, you can set the MTU advertised through the RA packets to incoming routers, without altering the actual MTU setting on the interface.
PAGE 511
FTOS IPv6 supports quality of service based on DSCP field. You can configure FTOS to honor the DSCP value on incoming routed traffic and forward the packets with the same value. Refer to Chapter 42, Quality of Service for details. Refer also to the Honor DSCP values on ingress packets in the QoS chapter for information relating to the trust diffserv command.
PAGE 512
www.dell.com | support.dell.
PAGE 513
Figure 23-5.
PAGE 514
www.dell.com | support.dell.com Save the new CAM settings to the startup-config (write-mem or copy run start) then reload the system for the new settings to take effect. Command Syntax Command Mode Purpose cam-acl {default | l2acl number ipv4acl number ipv6acl number, ipv4qos number l2qos number, l2pt number ipmacacl number ecfmacl number [vman-qos | vman-dual-qos number} CONFIGURATION Allocate space for IPV6 ACLs.
PAGE 515
Assign a Static IPv6 Route IPv6 Static Routes are supported on platforms ces Use the ipv6 route command to configure IPv6 static routes.
PAGE 516
www.dell.com | support.dell.com Command Syntax Command Mode Purpose telnet ipv6 address EXEC or EXEC Privileged Enter the IPv6 Address for the device. ipv6 address : x:x:x:x::x mask : prefix length 0-128 IPv6 addresses are normally written as eight groups of four hexadecimal digits, where each group is separated by a colon (:). Omitting zeros is accepted as described in Addressing earlier in this chapter.
PAGE 517
Command Syntax Command Mode Purpose Force10#show ipv6 ? accounting IPv6 accounting information cam linecard IPv6 CAM Entries for Line Card fib linecard IPv6 FIB Entries for Line Card interface IPv6 interface information mbgproutes MBGP routing table mld MLD information mroute IPv6 multicast-routing table neighbors IPv6 neighbor information ospf OSPF information pim PIM V6 information prefix-list List IPv6 prefix lists route IPv6 routing information rpf RPF table Force10# Show an IPv6 Interface View the
PAGE 518
www.dell.com | support.dell.com Figure 23-6.
PAGE 519
Figure 23-7 illustrates the show ipv6 route command output. Figure 23-7.
PAGE 520
www.dell.com | support.dell.com Show the Running-Configuration for an Interface View the configuration for any interface with the following command.
PAGE 521
Command Syntax Command Mode Purpose IPv6 addresses are normally written as eight groups of four hexadecimal digits, where each group is separated by a colon (:). Omitting zeros is accepted as described in Addressing earlier in this chapter.
PAGE 522
| IPv6 Addressing www.dell.com | support.dell.
PAGE 523
24 Intermediate System to Intermediate System Intermediate System to Intermediate System is supported on platform: e Intermediate System to Intermediate System (IS-IS) protocol is an interior gateway protocol (IGP) that uses a shortest-path-first algorithm. Dell Force10 supports both IPv4 and IPv6 versions of IS-IS, as described in this chapter.
PAGE 524
www.dell.com | support.dell.com routing information directly with external routers located outside of the routing domains. Level 1-2 systems manage both inter-area and intra-area traffic by maintaining two separate link databases; one for Level 1 routes and one for Level 2 routes. A Level 1-2 router does not advertise Level 2 routes to a Level 1 router. To establish adjacencies, each IS-IS router sends different Protocol Data Units (PDU).
PAGE 525
Multi-Topology IS-IS FTOS 7.8.1.0 and later support Multi-Topology Routing IS-IS. E-Series ExaScale platform ex supports Multi-Topology IS-IS with FTOS 8.2.1.0 and later. Multi-Topology IS-IS (MT IS-IS) allows you to create multiple IS-IS topologies on a single router with separate databases. This feature is used to place a virtual physical topology into logical routing domains, which can each support different routing and security policies.
PAGE 526
www.dell.com | support.dell.com Adjacencies Adjacencies on point-to-point interfaces are formed as usual, where IS-IS routers do not implement Multi-Topology (MT) extensions. If a local router does not participate in certain MTs, it will not advertise those MT IDs in its IIHs and so will not include that neighbor within its LSPs. If an MT ID is not detected in the remote side's IIHs, the local router does not include that neighbor within its LSPs.
PAGE 527
• The T3 timer sets the overall wait time after which the router determines that it has failed to achieve database synchronization (by setting the overload bit in its own LSP). This timer can be based on adjacency settings with the value derived from adjacent routers that are engaged in graceful restart recovery (the minimum of all the Remaining Time values advertised by the neighbors) or by setting a specific amount of time manually.
PAGE 528
www.dell.com | support.dell.com Table 24-1 displays the default values for IS-IS. Table 24-1.
PAGE 529
Configuration Task List for IS-IS The following list includes the configuration tasks for IS-IS: • • • • • • • • • • Enable IS-IS on page 529 Configure Multi-Topology IS-IS (MT IS-IS) on page 532 Configure IS-IS Graceful Restart on page 533 Change LSP attributes on page 536 Configure IS-IS metric style and cost on page 537 Change the IS-type on page 539 Control routing updates on page 540 Configure authentication passwords on page 545 Set the overload bit on page 545 Debug IS-IS on page 546 Enable IS-IS B
PAGE 530
www.dell.com | support.dell.com Step Task Command Syntax Command Mode 3 Enter the interface configuration mode. Enter the keyword interface followed by the type of interface and slot/port information: • For a 1-Gigabit Ethernet interface, enter the keyword GigabitEthernet followed by the slot/port information. • For the Loopback interface on the RPM, enter the keyword loopback followed by a number from 0 to 16383.
PAGE 531
Figure 24-2. Command Example: show isis protocol Force10#show isis protocol IS-IS Router: System Id: EEEE.EEEE.EEEE IS-Type: level-1-2 Manual area address(es): 47.0004.004d.0001 Routing for area address(es): 21.2223.2425.2627.2829.3031.3233 47.0004.004d.
PAGE 532
www.dell.com | support.dell.com Configure Multi-Topology IS-IS (MT IS-IS) Step 1 Task Command Syntax Command Mode Enable Multi-Topology IS-IS for IPv6. Enter the transition keyword to allow an IS-IS IPv6 user to continue to use single-topology mode while upgrading to multi-topology mode.After every router has been configured with the transition keyword, and all the routers are in MT IS-IS IPv6 mode users can remove the transition keyword on each router.
PAGE 533
Configure Multi-Topology IS-IS (MT IS-IS) Step 1 Task Command Syntax Command Mode Enable Multi-Topology IS-IS for IPv6. Enter the transition keyword to allow an IS-IS IPv6 user to continue to use single-topology mode while upgrading to multi-topology mode.After every router has been configured with the transition keyword, and all the routers are in MT IS-IS IPv6 mode users can remove the transition keyword on each router.
PAGE 534
www.dell.com | support.dell.com Command Syntax Command Mode Purpose graceful-restart restart- wait seconds ROUTER-ISIS Enable the Graceful Restart maximum wait time before a restarting peer comes up. Be sure to set the t3 timer to adjacency on the restarting router when implementing this command.
PAGE 535
Use the show isis graceful-restart detail command in EXEC Privilege mode to view all Graceful Restart related configuration. Figure 24-4.
PAGE 536
www.dell.com | support.dell.com Figure 24-5. Command Example: show isis interface show isis interface G1/34 GigabitEthernet 2/10 is up, line protocol is up MTU 1497, Encapsulation SAP Routing Protocol: IS-IS Circuit Type: Level-1-2 Interface Index 0x62cc03a, Local circuit ID 1 Level-1 Metric: 10, Priority: 64, Circuit ID: 0000.0000.000B.01 Hello Interval: 10, Hello Multiplier: 3, CSNP Interval: 10 Number of active level-1 adjacencies: 1 Level-2 Metric: 10, Priority: 64, Circuit ID: 0000.0000.000B.
PAGE 537
Figure 24-6. Command Example: show running-config isis Force10#show running-config isis ! router isis lsp-refresh-interval 902 net 47.0005.0001.000C.000A.4321.00 net 51.0005.0001.000C.000A.4321.00 Force10# Configure IS-IS metric style and cost All IS-IS links or interfaces are associated with a cost that is used in the SPF calculations. The possible cost varies depending on the metric style supported.
PAGE 538
www.dell.com | support.dell.com Figure 24-7. Command Example: show isis protocol Force10#show isis protocol IS-IS Router: System Id: EEEE.EEEE.EEEE IS-Type: level-1-2 Manual area address(es): 47.0004.004d.0001 Routing for area address(es): 21.2223.2425.2627.2829.3031.3233 47.0004.004d.
PAGE 539
Table 24-3. Correct Value Range for the isis metric command Metric Style Correct Value Range narrow transition 0 to 63 transition 0 to 63 Configuring the distance of a route Configure the distance for a route using the distance command from ROUTER ISIS mode.
PAGE 540
www.dell.com | support.dell.com Figure 24-8. Command Example: show isis database Force10#show isis database IS-IS Level-1 Link State Database LSPID LSP Seq Num B233.00-00 0x00000003 eljefe.00-00 * 0x00000009 eljefe.01-00 * 0x00000001 eljefe.02-00 * 0x00000001 Force10.00-00 0x00000002 IS-IS Level-2 Link State Database LSPID LSP Seq Num B233.00-00 0x00000006 eljefe.00-00 * 0x0000000D eljefe.01-00 * 0x00000001 eljefe.02-00 * 0x00000001 Force10.
PAGE 541
Distribute Routes Another method of controlling routing information is to filter the information through a prefix list. Prefix lists are applied to incoming or outgoing routes and routes must meet the conditions of the prefix lists or FTOS does not install the route in the routing table. The prefix lists are globally applied on all interfaces running IS-IS. Configure the prefix list in the PREFIX LIST mode prior to assigning it to the IS-IS process.
PAGE 542
www.dell.com | support.dell.com Command Syntax Command Mode Purpose distribute-list prefix-list-name out [bgp as-number | connected | ospf process-id | rip | static] ROUTER ISIS Apply a configured prefix list to all outgoing IPv4 IS-IS routes. You can configure one of the optional parameters: • connected: for directly connected routes. • ospf process-id: for OSPF routes only. • rip: for RIP routes only. • static: for user-configured routes.
PAGE 543
Command Syntax Command Mode Purpose distribute-list prefix-list-name out [bgp as-number | connected | ospf process-id | rip | static] ROUTER ISIS-AF IPV6 Apply a configured prefix list to all outgoing IPv6 IS-IS routes. You can configure one of the optional parameters: • connected: for directly connected routes. • ospf process-id: for OSPF routes only. • rip: for RIP routes only. • static: for user-configured routes.
PAGE 544
www.dell.com | support.dell.com Command Syntax Command Mode Purpose redistribute ospf process-id [level-1| level-1-2 | level-2] [metric value] [match external {1 | 2} | match internal] [metric-type {external | internal}] [route-map map-name] ROUTER ISIS Include specific OSPF routes in IS-IS. Configure the following parameters: • process-id range: 1 to 65535 • level-1, level-1-2, or level-2: Assign all redistributed routes to a level. Default is level-2. • metric range: 0 to 16777215. Default is 0.
PAGE 545
Use the show running-config isis command in EXEC Privilege mode to view IS-IS configuration globally (including both IPv4 and IPv6 settings), or the show config command in ROUTER ISIS mode to view the current IPv4 IS-IS configuration, or the show config command in ROUTER ISIS-ADDRESS FAMILY IPV6 mode to view the current IPv6 IS-IS configuration Configure authentication passwords You can assign an authentication password for routers in Level 1 and for routers in Level 2.
PAGE 546
www.dell.com | support.dell.com When the bit is set, a 1 is placed in the OL column in the show isis database command output. In Figure 24-9, the overload bit is set in both the Level-1 and Level-2 database because the IS type for the router is Level-1-2 Figure 24-9. Command Example: show isis database Force10#show isis database IS-IS Level-1 Link State Database LSPID LSP Seq Num B233.00-00 0x00000003 eljefe.00-00 * 0x0000000A eljefe.01-00 * 0x00000001 eljefe.02-00 * 0x00000001 Force10.
PAGE 547
Command Syntax Command Mode Purpose debug isis snp-packets [interface] EXEC Privilege View IS-IS SNP packets, include CSNPs and PSNPs. To view specific information, enter one of the following optional parameters: • interface: Enter the type of interface and slot/port information to view IS-IS information on that interface only. debug isis spf-triggers EXEC Privilege View the events that triggered IS-IS shortest path first (SPF) events for debugging purposes.
PAGE 548
www.dell.com | support.dell.com Configure Metric Values The following topics are covered in this section: • • • Maximum Values in the Routing Table on page 548 Changing the IS-IS Metric Style in One Level Only on page 548 Leaking from One Level to Another on page 550 For any level (Level-1, Level-2, or Level-1-2), the value range possible in the isis metric command in INTERFACE mode changes depending on the metric style. Table 24-4.
PAGE 549
Table 24-5. Metric Value when Metric Style Changes Beginning metric style Final metric style Resulting IS-IS metric value wide narrow transition default value (10) if the original value is greater than 63. A message is sent to the console.
PAGE 550
www.dell.com | support.dell.com Table 24-6.
PAGE 551
Sample Configuration The following configurations are examples for enabling IPv6 IS-IS. These are not comprehensive directions. They are intended to give you a some guidance with typical configurations. S Note: Only one IS-IS process can run on the router, even if both IPv4 and IPv6 routing is being used. You can copy and paste from these examples to your CLI. Be sure you make the necessary changes to support your own IP Addresses, Interfaces, Names, etc.
PAGE 552
www.dell.com | support.dell.com Figure 24-10. IS-IS Sample Configuration Router 1 R1(conf)#interface Loopback 0 R1(conf-if-lo-0)#ip address 192.168.1.1/24 R1(conf-if-lo-0)#ipv6 address 2001:db8:9999:1::/48 R1(conf-if-lo-0)#ip router isis 9999 R1(conf-if-lo-0)#no shutdown R1(conf-if-lo-0)#router isis 9999 R1(conf-router_isis)#is-type level-1 R1(conf-router_isis)#net FF.F101.0002.0C00.1111.
PAGE 553
Figure 24-11. IS-IS Sample Configuration continued Router 2 R2(conf)#interface Loopback 0 R2(conf-if-lo-0)#ip address 192.168.1.1/24 R2(conf-if-lo-0)#ipv6 address 2001:db8:9999:1::/48 R2(conf-if-lo-0)#ip router isis 9999 R2(conf-if-lo-0)#no shutdown R2(conf-if-lo-0)#router isis 9999 R2(conf-router_isis)#int gi 2/11 R2(conf-if-gi-2/11)#ip address 10.0.12.
PAGE 554
www.dell.com | support.dell.com Figure 24-12. IS-IS Sample Configuration continued Router 3 R3(conf)#interface Loopback 0 R3(conf-if-lo-0)#ip address 192.168.1.3/24 R3(conf-if-lo-0)#ipv6 address 2001:db8:9999:3::/48 R3(conf-if-lo-0)#ip router isis 9999 R3(conf-if-lo-0)#no shutdown R3(conf-if-lo-0)#router isis 9999 R3(conf-router_isis)#net FF.F101.0002.0C00.1133.
PAGE 555
Figure 24-13. IPv6 IS-IS Sample Topography Loopback 0 2001:0db8:9999:2:: /48 (192.168.1.2 /24) GigE 2/11 2001:0db8:1021:2:: /48 (10.0.12.2 /24) GigE 2/31 2001:0db8:1023:2:: /48 (10.0.23.2 /24) R2 GigE 1/21 2001:0db8:1021:1:: /48 (10.0.12.1 /24) GigE 3/21 2001:0db8:1023:3:: /48 (10.0.23.3 /24) Loopback 0 R1 2001:0db8:9999:1:: /48 GigE 1/34 (192.168.1.1 /24) 2001:0db8:1022:1:: /48 (10.0.13.1 /24) R3 Loopback 0 2001:0db8:9999:3:: /48 (192.168.1.
PAGE 556
www.dell.com | support.dell.
PAGE 557
25 Link Aggregation Control Protocol Link Aggregation Control Protocol is supported on platforms ce s LACP addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later.
PAGE 558
www.dell.com | support.dell.com LACP functions by constantly exchanging custom MAC PDUs across LAN Ethernet links. The protocol packets are only exchanged between ports that are configured as LACP capable. Important Points to Remember • • • • • • • • • On ExaScale, LACP is supported on 200 physical ports. Use static LAGs for the remaining ports to avoid unpredictable results. LACP enables you to add members to a port channel (LAG) as long as it has no static members.
PAGE 559
LACP modes FTOS provides the following three modes for configuration of LACP: • • • Off—In this state, an interface is not capable of being part of a dynamic LAG. LACP does not run on any port that is configured to be in this state. Active—In this state, the interface is said to be in the “active negotiating state.” LACP runs on any link that is configured to be in this state. A port in Active state also automatically initiates negotiations with other ports by initiating LACP packets.
PAGE 560
www.dell.com | support.dell.com LACP Configuration Tasks The tasks covered in this section are: • • • • • Create a LAG Configure the LAG interfaces as dynamic on page 560 Set the LACP long timeout on page 561 Monitor and Debugging LACP on page 562 Configure Shared LAG State Tracking on page 563 Create a LAG To create a dynamic port channel (LAG), define the LAG and then the LAG interfaces.
PAGE 561
Figure 25-3. Creating a Dynamic LAG Example Force10(conf)#interface Gigabitethernet 3/15 Force10(conf-if-gi-3/15)#no shutdown Force10(conf-if-gi-3/15)#port-channel-protocol lacp Force10(conf-if-gi-3/15-lacp)#port-channel 32 mode active ... Force10(conf)#interface Gigabitethernet 3/16 Force10(conf-if-gi-3/16)#no shutdown Force10(conf-if-gi-3/16)#port-channel-protocol lacp Force10(conf-if-gi-3/16-lacp)#port-channel 32 mode active ...
PAGE 562
www.dell.com | support.dell.com Figure 25-4. Invoking the LACP Long Timeout Force10(conf)# interface port-channel 32 Force10(conf-if-po-32)#no shutdown Force10(conf-if-po-32)#switchport Force10(conf-if-po-32)#lacp long-timeout Force10(conf-if-po-32)#end Force10# show lacp 32 Port-channel 32 admin up, oper up, mode lacp Actor System ID: Priority 32768, Address 0001.e800.a12b Partner System ID: Priority 32768, Address 0001.e801.
PAGE 563
Figure 25-5. LAGs using ECMP without Shared LAG State Tracking R4 Po 2 Po 1 Po 1 failure R1 Po 2 over-subscribed R2 R3 fnC0049mp To avoid packet loss, traffic must be re-directed through the next lowest-cost link (R3 to R4). FTOS has the ability to bring LAG 2 down in the event that LAG 1 fails, so that traffic can be re-directed, as described. This is what is meant by Shared LAG State Tracking.
PAGE 564
www.dell.com | support.dell.com In Figure 25-8, LAGs 1 and 2 are members of a failover group. LAG 1 fails and LAG 2 is brought down upon the failure. This effect is logged by Message 2, in which a console message declares both LAGs down at the same time. Figure 25-8.
PAGE 565
• • • • Only a LAG can be a member of a failover group. Shared LAG State Tracking can be configured on one side of a link or on both sides. If a LAG that is part of a failover group is deleted, the failover group is deleted. If a LAG moves to the down state due to this feature, its members may still be in the up state. Configure LACP as Hitless Configure LACP as Hitless is supported only on platforms: ce LACP on Dell Force10 systems can be configured to be hitless.
PAGE 566
www.dell.com | support.dell.com Figure 25-11. LACP Sample Topology Port Channel 10 ALPHA BRAVO Gig 3/21 Gig 2/31 Gig 2/32 Gig 3/23 Gig 2/33 Configuring a LAG on ALPHA Figure 25-12.
PAGE 567
Figure 25-13. Inspecting a LAG Port Configuration on ALPHA Alpha#sh int gig 2/31 GigabitEthernet 2/31 is up, line protocol is up Port is part of Port-channel 10 Hardware is Force10Eth, address is 00:01:e8:06:95:c0 Current address is 00:01:e8:06:95:c0 Interface index is 109101113 Port will not be disabled on partial SFM failure Internet address is not set MTU 1554 bytes, IP MTU 1500 bytes Shows the speed of this physical interface.
PAGE 568
www.dell.com | support.dell.com Figure 25-14. 568 Inspecting Configuration of LAG 10 on ALPHA Indicates the MAC address assigned to the LAG. This does NOT match any of the physical interface MAC addresses.
PAGE 569
Figure 25-15. Using the show lacp Command to Verify LAG 10 Status on ALPHA Alpha#sho lacp 10 Port-channel 10 admin up, oper up, mode lacp Actor System ID: Priority 32768, Address 0001.e806.953e Partner System ID: Priority 32768, Address 0001.e809.
PAGE 570
www.dell.com | support.dell.com Summary of the configuration on ALPHA Figure 25-16.
PAGE 571
Summary of the configuration on BRAVO Figure 25-17.
PAGE 572
www.dell.com | support.dell.com Figure 25-18. 572 Using the show interface Command to Inspect a LAG Port on BRAVO Shows the status of this nterface. Also shows it is part of LAG 10. Bravo#show int gig 3/21 GigabitEthernet 3/21 is up, line protocol is up Port is part of Port-channel 10 Hardware is Force10Eth, address is 00:01:e8:09:c3:82 Current address is 00:01:e8:09:c3:82 Shows that this is a Layer 2 port.
PAGE 573
Figure 25-19. Using the show interfaces port-channel Command to Inspect LAG 10 This does NOT match any of the physical interface MAC addresses.
PAGE 574
www.dell.com | support.dell.com Figure 25-20. Using the show lacp Command to Inspect LAG Status Force10#show lacp 10 Port-channel 10 admin up, oper up, mode lacp Actor System ID: Priority 32768, Address 0001.e809.c24a Partner System ID: Priority 32768, Address 0001.e806.
PAGE 575
26 Layer 2 Layer 2 features are supported on platforms ces The E-Series ExaScale platform is supported with FTOS 8.1.1.0 and later.
PAGE 576
www.dell.com | support.dell.com Clear the MAC Address Table You may clear the MAC address table of dynamic entries: Task Command Syntax Command Mode Clear a MAC address table of dynamic entries.
PAGE 577
Configure a Static MAC Address A static entry is one that is not subject to aging. Static entries must be entered manually: Task Command Syntax Command Mode Create a static MAC address entry in the MAC address table. mac-address-table static CONFIGURATION Display the MAC Address Table To display the contents of the MAC address table: Task Command Syntax CommandMode Display the contents of the MAC address table. • address displays the specified entry. • aging-time displays the configured aging-time.
PAGE 578
www.dell.com | support.dell.
PAGE 579
mac learning-limit dynamic After you enable a MAC learning limit, MAC addresses learned on the port and entered in the MAC address table are static by default. If you configure the MAC learning dynamic option, learned MAC addresses are stored in the dynamic region of the table and are subject to aging. Entries created before this option is set are not affected. On the C-Series and S-Series, the MAC address table is stored in the Layer 2 FIB region of CAM.
PAGE 580
www.dell.com | support.dell.com mac learning-limit no-station-move Note: Sticky MAC is not supported on the S25 or S50 in FTOS release 8.4.2.6. The no-station-move option, also known as “sticky MAC,” provides additional port security by preventing a station move. When this option is configured, the first entry in the table is maintained instead of creating a new entry on the new interface. no-station-move is the default behavior. Entries created before this option is set are not affected.
PAGE 581
FTOS Behavior: The following conditions apply when you enable the sticky-MAC address option for MAC learning on an interface: • When you enable the sticky MAC learning option, all dynamically-learned MAC addresses that you save to the start-up configuration are converted to statically-configured MAC addresses when you reboot the switch.
PAGE 582
www.dell.com | support.dell.com Displaying MAC Learning-Limited Interfaces To display a list of all interfaces with a MAC learning limit: Task Command Syntax Command Mode Display a list of all interfaces with a MAC learning limit.
PAGE 583
To display a list of interfaces configured with MAC learning limit or station move violation actions: Task Command Syntax Command Mode Display a list of all of the interfaces configured with MAC learning limit or station move violation.
PAGE 584
www.dell.com | support.dell.com Figure 26-1. Per-VLAN MAC Learning Limit Internet Exchange Point 802.1QTagged interface GigabitEthernet 1/1 ... mac learning-limit 1 vlan 10 mac learning-limit 1 vlan 20 ISP A ISP B ISP C ISP A, B, and C are all public peers through VLAN 10. In addition, ISP A and C are private peers on a separate VLAN, VLAN 20. Since the access ports for ISP A and C are members of multiple VLANs, Per-VLAN MAC Learning Limit can be applied to those ports.
PAGE 585
NIC Teaming NIC teaming is a feature that allows multiple network interface cards in a server to be represented by one MAC address and one IP address in order to provide transparent redundancy, balancing, and to fully utilize network adapter resources. Figure 26-2 shows a topology where two NICs have been teamed together. In this case, if the primary NIC fails, traffic switches to the secondary NIC, since they are represented by the same set of addresses. Figure 26-2.
PAGE 586
www.dell.com | support.dell.com Figure 26-3. Configuring mac-address-table station-move refresh-arp Command X MAC: A:B:C:D A:B IP: 1.1.1.1 Port 0/1 Move MAC address k Active Lin Port 0/5 fnC0026mp mac-address-table station-move refresh-arp configured at time of NIC teaming MAC Move Optimization MAC Move Optimization is supported only on platform: e Station-move detection takes 5000ms because this is the interval at which the detection algorithm runs.
PAGE 587
Since the virtual MAC address is never learned, traffic is forwarded to only one server rather than the entire cluster, and failover and balancing are not preserved (Figure 26-5). Figure 26-4.
PAGE 588
www.dell.com | support.dell.com Figure 26-6.
PAGE 589
Configuring Redundant Pairs Configuring Redundant Pairs is supported: • • ces On physical interfaces on platforms On static and dynamic port-channel interfaces on platforms ces The Redundant Pairs feature allows you to provide redundancy for Layer 2 links without using Spanning Tree (STP). You create redundant links by configuring pairs of Layer 2 (physical or port-channel) interfaces so that only one interface is up and carries user traffic at any time.
PAGE 590
www.dell.com | support.dell.com To ensure that existing network applications see no difference when a primary interface in a redundant pair transitions to the backup interface, be sure to apply identical configurations of other traffic parameters to each interface. If you remove an interface in a redundant link (remove the line card of a physical interface or delete a port channel with the no interface port-channel command), the redundant pair configuration is also removed.
PAGE 591
In Figure 26-8, interface 3/41 is a backup interface for 3/42, and 3/42 is DOWN as shown in message Message 1. If 3/41 fails, 3/42 transitions to the UP state, which makes the backup link active. A message similar to Message 1 appears whenever you configure a backup port.
PAGE 592
www.dell.com | support.dell.com Restricting Layer 2 Flooding Restricting Layer 2 Flooding is supported only on platform: et When Layer 2 multicast traffic must be forwarded on a VLAN that has multiple ports with different speeds on the same port-pipe, forwarding is limited to the speed of the slowest port.
PAGE 593
Far-end Failure Detection Far-end Failure Detection is supported only on platform: e Far-end Failure Detection (FEFD) is a protocol that senses remote data link errors in a network. It responds by sending a unidirectional report that triggers an echoed response after a specified time interval. Figure 26-10.
PAGE 594
www.dell.com | support.dell.com 5. If the FEFD system has been set to Aggressive mode and neighboring echoes are not received after three intervals, the state changes to Err-disabled. All interfaces in the Err-disabled state must be manually reset using the fefd reset [interface] command in EXEC privilege mode (it can be done globally or one interface at a time) before the FEFD enabled system can become operational again. Table 26-1.
PAGE 595
Step Task Command Syntax Command Mode 2 Activate the necessary ports administratively no shutdown INTERFACE 3 Enable fefd globally fefd {interval | mode} CONFIGURATION Entering the show fefd command in EXEC privilege mode displays information about the state of each interface. Figure 26-11. Show FEFD global outputs Force10#show fefd FEFD is globally 'ON', interval is 3 seconds, mode is 'Normal'.
PAGE 596
www.dell.com | support.dell.com Figure 26-12. FEFD enabled interface configuration Force10(conf-if-gi-1/0)#show config ! interface GigabitEthernet 1/0 no ip address switchport fefd mode normal no shutdown Force10(conf-if-gi-1/0)#do show fefd | grep 1/0 Gi 1/0 Normal 3 Unknown Debugging FEFD By entering the command debug fefd events in EXEC privilege mode, output is displayed whenever events occur that initiate or disrupt an FEFD enabled connection. Figure 26-13.
PAGE 597
During an RPM Failover In the event that an RPM failover occurs, FEFD will become operationally down on all enabled ports for approximately 8-10 seconds before automatically becoming operational again. Figure 26-15. FEFD state change during an RPM failover 02-05-2009 12:40:38 Local7.Debug 10.16.151.12 Feb 5 07:06:09: %RPM1-S:CP %RAM-6-FAILOVER_REQ: RPM failover request from active peer: User request. 02-05-2009 12:40:38 Local7.Debug 10.16.151.
PAGE 598
| Layer 2 www.dell.com | support.dell.
PAGE 599
27 Link Layer Discovery Protocol Link Layer Discovery Protocol is supported only on platforms: ces LLDP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. This chapter contains the following sections: • • • 802.1AB (LLDP) Overview on page 599 TIA-1057 (LLDP-MED) Overview on page 602 Configuring LLDP on page 607 802.1AB (LLDP) Overview Link Layer Discovery Protocol (LLDP)—defined by IEEE 802.
PAGE 600
www.dell.com | support.dell.com Figure 27-1. Type, Length, Value (TLV) Segment TLV Header TLV Type (1-127) TLV Length Value 9 bits 7 bits 0-511 octets Chassis ID Sub-type Chassis ID fnC0057mp 1- 255 octets 1 octet TLVs are encapsulated in a frame called an LLDP Data Unit (LLDPDU) (Figure 27-2), which is transmitted from one LLDP-enabled device to its LLDP-enabled neighbors. LLDP is a one-way protocol.
PAGE 601
Optional TLVs FTOS supports the following optional TLVs: Management TLVs • • • IEEE 802.1 and 802.3 Organizationally Specific TLVs TIA-1057 Organizationally Specific TLVs Management TLVs A Management TLV is an Optional TLVs sub-type. This kind of TLV contains essential management information about the sender. The five types are described in Table 27-2. Organizationally Specific TLVs Organizationally specific TLVs can be defined by a professional organization or a vendor.
PAGE 602
www.dell.com | support.dell.com Table 27-2. Optional TLV Types Type TLV Description 7 System capabilities Identifies the chassis as one or more of the following: repeater, bridge, WLAN Access Point, Router, Telephone, DOCSIS cable device, end station only, or other 8 Management address Indicates the network address of the management interface. FTOS does not currently support this TLV. IEEE 802.
PAGE 603
With regard to connected endpoint devices, LLDP-MED provides network connectivity devices with the ability to: • • • • manage inventory manage Power over Ethernet (PoE) identify physical location identify network policy LLDP-MED is designed for, but not limited to, VoIP endpoints. TIA Organizationally Specific TLVs The Dell Force10 system is an LLDP-MED Network Connectivity Device (Device Type 4).
PAGE 604
www.dell.com | support.dell.com Table 27-3. TIA-1057 (LLDP-MED) Organizationally Specific TLVs (continued) Type Sub-type 127 11 127 12-255 TLV Description Inventory - Asset ID Indicates a user specified device number to manage inventory Reserved — LLDP-MED Capabilities TLV The LLDP-MED Capabilities TLV communicates the types of TLVs that the endpoint device and the network connectivity device support. LLDP-MED network connectivity devices must transmit the Network Policies TLV.
PAGE 605
Table 27-5.
PAGE 606
www.dell.com | support.dell.com Table 27-6. Type Network Policy Applications (continued) Application Description 7 Streaming Video Specify this application type for broadcast or multicast based video content distribution and other similar applications supporting streaming video services. This does not include video applications relying on TCP with buffering. 8 Video Signaling Specify this application type only if video control packets use a separate network policy than video data.
PAGE 607
Configuring LLDP Configuring LLDP is a two-step process: 1. Enable LLDP globally. See page 608. 2. Advertise TLVs out of an interface. See page 608.
PAGE 608
www.dell.com | support.dell.com Figure 27-7.
PAGE 609
• If you configure an interface, only the interface will send LLDPDUs with the specified TLVs. If LLDP is configured both globally and at interface level, the interface level configuration overrides the global configuration. To advertise TLVs: Step Command Mode Task Command 1 Enter LLDP mode. protocol lldp CONFIGURATI ON or INTERFACE 2 Advertise one or more TLVs. Include the keyword for each TLV you want to advertise.
PAGE 610
www.dell.com | support.dell.com Viewing the LLDP Configuration Display the LLDP configuration using the command show config in either CONFIGURATION or INTERFACE mode, as shown in Figure 27-9 and Figure 27-10, respectively Figure 27-9.
PAGE 611
Figure 27-12.
PAGE 612
www.dell.com | support.dell.com Figure 27-13.
PAGE 613
Figure 27-14.
PAGE 614
www.dell.com | support.dell.com Figure 27-15.
PAGE 615
Figure 27-16.
PAGE 616
www.dell.com | support.dell.com Table 27-7.
PAGE 617
Table 27-8.
PAGE 618
www.dell.com | support.dell.com Table 27-9. LLDP 802.
PAGE 619
Table 27-10.
PAGE 620
www.dell.com | support.dell.com Table 27-10.
PAGE 621
28 Multicast Listener Discovery Multicast Listener Discovery is supported only on platform: MLD Snooping is supported only on platform: e e Multicast Listener Discovery (MLD) is a Layer 3 protocol that IPv6 routers use to learn of the multicast receivers that are directly connected to them and the groups in which the receivers are interested. Multicast routing protocols (like PIM) use the information learned from MLD to route multicast traffic to all interested receivers.
PAGE 622
www.dell.com | support.dell.com • • Maximum Response Delay—the maximum amount of time that the Querier waits to receive a response to a General or Multicast-Address-Specific Query. The value is zero in reports and Done messages. Multicast Address — set to zero in General Queries, and set to the relevant multicast address in multicast-address-specific queries and done messages. Figure 28-1.
PAGE 623
Leaving a Multicast Group A receiver that is no longer interested in traffic for a particular group should leave the group by sending a Done message to the link-scope all-routers multicast address, FF02::02. When a Querier receives a Done message, it sends a Multicast-Address-Specific Query addressed to the relevant multicast group. Hosts still interested in receiving traffic for that group (according to the suppression mechanism) so that the group table entry is maintained.
PAGE 624
www.dell.com | support.dell.com Figure 28-3.
PAGE 625
• • Debug MLD on page 627 MLD Snooping on page 627 Change MLD Timer Values All non-queriers have a timer that is refreshed when it hears a General Query. If the timer expires, then the router can assume that the Querier is not present, and so it assumes the role of Querier. The Other Querier Present Interval, or Querier Timeout Interval, is the amount of time that passes before a non-querier router assumes that there is no longer a Querier on the link.
PAGE 626
www.dell.com | support.dell.com Last Member Query Interval The Querier sends a Multicast-Address-Specific Query upon receiving a Done message to ascertain whether there are any remain receivers for a group. The Last Listener Query Interval is the Maximum Response Delay for a Multicast-Address-Specific Query, and also the amount of time between Multicast-Address-Specific Query retransmissions.
PAGE 627
Display the MLD Group Table Task Command Syntax Command Mode Display MLD groups. Group information can be filtered, see the FTOS Command Line Reference for the options available with this command. show ipv6 mld {groups | interface} EXEC Privilege Clear MLD Groups Clear a specific group or all groups on an interface from the multicast routing table using the command clear ipv6 mld groups from EXEC Privilege mode. Change the MLD Version Task Command Syntax Command Mode Change the MLD version.
PAGE 628
www.dell.com | support.dell.com Enable MLD Snooping MLD is automatically enabled when you enable IPv6 PIM, but MLD Snooping must be explicitly enabled. Task Command Syntax Command Mode Enable MLD Snooping ipv6 mld snooping enable CONFIGURATION Disable MLD Snooping on a VLAN When MLD is enabled globally, it is by default enabled on all VLANs. Disable snooping on a VLAN, using the command no ipv6 mld snooping from INTERFACE VLAN mode.
PAGE 629
View the ports that are connected to multicast routers using the command show ipv6 mld snooping mrouter from EXEC Privilege mode. Enable Snooping Explicit Tracking The switch can be a querier, and therefore also has the option of updating the group table through explicit-tracking (see Explicit Tracking on page 626). Whether the switch is the Querier or not, if snooping is enabled, the switch tracks all MLD joins.
PAGE 630
www.dell.com | support.dell.com Figure 28-4. Port Inheritance on Mixed-mode VLANs Snooping Table VLAN 10 1 2 MLDv2 IGMP (*,G) 1 (*,G) 1, 3 (S,G) 1*, 3 3 4 exclude (*,G) include (S,G) In Figure 28-4, the host on Port 1 sends an exclude—that is, exclude nothing—report to join group G and receive traffic from all transmitting sources for the group. FTOS creates a (*,G) entry and lists Port 1 in the outgoing interface list.
PAGE 631
29 Multicast Source Discovery Protocol Multicast Source Discovery Protocol is supported only on platform e MSDP addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Multicast Source Discovery Protocol (MSDP) is a Layer 3 protocol that connects IPv4 PIM-SM domains. A domain in the context of MSDP is contiguous set of routers operating PIM within a common boundary defined by an exterior gateway protocol, such as BGP.
PAGE 632
Multicast Source Discovery Protocol + + P 3 MPC IG Receiver OS PF + PI M PC 2 Source MP IG 4/1 AS Y Area 0 R4 4/31 2/1 + PI M AS X Area 0 OS PF www.dell.com | support.dell.com Figure 29-1. BGP R2 2/11 3/21 3/41 R3 P Pe MSD 1/21 1/2 R1 ersh ip RP RP1 1/1 PC 1 Receiver RPs advertise each (S,G) in its domain in Type, Length, Value (TLV) format. The total number of TLVs contained in the SA is indicated in the “Entry Count” field.
PAGE 633
Configuring Multicast Source Discovery Protocol Configuring MSDP is a three-step process: 1. Enable an exterior gateway protocol (EGP) with at least two routing domains. Figure 29-5 and MSDP Sample Configurations on page 654 show the OSPF-BGP configuration used in this chapter for MSDP. Otherwise, see Chapter 33, Open Shortest Path First (OSPFv2 and OSPFv3), on page 707 and Chapter 10, Border Gateway Protocol IPv4 (BGPv4), on page 207. 2. Configure PIM-SM within each EGP routing domain.
PAGE 634
interface GigabitEthernet 1/1 ip pim sparse-mode ip address 10.11.3.1/24 no shutdown ! interface GigabitEthernet 1/2 ip address 10.11.2.1/24 no shutdown ! interface GigabitEthernet 1/21 ip pim sparse-mode ip address 10.11.1.12/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.1/32 no shutdown | Multicast Source Discovery Protocol 1/1 1/21 PC 1 : 10.11.3.2/24 R1 1/2 interface GigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.4.
PAGE 635
router ospf 1 network 10.11.2.0/24 area 0 network 10.11.1.0/24 area 0 network 192.168.0.1/32 area 0 network 10.11.3.0/24 area 0 router ospf 1 network 192.168.0.1/32 area 0 network 10.11.1.0/24 area 0 network 10.11.4.0/24 area 0 redistribute static redistribute connected redistribute bgp 100 R2_E300(conf)#do show run bgp ! router bgp 100 redistribute ospf 1 neighbor 192.168.0.3 remote-as 200 neighbor 192.168.0.3 ebgp-multihop 255 neighbor 192.168.0.3 update-source Loopback 0 neighbor 192.168.0.
PAGE 636
| Multicast Source Discovery Protocol M PI P GM +I R1 1/2 RP1 PC 2 Receiver: 239.0.0.1 1/1 1/21 ip multicast routing ! ip pim rp-address 192.168.0.1 group-address 224.0.0.0/4 AS 100 R2 2/31 R3 3/41 4/31 R4 AS 200 ip multicast-routing ! ip pim rp-address 192.168.0.3 group-address 224.0.0.0/4 ip multicast-routing ! ip pim rp-address 192.168.0.3 group-address 224.0.0.0/4 4/1 P GM + I PC 3 Receiver: 239.0.0.1 RP2 3/21 M PI ip multicast-routing ! ip pim rp-address 192.168.0.
PAGE 637
R1_E600(conf)#do show ip msdp sa-cache MSDP Source-Active Cache - 1 entries GroupAddr SourceAddr RPAddr LearnedFrom Expire UpTime 239.0.0.1 10.11.4.2 192.168.0.1 local 95 16:49:25 (10.11.4.2, 239.0.0.1), uptime 1d16h, expires 00:03:12, flags: CTA Incoming interface: GigabitEthernet 1/21, RPF neighbor 10.11.1.21 Outgoing interface list: GigabitEthernet 1/1 Forward/Sparse 22:26:37/Never (*, 239.0.0.1), uptime 22:26:37, expires 00:00:00, RP 192.168.0.
PAGE 638
www.dell.com | support.dell.com Enable MSDP Enable MSDP by peering RPs in different administrative domains. Step Task Command Syntax Command Mode 1 Enable MSDP. ip multicast-msdp CONFIGURATION 2 PeerPIM systems in different administrative domains. ip msdp peer connect-source CONFIGURATION Figure 29-7. Configuring an MSDP Peer R3_E600(conf)#ip multicast-msdp R3_E600(conf)#ip msdp peer 192.168.0.1 connect-source Loopback 0 R3_E600(conf)#do show ip msdp summary Peer Addr 192.168.0.
PAGE 639
• • RPs can transmit SA messages periodically to prevent SA storms, and only sources that are in the cache are advertised in the SA to prevent transmitting multiple copies of the same source information. View the Source-active Cache Task Command Syntax Command Mode View the SA cache. show ip msdp sa-cache EXEC Privilege Figure 29-9. Displaying the MSDP Source-active Cache R3_E600#show ip msdp sa-cache MSDP Source-Active Cache - 1 entries GroupAddr SourceAddr RPAddr 239.0.0.1 10.11.4.2 192.168.0.
PAGE 640
www.dell.com | support.dell.com • • Task Command Syntax Command Mode Cache rejected sources. ip msdp cache-rejected-sa CONFIGURATION Accept Source-active Messages that fail the RFP Check A default peer is a peer from which active sources are accepted even though they fail the RFP check. • • • • 640 the peer RP is unreachable, or because of an SA message format error. | In Scenario 1 of Figure 29-10, all MSPD peers are up.
PAGE 641
Figure 29-10.
PAGE 642
www.dell.com | support.dell.com Task Command Syntax Command Mode Specify the forwarding-peer and originating-RP from which all active sources are accepted without regard for the the RPF check. If you do not specify an access list, the peer accepts all sources advertised by that peer. All sources from RPs denied by the ACL are subjected to the normal RPF check. ip msdp default-peer ip-address list CONFIGURATION Figure 29-11. Accepting Source-active Messages with Force10(conf)#ip msdp peer 10.0.50.
PAGE 643
Prevent MSDP from Caching a Local Source You can prevent MSDP from caching an active source based on source and/or group. Since the source is not cached, it is not advertised to remote RPs. Task Command Syntax Command Mode OPTIONAL: Cache sources that are denied by the redistribute list in the rejected SA cache. ip msdp cache-rejected-sa CONFIGURATION Prevent the system from caching local SA entries based on source and group using an extended ACL.
PAGE 644
www.dell.com | support.dell.com Prevent MSDP from Caching a Remote Source Task Command Syntax Command Mode OPTIONAL: Cache sources that are denied by the SA filter in the rejected SA cache. ip msdp cache-rejected-sa CONFIGURATION Prevent the system from caching remote sources learned from a specific peer based on source and group. ip msdp sa-filter list out peer list ext-acl CONFIGURATION In Figure 29-14, R1 is advertising source 10.11.4.2.
PAGE 645
Prevent MSDP from Advertising a Local Source Task Command Syntax Command Mode Prevent an RP from advertising a source in the SA cache. ip msdp sa-filter list in peer list ext-acl CONFIGURATION In Figure 29-14, R1 stops advertising source 10.11.4.2. Since it is already in the SA cache of R3, the entry remains there until it expires. Figure 29-14. Preventing MSDP from Advertising a Local Source [Router 1] R1_E600(conf)#do show run msdp ! ip multicast-msdp ip msdp peer 192.168.0.
PAGE 646
www.dell.com | support.dell.com Log Changes in Peership States Task Command Syntax Command Mode Log peership state changes. ip msdp log-adjacency-changes CONFIGURATION Terminate a Peership MSDP uses TCP as its transport protocol. In a peering relationship, the peer with the lower IP address initiates the TCP session, while the peer with the higher IP address listens on port 639. Task Command Syntax Command Mode Terminate the TCP connection with a peer.
PAGE 647
Clear Peer Statistics Task Command Syntax Command Mode Reset the TCP connection to the peer and clear all peer statistics. clear ip msdp peer peer-address CONFIGURATION Figure 29-16. Clearing Peer Statistics R3_E600(conf)#do show ip msdp peer Peer Addr: 192.168.0.1 Local Addr: 192.168.0.
PAGE 648
www.dell.com | support.dell.com Debug MSDP Task Command Syntax Command Mode Display the information exchanged between peers. debug ip msdp CONFIGURATION Figure 29-17. Debugging MSDP R1_E600(conf)#do debug ip msdp All MSDP debugging has been turned on R1_E600(conf)#03:16:08 : MSDP-0: Peer 03:16:09 : MSDP-0: Peer 192.168.0.3, 03:16:27 : MSDP-0: Peer 192.168.0.3, 03:16:38 : MSDP-0: Peer 192.168.0.3, 03:16:39 : MSDP-0: Peer 192.168.0.3, 03:17:09 : MSDP-0: Peer 192.168.0.3, 03:17:10 : MSDP-0: Peer 192.
PAGE 649
MSDP with Anycast RP (10.11.4.2, 239.0.0.1), uptime 00:00:52, expires 00:03:20, flags: FTA Incoming interface: GigabitEthernet 2/1, RPF neighbor 0.0.0.0 Outgoing interface list: GigabitEthernet 2/11 Forward/Sparse 00:00:50/00:02:40 GigabitEthernet 2/31 Forward/Sparse 00:00:50/00:02:40 PI M AS X Area 0 + PI M PC 2 Source + MP IG PC 3 Receiver OS PF + Figure 29-18. MP IG 4/1 R4 4/31 OS PF + 2/1 BGP (*, 239.0.0.1), uptime 00:00:23, expires 00:00:00, RP 192.168.0.
PAGE 650
www.dell.com | support.dell.com Reducing Source-active Message Flooding RPs flood source-active messages to all of their peers away from the RP. When multiple RPs exist within a domain, the RPs forward received active source information back to the originating RP, which violates the RFP rule. You can prevent this unnecessary flooding by creating a mesh-group. A mesh in this context is a topology in which each RP in a set of RPs has a peership with all other RPs in the set.
PAGE 651
Figure 29-19. R1 Configuration for MSDP with Anycast RP ip multicast-routing ! interface GigabitEthernet 1/1 ip pim sparse-mode ip address 10.11.3.1/24 no shutdown ! interface GigabitEthernet 1/2 ip address 10.11.2.1/24 no shutdown ! interface GigabitEthernet 1/21 ip pim sparse-mode ip address 10.11.1.12/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.1/32 no shutdown ! interface Loopback 1 ip address 192.168.0.11/32 no shutdown ! router ospf 1 network 10.11.2.
PAGE 652
www.dell.com | support.dell.com Figure 29-20. 652 R2 Configuration for MSDP with Anycast RP ip multicast-routing ! interface GigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.4.1/24 no shutdown ! interface GigabitEthernet 2/11 ip pim sparse-mode ip address 10.11.1.21/24 no shutdown ! interface GigabitEthernet 2/31 ip pim sparse-mode ip address 10.11.0.23/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.1/32 no shutdown ! interface Loopback 1 ip address 192.168.0.
PAGE 653
Figure 29-21. R3 Configuration for MSDP with Anycast RP ip multicast-routing ! interface GigabitEthernet 3/21 ip pim sparse-mode ip address 10.11.0.32/24 no shutdown interface GigabitEthernet 3/41 ip pim sparse-mode ip address 10.11.6.34/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.3/32 no shutdown ! router ospf 1 network 10.11.6.0/24 area 0 network 192.168.0.
PAGE 654
www.dell.com | support.dell.com 654 MSDP Sample Configurations The following figures show the running-configurations for the routers shown in figures Figure 29-5, Figure 29-4, Figure 29-5, Figure 29-6. Figure 29-22. MSDP Sample Configuration: R1 Running-config ip multicast-routing ! interface GigabitEthernet 1/1 ip pim sparse-mode ip address 10.11.3.1/24 no shutdown ! interface GigabitEthernet 1/2 ip address 10.11.2.1/24 no shutdown ! interface GigabitEthernet 1/21 ip pim sparse-mode ip address 10.11.1.
PAGE 655
Figure 29-23. MSDP Sample Configuration: R2 Running-config ip multicast-routing ! interface GigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.4.1/24 no shutdown ! interface GigabitEthernet 2/11 ip pim sparse-mode ip address 10.11.1.21/24 no shutdown ! interface GigabitEthernet 2/31 ip pim sparse-mode ip address 10.11.0.23/24 no shutdown ! interface Loopback 0 ip address 192.168.0.2/32 no shutdown ! router ospf 1 network 10.11.1.0/24 area 0 network 10.11.4.0/24 area 0 network 192.168.0.
PAGE 656
www.dell.com | support.dell.com Figure 29-24. 656 MSDP Sample Configuration: R3 Running-config ip multicast-routing ! interface GigabitEthernet 3/21 ip pim sparse-mode ip address 10.11.0.32/24 no shutdown ! interface GigabitEthernet 3/41 ip pim sparse-mode ip address 10.11.6.34/24 no shutdown ! interface ManagementEthernet 0/0 ip address 10.11.80.3/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.3/32 no shutdown ! router ospf 1 network 10.11.6.0/24 area 0 network 192.168.0.
PAGE 657
Figure 29-25. MSDP Sample Configuration: R4 Running-config ip multicast-routing ! interface GigabitEthernet 4/1 ip pim sparse-mode ip address 10.11.5.1/24 no shutdown ! interface GigabitEthernet 4/22 ip address 10.10.42.1/24 no shutdown ! interface GigabitEthernet 4/31 ip pim sparse-mode ip address 10.11.6.43/24 no shutdown ! interface Loopback 0 ip address 192.168.0.4/32 no shutdown ! router ospf 1 network 10.11.5.0/24 area 0 network 10.11.6.0/24 area 0 network 192.168.0.
PAGE 658
www.dell.com | support.dell.
PAGE 659
30 Multiple Spanning Tree Protocol Multiple Spanning Tree Protocol is supported on platforms: ces MSTP addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Multiple Spanning Tree Protocol (MSTP)—specified in IEEE 802.1Q-2003—is an RSTP-based spanning tree variation that improves on PVST+. MSTP allows multiple spanning tree instances and allows you to map many VLANs to one spanning tree instance to reduce the total number of required instances.
PAGE 660
www.dell.com | support.dell.com FTOS supports three other variations of Spanning Tree, as shown in Table 44. Table 30-1. FTOS Supported Spanning Tree Protocols Dell Force10 Term IEEE Specification Spanning Tree Protocol 802.1d Rapid Spanning Tree Protocol 802.1w Multiple Spanning Tree Protocol 802.1s Per-VLAN Spanning Tree Plus Third Party Implementation Information • • • • • The FTOS MSTP implementation is based on IEEE 802.
PAGE 661
Enable Multiple Spanning Tree Globally MSTP is not enabled by default. To enable MSTP: Step Task Command Syntax Command Mode 1 Enter PROTOCOL MSTP mode. protocol spanning-tree mstp CONFIGURATION 2 Enable MSTP. no disable PROTOCOL MSTP Verify that MSTP is enabled using the show config command from PROTOCOL MSTP mode, as shown in Figure 30-2. Figure 30-2.
PAGE 662
www.dell.com | support.dell.com Figure 30-3. Mapping VLANs to MSTI Instances Force10(conf)#protocol spanning-tree mstp Force10(conf-mstp)#msti 1 vlan 100 Force10(conf-mstp)#msti 2 vlan 200-300 Force10(conf-mstp)#show config ! protocol spanning-tree mstp no disable MSTI 1 VLAN 100 MSTI 2 VLAN 200-300 All bridges in the MSTP region must have the same VLAN-to-instance mapping.
PAGE 663
Influence MSTP Root Selection MSTP determines the root bridge, but you can assign one bridge a lower priority to increase the probability that it will become the root bridge. To change the bridge priority: Task Command Syntax Command Mode Assign a number as the bridge priority. A lower number increases the probability that the bridge becomes the root bridge.
PAGE 664
www.dell.com | support.dell.com To change the region name or revision: Task Command Syntax Command Mode Change the region name. name name PROTOCOL MSTP Change the region revision number. • Range: 0 to 65535 • Default: 0 revision number PROTOCOL MSTP View the current region name and revision using the command show spanning-tree mst configuration from EXEC Privilege mode, as shown in Figure 30-6. Figure 30-6.
PAGE 665
Task Command Syntax Command Mode Change the hello-time parameter. Note: With large configurations (especially those with more ports) Dell Force10 recommends that you increase the hello-time. Range: 1 to 10 Default: 2 seconds hello-time seconds PROTOCOL MSTP Change the max-age parameter. Range: 6 to 40 Default: 20 seconds max-age seconds PROTOCOL MSTP Change the max-hops parameter.
PAGE 666
www.dell.com | support.dell.com Modify Interface Parameters You can adjust two interface parameters to increase or decrease the probability that a port becomes a forwarding port: • • Port cost is a value that is based on the interface type. The greater the port cost, the less likely the port will be selected to be a forwarding port. Port priority influences the likelihood that a port will be selected to be a forwarding port in case that several ports have the same port cost.
PAGE 667
Configure an EdgePort The EdgePort feature enables interfaces to begin forwarding traffic approximately 30 seconds sooner. In this mode an interface forwards frames by default until it receives a BPDU that indicates that it should behave otherwise; it does not go through the Learning and Listening states. The bpduguard shutdown-on-violation option causes the interface hardware to be shutdown when it receives a BPDU.
PAGE 668
www.dell.com | support.dell.com Configure a Root Guard Use the Root Guard feature in a Layer 2 MSTP network to avoid bridging loops. You enable root guard on a per-port or per-port-channel basis. FTOS Behavior: The following conditions apply to a port enabled with root guard: • Root guard is supported on any MSTP-enabled port or port-channel interface except when used as a stacking port.
PAGE 669
Configure a Loop Guard The Loop Guard feature provides protection against Layer 2 forwarding loops (STP loops) caused by a hardware failure, such as a cable failure or an interface fault. When a cable or interface fails, a participating STP link may become unidirectional (STP requires links to be bidirectional) and an STP port does not receive BPDUs. When an STP blocking port does not receive BPDUs, it transitions to a forwarding state. This condition can create a loop in the network.
PAGE 670
www.dell.com | support.dell.com Flush MAC Addresses after a Topology Change FTOS has an optimized MAC address flush mechanism for RSTP, MSTP, and PVST+ that flushes addresses only when necessary, which allows for faster convergence during topology changes. However, you may activate the flushing mechanism defined by 802.1Q-2003 using the command tc-flush-standard, which flushes MAC addresses upon every topology change notification.
PAGE 671
MSTP Sample Configurations The running-configurations in Figure 30-11, Figure 30-12, and Figure 30-12 support the topology shown in Figure 30-10. The configurations are from FTOS systems. An S50 system using SFTOS, configured as shown Figure 30-14, could be substituted for an FTOS router in this sample following topology and MSTP would function as designed. Figure 30-10.
PAGE 672
www.dell.com | support.dell.com Figure 30-11.
PAGE 673
Figure 30-12.
PAGE 674
www.dell.com | support.dell.com Figure 30-13.
PAGE 675
Figure 30-14.
PAGE 676
www.dell.com | support.dell.com Debugging and Verifying MSTP Configuration Display BPDUs using the command debug spanning-tree mstp bpdu from EXEC Privilege mode. Display MSTP-triggered topology change messages debug spanning-tree mstp events. Figure 30-15. Displaying BPDUs and Events Force10#debug spanning-tree mstp bpdu 1w1d17h : MSTP: Sending BPDU on Gi 1/31 : ProtId: 0, Ver: 3, Bpdu Type: MSTP, Flags 0x68 CIST Root Bridge Id: 32768:0001.e806.953e, Ext Path Cost: 20000 Regional Bridge Id: 32768:0001.
PAGE 677
Figure 30-16. Sample Output for show running-configuration spanning-tree mstp command Force10#show run spanning-tree mstp ! protocol spanning-tree mstp name Tahiti revision 123 MSTI 1 VLAN 100 MSTI 2 VLAN 200,300 Figure 30-17. Displaying BPDUs and Events - Debug Log of Successful MSTP Configuration Force10#debug spanning-tree mstp bpdu MSTP debug bpdu is ON Force10# 4w0d4h : MSTP: Sending BPDU on Gi 2/21 : ProtId: 0, Ver: 3, Bpdu Type: MSTP, Flags 0x6e CIST Root Bridge Id: 32768:0001.e806.
PAGE 678
www.dell.com | support.dell.
PAGE 679
31 Multicast Features Multicast Features are supported on platforms: ces Multicast is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later.
PAGE 680
www.dell.com | support.dell.com Prior to enabling any multicast protocols, you must enable multicast routing. Task Command Syntax Command Mode Enable multicast routing. ip multicast-routing CONFIGURATION Multicast with ECMP Dell Force10 multicast uses Equal-cost Multi-path (ECMP) routing to load-balance multiple streams across equal cost links.
PAGE 681
Implementation Information • Because protocol control traffic in FTOS is redirected using the MAC address, and multicast control traffic and multicast data traffic might map to the same MAC address, FTOS might forward data traffic with certain MAC addresses to the CPU in addition to control traffic. As the upper five bits of an IP Multicast address are dropped in the translation, 32 different multicast group IDs all map to the same Ethernet address. For example, 224.0.0.
PAGE 682
www.dell.com | support.dell.com Limit the Number of Multicast Routes Task Command Syntax Command Mode Limit the total number of multicast routes on the system. ip multicast-limit CONFIGURATION Range: 1-50000 Default: 15000 When the limit is reached, FTOS does not process any IGMP or MLD joins to PIM—though it still processes leave messages—until the number of entries decreases below 95% of the limit.
PAGE 683
Prevent a Host from Joining a Group You can prevent a host from joining a particular group by blocking specific IGMP reports. Create an extended access list containing the permissible source-group pairs. Use the command ip igmp access-group access-list-name from INTERFACE mode to apply the access list. Note: For rules in IGMP access lists, source is the multicast source, not the source of the IGMP packet.
PAGE 684
| Multicast Features ip igmp snooping enable interface Vlan 400 ip pim sparse-mode ip address 10.11.4.1/24 untagged GigabitEthernet 1/2 ip igmp access-group igmpjoinfilR2G2 no shutdown (*, 239.0.0.1), uptime 00:00:06, expires 00:00:00, RP 10.11.12.2, flags: SCJ Incoming interface: GigabitEthernet 1/21, RPF neighbor 10.11.12.2 Outgoing interface list: Vlan 400 Forward/Sparse 00:00:06/Never interface GigabitEthernet 2/31 ip pim sparse-mode ip address 10.11.23.
PAGE 685
Rate Limit IGMP Join Requests If you expect a burst of IGMP Joins, protect the IGMP process from overload by limiting that rate at which new groups can be joined using the command ip igmp group-join-limit from INTERFACE mode. Hosts whose IGMP requests are denied will use the retry mechanism built-in to IGMP so that they’re membership is delayed rather than permanently denied. View the enable status of this feature using the command show ip igmp interface from EXEC Privilege mode.
PAGE 686
| Multicast Features (10.11.5.2, 239.0.0.2), uptime 00:00:33, expires 00:03:07, flags: CT Incoming interface: GigabitEthernet 1/31, RPF neighbor 10.11.13.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:00:40/Never (*, 239.0.0.2), uptime 00:00:40, expires 00:00:00, RP 10.11.12.2, flags: SCJ Incoming interface: GigabitEthernet 1/21, RPF neighbor 10.11.12.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:00:40/Never (10.11.5.2, 239.0.0.
PAGE 687
Using a Static Multicast MAC Address Using a Static Multicast MAC Address is supported on platform c When a multicast source and multicast receivers are in the same VLAN, you can configure a router so that multicast traffic is switched only to the ports assigned to a VLAN that is associated with a static multicast MAC address. This task improves router performance by limiting the output ports to which multicast data is sent.
PAGE 688
www.dell.com | support.dell.com To display the current configuration of Layer 2 multicast switching on a router, enter the show mac-address-table static multicast [vlan vlan-id | multicast-mac-address [vlan vlan-id]] command in EXEC mode. Static MAC addresses configured for Layer 2 multicast forwarding with an associated VLAN and assigned output ports are displayed as shown in Figure 31-4. Figure 31-4.
PAGE 689
IPv6 Multicast Policies IPv6 Multicast Policies is available only on platform: • • • • e Limit the Number of IPv6 Multicast Routes on page 689 Prevent an IPv6 Neighbor from Forming an Adjacency on page 689 Prevent an IPv6 Source from Registering with the RP on page 690 Prevent an IPv6 PIM Router from Processing an IPv6 Join on page 690 Limit the Number of IPv6 Multicast Routes You can limit the total number of IPv6 multicast routes on the system.
PAGE 690
www.dell.com | support.dell.com Prevent an IPv6 Source from Registering with the RP Task Command Syntax Command Mode Configured on the source DR, prevent the source DR from sending register packets to the RP for specific sources and groups.
PAGE 691
• MTRACE Transit—when a Dell Force10 system is an intermediate router between the source and destination in an MTRACE query, FTOS computes the RPF neighbor for the source, fills in the request, and forwards the request to the RPF neighbor. While computing the RPF neighbor, static mroutes and mBGP routes are preferred over unicast routes. When a Dell Force10 system is the last hop to the destination, FTOS sends a response to the query.
PAGE 692
www.dell.com | support.dell.com • • Allocate More Buffer Memory for Multicast WRED Allocate More Bandwidth to Multicast using Egress WFQ Allocate More Buffer Memory for Multicast WRED Allocate more buffer memory to multicast WRED (Weighted Random Early Detection) for bursty multicast traffic that might temporarily become oversubscribed.
PAGE 693
32 Object Tracking IPv4/IPv6 Object Tracking is available on platforms: ces This chapter covers the following information: • • • Object Tracking Overview Object Tracking Configuration Displaying Tracked Objects Object tracking allows FTOS client processes, such as VRRP, to monitor tracked objects (for example, interface or link status) and take appropriate action when the state of an object changes. Note: In release 8.4.1.0, object tracking is supported only on VRRP.
PAGE 694
www.dell.com | support.dell.com You can create a tracked object to monitor the metric of the default route 0.0.0.0/0. After you configure the default route as a tracked object, you can configure the VRRP group to track the state of the route. In this way, the VRRP priority of the router with the better metric as determined by OSPF automatically becomes master of the VRRP group.
PAGE 695
Tracking Layer 3 Interfaces You can create an object that tracks the Layer 3 state (IPv4 or IPv6 routing status) of an interface. • • The Layer 3 status of an interface is UP only if the Layer 2 status of the interface is UP and the interface has a valid IP address. The Layer 3 status of an interface goes DOWN when its Layer 2 status goes down or the IP address is removed from the routing table.
PAGE 696
www.dell.com | support.dell.com • If the scaled metric for a route is greater than or equal to the DOWN threshold or the route is not entered in the routing table, the state of a route is DOWN. The UP and DOWN thresholds are user-configurable for each tracked route. The default UP threshold is 254; the default DOWN threshold is 255. The notification of a change in the state of a tracked object is sent when a metric value crosses a configured threshold.
PAGE 697
You can assign a unique priority-cost value from 1 to 254 to each tracked VRRP object or group interface. The priority cost is subtracted from the VRRP group priority if a tracked VRRP object is in a DOWN state. If a VRRP group router acts as owner-master, the run-time VRRP group priority remains fixed at 255 and changes in the state of a tracked object have no effect. For more information on how to track a VRRP object, see Track an Interface or Object on page 1153.
PAGE 698
www.dell.com | support.dell.com To configure object tracking on the status of a Layer 2 interface, use the following commands. To remove object tracking on a Layer 2 interface, enter the no track object-id command. Step 1 Task Command Syntax Command Mode Configure object tracking on the line-protocol state of a Layer 2 interface. track object-id interface interface CONFIGURATION line-protocol Valid object IDs are from 1 to 65535.
PAGE 699
For an IPv4 interface, a routing object only tracks the UP/DOWN status of the specified IPv4 interface (track interface ip-routing command). • • The status of an IPv4 interface is UP only if the Layer 2 status of the interface is UP and the interface has a valid IP address. The Layer 3 status of an IPv4 interface goes DOWN when its Layer 2 status goes down (for a Layer 3 VLAN, all VLAN ports must be down) or the IP address is removed from the routing table.
PAGE 700
www.dell.com | support.dell.com Figure 32-4.
PAGE 701
The tracking process uses a protocol-specific resolution value to convert the actual metric in the routing table to a scaled metric in the range 0 to 255. The resolution value is user-configurable and calculates the scaled metric by dividing a route's cost by the resolution value set for the route type: • • • • For ISIS, you can set the resolution in the range 1 to 1000, where the default is 10. For OSPF, you can set the resolution in the range 1 to 1592, where the default is 1.
PAGE 702
www.dell.com | support.dell.com Figure 32-5. Command Example: track ip route reachability Force10(conf)#track 104 ip route 10.0.0.0/8 reachability Force10(conf-track-104)#delay up 20 down 10 Force10(conf-track-104)#end Force10#show track 104 Track 104 IP route 10.0.0.0/8 reachability Reachability is Down (route not in route table) 2 changes, last change 00:02:49 Tracked by: Force10#configure Force10(conf)#track 4 ip route 3.1.1.0/24 reachability vrf vrf1 Figure 32-6.
PAGE 703
Step 3 4 5 Task Command Syntax Command Mode (Optional) Configure the time delay used before communicating a change in the UP and/or DOWN status of a tracked route. delay {[up seconds] [down seconds]} OBJECT TRACKING Valid delay times are from 0 to 180 seconds. Default: 0. (Optional) Identify the tracked object with a text description. description text (Optional) Configure the metric threshold for the UP and/or DOWN routing status to be tracked for the specified route.
PAGE 704
www.dell.com | support.dell.
PAGE 705
Figure 32-11. Command Example: show track resolution Force10#show track resolution IP Route Resolution ISIS 1 OSPF 1 IPv6 Route Resolution ISIS 1 OSPF 1 Figure 32-12. Command Example: show track vrf Force10#show track vrf red Track 5 IP route 192.168.0.
PAGE 706
| Object Tracking www.dell.com | support.dell.
PAGE 707
33 Open Shortest Path First (OSPFv2 and OSPFv3) ces Open Shortest Path First version 3 (OSPF for IPv6) is supported on platforms c e Open Shortest Path First version 2 (OSPF for IPv4) is supported on platforms OSPF for IPv4 is supported on the E-Series ExaScale platform with FTOS 8.1.1.0; OSPF for IPv6 is supported on E-Series ExaScale with FTOS version 8.2.1.0 and later.
PAGE 708
www.dell.com | support.dell.com Protocol Overview Open Shortest Path First (OSPF) routing is a link-state routing protocol that calls for the sending of Link-State Advertisements (LSAs) to all other routers within the same Autonomous System (AS) Areas. Information on attached interfaces, metrics used, and other variables is included in OSPF LSAs. As OSPF routers accumulate link-state information, they use the SPF algorithm (Shortest Path First algorithm) to calculate the shortest path to each node.
PAGE 709
Figure 33-1. Autonomous System Areas Router M Router K Router F Router E Router L Area 200 Router D Router C Router G Area 100 Area 0 Router H Router B Router A Router I Router J Area 300 Area Types The Backbone of the network is Area 0. It is also called Area 0.0.0.0 and is the core of any Autonomous System (AS). All other areas must connect to Area 0. Areas can be defined in such a way that the backbone is not contiguous.
PAGE 710
www.dell.com | support.dell.com A Stub Area (SA) does not receive external route information, except for the default route. These areas do receive information from inter-area (IA) routes. Note that all routers within an assigned Stub area must be configured as stubby, and no generate LSAs that do not apply. For example, a Type 5 LSA is intended for external areas and the Stubby area routers may not generate external LSAs. Stubby areas cannot be traversed by a virtual link.
PAGE 711
Figure 33-2.
PAGE 712
www.dell.com | support.dell.com Area Border Router (ABR) Within an AS, an Area Border (ABR) connects one or more areas to the Backbone. The ABR keeps a copy of the link-state database for every area it connects to, so it may keep multiple copies of the link state database. An Area Border Router (ABR) takes information it has learned on one of its attached areas and can summarize it before sending it out on other areas it is connected to.
PAGE 713
Link-State Advertisements (LSAs) A Link-State Advertisement (LSA) communicates the router's local routing topology to all other local routers in the same area. • • OSPFv3 can treat LSAs as having link-local flooding scope, or store and flood them as if they are understood, while ignoring them in their own SPF algorithms. OSPFv2 always discards unknown LSA types.
PAGE 714
www.dell.com | support.dell.com For all LSA types, there are 20-byte LSA headers. One of the fields of the LSA header is the Link-State ID. Each router link is defined as one of four types: type 1, 2, 3, or 4. The LSA includes a link ID field that identifies, by the network number and mask, the object this link connects to. Depending on the type, the link ID has different meanings.
PAGE 715
Figure 33-3. Priority and Costs Example Router 2 Priority 180 Cost 50 Router 1 Priority 200 Cost 21 Router 3 Priority 100 Cost 25 Router 4 Priority 150 Cost 20 Router 1 selected by the system as DR. Router 2 selected by the system as BDR. If R1 fails, the system subtracts 21 fromR1 s priority number. R1 s new pr iority is 179. R2 as both the selected BDR and the now-highest priority, becomes the DR. If R3 fails, the system subtracts R2 s new priority is130. 50 fromits priority.
PAGE 716
www.dell.com | support.dell.com • • NSSA External (type 7) Opaque Link-local (type 9) Graceful Restart c e and s platforms in Helper and Restart modes. Graceful Restart for OSPFv3 is supported only on et platforms in Helper and Restart modes. Graceful Restart for OSPFv2 is supported on When a router goes down without a Graceful Restart, there is a possibility for loss of access to parts of the network due to ongoing network topology changes.
PAGE 717
• period. You reconfigure OSPFv3 graceful restart to a “restarting-only” role when you enable the helper-reject role on an interface. OSPFv3 supports the helper-reject role on a per-interface basis. Configuring helper-reject role on an OSPFv2 router or OSPFv3 interface enables the restarting-only role globally on the router or locally on the interface. In a helper-reject role, OSPF does not participate in the graceful restart of an adjacent OSPFv2/v3 router.
PAGE 718
www.dell.com | support.dell.com Each OSPFv2 process has a unique process ID and must have an associated Router ID. There must be an equal number of interfaces must be in Layer-3 mode for the number of processes created. For example, if 5 OSPFv2 processes are created on a system, there must be at least 5 interfaces assigned in Layer-3 mode. Each OSPFv2 process is independent.
PAGE 719
Figure 33-4. Enabling RFC-2328 Compliant OSPF Flooding 00:10:41 : OSPF(1000:00): Printed only for ACK packets Rcv. v:2 t:5(LSAck) l:64 Acks 2 rid:2.2.2.2 aid:1500 chk:0xdbee aut:0 auk: keyid:0 from:Vl 1000 LSType:Type-5 AS External id:160.1.1.0 adv:6.1.0.0 seq:0x8000000c LSType:Type-5 AS External id:160.1.2.0 adv:6.1.0.0 seq:0x8000000c 00:10:41 : OSPF(1000:00): Rcv. v:2 t:5(LSAck) l:64 Acks 2 rid:2.2.2.2 aid:1500 chk:0xdbee aut:0 auk: keyid:0 from:Vl 100 LSType:Type-5 AS External id:160.1.1.0 adv:6.1.0.
PAGE 720
www.dell.com | support.dell.com To ensure equal intervals between the routers, manually set the dead interval of the Dell Force10 router to match the Cisco configuration. Use the command “ip ospf dead-interval ” in interface mode: Figure 33-6. Command Example: ip ospf intervals Force10(conf)#int gi 2/2 Force10(conf-if-gi-2/2)#ip ospf hello-interval 20 Force10(conf-if-gi-2/2)#ip ospf dead-interval 80 Force10(conf-if-gi-2/2)# Figure 33-7.
PAGE 721
2. Enable OSPF globally. Assign network area and neighbors. 3. Add interfaces or configure other attributes.
PAGE 722
www.dell.com | support.dell.com Return to CONFIGURATION mode to enable the OSPF process. The OSPF Process ID is the identifying number assigned to the OSPF process, and the Router ID is the IP address associated with the OSPF process. . Command Syntax Command Mode Usage router ospf process-id [vrf {vrf name}] CONFIGURATION Enable the OSPFv2 process globally. Range: 0-65535 vrf name: Enter the VRF key word and instance name to tie the OSPF instance to the VRF.
PAGE 723
Enable Multi-Process OSPF Multi-Process OSPF allows multiple OSPFv2 processes on a single router. The following list shows the number of processes supported on each platform type. • • • The E-Series supports up to 30 OSPFv2 processes. The C-Series supports up to 6 OSPFv2 processes. The S-Series supports up to 4 OSPFv2 processes. Follow the same steps as above, when configuring a single OSPF process. Repeat them as often as necessary for the desired number of processes.
PAGE 724
www.dell.com | support.dell.com In CONFIGURATION ROUTER OSPF mode, assign the Router ID. The Router ID is not required to be the router’s IP address. Dell Force10 recommends using the IP address as the Router ID for easier management and troubleshooting. Command Syntax Command Mode Usage router-id ip address CONFIG-ROUTER-O SPF-id Assign the Router ID for the OSPFv2 process. IP Address: A.B.C.D Use the no router ospf process-id command syntax in the CONFIGURATION mode to disable OSPF.
PAGE 725
Enable OSPFv2 on interfaces Each interface must have OSPFv2 enabled on it. It must be configured for Layer 3 protocol, and not be shutdown. OSPFv2 can also be assigned to a loopback interface as a virtual interface. OSPF functions and features, such as MD5 Authentication, Grace Period, Authentication Wait Time, etc, are assigned on a per interface basis. Note: If using features like MD5 Authentication, ensure all the neighboring routers are also configured for MD5.
PAGE 726
www.dell.com | support.dell.com Figure 33-10. Command Example: show ip ospf process-id interface Force10>show ip ospf 1 interface GigabitEthernet 12/17 is up, line protocol is up Internet Address 10.2.2.1/24, Area 0.0.0.0 Process ID 1, Router ID 11.1.2.1, Network Type BROADCAST, Cost: 1 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 11.1.2.1, Interface address 10.2.2.1 Backup Designated Router (ID) 0.0.0.0, Interface address 0.0.0.
PAGE 727
Configure stub areas OSPF supports different types of LSAs to help reduce the amount of router processing within the areas. Type 5 LSAs are not flooded into stub areas; the Area Border Router (ABR) advertises a default route into the stub area to which it is attached. Stub area routers use the default route to reach external destinations To ensure connectivity in your OSPFv2 network, never configure the backbone area as a stub area.
PAGE 728
www.dell.com | support.dell.
PAGE 729
Enable passive interfaces A passive interface is one that does not send or receive routing information. Enabling passive interface suppresses routing updates on an interface. Although the passive interface will neither send nor receive routing updates, the network on that interface will still be included in OSPF updates sent via other interfaces. Use the following command in the ROUTER OSPF mode to suppress the interface’s participation on an OSPF interface.
PAGE 730
www.dell.com | support.dell.com Figure 33-13. Command Example: show ip ospf process-id interface Force10#show ip ospf 34 int GigabitEthernet 0/0 is up, line protocol is down Internet Address 10.1.2.100/24, Area 1.1.1.1 Process ID 34, Router ID 10.1.2.100, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State DOWN, Priority 1 Designated Router (ID) 10.1.2.100, Interface address 0.0.0.0 Backup Designated Router (ID) 0.0.0.0, Interface address 0.0.0.
PAGE 731
Figure 33-14 shows the convergence settings when fast-convergence is enabled and Figure 33-15 shows settings when fast-convergence is disabled. These displays appear with the show ip ospf command. Figure 33-14. Command Example: show ip ospf process-id (fast-convergence enabled) Force10(conf-router_ospf-1)#fast-converge 2 Force10(conf-router_ospf-1)#ex Force10(conf)#ex Force10#show ip ospf 1 Routing Process ospf 1 with ID 192.168.67.
PAGE 732
www.dell.com | support.dell.com Use any or all of the following commands in CONFIGURATION INTERFACE mode to change OSPFv2 parameters on the interfaces: Command Syntax Command Mode Usage ip ospf cost CONFIG-INTERFACE Change the cost associated with OSPF traffic on the interface. Cost: 1 to 65535 (default depends on the interface speed). ip ospf dead-interval seconds CONFIG-INTERFACE Change the time interval the router waits before declaring a neighbor dead.
PAGE 733
Figure 33-16. Changing the OSPF Cost Value on an Interface Force10(conf-if)#ip ospf cost 45 Force10(conf-if)#show config ! interface GigabitEthernet 0/0 ip address 10.1.2.100 255.255.255.0 no shutdown ip ospf cost 45 Force10(conf-if)#end Force10#show ip ospf 34 interface The change is made on the interface and it is reflected in the OSPF configuration GigabitEthernet 0/0 is up, line protocol is up Internet Address 10.1.2.100/24, Area 2.2.2.2 Process ID 34, Router ID 10.1.2.
PAGE 734
www.dell.com | support.dell.com • helper-reject neighbors—the router ID of each restart router that does not receive assistance from the • • configured router. mode—the situation or situations that trigger a graceful restart. role—the role or roles the configured router can perform. Note: By default, OSPFv2 graceful restart is disabled. You enable OSPFv2 graceful restart in CONFIGURATION ROUTER OSPF mode.
PAGE 735
Figure 33-17. Command Example: show run ospf Force10#show run ospf ! router ospf 1 graceful-restart grace-period 300 graceful-restart role helper-only graceful-restart mode unplanned-only graceful-restart helper-reject 10.1.1.1 graceful-restart helper-reject 20.1.1.1 network 10.0.2.0/24 area 0 Force10# Use the following command to disable OSPFv2 graceful-restart after you have enabled it.
PAGE 736
www.dell.com | support.dell.com Use the following command in CONFIGURATION ROUTER OSPF mode to configure virtual links. Command Syntax Command Mode Usage area area-id virtual-link router-id [hello-interval seconds | retransmit-interval seconds | transmit-delay seconds | dead-interval seconds | authentication-key key | message-digest-key keyid md5 key] CONFIG-ROUTEROSPF-id Configure the optional parameters of a virtual link: • Area ID: assigned earlier (0-65535 or A.B.C.
PAGE 737
Command Syntax Command Mode Usage seq sequence-number {deny |permit} ip-prefix [ge min-prefix-length] [le max-prefix-length] CONFIG- PREFIX LIST Create a prefix list with a sequence. number and a deny or permit action. The optional parameters are: ge min-prefix-length: is the minimum prefix length to be matched (0 to 32). le max-prefix-length: is the maximum prefix length to be matched (0 to 32).
PAGE 738
www.dell.com | support.dell.com To view the current OSPF configuration, use the show running-config ospf command in the EXEC mode or the show config command in the ROUTER OSPF mode Figure 33-19. Command Example: show config Force10(conf-router_ospf)#show config ! router ospf 34 network 10.1.2.32 0.0.0.255 area 2.2.2.2 network 10.1.3.24 0.0.0.255 area 3.3.3.3 distribute-list dilling in Force10(conf-router_ospf)# Troubleshooting OSPFv2 FTOS has several tools to make troubleshooting easier.
PAGE 739
Use the show running-config ospf command to see the state of all the enabled OSPFv2 processes. Command Syntax Command Mode Usage show running-config ospf EXEC Privilege View the summary of all OSPF process IDs enables on the router. Figure 33-20. Command Example: show running-config ospf Force10#show run ospf ! router ospf 3 ! router ospf 4 router-id 4.4.4.4 network 4.4.4.0/28 area 1 ! router ospf 5 ! router ospf 6 ! router ospf 7 mib-binding ! router ospf 8 ! router ospf 90 area 2 virtual-link 4.4.
PAGE 740
www.dell.com | support.dell.com Use the following command in EXEC Privilege mode to configure the debugging options of an OSPFv2 process: Command Syntax Command Mode Usage debug ip ospf process-id [event | packet | spf] EXEC Privilege View debug messages. To view debug messages for a specific OSPF process ID, enter debug ip ospf process-id. If you do not enter a process ID, the command applies to the first OSPF process.
PAGE 741
Sample Configurations for OSPFv2 The following configurations are examples for enabling OSPFv2. These are not comprehensive directions. They are intended to give you a some guidance with typical configurations. You can copy and paste from these examples to your CLI. Be sure you make the necessary changes to support your own IP Addresses, Interfaces, Names, etc. Basic OSPFv2 Router Topology The following illustration is a sample basic OSPFv2 topology.
PAGE 742
www.dell.com | support.dell.com Configuration Task List for OSPFv3 (OSPF for IPv6) Open Shortest Path First version 3 (OSPF for IPv6) is supported on platforms ce The configuration options of OSPFv3 are the same as those for OSPFv2, but may be configured with differently labeled commands. Process IDs and areas need to be specified. Interfaces and addresses need to be included in the process. Areas can be defined as stub or totally stubby.
PAGE 743
Enable IPv6 Unicast Routing Command Syntax Command Mode Usage ipv6 unicast routing CONFIGURATION Enables IPv6 unicast routing globally. Assign IPv6 addresses on an interface Command Syntax Command Mode Usage ipv6 address ipv6 address CONF-INT-type slot/port Assign IPv6 address to the interface. IPv6 addresses are normally written as eight groups of four hexadecimal digits, where each group is separated by a colon (:).
PAGE 744
www.dell.com | support.dell.com Assign OSPFv3 Process ID and Router ID Globally Command Syntax Command Mode Usage ipv6 router ospf {process ID} CONFIGURATION Enable the OSPFv3 process globally and enter OSPFv3 mode. Range: 0-65535 router-id {number} CONF-IPV6-ROUTER-OSPF Assign the Router ID for this OSPFv3 process number: IPv4 address Format: A.B.C.D Note: The router-id for an OSPFv3 router is entered as an IPv4 IP address.
PAGE 745
Configure Passive-Interface Use the following command to suppress the interface’s participation on an OSPFv3 interface. This command stops the router from sending updates on that interface. Command Syntax Command Mode Usage passive-interface {type slot/port} CONF-IPV6-ROUTER-OSPF Specify whether some or all some of the interfaces will be passive. Interface identifies the specific interface that will be passive.
PAGE 746
www.dell.com | support.dell.com Redistribute routes You can add routes from other routing instances or protocols to the OSPFv3 process. With the redistribute command syntax, you can include RIP, static, or directly connected routes in the OSPF process. Command Syntax Command Mode Usage redistribute {bgp | connected | static} [metric metric-value | metric-type type-value] [route-map map-name] [tag tag-value] CONF-IPV6-ROUTER-OSPF Specify which routes will be redistributed into OSPF process.
PAGE 747
Enable OSPFv3 graceful restart Graceful Restart for OSPFv3 is supported only on platform for more information on the feature. et. Refer to Graceful Restart on page 716 By default, OSPFv3 graceful restart is disabled and functions only in a helper role to help restarting neighbor routers in their graceful restarts when it receives a Grace LSA.
PAGE 748
www.dell.com | support.dell.com To display information on the use and configuration of OSPFv3 graceful restart, enter any of the following commands: Command Syntax Command Mode Usage show run ospf EXEC Privilege Display the graceful-restart configuration for OSPFv2 and OSPFv3 (Figure 33-23). show ipv6 ospf database grace-lsa EXEC Privilege Display the Type-11 Grace LSAs sent and received on an OSPFv3 router (Figure 33-24).
PAGE 749
Figure 33-24. Command Example: show ipv6 ospf database database-summary Force10#show ipv6 ospf database database-summary ! OSPFv3 Router with ID (200.1.1.
PAGE 750
www.dell.com | support.dell.com OSPFv3 Authentication Using IPsec OSPFv3 Authentication Using IPsec is supported only on platform: et Starting in release 8.4.2.0, OSPFv3 uses the IP Security (IPsec) to provide authentication for OSPFv3 packets. IPsec authentication ensures security in the transmission of OSPFv3 packets between IPsec-enabled routers. IPsec is a set of protocols developed by the IETF to support secure exchange of packets at the IP layer.
PAGE 751
OSPFv3 Authentication using IPsec: Configuration Notes OSPFv3 authentication using IPsec is implemented according to the specifications in RFC 4552, including: • • • • To use IPsec, you configure an authentication (using AH) or encryption (using ESP) security policy on an interface or in an OSPFv3 area. Each security policy consists of a security policy index (SPI) and the key used to validate OSPFv3 packets. After IPsec is configured for OSPFv3, IPsec operation is invisible to the user.
PAGE 752
www.dell.com | support.dell.
PAGE 753
Configuring IPsec Encryption on an Interface Prerequisite: Before you enable IPsec encryption on an OSPFv3 interface, you must first enable IPv6 unicast routing globally, configure an IPv6 address and enable OSPFv3 on the interface, and assign it to an area (see Configuration Task List for OSPFv3 (OSPF for IPv6) on page 742).
PAGE 754
www.dell.com | support.dell.com To remove an IPsec encryption policy from an interface, enter the no ipv6 ospf encryption ipsec spi number command. To remove null encryption on an interface to allow the interface to inherit the encryption policy configured for the OSPFv3 area, enter the no ipv6 ospf encryption null command. To display the configuration of IPsec encryption policies on the router, enter the show crypto ipsec policy command.
PAGE 755
To display the configuration of IPsec authentication policies on the router, enter the show crypto ipsec policy command. Configuring IPsec Encryption for an OSPFv3 Area Prerequisite: Before you enable IPsec encryption in an OSPFv3 area, you must first enable OSPFv3 globally on the router (see Configuration Task List for OSPFv3 (OSPF for IPv6) on page 742).
PAGE 756
www.dell.com | support.dell.com Note that when you configure encryption with the area encryption command, you enable both IPsec encryption and authentication. However, when you enable authentication on an area with the area authentication command, you do not enable encryption at the same time. If you have enabled IPsec authentication in an OSPFv3 area with the area authentication command, you cannot use the area encryption command in the area at the same time.
PAGE 757
Figure 33-26. Command Example: show crypto ipsec policy Force10#show crypto ipsec policy Crypto IPSec client security policy data Policy name Policy refcount Inbound ESP SPI Outbound ESP SPI Inbound ESP Auth Key Outbound ESP Auth Key Inbound ESP Cipher Key Outbound ESP Cipher Key Transform set : : : : : : : : : In this encryption policy, the keys OSPFv3-1-502 are not encrypted.
PAGE 758
www.dell.com | support.dell.com To display the IPsec security associations (SAs) used on OSPFv3 interfaces, enter the following command: Command Syntax Command Mode Usage show crypto ipsec sa ipv6 [interface interface] EXEC Privilege Displays security associations set up for OSPFv3 links in IPsec authentication and encryption policies on the router.
PAGE 759
Figure 33-27.
PAGE 760
www.dell.com | support.dell.com Troubleshooting OSPFv3 FTOS has several tools to make troubleshooting easier. Be sure to check the following, as these are typical issues that interrupt the OSPFv3 process. Note that this is not a comprehensive list, just some examples of typical troubleshooting checks.
PAGE 761
Use the following command in EXEC Privilege mode to configure the debugging options of an OSPFv3 process: Command Syntax Command Mode Usage debug ipv6 ospf [event | packet] {type slot/port} EXEC Privilege View debug messages for all OSPFv3 interfaces. • event: View OSPF event messages. • packet: View OSPF packets. • For a Gigabit Ethernet interface, enter the keyword GigabitEthernet followed by the slot/port information (e.g. passive-interface gi 2/1).
PAGE 762
www.dell.com | support.dell.
PAGE 763
34 PIM Dense-Mode PIM Dense-Mode is supported on platforms: ces PIM-Dense Mode (PIM-DM) is a multicast protocol that directs routers to forward multicast traffic to all subnets until the router receives a request to stop; this behavior is the opposite of PIM-Sparse Mode, which does not forward multicast traffic to a subnet until the traffic is specifically requested using a PIM Join message.
PAGE 764
www.dell.com | support.dell.com Figure 34-1. Multicast Flooding in a PIM-DM Network Source Group Address: 239.192.0.1 Hello R1 Adjacency R2 Receiver PIM-DM 001 R4 R3 Refusing Multicast Traffic If a PIM-DM router has no receivers for a group, it refuses multicast traffic by sending a PIM Prune message to address 224.0.0.13 out of the source interface. The upstream neighbor receives the prune message and determines if it has any remaining neighbors downstream.
PAGE 765
When a router receives a prune message, it flags the relevant (S,G) entry and sets a timer. If the timer expires, it begins flooding traffic out of the interface, and downstream routers must again evaluate whether to prune itself from the tree. To prevent the timer from expiring, while the source is sending traffic for the (S,G), the first-hop router periodically sends an (S,G) state-refresh messages down the entire SPT.
PAGE 766
www.dell.com | support.dell.com Configure PIM-DM Configuring PIM-DM is a two-step process: 1. Enable multicast routing using the command ip multicast-routing from CONFIGURATION mode. 2. Enable PIM-DM on an interface. See page 766. Related Configuration Tasks • • Clear the PIM TIB using the command clear ip pim tib from EXEC Privilege mode. Debug PIM-DM by displaying control activity (packets, events, timers, etc.) using the command debug ip pim from EXEC Privilege mode.
PAGE 767
Figure 34-4. Enabling PIM-DM R1_E600(conf-if-range-gi-1/0,gi-1/12,gi-1/13)#show config ! interface GigabitEthernet 1/0 description Connection to Ixia ip address 2.1.0.1/24 ip pim dense-mode no shutdown ! interface GigabitEthernet 1/12 ip address 2.1.1.1/24 ip pim dense-mode no shutdown ! interface GigabitEthernet 1/13 ip address 2.1.2.1/24 ip pim dense-mode no shutdown R1_E600(conf-if-range-gi-1/0,gi-1/12,gi-1/13)#router rip R1_E600(conf-router_rip)#show config ! router rip network 2.0.0.
PAGE 768
www.dell.com | support.dell.com Figure 34-6. 768 Viewing PIM Neighbors Command Example R1_E600(conf)#do show ip pim neighbor Neighbor Interface Address 2.1.1.2 Gi 1/12 2.1.2.2 Gi 1/13 R1_E600(conf)# Uptime/Expires Ver DR Prio/Mode GR 01:43:51/00:01:35 02:00:46/00:01:41 v2 v2 0 0 / D / D Display the PIM routing table using the command show ip pim tib from EXEC privilege mode, as shown in Figure 34-7.
PAGE 769
Figure 34-7. Viewing the PIM Multicast Routing Table ------------------------------------- Router 1 ---------------------------------------------R1_E600(conf)#do show ip pim tib PIM Multicast Routing Table Flags: D - Dense, S - Sparse, C - Connected, L - Local, P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set, J - Join SPT, M - MSDP created entry, A - Candidate for MSDP Advertisement K - Ack-Pending State Timers: Uptime/Expires Interface state: Interface, next-Hop, State/Mode (*, 239.192.0.
PAGE 770
| PIM Dense-Mode www.dell.com | support.dell.
PAGE 771
35 PIM Sparse-Mode PIM Sparse-Mode is supported on platforms: ces PIM-SM is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. PIM-Sparse Mode (PIM-SM) is a multicast protocol that forwards multicast traffic to a subnet only upon request using a PIM Join message; this behavior is the opposite of PIM-Dense Mode, which forwards multicast traffic to all subnets until it receives a request to stop.
PAGE 772
www.dell.com | support.dell.com Protocol Overview To distribute the same traffic to multiple receivers, PIM-SM creates a tree extending from a root, called the Rendezvous Point (RP), down branches that extend to the nodes which have requested the traffic. Nodes requesting the same traffic belong to the same multicast group. Initially, a single PIM-SM tree called a shared tree to distribute traffic.
PAGE 773
Sending Multicast Traffic With PIM-SM, all multicast traffic must initially originate from the RP. A source must unicast traffic to the RP so that the RP can learn about the source and create an SPT to it. Then the last-hop DR may create an SPT directly to the source. 1. The source gateway router (first-hop DR) receives the multicast packets and creates an (S,G) entry in its multicast routing table.
PAGE 774
www.dell.com | support.dell.com 3. Enable PIM-SM on an interface. See page 774.
PAGE 775
Figure 35-2. Viewing PIM Neighbors Command Example Force10#show ip pim neighbor Neighbor Interface Address 127.87.5.5 Gi 4/11 127.87.3.5 Gi 4/12 127.87.50.5 Gi 7/13 Force10# Uptime/Expires Ver 01:44:59/00:01:16 01:45:00/00:01:16 00:03:08/00:01:37 v2 v2 v2 DR Prio/Mode 1 / S 1 / DR 1 / S Display the PIM routing table using the command show [ip | ipv6] pim tib from EXEC privilege mode, as shown in Figure 35-3. Figure 35-3.
PAGE 776
www.dell.com | support.dell.com Configure the expiry time for a particular (S,G) entry: Step Task Command Syntax Command Mode 1 Create an Extended ACL ip access-list extended access-list-name CONFIGURATION 2 Specify the source and group to which the timer will be applied using extended ACLs with permit rules only. [seq sequence-number] permit ip CONFIG-EXT-NACL 3 Set the expiry time for a specific (S,G) entry (Figure 35-4).
PAGE 777
Figure 35-5. Electing a Rendezvous Point Force10#sh run int loop0 ! interface Loopback 0 ip address 1.1.1.1/32 ip pim sparse-mode no shutdown Force10#sh run pim ! ip pim rp-address 1.1.1.1 group-address 224.0.0.0/4 Override Bootstrap Router Updates PIM-SM routers need to know the address of the RP for each group for which they have (*,G) entry. This address is obtained automatically through the bootstrap router (BSR) mechanism or a static RP configuration.
PAGE 778
www.dell.com | support.dell.com IP Version Task Command Syntax Command Mode IPv6 Override bootstrap router RP election results with your static RP configuration. ipv6 pim rp-address CONFIGURATION IPv6 Display the assigned RP for a group. show ipv6 pim rp EXEC Privilege IPv6 Display the assigned RP for a group range (group-to-RP mapping).
PAGE 779
Configure a Designated Router Multiple PIM-SM routers might be connected to a single LAN segment. One of these routers is elected to act on behalf of directly connected hosts. This router is the Designated Router (DR). The DR is elected using hello messages. Each PIM router learns about its neighbors by periodically sending a hello message out of each PIM-enabled interface. Hello messages contain the IP address of the interface out of which it is sent and a DR priority value.
PAGE 780
www.dell.com | support.dell.com IP Version Task Command Syntax Command Mode IPv6 Filter inbound and outbound Bootstrap Router messages per interface. ipv6 pim bsr-border INTERFACE Remove candidate RP advertisements. clear ip pim rp-mapping EXEC PRIVILEGE Set a Threshold for Switching to the SPT Set a Threshold for Switching to the SPT is available only on platform: e Initially, a single PIM-SM tree called a shared tree to distribute traffic.
PAGE 781
FTOS supports PIM-SM graceful restart based on the GenID. Per RFC 4601, hello messages should contain a Generation_Identifier option, which contains a randomly generated value (GenID) that is regenerated each time PIM forwarding is started or restarted on the interface, including when the router restarts. When a router receives from a neighbor a hello message with a new GenID, any old hello information about that neighbor should be discarded and superseded by the information from the new hello message.
PAGE 782
www.dell.com | support.dell.com To prevent these delivery errors you must statically map the potential incoming interfaces for the (*,G) entries via the CLI. When you create this mapping, (*,G) entries are programmed in hardware. Packets are then fast forwarded starting with the first packet, and the potential for these delivery errors is avoided. Step 1 Task Command Syntax Command Mode Create a standard access-list that permits one or more IGMP groups.
PAGE 783
• Table 35-1. It is recommended that you do not enable IGMP snooping on a PIM-SM snooping-enabled VLAN interface unless until it is necessary for VLAN operation.
PAGE 784
www.dell.com | support.dell.com Feature Overview PIM-SM snooping functions in a Layer 2 network in which multiple routers are interconnected by a switch, such as an IXP where Internet service providers (ISPs) exchange Internet traffic between their networks. By default, the switch floods multicast traffic to all VLAN member ports, regardless of whether there are multicast receivers downstream that are joined to a multicast group.
PAGE 785
• In the downstream PIM TIB, states and timers are maintained for each VLAN and member port. The downstream outgoing-interface timers for each valid (*,G) and (S,G) entry are started for each VLAN/ port and upstream neighbor combination: (port,*,G,neighbor) or (port,S,G,neighbor), where port is a downstream port and neighbor is the upstream neighbor. • A timer is removed when a timer times out or a prune message is received for a specific VLAN member port.
PAGE 786
www.dell.com | support.dell.com PIM-SM Snooping Example Figure 35-8 shows an example with PIM-SM snooping enabled. When Router A sends a join message to Router B, the switches forward the join message only to Router B without flooding the message to other connected routers, such as Routers C and D. Figure 35-8.
PAGE 787
Similarly, in Figure 35-8, when PIM-SM snooping is enabled and multicast data is sent to VLAN members of group G, the switches forward the data traffic from the server attached to Router B only to the router (Router A) in the multicast group that should receive it. Without PIM-SM snooping, the switches would flood the data to all connected routers, including Routers C and D. Figure 35-9.
PAGE 788
www.dell.com | support.dell.com PIM-SM Snooping Configuration You can enable PIM-SM snooping globally on a switch or on individual VLANs. PIM-SM snooping is not enabled by default and does not require an IP address, PIM-DM, or PIM-SM. PIM-SM snooping and PIM multicast routing are mutually exclusive: PIM-SM snooping cannot be enabled on a switch/router if PIM-SM or PIM-DM is enabled.
PAGE 789
Verify PIM-SM Snooping To display information about PIM-SM snooping operation, enter one of the following show commands: Task Command Command Mode Display information about PIM neighbors discovered by PIM-SM snooping. show ip pim snooping neighbor [vlan vlan-id] EXEC Privilege Figure 35-10 Display information about PIM group members and states stored in the tree information base (TIB) that was discovered by PIM-SM snooping.
PAGE 790
www.dell.com | support.dell.com Figure 35-11. PIM-SM snooping: show ip pim snooping tib Force10#show ip pim snooping tib PIM Multicast Snooping Table Flags: J/P - (*,G) Join/Prune, j/p - (S,G) Join/Prune SGR-P - (S,G,R) Prune Timers: Uptime/Expires * : Inherited port (*, 225.1.2.1), uptime 00:00:01, expires 00:02:59, RP 165.87.70.1, flags: J Incoming interface: Vlan 2, RPF neighbor 0.0.0.0 Outgoing interface list: GigabitEthernet 4/11 RPF 165.87.32.
PAGE 791
Figure 35-13.
PAGE 792
www.dell.com | support.dell.com Figure 35-14. PIM-SM snooping: show ip mroute snooping Force10#show ip mroute snooping IPv4 Multicast Snooping Table (*, 224.0.0.0), uptime 17:46:23 Incoming vlan: Vlan 2 Outgoing interface list: GigabitEthernet 4/13 (*, 225.1.2.1), uptime 00:04:16 Incoming vlan: Vlan 2 Outgoing interface list: GigabitEthernet 4/11 GigabitEthernet 4/13 (165.87.1.7, 225.1.2.
PAGE 793
36 PIM Source-Specific Mode PIM Source-Specific Mode is supported on platforms: ces PIM-SSM is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. PIM-Source-Specific Mode (PIM-SSM) is a multicast protocol that forwards multicast traffic from a single source to a subnet. In the other versions of Protocol Independent Multicast (PIM), a receiver subscribes to a group only.
PAGE 794
| PIM Source-Specific Mode (10.11.5.2, 239.0.0.2), uptime 00:00:36, expires 00:03:14, flags: CT Incoming interface: GigabitEthernet 1/31, RPF neighbor 10.11.13.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:02:12/Never interface Vlan 400 ip pim sparse-mode ip address 10.11.4.1/24 untagged GigabitEthernet 1/2 ip igmp version 3 no shutdown interface GigabitEthernet 2/31 ip pim sparse-mode ip address 10.11.23.1/24 no shutdown RP 2/1 R1 3/21 3/1 Source 1 10.11.5.
PAGE 795
Implementation Information • • • • • The Dell Force10 implementation of PIM-SSM is based on RFC 3569. C-Series supports a maximum of 31 PIM interfaces and 4K multicast entries including (*,G), and (S,G) entries. There is no limit on the number of PIM neighbors C-Series can have. S-Series supports a maximum of 31 PIM interfaces and 2K multicast entries including (*,G), and (S,G) entries. There is no limit on the number of PIM neighbors S-Series can have.
PAGE 796
www.dell.com | support.dell.com Enable PIM-SSM To enable PIM-SSM: Step Task Command Syntax Command Mode 1 Create an ACL that uses permit rules to specify what range of addresses should use SSM. You must at least include one rule, permit 232.0.0.0/8, which is the default range for PIM-SSM. [ip | ipv6] access-list standard name CONFIGURATION 2 Enter the command ip pim ssm-range and specify the ACL you created.
PAGE 797
• When an extended ACL is associated with this command, FTOS displays an error message. If you apply an extended ACL before you create it, FTOS accepts the configuration, but when the ACL is later defined, FTOS ignores the ACL and the stated mapping has no effect. Display the source to which a group is mapped using the command show ip igmp ssm-map [group], as shown in Figure 36-4 on page 799.
PAGE 798
| PIM Source-Specific Mode interface Vlan 400 ip pim sparse-mode ip address 10.11.4.1/24 untagged GigabitEthernet 1/2 ip igmp version 3 no shutdown ip igmp snooping enable (10.11.5.2, 239.0.0.2), uptime 00:00:33, expires 00:00:00, flags: CJ Incoming interface: GigabitEthernet 1/31, RPF neighbor 10.11.13.2 Outgoing interface list: Vlan 300 Forward/Sparse 00:00:33/Never (10.11.5.2, 239.0.0.1), uptime 00:01:50, expires 00:03:28, flags: CT Incoming interface: GigabitEthernet 1/31, RPF neighbor 10.11.
PAGE 799
Figure 36-4. Configuring PIM-SSM with IGMPv2 R1(conf)#do show run pim ! ip pim rp-address 10.11.12.2 group-address 224.0.0.0/4 ip pim ssm-range ssm R1(conf)#do show run acl ! ip access-list standard map seq 5 permit host 239.0.0.2 ! ip access-list standard ssm seq 5 permit host 239.0.0.2 R1(conf)#ip igmp ssm-map map 10.11.5.2 R1(conf)#do show ip igmp groups Total Number of Groups: 2 IGMP Connected Group Membership Group Address Interface Mode 239.0.0.2 Vlan 300 IGMPv2-Compat Member Ports: Gi 1/1 239.0.0.
PAGE 800
| PIM Source-Specific Mode www.dell.com | support.dell.
PAGE 801
37 Power over Ethernet Power over Ethernet (PoE) is supported only on platforms: cs This chapter contains the following major sections: • • • Configuring Power over Ethernet on page 802 Power Additional PoE Ports on the S-Series on page 810 Deploying VOIP on page 811 FTOS supports Power over Ethernet (PoE), as described by IEEE 802.3af . IEEE 802.3af specifies that a maximum of 15.4 Watts can be transmitted to Ethernet devices over the signal pairs of an unshielded twisted pair (UTP) cable.
PAGE 802
www.dell.com | support.dell.com For the C-Series, FTOS requires that a minimum number of AC power supplies (PSU) be installed before PoE can be enabled, and some PSUs are reserved for PoE redundancy, as described in Table 37-2. Note: The C-Series can provide PoE only through its AC power supplies. Table 37-2.
PAGE 803
Related Configuration Tasks • • • • • Manage Ports using Power Priority and the Power Budget on page 805 Monitor the Power Budget on page 808 Manage Power Priorities on page 808 Recover from a Failed Power Supply on page 809 Power Additional PoE Ports on the S-Series on page 810 Enabling PoE on a Port PoE is disabled by default. Enable PoE on a port from INTERFACE mode using the command power inline {auto [max_milliwatts] | static [max_milliwatts]}.
PAGE 804
www.dell.com | support.dell.com View the amount of power that a port is consuming using the show power inline command from EXEC privilege mode. Figure 37-2. PoE Allocation Displayed with show power inline Command Force10(conf-if-range-gi-0/1-48)#do show power inline Interface Admin Inline Power Inline Power Class Allocated Consumed (Watts) (Watts) --------------------------------------Gi 0/1 auto 0.00 0.00 NO_DEVICE Gi 0/2 auto 7.00 3.
PAGE 805
Table 37-4 describes the fields that the show power detail command displays. Table 37-4. show power detail Field Description Field Port Number Unit (S-Series only) The stack member unit ID. Catalog Name (C-Series only) Displays the component’s Dell Force10 catalog number. Slot ID (C-Series only) Displays the slot number in which the line card or RPM is installed. Total Power Available The total power available in the stack member or chassis.
PAGE 806
www.dell.com | support.dell.com power-inline priority, it breaks the tie using the third parameter, the LLDP-MED Priority advertised by the PD, which like power-inline priority could be “Critical,” “High,” or “Low”. After this, if FTOS still finds a tie, priority is based on the fourth parameter which is the ports position in the chassis; there cannot be a tie based on this parameter.
PAGE 807
Determine the Affect of a Port on the Power Budget The PoE power budget is affected differently depending on how PoE is enabled and whether a device is connected: 1. When you configure a port with power inline auto without the max_milliwatts power limit option, power is only allocated after you connect a device to the port. • • • When you connect a device, the maximum power for the device class is allocated if there is sufficient power in the budget. See Table 37-1 on page 801.
PAGE 808
www.dell.com | support.dell.com Monitor the Power Budget The power budget is the amount of power available from the installed PSUs minus the power required to operate the chassis. Use the show power inline (Figure 37-2 on page 804) and show power detail (Figure 37-3 on page 804) commands to help you determine if power is available for additional PoE ports (1478.40 Watts are supplied per C-Series PSU; max of 790W on S-Series with load-sharing external DC PSU).
PAGE 809
You can augment the default prioritization using the command [no] power inline priority {critical | high | low}, where critical is the highest priority, and low is the lowest. FTOS ignores any LLDP-MED priority on this port if you configure a priority with this command. If you do not configure a port priority with this command, FTOS honors any LLDP-MED priority. In general, priority is assigned in this order: 1.
PAGE 810
www.dell.com | support.dell.com Figure 37-5. Order of PoE Termination 0 1 Term i nate 2 PoE For the configuration in Figure 37-2: • • • Power for ports 7/1 and 7/2 is terminated first because it is configured with inline power auto. Power for port 7/2 is terminated before PoE for port 7/1 because port 7/1 has a lower port number. Power for port 7/0 is terminated last because it is configured with inline power static.
PAGE 811
Deploying VOIP VoIP phones on the market today follow the same basic boot and operations process: 1. Wait for an LLDP from the Ethernet switch. 2. Obtain an IP address from a DHCP server. 3. Send an LLDP-MED frame to the switch. 4. Wait for an LLDP-MED frame from the switch and read the Network Policy TLV to get the VLAN ID, Layer 2 Priority, and DSCP value. 5. Download applications and software from the call manager. 6.
PAGE 812
www.dell.com | support.dell.com Figure 37-8.
PAGE 813
Configure Quality of Service for an Office VOIP Deployment There are multiple ways you can use QoS to map ingress phone and PC traffic so that you can give them each a different quality of service. See Chapter 42, Quality of Service.
PAGE 814
www.dell.com | support.dell.com Classifying VOIP traffic and applying QoS policies Avoid congestion and give precedence to voice and signaling traffic by classifying traffic based on subnet and using strict priority and bandwidth weights on egress, as outlined in the steps below. Figure 37-12 depicts the topology and shows the configuration for a C-Series. The steps are the same on an S-Series. Figure 37-13 on page 815 is a screenshot showing some of the steps and the resulting running-config.
PAGE 815
Figure 37-13. Classifying VOIP Traffic and Applying QoS Policies for an Office VOIP Deployment Force10#sh run acl ! ip access-list extended pc-subnet seq 5 permit ip 201.1.1.0/24 any ! ip access-list extended phone-signalling seq 5 permit ip 192.1.1.0/24 host 192.1.1.1 ! ip access-list extended phone-subnet seq 5 permit ip 192.1.1.
PAGE 816
| Power over Ethernet www.dell.com | support.dell.
PAGE 817
38 Policy-based Routing Policy-based Routing is supported on platforms: ces PBR is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. PBR is supported on the E-Series TeraScale, C-Series, and S-Series platforms in FTOS 8.4.2.0 and later.
PAGE 818
ps ps Mb Operations Mb ps ps Mb Mb ps Mb Internet ps 45 10 1.5 With 3 separate internet connections from the Edge Routers, bandwidth can be allotted to meet each department's needs. Some departments will need higher-speed internet access while others will require less bandwidth. Customer Support Sales 1.5 Marketing 10 Engineering Mb Finance PBR Example 45 www.dell.com | support.dell.com Figure 38-1.
PAGE 819
2. If the specified next-hops are not reachable, then the normal routing table is used to forward the traffic. 3. FTOS supports multiple next-hop entries in the redirect lists. 4. Redirect-Lists are applied at Ingress. Implementing Policy-based Routing with FTOS Non-contiguous bitmasks for PBR Non-contiguous bitmasks for PBR allows more granular and flexible control over routing policies. Network addresses that are in the middle of a subnet can be included or excluded.
PAGE 820
www.dell.com | support.dell.com Configuration Task List for Policy-based Routing To enable the PBR: 1. 2. 3. Create a Redirect List Create a Rule for a Redirect-list Apply a Redirect-list to an Interface using a Redirect-group Create a Redirect List Use the following command in CONFIGURATION mode: Command Syntax Command Mode Purpose ip redirect-list redirect-list-name CONFIGURATION Create a redirect list by entering the list name.
PAGE 821
Create a Rule for a Redirect-list Use the following command in CONFIGURATION REDIRECT-LIST mode to set the rules for the redirect list. You can enter the command multiple times and create a sequence of redirect rules. Use the seq nn redirect version of the command to organize your rules.
PAGE 822
www.dell.com | support.dell.com Figure 38-4. Creating a Rule Example Force10(conf-redirect-list)#redirect ? A.B.C.D Forwarding router's address sonet SONET interface IP address of forwarding router Force10(conf-redirect-list)#redirect 3.3.3.3 ? <0-255> An IP protocol number icmp Internet Control Message Protocol ip Any Internet Protocol tcp Transmission Control Protocol udp User Datagram Protocol Force10(conf-redirect-list)#redirect 3.3.3.3 ip ? A.B.C.
PAGE 823
PBR Exceptions (Permit) Use the command permit to create an exception to a redirect list. Exceptions are used when a forwarding decision should be based on the routing table rather than a routing policy. FTOS assigns the first available sequence number to a rule configured without a sequence number and inserts the rule into the PBR CAM region next to the existing entries. Since the order of rules is important, ensure that you configure any necessary sequence numbers.
PAGE 824
www.dell.com | support.dell.com Apply a Redirect-list to an Interface using a Redirect-group IP redirect lists are supported on physical interfaces as well as VLAN and port-channel interfaces. Note: When you apply a redirect-list on a port-channel on the E-Series, when traffic is redirected to the next hop and the destination port-channel is shut down, the traffic is dropped. However, on the C-Series, the traffic redirected to the destination port-channel is sometimes switched.
PAGE 825
Show Redirect List Configuration To view the configuration redirect list configuration, use the following command in EXEC mode: Command Syntax Command Mode Purpose show ip redirect-list redirect-list-name EXEC View the redirect list configuration and the associated interfaces. show cam pbr show cam-usage EXEC View the redirect list entries programmed in the CAM. List the redirect list configuration using the show ip redirect-list redirect-list-name command.
PAGE 826
www.dell.com | support.dell.com Figure 38-12. Showing CAM PBR Configuration Example Force10(conf-if-gi-8/1)#do show cam pbr l 8 p0 TCP Flag: Bit 5 - URG, Bit 4 - ACK, Bit 3 - PSH, Bit 2 - RST, Bit 1 - SYN, Bit 0 - FIN Cam Port VlanID Proto Tcp Index Flag Src Dst Port Port SrcIp DstIp Next-hop MAC -------------------------------------------------------------------------------------------------------------------------------06080 0 N/A IP 0x0 0 0 200.200.200.200 200.200.200.200 199.199.
PAGE 827
Figure 38-13. PBR Sample Illustration Customer Support 192.168.1.0 /24 192.168.2.0 /24 10.0.0.0 /16 10.1.0.0 /16 GigE 2/11 EDGE_ROUTER 1.5 Mbps 10 Mbps 45 Mbps 10.44.44.13 10.22.22.
PAGE 828
www.dell.com | support.dell.com Figure 38-14. PBR Sample Configuration Create the Redirect-List GOLD. EDGE_ROUTER(conf-if-gi-3/23)#ip redirect-list GOLD EDGE_ROUTER(conf-redirect-list)#description Route GOLD traffic to ISP_GOLD. EDGE_ROUTER(conf-redirect-list)#$direct 10.99.99.254 ip 192.168.1.0/24 any EDGE_ROUTER(conf-redirect-list)#$redirect 10.99.99.254 ip 192.168.2.
PAGE 829
39 Port Monitoring Port Monitoring is supported on platforms: ces Port Monitoring is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Port Monitoring is a feature that copies all incoming or outgoing packets on one port and forwards (mirrors) them to another port. The source port is the monitored port (MD) and the destination port is the monitoring port (MG). Port Monitoring functionality is different between platforms, but the behavior is the same, with highlighted exceptions.
PAGE 830
www.dell.com | support.dell.com • A source port (MD) can only be monitored by one destination port (MG). The following error is displayed if you try to assign a monitored port to more than one monitoring port.
PAGE 831
E-Series TeraScale The E-Series TeraScale system supports 1 monitoring session per port-pipe. E-Series TeraScale supports a maximum of 28 port pipes. On the E-Series TeraScale, FTOS supports a single source-destination statement in a monitor session (Message 2). E-Series TeraScale supports only one source and one destination port per port-pipe (Message 3). Therefore, the E-Series TeraScale supports as many monitoring sessions as there are port-pipes in the system.
PAGE 832
www.dell.com | support.dell.com Port Monitoring on C-Series and S-Series The C-Series and S-Series support multiple source-destination statements in a monitor session, but there may only be one destination port in a monitoring session (Message 4). Message 4 One Destination Port in a Monitoring Session Error Message on C-Series and S-Series % Error: Only one MG port is allowed in a session.
PAGE 833
Figure 39-3. Number of Monitoring Ports on the C-Series and S-Series Force10(conf)#mon ses 300 Force10(conf-mon-sess-300)#source gig 0/17 destination gig 0/4 direction tx % Error: Exceeding max MG ports for this MD port pipe.
PAGE 834
www.dell.com | support.dell.com Figure 39-5. Port Monitoring Configurations on the C-Series and S-Series Line Card 0 Port-Pipe 0 Monitor Session 0 MD MD MG MD MD MG Line Card 1 Port-Pipe 0 Port-Pipe 1 MD Monitor Session 1 Monitor Session 2 Port-Pipe 1 MD MG MG Port Monitoring 003 FTOS Behavior: On the C-Series and S-Series, all monitored frames are tagged if the configured monitoring direction is transmit (TX), regardless of whether the monitored port (MD) is a Layer 2 or Layer 3 port.
PAGE 835
Configuring Port Monitoring To configure port monitoring: Step Command Syntax Command Mode Task 1 show interface EXEC Privilege Verify that the intended monitoring port has no configuration other than no shutdown, as shown in Figure 39-6. 2 monitor session CONFIGURATION Create a monitoring session using the command monitor session from CONFIGURATION mode, as shown in Figure 39-6.
PAGE 836
www.dell.com | support.dell.com Figure 39-7.
PAGE 837
Figure 39-8. Configuring Flow-based Monitoring Force10(conf)#monitor session 0 Force10(conf-mon-sess-0)#flow-based enable Force10(conf)#ip access-list ext testflow Force10(config-ext-nacl)#seq 5 permit icmp any any count bytes monitor Force10(config-ext-nacl)#seq 10 permit ip 102.1.1.
PAGE 838
www.dell.com | support.dell.com Remote port mirroring uses the analyzers shown in the aggregation network in Site A. The VLAN traffic on monitored links from the access network is tagged and assigned to a dedicated L2 VLAN. Monitored links are configured in two source sessions shown with orange and green circles. Each source session uses a separate reserved VLAN to transmit mirrored packets (mirrored source-session traffic is shown with an orange or green circle with a blue border).
PAGE 839
• • • • • You can configure any switch in the network with source ports and destination ports, and allow it to function in an intermediate transport session for a reserved VLAN at the same time for multiple remote-port mirroring sessions. You can enable and disable individual mirroring sessions. BPDU monitoring is not required to use remote port mirroring.
PAGE 840
www.dell.com | support.dell.com • - The VLAN consists of more than 128 ports. - You add a port to a VLAN, which has already been configured in a source session, and the newly added port exceeds the 128-port limit. - You configure a range of VLANs in a source session and the combined number of ports in the VLANs exceeds 128. • You can use ACLs on a source port. In a flow-based source session, packets sent from the RPM are not monitored.
PAGE 841
Configure a dedicated L2 VLAN for Remote Port Mirroring Step Command Syntax Command Mode Task 1 interface vlan vlan-id CONFIGURATION Create a VLAN to transport mirrored traffic in remote port mirroring. Valid vlan-id values are 1 to 4094. The default VLAN ID is not supported. 2 mode remote-port-mirroring VLAN INTERFACE Configure the dedicated L2 VLAN to be used to transport mirrored traffic in remote port mirroring.
PAGE 842
www.dell.com | support.dell.
PAGE 843
Configure a Destination Session on Multiple Switches Step Command Syntax Command Mode Task 1 monitor session session-id CONFIGURATION Configure the destination session for remote port mirroring and enter Monitor Session configuration mode.
PAGE 844
www.dell.com | support.dell.com Displaying Remote-Port Mirroring Configurations To display the current configuration of remote port mirroring for a specified session, enter the show config command in MONITOR SESSION configuration mode.
PAGE 845
Sample Configuration: Remote Port Mirroring Remote port mirroring requires a source session (monitored ports on different source switches), a reserved tagged VLAN for transporting mirrored traffic (configured on source, intermediate, and destination switches), and a destination session (destination ports connected to analyzers on destination switches). Figure 39-10 shows a sample configuration of remote port mirroring on a source switch.
PAGE 846
www.dell.com | support.dell.com Figure 39-12 shows a sample configuration of remote port mirroring on a destination switch. Note that in the show monitor session output of a destination session, the source is the reserved VLAN (for example, remote-vlan 22) and the destination is the destination port (for example, Gi 4/73) to which an analyzer is attached. Figure 39-12.
PAGE 847
40 Private VLANs Private VLANs is available on platforms: cs Private VLANs (PVLANs) provide Layer 2 isolation between ports within the same VLAN. That is, peer-to-peer communication is restricted or blocked. This is done by dividing the VLAN, into subdomains, and then restricting or blocking traffic flow between them.
PAGE 848
www.dell.com | support.dell.com There are three types of ports in PVLAN: • • • Host Ports—these ports are the ones that Private VLAN aims to isolate. They are connected to end-stations. Promiscuous Ports—these ports are members of the primary VLAN, and function as gateways to the primary and secondary VLANs. Trunk Ports—trunk ports carry tagged traffic between switches. They have promiscuous and trunk ports as members. Figure 40-2.
PAGE 849
Related Configuration Tasks • Private VLAN show Commands on page 850 Configure PVLAN Ports You must assign switchports a PVLAN Port role—host, promiscuous, or trunk—before you can add them to a primary or secondary VLAN. • • • Host ports may not be a part of a non-private (regular) VLAN. Promiscuous ports may be a member of more than one primary VLAN, but may not be a member of a regular VLAN. Trunk ports may be a member of a regular VLAN.
PAGE 850
www.dell.com | support.dell.com Place the Secondary VLANs in a Primary VLAN A primary VLAN is a port-based VLAN that is specifically designated as a private VLAN. Doing so enables the VLAN to be divided into secondary VLANs. Step Task Command Syntax Command Mode 1 Access INTERFACE VLAN mode for the VLAN that you want to make the primary VLAN. interface vlan vlan-id CONFIGURATION 2 Designate a VLAN as a primary VLAN.
PAGE 851
41 Per-VLAN Spanning Tree Plus Per-VLAN Spanning Tree Plus is supported platforms: ces Port Monitoring is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Per-VLAN Spanning Tree Plus (PVST+) is a variation of Spanning Tree—developed by a third party— that allows you to configure a separate Spanning Tree instance for each VLAN. For more information on Spanning Tree, see Chapter 53, Spanning Tree Protocol. Figure 41-1.
PAGE 852
www.dell.com | support.dell.com FTOS supports three other variations of Spanning Tree, as shown in Table 41-1. Table 41-1. FTOS Supported Spanning Tree Protocols Dell Force10 Term IEEE Specification Spanning Tree Protocol 802.1d Rapid Spanning Tree Protocol 802.1w Multiple Spanning Tree Protocol 802.1s Per-VLAN Spanning Tree Plus Third Party Implementation Information • • • • The FTOS implementation of PVST+ is based on IEEE Standard 802.1d. The FTOS implementation of PVST+ uses IEEE 802.
PAGE 853
Enable PVST+ When you enable PVST+, FTOS instantiates STP on each active VLAN. To enable PVST+ globally: Step Task Command Syntax Command Mode 1 Enter PVST context. protocol spanning-tree pvst PROTOCOL PVST 2 Enable PVST+. no disable PROTOCOL PVST Disable PVST+ Task Command Syntax Command Mode Disable PVST+ globally. disable PROTOCOL PVST Disable PVST+ on an interface, or remove a PVST+ parameter configuration.
PAGE 854
Load Balancing with PVST+ STI 2 root STI 1: VLAN 100 STI 2: VLAN 200 STI 3: VLAN 300 R2 vlan 100 bridge-priority 4096 2/32 Blocking 3/22 X R3 STI 3 root vlan 100 bridge-priority 4096 3/12 2/12 Forwarding www.dell.com | support.dell.com Figure 41-3. 1/22 X X 1/32 STI 1 root R1 vlan 100 bridge-priority 4096 The bridge with the bridge value for bridge priority is elected root.
PAGE 855
Figure 41-4. Display the PVST+ Forwarding Topology Force10_E600(conf)#do show spanning-tree pvst vlan 100 VLAN 100 Root Identifier has priority 4096, Address 0001.e80d.b6d6 Root Bridge hello time 2, max age 20, forward delay 15 Bridge Identifier has priority 4096, Address 0001.e80d.b6d6 Configured hello time 2, max age 20, forward delay 15 We are the root of VLAN 100 Current root has priority 4096, Address 0001.e80d.
PAGE 856
www.dell.com | support.dell.com Modify Global PVST+ Parameters The root bridge sets the values for forward-delay, and hello-time and overwrites the values set on other PVST+ bridges. • • • Forward-delay is the amount of time an interface waits in the Listening State and the Learning State before it transitions to the Forwarding State. Hello-time is the time interval in which the bridge sends Bridge Protocol Data Units (BPDUs).
PAGE 857
Table 41-2 lists the default values for port cost by interface. Table 41-2. PVST+ Default Port Cost Values Port Cost Default Value 100-Mb/s Ethernet interfaces 200000 1-Gigabit Ethernet interfaces 20000 10-Gigabit Ethernet interfaces 2000 Port Channel with 100 Mb/s Ethernet interfaces 180000 Port Channel with 1-Gigabit Ethernet interfaces 18000 Port Channel with 10-Gigabit Ethernet interfaces 1800 Note: The FTOS implementation of PVST+ uses IEEE 802.1s costs as the default costs.
PAGE 858
www.dell.com | support.dell.com To enable EdgePort on an interface, use the following command: Task Enable EdgePort on an interface. Command Mode spanning-tree pvst edge-port INTERFACE [bpduguard | shutdown-on-violation] The EdgePort status of each interface is given in the output of the command show spanning-tree pvst, as shown in Figure 41-4.
PAGE 859
Configure a Root Guard Use the Root Guard feature in a Layer 2 PVST+ network to avoid bridging loops. You enable root guard on a per-port or per-port-channel basis. FTOS Behavior: The following conditions apply to a port enabled with root guard: • Root guard is supported on any PVST-enabled port or port-channel interface except when used as a stacking port.
PAGE 860
www.dell.com | support.dell.com Configure a Loop Guard The Loop Guard feature provides protection against Layer 2 forwarding loops (STP loops) caused by a hardware failure, such as a cable failure or an interface fault. When a cable or interface fails, a participating STP link may become unidirectional (STP requires links to be bidirectional) and an STP port does not receive BPDUs. When an STP blocking port does not receive BPDUs, it transitions to a forwarding state.
PAGE 861
PVST+ in Multi-vendor Networks Some non-Dell Force10 systems which have hybrid ports participating in PVST+ transmit two kinds of BPDUs: an 802.1D BPDU and an untagged PVST+ BPDU. Dell Force10 systems do not expect PVST+ BPDU (tagged or untagged) on an untagged port. If this happens, FTOS places the port in error-disable state. This behavior might result in the network not converging. To prevent FTOS from executing this action, use the command no spanning-tree pvst err-disable cause invalid-pvst-bpdu.
PAGE 862
www.dell.com | support.dell.com Task Command Syntax Command Mode Augment the Bridge ID with the VLAN ID. extend system-id PROTOCOL PVST Force10(conf-pvst)#do show spanning-tree pvst vlan 5 brief VLAN 5 Executing IEEE compatible Spanning Tree Protocol Root ID Priority 32773, Address 0001.e832.73f7 Root Bridge hello time 2, max age 20, forward delay 15 Bridge ID Priority 32773 (priority 32768 sys-id-ext 5), Address 0001.e832.
PAGE 863
PVST+ Sample Configurations Figure 41-7, Figure 41-8, and Figure 41-9 provide the running configurations for the topology shown in Figure 41-3. Figure 41-7.
PAGE 864
www.dell.com | support.dell.com Figure 41-8.
PAGE 865
42 Quality of Service Quality of Service (QoS) is supported on platforms: ces Differentiated service is accomplished by classifying and queuing traffic, and assigning priorities to those queues. The E-Series has eight unicast queues per port and 128 multicast queues per-port pipe. Traffic is queued on ingress and egress. By default, on ingress, all data traffic is mapped to Queue 0, and all control traffic is mapped to Queue 7. On egress control traffic is mapped across all eight queues.
PAGE 866
www.dell.com | support.dell.com Table 42-1.
PAGE 867
Figure 42-1. Dell Force10 QoS Architecture Marking (DiffServ, 802.1p, Exp) Ingress Packet Processing Packet Classification (ACL) Rate Policing Buffers Class-based Queues Switching Rate Limiting Buffers Class-based Queues Egress Congestion Management (WFQ Scheduling) Egress Packet Processing Traffic Shaping Congestion Avoidance (WRED) Implementation Information Dell Force10 QoS implementation complies with IEEE 802.1p User Priority Bits for QoS Indication.
PAGE 868
www.dell.com | support.dell.
PAGE 869
Honor dot1p Priorities on Ingress Traffic By default FTOS does not honor dot1p priorities on ingress traffic. Use the command service-class dynamic dot1p from INTERFACE mode to honor dot1p priorities on ingress traffic, as shown in Figure 42-3. You can configure this feature on physical interfaces and port-channels, but you cannot configure it on individual interfaces in a port channel.
PAGE 870
www.dell.com | support.dell.com Configure Port-based Rate Policing Rate policing ingress traffic on an interface using the command rate police from INTERACE mode, as shown in Figure 42-4. If the interface is a member of a VLAN, you may specify the VLAN for which ingress packets are policed. FTOS Behavior: On the C-Series and S-Series, rate shaping is effectively rate limiting because of its smaller buffer size. On the E-Series: — 802.
PAGE 871
Configure Port-based Rate Limiting Configure Port-based Rate Limiting is supported only on platform e FTOS Behavior: On the C-Series and S-Series, rate shaping is effectively rate limiting because of its smaller buffer size. On the E-Series: — 802.1Q-priority tagged frames are sometimes not rate-limited according to the configured rate-limit value.
PAGE 872
www.dell.com | support.dell.com Configure Port-based Rate Shaping Rate shaping buffers, rather than drops, traffic exceeding the specified rate until the buffer is exhausted. If any stream exceeds the configured bandwidth on a continuous basis, it can consume all of the buffer space that is allocated to the port. Apply rate shaping to outgoing traffic on a port using the command rate shape from INTERFACE mode, as shown in Figure 42-8.
PAGE 873
Policy-based QoS Configurations Policy-based QoS configurations consist of the components shown in Figure 42-9. Figure 42-9.
PAGE 874
www.dell.com | support.dell.com 2. Once you create a class-map, FTOS places you in CLASS MAP mode. From this mode, specify your match criteria using the command match ip, as shown in Figure 42-10. Match-any class maps allow up to five ACLs, and match-all class-maps allow only one ACL. 3. After you specify your match criteria, link the class-map to a queue using the command service-queue from POLICY MAP mode, as shown in Figure 42-10. Figure 42-10.
PAGE 875
Determine the order in which ACLs are used to classify traffic When you link class-maps to queues using the command service-queue, FTOS matches the class-maps according to queue priority (queue numbers closer to 0 have lower priorities). For example, in Figure 42-10, class-map cmap2 is matched against ingress packets before cmap1. ACLs acl1 and acl2 have overlapping rules because the address range 20.1.1.0/24 is within 20.0.0.0/8. Therefore, (without the keyword order) packets within the range 20.1.1.
PAGE 876
www.dell.com | support.dell.com FTOS Behavior: An explicit “deny any" rule in a Layer 3 ACL used in a (match any or match all) class-map creates a "default to Queue 0" entry in the CAM, which causes unintended traffic classification. Below, traffic is classified in two Queues, 1 and 2. Class-map ClassAF1 is “match any,” and ClassAF2 is “match all”.
PAGE 877
Create a QoS Policy There are two types of QoS policies: input and output. Input QoS policies regulate Layer 3 and Layer 2 ingress traffic. The regulation mechanisms for input QoS policies are rate policing and setting priority values. There are two types of input QoS policies: Layer 3 and Layer 2. • • Layer 3 QoS input policies allow you to rate police and set a DSCP or dot1p value. Layer 2 QoS input policies allow you to rate police and set a dot1p value.
PAGE 878
www.dell.com | support.dell.com Figure 42-12. Marking DSCP Values for Egress Packets Force10#config Force10(conf)#qos-policy-input my-input-qos-policy Force10(conf-qos-policy-in)#set ip-dscp 34 % Info: To set the specified DSCP value 34 (100-010 b) the QoS policy must be mapped to queue 4 (100 b).
PAGE 879
Configure policy-based rate shaping Rate shape egress traffic using the command rate-shape from QOS-POLICY-OUT mode. Output QoS policy can be applied to an output policy map with a policy aggregate or to an specific queue. Per queue rate shaping is supported on C-Series and S-Series only; see Create Output Policy Maps on page 884.
PAGE 880
www.dell.com | support.dell.com Table 42-4 shows an example of choosing bandwidth weights for all four queues to achieve a target bandwidth allocation. Table 42-4. Assigning Bandwidth Weights for the C-Series and S-Series Weight Equivalent Percentage Target Allocation 0 1 0.44% 1% 1 64 28.44% 25% 2 128 56.89% 60% 3 32 14.
PAGE 881
Apply an input QoS policy to an input policy map Apply an input QoS policy to an input policy map using the command policy-aggregate from POLICY-MAP-IN mode. Honor DSCP values on ingress packets FTOS provides the ability to honor DSCP values on ingress packets using Trust DSCP feature. Enable this feature using the command trust diffserv from POLICY-MAP-IN mode. Table 42-5 lists the standard DSCP definitions, and indicates to which queues FTOS maps DSCP values.
PAGE 882
www.dell.com | support.dell.com Honoring dot1p values on ingress packets FTOS provides the ability to honor dot1p values on ingress packets with the Trust dot1p feature. Enable Trust dot1p using the command trust dot1p from POLICY-MAP-IN mode. Table 42-6 specifies the queue to which the classified traffic is sent based on the dot1p value. Table 42-6.
PAGE 883
In the following configuration, packets are classified to queues using the three class maps: ! policy-map-input input-policy service-queue 1 class-map qos-BE1 service-queue 3 class-map qos-AF3 service-queue 4 class-map qos-AF4 ! class-map match-any qos-AF3 match ip dscp 24 match ip access-group qos-AF3-ACL ! class-map match-any qos-AF4 match ip dscp 32 match ip access-group qos-AF4-ACL ! class-map match-all qos-BE1 match ip dscp 0 match ip access-group qos-BE1-ACL The packet classification logic for the ab
PAGE 884
www.dell.com | support.dell.com On the C-Series and S-Series all traffic is by default mapped to the same queue, Queue 0. If you honor dot1p on ingress, then you can create service classes based the queueing strategy in Table 42-6 using the command service-class dynamic dot1p from INTERFACE mode. You may apply this queuing strategy globally by entering this command from CONFIGURATION mode. • • All dot1p traffic is mapped to Queue 0 unless service-class dynamic dot1p is enabled on an interface or globally.
PAGE 885
Specify an aggregate QoS policy Specify an aggregate QoS policy using the command policy-aggregate from POLICY-MAP-OUT mode. Apply an output policy map to an interface Apply an input policy map to an interface using the command service-policy output from INTERFACE mode. You can apply the same policy map to multiple interfaces, and you can modify a policy map after you apply it.
PAGE 886
www.dell.com | support.dell.com Strict-priority Queueing You can assign strict-priority to one unicast queue, 1-7, using the command strict-priority from CONFIGURATION mode. Strict-priority means that FTOS dequeues all packets from the assigned queue before servicing any other queues. • • • The strict-priority supersedes bandwidth-percentage an bandwidth-weight percentage configurations. A queue with strict-priority can starve other queues in the same port-pipe.
PAGE 887
You can create a custom WRED profile or use on of the five pre-defined profiles listed in Table 42-7. Table 42-7. Pre-defined WRED Profiles Default Profile Minimum Name Threshold Maximum Threshold wred_drop 0 0 wred_ge_y 1024 2048 wred_ge_g 2048 4096 wred_teng_y 4096 8192 wred_teng_g 8192 16384 Create WRED Profiles To create a WRED profile: 1. Create a WRED profile using the command wred from CONFIGURATION mode. 2. The command wred places you in WRED mode.
PAGE 888
www.dell.com | support.dell.com WRED can be used in combination with storm control to regulate broadcast and unknown-unicast traffic. This feature is available through an additional option in command storm-control [broadcast | unknown-unicast] at CONFIGURATION. See the FTOS Command Line Reference for information on using this command. Using the command storm-control broadcast 50 out wred-profile, for example, first the total bandwidth that broadcast traffic can consume is reduced to 50% of line rate.
PAGE 889
Figure 42-15.
PAGE 890
www.dell.com | support.dell.com For example, if you configure 70% bandwidth to multicast, 80% bandwidth to one queue in unicast and 0 % to all remaining unicast queues, then first, FTOS assigns 70% bandwidth to multicast, then FTOS derives the 80% bandwidth for unicast from the remaining 30% of total bandwidth. Pre-calculating Available QoS CAM Space Pre-calculating Available QoS CAM Space is supported on platforms: ces Before version 7.3.
PAGE 891
• Status indicates whether or not the specified policy-map can be completely applied to an interface in the port-pipe. • Allowed indicates that the policy-map can be applied because the estimated number of CAM entries is less or equal to the available number of CAM entries. The number of interfaces in the port-pipe to which the policy-map can be applied is given in parenthesis.
PAGE 892
| Quality of Service www.dell.com | support.dell.
PAGE 893
43 Routing Information Protocol Routing Information Protocol is supported only on platforms: ce s RIP is supported on the S-Series following the release of FTOS version 7.8.1.0, and on the C-Series with FTOS versions 7.6.1.0 and after. RIP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Routing Information Protocol (RIP) is based on a distance-vector algorithm, it tracks distances or hop counts to nearby routers when establishing network connections.
PAGE 894
www.dell.com | support.dell.com RIP must receive regular routing updates to maintain a correct routing table. Response messages containing a router’s full routing table are transmitted every 30 seconds. If a router does not send an update within a certain amount of time, the hop count to that route is changed to unreachable (a route hop metric of 16 hops). Another timer sets the amount of time before the unreachable routes are removed from the routing table.
PAGE 895
Configuration Task List for RIP • • • • • • • • • Enable RIP globally on page 895 (mandatory) Configure RIP on interfaces on page 896 (optional) Control RIP routing updates on page 897 (optional) Set send and receive version on page 898 (optional) Generate a default route on page 900 (optional) Control route metrics on page 901 (optional) Summarize routes on page 900 (optional) Control route metrics on page 901 Debug RIP on page 901 For a complete listing of all commands related to RIP, refer to the FTOS
PAGE 896
www.dell.com | support.dell.com When the RIP process has learned the RIP routes, use the show ip rip database command in the EXEC mode to view those routes (Figure 385). Figure 43-2. show ip rip database Command Example (Partial) Force10#show ip Total number of 160.160.0.0/16 [120/1] 160.160.0.0/16 2.0.0.0/8 [120/1] 2.0.0.0/8 4.0.0.0/8 [120/1] 4.0.0.0/8 8.0.0.0/8 [120/1] 8.0.0.0/8 12.0.0.0/8 [120/1] 12.0.0.0/8 20.0.0.0/8 [120/1] 20.0.0.0/8 29.10.10.0/24 29.0.0.0/8 31.0.0.0/8 [120/1] 31.0.0.0/8 192.162.2.
PAGE 897
Control RIP routing updates By default, RIP broadcasts routing information out all enabled interfaces, but you can configure RIP to send or to block RIP routing information, either from a specific IP address or a specific interface. To control which devices or interfaces receive routing updates, you must configure a direct update to one router and configure interfaces to block RIP updates from other sources.
PAGE 898
www.dell.com | support.dell.com To add routes from other routing instances or protocols, use any of the following commands in the ROUTER RIP mode: Command Syntax Command Mode Purpose redistribute {connected | static} [metric metric-value] [route-map map-name] ROUTER RIP Include directly connected or user-configured (static) routes in RIP. • metric range: 0 to 16 • map-name: name of a configured route map.
PAGE 899
Figure 43-3 shows an example of the RIP configuration after the ROUTER RIP mode version command is set to RIPv2. When the ROUTER RIP mode version command is set, the interface (GigabitEthernet 0/0) participating in the RIP process is also set to send and receive RIPv2. Figure 43-3.
PAGE 900
www.dell.com | support.dell.com Figure 43-5.
PAGE 901
If you must perform routing between discontiguous subnets, disable automatic summarization. With automatic route summarization disabled, subnets are advertised. The command autosummary requires no other configuration commands. To disable automatic route summarization, in the ROUTER RIP mode, enter no autosummary. Note: If the ip split-horizon command is enabled on an interface, then the system does not advertise the summarized address.
PAGE 902
www.dell.com | support.dell.com To enable RIP debugging, use the following command in the EXEC privilege mode: Command Syntax Command Mode Purpose debug ip rip [interface | database | events | trigger] EXEC privilege Enable debugging of RIP. Figure 43-6 shows the confirmation when the debug function is enabled. Figure 43-6. debug ip rip Command Example Force10#debug ip rip RIP protocol debug is ON Force10# To disable RIP, use the no debug ip rip command.
PAGE 903
Configuring RIPv2 on Core 2 Figure 43-8. Configuring RIPv2 on Core 2 Core2(conf-if-gi-2/31)# Core2(conf-if-gi-2/31)#router rip Core2(conf-router_rip)#ver 2 Core2(conf-router_rip)#network 10.200.10.0 Core2(conf-router_rip)#network 10.300.10.0 Core2(conf-router_rip)#network 10.11.10.0 Core2(conf-router_rip)#network 10.11.20.0 Core2(conf-router_rip)#show config ! router rip network 10.0.0.
PAGE 904
www.dell.com | support.dell.com Figure 43-10.
PAGE 905
RIP Configuration on Core 3 Figure 43-12. RIP Configuration on Core 3 Core3(conf-if-gi-3/21)#router rip Core3(conf-router_rip)#version 2 Core3(conf-router_rip)#network 192.168.1.0 Core3(conf-router_rip)#network 192.168.2.0 Core3(conf-router_rip)#network 10.11.30.0 Core3(conf-router_rip)#network 10.11.20.0 Core3(conf-router_rip)#show config ! router rip network 10.0.0.0 network 192.168.1.0 network 192.168.2.
PAGE 906
www.dell.com | support.dell.com Figure 43-14.
PAGE 907
RIP Configuration Summary Figure 43-16. Summary of Core 2 RIP Configuration Using Output of show run Command ! interface GigabitEthernet 2/11 ip address 10.11.10.1/24 no shutdown ! interface GigabitEthernet 2/31 ip address 10.11.20.2/24 no shutdown ! interface GigabitEthernet 2/41 ip address 10.200.10.1/24 no shutdown ! interface GigabitEthernet 2/42 ip address 10.250.10.1/24 no shutdown router rip version 2 10.200.10.0 10.300.10.0 10.11.10.0 10.11.20.0 Figure 43-17.
PAGE 908
www.dell.com | support.dell.
PAGE 909
44 Remote Monitoring Remote Monitoring is supported on platform ces Remote Monitoring is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. This chapter describes the Remote Monitoring (RMON): • • Implementation on page 909 Fault Recovery on page 910 Remote Monitoring (RMON) is an industry-standard implementation that monitors network traffic by sharing network monitoring information.
PAGE 910
www.dell.com | support.dell.com Fault Recovery RMON provides the following fault recovery functions: Interface Down—When an RMON-enabled interface goes down, monitoring continues. However, all data values are registered as 0xFFFFFFFF (32 bits) or ixFFFFFFFFFFFFFFFF (64 bits). When the interface comes back up, RMON monitoring processes resumes. Note: A Network Management System (NMS) should be ready to interpret a down interface and plot the interface performance graph accordingly.
PAGE 911
Set rmon alarm To set an alarm on any MIB object, use the rmon alarm or rmon hc-alarm command in GLOBAL CONFIGURATION mode. To disable the alarm, use the no form of this command: Command Syntax Command Mode Purpose [no] rmon alarm number variable interval {delta | absolute} rising-threshold [value event-number] falling-threshold value event-number [owner string] CONFIGURATION Set an alarm on any MIB object. Use the no form of this command to disable the alarm.
PAGE 912
www.dell.com | support.dell.com Figure 44-1. rmon alarm Command Example Force10(conf)#rmon alarm 10 1.3.6.1.2.1.2.2.1.20.1 20 delta rising-threshold 15 1 falling-threshold 0 owner nms1 Alarm Number MIB Variable Monitor Interval Counter Value Limit Triggered Event The above example configures RMON alarm number 10. The alarm monitors the MIB variable 1.3.6.1.2.1.2.2.1.20.1 (ifEntry.ifOutErrors) once every 20 seconds until the alarm is disabled, and checks the rise or fall of the variable.
PAGE 913
Figure 44-2. rmon event Command Example Force10(conf)#rmon event 1 log trap eventtrap description “High ifOutErrors” owner nms1 The above configuration example creates RMON event number 1, with the description “High ifOutErrors”, and generates a log entry when the event is triggered by an alarm. The user nms1 owns the row that is created in the event table by this command. This configuration also generates an SNMP trap when the event is triggered using the SNMP community string “eventtrap”.
PAGE 914
www.dell.com | support.dell.com Configure RMON collection history To enable the RMON MIB history group of statistics collection on an interface, use the rmon collection history command in interface configuration mode. To remove a specified RMON history group of statistics collection, use the no form of this command.
PAGE 915
45 Rapid Spanning Tree Protocol Rapid Spanning Tree Protocol is supported on platforms: ces RSTP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Rapid Spanning Tree Protocol (RSTP) is a Layer 2 protocol—specified by IEEE 802.1w—that is essentially the same as Spanning-Tree Protocol (STP) but provides faster convergence and interoperability with switches configured with STP and MSTP.
PAGE 916
www.dell.com | support.dell.com • • • • • • • Modify Interface Parameters on page 922 Configure an EdgePort on page 922 Preventing Network Disruptions with BPDU Guard on page 1071 Influence RSTP Root Selection on page 924 Configuring Spanning Trees as Hitless on page 1078 Fast Hellos for Link State Detection on page 925 Flush MAC Addresses after a Topology Change on page 670 Important Points to Remember • • • • RSTP is disabled by default. FTOS supports only one Rapid Spanning Tree (RST) instance.
PAGE 917
To configure the interfaces for Layer 2 and then enable them: Step Task Command Syntax Command Mode 1 If the interface has been assigned an IP address, remove it. no ip address INTERFACE 2 Place the interface in Layer 2 mode. switchport INTERFACE 3 Enable the interface. no shutdown INTERFACE Verify that an interface is in Layer 2 mode and enabled using the show config command from INTERFACE mode. Figure 45-2.
PAGE 918
www.dell.com | support.dell.com Figure 45-3. Verifying RSTP is Enabled Force10(conf-rstp)#show config ! protocol spanning-tree rstp no disable Force10(conf-rstp)# Indicates that Rapid Spanning Tree is enabled When you enable Rapid Spanning Tree, all physical and port-channel interfaces that are enabled and in Layer 2 mode are automatically part of the RST topology. • • Only one path from any bridge to any other bridge is enabled. Bridges block a redundant path by disabling one of the link ports.
PAGE 919
Figure 45-5. show spanning-tree rstp Command Example Force10#show spanning-tree rstp Root Identifier has priority 32768, Address 0001.e801.cbb4 Root Bridge hello time 2, max age 20, forward delay 15, max hops 0 Bridge Identifier has priority 32768, Address 0001.e801.cbb4 Configured hello time 2, max age 20, forward delay 15, max hops 0 We are the root Current root has priority 32768, Address 0001.e801.
PAGE 920
www.dell.com | support.dell.com Figure 45-6. show spanning-tree rstp brief Command Example R3#show spanning-tree rstp brief Executing IEEE compatible Spanning Tree Protocol Root ID Priority 32768, Address 0001.e801.cbb4 Root Bridge hello time 2, max age 20, forward delay 15 Bridge ID Priority 32768, Address 0001.e80f.
PAGE 921
Table 45-2 displays the default values for RSTP. Table 45-2.
PAGE 922
www.dell.com | support.dell.com Modify Interface Parameters On interfaces in Layer 2 mode, you can set the port cost and port priority values. • • Port cost is a value that is based on the interface type. The default values are listed in Table 45-2. The greater the port cost, the less likely the port will be selected to be a forwarding port. Port priority influences the likelihood that a port will be selected to be a forwarding port in case that several ports have the same port cost.
PAGE 923
Verify that EdgePort is enabled on a port using the show spanning-tree rstp command from the EXEC privilege mode or the show config command from INTERFACE mode; Dell Force10 recommends using the show config command, as shown in Figure 45-7. FTOS Behavior: Regarding bpduguard shutdown-on-violation behavior: 1 If the interface to be shutdown is a port channel then all the member ports are disabled in the hardware.
PAGE 924
www.dell.com | support.dell.com Influence RSTP Root Selection The Rapid Spanning Tree Protocol determines the root bridge, but you can assign one bridge a lower priority to increase the likelihood that it will be selected as the root bridge. To change the bridge priority, use the following command: Task Command Syntax Command Mode Assign a number as the bridge priority or designate it as the primary or secondary root. priority-value range: 0 to 65535.
PAGE 925
Fast Hellos for Link State Detection Fast Hellos for Link State Detection is available only on platform: s Use RSTP Fast Hellos to achieve sub-second link-down detection so that convergence is triggered faster. The standard RSTP link-state detection mechanism does not offer the same low link-state detection speed. RSTP Fast Hellos decrease the hello interval to the order of milliseconds and all timers derived from the hello timer are adjusted accordingly.
PAGE 926
www.dell.com | support.dell.com Configure a Root Guard Use the Root Guard feature in a Layer 2 RSTP network to avoid bridging loops. You enable root guard on a per-port or per-port-channel basis. FTOS Behavior: The following conditions apply to a port enabled with root guard: • Root guard is supported on any RSTP-enabled port or port-channel interface except when used as a stacking port.
PAGE 927
Configure a Loop Guard The Loop Guard feature provides protection against Layer 2 forwarding loops (STP loops) caused by a hardware failure, such as a cable failure or an interface fault. When a cable or interface fails, a participating STP link may become unidirectional (STP requires links to be bidirectional) and an STP port does not receive BPDUs. When an STP blocking port does not receive BPDUs, it transitions to a forwarding state. This condition can create a loop in the network.
PAGE 928
www.dell.com | support.dell.com 928 Displaying STP Guard Configuration To verify the STP guard configured on RSTP port or port-channel interfaces, enter the show spanning-tree rstp guard command. Refer to Chapter 53, “Spanning Tree Protocol,” on page 1063 for information on how to configure and use the STP root guard, loop guard, and BPDU guard features. Figure 45-9 shows an example for an RSTP network (instance 0) in which: • • • Root guard is enabled on a port that is in a root-inconsistent state.
PAGE 929
46 Security Security features are supported on platforms ces This chapter discusses several ways to provide access security to the Dell Force10 system. Platform-specific features are identified by the c, e or s icons (as shown below). Security features are supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later.
PAGE 930
www.dell.com | support.dell.
PAGE 931
Suppress AAA Accounting for null username sessions When AAA Accounting is activated, the FTOS software issues accounting records for all users on the system, including users whose username string, because of protocol translation, is NULL. An example of this is a user who comes in on a line where the AAA Authentication login method-list none command is applied.
PAGE 932
www.dell.com | support.dell.com No specific show command exists for TACACS+ accounting. To obtain accounting records displaying information about users currently logged in, perform the following task in Privileged EXEC mode: 932 Command Syntax Command Mode Purpose show accounting CONFIGURATION Step through all active sessions and print all the accounting records for the actively accounted functions. Figure 46-1.
PAGE 933
AAA Authentication FTOS supports a distributed client/server system implemented through Authentication, Authorization, and Accounting (AAA) to help secure networks against unauthorized access. In the Dell Force10 implementation, the Dell Force10 system acts as a RADIUS or TACACS+ client and sends authentication requests to a central RADIUS or TACACS+ server that contains all user authentication and network service access information.
PAGE 934
www.dell.com | support.dell.com Configure AAA Authentication login methods To configure an authentication method and method list, use these commands in the following sequence in the CONFIGURATION mode: Step 1 Command Syntax Command Mode Purpose aaa authentication login CONFIGURATION Define an authentication method-list (method-list-name) or specify the default. The default method-list is applied to all terminal lines.
PAGE 935
Enable AAA Authentication To enable AAA authentication, use the following command in the CONFIGURATION mode: Command Syntax Command Mode Purpose aaa authentication enable {method-list-name | default} method1 [... method4] CONFIGURATION • • • default—Uses the listed authentication methods that follow this argument as the default list of methods when a user logs in. method-list-name—Character string used to name the list of enable authentication methods activated when a user logs in. method1 [...
PAGE 936
www.dell.com | support.dell.com Server-side configuration TACACS+: When using TACACS+, Dell Force10 sends an initial packet with service type SVC_ENABLE, and then, a second packet with just the password. The TACACS server must have an entry for username $enable$. RADIUS: When using RADIUS authentication, FTOS sends an authentication packet with the following: Username: $enab15$ Password: Therefore, the RADIUS server must have an entry for this username.
PAGE 937
By default, commands in FTOS are assigned to different privilege levels. You can access those commands only if you have access to that privilege level. For example, to reach the protocol spanning-tree command, you must log in to the router, enter the enable command for privilege level 15 (this is the default level for the command) and then enter the CONFIGURATION mode. You can configure passwords to control access to the box and assign different privilege levels to users.
PAGE 938
www.dell.com | support.dell.com Configure the enable password command To configure FTOS, you must use the enable command to enter the EXEC Privilege level 15. After entering the command, FTOS requests that you enter a password. Privilege levels are not assigned to passwords, rather passwords are assigned to a privilege level. A password for any privilege level can always be changed. To change to a different privilege level, enter the enable command, followed by the privilege level.
PAGE 939
To assign commands and passwords to a custom privilege level, you must be in privilege level 15 and use these commands in the following sequence in the CONFIGURATION mode: Step Command Syntax Command Mode Purpose username name [access-class access-list-name] [privilege level] [nopassword | password [encryption-type] password] CONFIGURATION Assign a user name and password. Configure the optional and required parameters: • name: Enter a text string (up to 63 characters).
PAGE 940
www.dell.com | support.dell.com Figure 46-2. Configuring a Custom Privilege Level Force10(conf)#username john privilege 8 password john Force10(conf)#enable password level 8 notjohn Force10(conf)#privilege exec level 8 configure Force10(conf)#privilege config level 8 snmp-server Force10(conf)#end Force10#show running-config Current Configuration ...
PAGE 941
To specify a password for the terminal line, use the following commands, in any order, in the LINE mode: Command Syntax Command Mode Purpose privilege level level LINE Configure a custom privilege level for the terminal lines. • level level range: 0 to 15. Levels 0, 1 and 15 are pre-configured. Levels 2 to 14 are available for custom configuration. password [encryption-type] password LINE Specify either a plain text or encrypted password.
PAGE 942
www.dell.com | support.dell.com RADIUS Authentication and Authorization FTOS supports RADIUS for user authentication (text password) at login and can be specified as one of the login authentication methods in the aaa authentication login command. When configuring AAA authorization, you can configure to limit the attributes of services available to a user. When authorization is enabled, the network access server uses configuration information from the user profile to issue the user's session.
PAGE 943
79 RADIUS_EAP_MSG 80 RADIUS_MSG_AUTHENTICATOR 81 RADIUS_TUNNEL_PRIVATE_GROUP_ID 95 NAS_IPv6_ADDRESS RADIUS exec-authorization stores a user-shell profile and that is applied during user login. You may name the relevant named-lists with either a unique name or the default name.
PAGE 944
www.dell.com | support.dell.com Auto-command You can configure the system through the RADIUS server to automatically execute a command when you connect to a specific line. To do this, use the command auto-command. The auto-command is executed when the user is authenticated and before the prompt appears to the user.
PAGE 945
Command Syntax Command Mode Purpose aaa authorization exec {method-list-name | default} radius tacacs+ CONFIGURATION Create methodlist with RADIUS and TACACS+ as authorization methods. Typical order of methods: RADIUS, TACACS+, Local, None. If authorization is denied by RADIUS, the session ends (radius should not be the last method specified). Apply the method list to terminal lines To enable RADIUS AAA login authentication for a method list, you must apply it to a terminal line.
PAGE 946
www.dell.com | support.dell.com To specify multiple RADIUS server hosts, configure the radius-server host command multiple times. If multiple RADIUS server hosts are configured, FTOS attempts to connect with them in the order in which they were configured. When FTOS attempts to authenticate a user, the software connects with the RADIUS server hosts one at a time, until a RADIUS server host responds with an accept or reject response.
PAGE 947
To view the configuration of RADIUS communication parameters, use the show running-config command in the EXEC Privilege mode. Monitor RADIUS To view information on RADIUS transactions, use the following command in the EXEC Privilege mode: Command Syntax Command Mode Purpose debug radius EXEC Privilege View RADIUS transactions to troubleshoot problems. TACACS+ FTOS supports Terminal Access Controller Access Control System (TACACS+ client, including support for login authentication.
PAGE 948
www.dell.com | support.dell.com To select TACACS as the login authentication method, use these commands in the following sequence in the CONFIGURATION mode: Step 1 2 Command Syntax Command Mode Purpose tacacs-server host {ipv4-address | ipv6-address | host} CONFIGURATION Configure a TACACS+ server host. Enter the IP address or host name of the TACACS+ server. Use this command multiple times to configure multiple TACACS+ server hosts.
PAGE 949
Figure 46-4.
PAGE 950
www.dell.com | support.dell.com Figure 46-5 demonstrates how to configure the access-class from a TACACS+ server. This causes the configured access-class on the VTY line to be ignored. If you have configured a deny10 ACL on the TACACS+ server, FTOS downloads it and applies it. If the user is found to be coming from the 10.0.0.0 subnet, FTOS also immediately closes the Telnet connection. Note, that no matter where the user is coming from, they see the login prompt. Figure 46-5.
PAGE 951
To delete a TACACS+ server host, use the no tacacs-server host {hostname | ip-address} command. freebsd2# telnet 2200:2200:2200:2200:2200::2202 Trying 2200:2200:2200:2200:2200::2202... Connected to 2200:2200:2200:2200:2200::2202. Escape character is '^]'. Login: admin Password: Force10# Force10# Command Authorization The AAA command authorization feature configures FTOS to send each configuration command to a TACACS server for authorization before it is added to the running configuration.
PAGE 952
www.dell.com | support.dell.com FTOS supports both inbound and outbound SSH sessions using IPv4 or IPv6 addressing. Inbound SSH supports accessing the system through the management interface as well as through a physical Layer 3 interface. For details on command syntax, see the Security chapter in the FTOS Command Line Interface Reference. SCP is a remote file copy program that works with SSH and is supported by FTOS.
PAGE 953
Figure 46-6. Specifying an SSH version Force10(conf)#ip ssh server version 2 Force10(conf)#do show ip ssh SSH server : disabled. SSH server version : v2. Password Authentication : enabled. Hostbased Authentication : disabled. RSA Authentication : disabled. To disable SSH server functions, enter no ip ssh server enable.
PAGE 954
www.dell.com | support.dell.com • ip ssh connection-rate-limit: Configure the maximum number of incoming SSH connections per minute. • • • • • • • • • • • ip ssh hostbased-authentication enable: Enable hostbased-authentication for the SSHv2 server. ip ssh key-size: Configure the size of the server-generated RSA SSHv1 key. ip ssh password-authentication enable: Enable password authentication for the SSH server. ip ssh pub-key-file: Specify the file to be used for host-based authentication.
PAGE 955
Figure 46-8. Enabling SSH Password Authentication Force10(conf)#ip ssh server enable % Please wait while SSH Daemon initializes ... done. Force10(conf)#ip ssh password-authentication enable Force10#sh ip ssh SSH server : enabled. Password Authentication : enabled. Hostbased Authentication : disabled. RSA Authentication : disabled. RSA Authentication of SSH The following procedure authenticates an SSH client based on an RSA key using RSA authentication.
PAGE 956
www.dell.com | support.dell.com To configure host-based authentication: Step Task Command Syntax 1 Configure RSA Authentication. See RSA Authentication of SSH, above. 2 Create shosts by copying the public RSA key to the to the file shosts in the diretory .ssh, and write the IP address of the host to the file. Figure 46-10. Command Mode cp /etc/ssh/ssh_host_rsa_key.pub /.ssh/shosts Creating shosts admin@Unix_client# cd /etc/ssh admin@Unix_client# ls moduli sshd_config ssh_host_dsa_key.
PAGE 957
Figure 46-12. Client-based SSH Authentication Force10#ssh 10.16.127.201 ? -l User name option -p SSH server port option (default 22) -v SSH protocol version Troubleshooting SSH • You may not bind id_rsa.pub to RSA authentication while logged in via the console. In this case, Message 2 appears. Message 2 RSA Authentication Error %Error: No username set for this term. • Host-based authentication must be enabled on the server (Dell Force10 system) and the client (Unix machine).
PAGE 958
www.dell.com | support.dell.com Trace Lists The Trace Lists feature is supported only on the E-Series: e You can log packet activity on a port to confirm the source of traffic attacking a system. Once the Trace list is enabled on the system, you view its traffic log to confirm the source address of the attacking traffic. In FTOS, Trace lists are similar to extended IP ACLs, except that Trace lists are not applied to an interface.
PAGE 959
Since traffic passes through the filter in the order of the filter’s sequence, you can configure the trace list by first entering the TRACE LIST mode and then assigning a sequence number to the filter. To create a filter for packets with a specified sequence number, use these commands in the following sequence, starting in the CONFIGURATION mode: Step 1 2 Command Syntax Command Mode Purpose ip trace-list trace-list-name CONFIGURATION Enter the TRACE LIST mode by creating an trace list.
PAGE 960
www.dell.com | support.dell.com Step Command Syntax Command Mode Purpose 2 seq sequence-number {deny | permit} tcp {source mask | any | host ip-address} [operator port [port]] {destination mask | any | host ip-address} [operator port [port]] [established] [count [byte] | log] TRACE LIST Configure a trace list filter for TCP packets. • source: An IP address as the source IP address for the filter to match.
PAGE 961
Figure 46-13. Trace list Using seq Command Example Force10(config-trace-acl)#seq 15 deny ip host 12.45.0.0 any log Force10(config-trace-acl)#seq 5 permit tcp 121.1.3.45 0.0.255.255 any Force10(config-trace-acl)#show conf ! ip trace-list dilling seq 5 permit tcp 121.1.0.0 0.0.255.255 any seq 15 deny ip host 12.45.0.0 any log If you are creating a Trace list with only one or two filters, you can let FTOS assign a sequence number based on the order in which the filters are configured.
PAGE 962
www.dell.com | support.dell.com Command Syntax Command Mode Purpose {deny | permit} tcp {source mask | any | host TRACE LIST Configure a deny or permit filter to examine TCP packets. Configure the following required and optional parameters: • source: An IP address as the source IP address for the filter to match. • mask: a network mask • any: to match any IP source address • host ip-address: to match IP addresses in a host. • destination: An IP address as the source IP address for the filter to match.
PAGE 963
Figure 46-14. Trace List Example Force10(config-trace-acl)#deny tcp host 123.55.34.0 any Force10(config-trace-acl)#permit udp 154.44.123.34 0.0.255.255 host 34.6.0.0 Force10(config-trace-acl)#show config ! ip trace-list nimule seq 5 deny tcp host 123.55.34.0 any seq 10 permit udp 154.44.0.0 0.0.255.255 host 34.6.0.0 To view all configured Trace lists and the number of packets processed through the Trace list, use the show (Figure 110) in the EXEC Privilege mode.
PAGE 964
www.dell.com | support.dell.com VTY Line and Access-Class Configuration Various methods are available to restrict VTY access in FTOS. These depend on which authentication scheme you use — line, local, or remote: Table 46-1. VTY Access Authentication Method Username VTY access-class access-class support? support? Remote authorization support? Line YES NO NO Local NO YES NO TACACS+ YES NO YES (with FTOS 5.2.1.0 and later) RADIUS YES NO YES (with FTOS 6.1.1.
PAGE 965
Figure 46-16.
PAGE 966
www.dell.com | support.dell.com Figure 46-18.
PAGE 967
47 Service Provider Bridging Service Provider Bridging is supported on platforms: ces This chapter contains the following major sections: • • • • • VLAN Stacking on page 967 VLAN Stacking Packet Drop Precedence on page 978 Dynamic Mode CoS for VLAN Stacking on page 981 Layer 2 Protocol Tunneling on page 983 Provider Backbone Bridging on page 987 VLAN Stacking ces VLAN Stacking is supported on E-Series ExaScale ex with FTOS 8.2.1.0. and later.
PAGE 968
Figure 47-1. VLAN Stacking in a Service Provider Network TPID (0x9100) PCP DEI VID (VLAN 300) PCP TPID (0x8100) CFI (0) VID (VLAN Red) AN 1 00 tagged 100 AN 0 10 VL VL www.dell.com | support.dell.com In at the access point of a VLAN-stacking network, service providers add a VLAN tag, the S-Tag, to each frame before the 802.1Q tag. From this point, the frame is double-tagged. The service provider uses the S-Tag, to forward the frame traffic across its network.
PAGE 969
Configure VLAN Stacking Configuring VLAN-Stacking is a three-step process: 1. Create access and trunk ports. See page 969. 2. Assign access and trunk ports to a VLAN. See page 970. 3. Make the VLAN VLAN-stacking capable.
PAGE 970
www.dell.com | support.dell.com Display the VLAN-Stacking configuration for a switchport using the command show config from INTERFACE mode, as shown in Figure 47-3. Figure 47-3.
PAGE 971
FTOS Options for Trunk Ports 802.1ad trunk ports may also be tagged members of a VLAN so that it can carry single and double-tagged traffic. You can enable trunk ports to carry untagged, single-tagged, and double-tagged VLAN traffic by making the trunk port a hybrid port. Step Task Command Syntax Command Mode 1 Configure a trunk port to carry untagged, single-tagged, and double-tagged traffic by making it a hybrid port. Note: Note: On the C-Series and S-Series, a trunk port can be added to an 802.
PAGE 972
www.dell.com | support.dell.com VLAN Stacking in Multi-vendor Networks The first field in the VLAN tag is the Tag Protocol Identifier (TPID), which is two bytes. In a VLAN-stacking network, once the frame is double tagged, the outer tag TPID must match the TPID of the next-hop system. While 802.1Q requires that the inner tag TPID is 0x8100, it does not require a specific value for the outer tag TPID.
PAGE 973
Figure 47-6.
PAGE 974
LUE TPID Mismatch and 0x8100 Match on the E-Series TeraScale TPID 0x9100 VLAN GREEN UE N BL VLA R1-E-Series TeraScale TPID: 0x9100 NB CE PROVIDER RVI SE X R2-E-Series TeraScale TPID: 0x8181 VLAN GREEN, VLAN VL AN Building D TPID 0x8100 VLA INTE RN ET www.dell.com | support.dell.com Figure 47-7.
PAGE 975
LUE First-byte TPID Match on the E-Series ExaScale TPID 0x9191 VLAN GREEN UE N BL VLA R1-E-Series TeraScale TPID: 0x9191 Building D NB CE PROVIDER RVI SE VLA INTE RN ET Figure 47-8. X R2-E-Series ExaScale TPID: 0x9100 VLAN R PURPLE VLAN GREEN, VLAN VL AN PU ED RP LE Building C VL AN D RE Table 47-1 details the outcome of matched and mis-matched TPIDs in a VLAN-stacking network with the E-Series. Table 47-1.
PAGE 976
www.dell.com | support.dell.com You can configure the first eight bits of the TPID using the command vlan-stack protocol-type. The TPID on the C-Series and S-Series systems is global. Ingress frames that do not match the system TPID are treated as untagged. This rule applies for both the outer tag TPID of a double-tagged frame and the TPID of a single-tagged frame.
PAGE 977
Single and Double-tag First-byte TPID Match on C-Series and S-Series VLA NB LUE DEFAULT VLAN Figure 47-10. TPID 0x8181 R2-C-Series w/ FTOS <8.2.1.0 ED TPID: 0x8181 VLAN R PURPLE VLAN GREEN, VLAN VLAN GREEN UE DEFAULT VLAN N BL R3-C-Series w/ FTOS >=8.2.1.0 VL VLA TPID: 0x8181 AN PU R1-C-Series w/ FTOS <8.2.1.
PAGE 978
www.dell.com | support.dell.com Table 47-2 details the outcome of matched and mismatched TPIDs in a VLAN-stacking network with the C-Series and S-Series. Table 47-2. Network Position C-Series and S-Series Behaviors for Mis-matched TPID Incoming Packet TPID System TPID Match Type Pre-8.2.1.0 8.2.1.
PAGE 979
Enable Drop Eligibility You must enable Drop Eligibility globally before you can honor or mark the DEI value. Task Command Syntax Command Mode Make packets eligible for dropping based on their DEI value. By default, packets are colored green, and DEI is marked 0 on egress. dei enable CONFIGURATION When Drop Eligibility is enabled, DEI mapping or marking takes place according to the defaults. In this case, the CFI is affected according to Table 47-3. Table 47-3.
PAGE 980
www.dell.com | support.dell.com Task Command Syntax Force10#show interface dei-honor Default Drop precedence: Green Interface CFI/DEI Drop precedence ------------------------------------------------------------Gi 0/1 0 Green Gi 0/1 1 Yellow Gi 8/9 1 Red Gi 8/40 0 Yellow Mark Egress Packets with a DEI Value On egress, you can set the DEI value according to a different mapping than ingress (see Honor the Incoming DEI Value).
PAGE 981
Dynamic Mode CoS for VLAN Stacking Dynamic Mode CoS for VLAN Stacking is available only on platforms: cs One of the ways to ensure quality of service for customer VLAN-tagged frames is to use the 802.1p priority bits in the tag to indicate the level of QoS desired. When an S-Tag is added to incoming customer frames, the 802.1p bits on the S-Tag may be configured statically for each customer or derived from the C-Tag using Dynamic Mode CoS. Dynamic Mode CoS maps the C-Tag 802.1p value to a S-Tag 802.
PAGE 982
www.dell.com | support.dell.com FTOS Behavior: For Option A above, when there is a conflict between the queue selected by Dynamic Mode CoS (vlan-stack dot1p-mapping) and a QoS configuration, the queue selected by Dynamic Mode CoS takes precedence. However, rate policing for the queue is determined by QoS configuration.
PAGE 983
To map C-Tag dot1p values to S-Tag dot1p values and mark the frames accordingly: Step Task Command Syntax Command Mode Allocate CAM space to enable queuing frames according to the C-Tag or the S-Tag. vman-qos: mark the S-Tag dot1p and queue the frame according to the original C-Tag dot1p. This method requires half as many CAM entries as vman-qos-dual-fp. vman-qos-dual-fp: mark the S-Tag dot1p and queue the frame according to the S-Tag dot1p.
PAGE 984
SPANNI NG TR VLAN Stacking without L2PT INTE RN E T no spanning-tree ETWORK EN RE SPAN NIN G www.dell.com | support.dell.com Figure 47-13. T ING TREE ANN SP CE PROVIDER w/ I V R SE EE EE TR Building B no spanning-tree X BPDU w/ destination MAC address: 01-80-C2-00-00-00 Building A You might need to transport control traffic transparently through the intermediate network to the other region.
PAGE 985
VLAN Stacking with L2PT SPANNI NG TR Figure 47-14. INTE RN E E RE SPAN NIN G T no spanning-tree NETWORK EE EE TR ING TREE ANN SP PROVIDER w/ E C I RV SE BPDU w/ destination T MAC address: 01-01-e8-00-00-00 R1-E-Series R2 Non-Force10 System BPDU w/ destination MAC address: 01-80-C2-00-00-00 no spanning-tree Building B R3 Non-Force10 System BPDU w/ destination MAC address: 01-80-C2-00-00-00 Building A Implementation Information • • • L2PT is available for STP, RSTP, MSTP, and PVST+ BPDUs.
PAGE 986
www.dell.com | support.dell.com Enable Layer 2 Protocol Tunneling Step Task Command Syntax Command Mode 1 Verify that the system is running the default CAM profile; you must use this CAM profile for L2PT. show cam-profile EXEC Privilege 2 Enable protocol tunneling globally on the system. protocol-tunnel enable CONFIGURATION 3 Tunnel BPDUs the VLAN.
PAGE 987
Rate-limit BPDUs on the C-Series and S-Series CAM space is allocated in sections called Field Processor (FP) blocks. There are total 13 user-configurable FP blocks on the C-Series and S-Series. The default number of blocks for L2PT is 0; you must allocate at least one to enable BPDU rate-limiting. Step Task Command Syntax Command Mode 1 Create at least one FP group for L2PT. See CAM Allocation on page 291 for details on this command.
PAGE 988
www.dell.com | support.dell.com The same is true for GVRP. 802.1ad specifies that provider bridges participating in GVRP use a reserved destination MAC address called the Provider Bridge GVRP Address, 01-80-C2-00-00-0D, to exchange GARP PDUs instead of the GVRP Address, 01-80-C2-00-00-21, specified in 802.1Q. Only bridges in the service provider network use this destination MAC address so these bridges treat GARP PDUs originating from the customer network as normal data frames, rather than consuming them.
PAGE 989
48 sFlow ces sFlow is supported on E-Series ExaScale ex with FTOS 8.1.1.0. and later. sFlow is supported on platforms • • • • • • • • Enable and Disable sFlow on page 991 sFlow Show Commands on page 992 Configure Collectors on page 994 Polling Intervals on page 994 Sampling Rate on page 995 Back-off Mechanism on page 996 sFlow on LAG ports on page 996 Extended sFlow on page 996 Overview FTOS supports sFlow version 5.
PAGE 990
www.dell.com | support.dell.com Figure 48-1. sFlow Traffic Monitoring System sFlow Collector Switch/Router sFlow Datagrams sFlow Agent Poll Interface Counters Interface Counters Flow Samples Switch ASIC Implementation Information Dell Force10 sFlow is designed so that the hardware sampling rate is per line card port-pipe and is decided based upon all the ports in that port-pipe.
PAGE 991
• • • • • • • • • • • FTOS exports all sFlow packets to the collector. A small sampling rate can equate to a large number of exported packets. A backoff mechanism will automatically be applied to reduce this amount. Some sampled packets may be dropped when the exported packet rate is high and the backoff mechanism is about to or is starting to take effect. The dropEvent counter, in the sFlow packet, will always be zero.
PAGE 992
www.dell.com | support.dell.com sFlow Show Commands FTOS includes the following sFlow display commands: • • • Show sFlow Globally on page 49 Show sFlow on an Interface on page 50 Show sFlow on a Line Card on page 50 Show sFlow Globally Use the following command to view sFlow statistics: Command Syntax show sflow Command Mode EXEC Purpose Display sFlow configuration information and statistics. Figure 48-2 is a sample output from the show sflow command: Figure 48-2.
PAGE 993
Figure 48-3. Command Example: show sflow interface Force10#show sflow interface gigabitethernet 1/16 Gi 1/16 Configured sampling rate :8192 Actual sampling rate :8192 Sub-sampling rate :2 Counter polling interval :15 Samples rcvd from h/w :33 Samples dropped for sub-sampling :6 The configuration, shown in Figure 48-2, is also displayed in the running configuration (Figure 48-4): Figure 48-4.
PAGE 994
www.dell.com | support.dell.com Configure Collectors The sflow collector command allows you to configure sFlow collectors to which sFlow datagrams are forwarded. You can configure up to two sFlow collectors (IPv4 or IPv6). If you configure two collectors, traffic samples are sent to both devices. e. IPv6 sFlow collectors and agents are supported on platforms: c e s.
PAGE 995
Sampling Rate Sampling Rate is supported on platform et. The sFlow sampling rate is the number of packets that are skipped before the next sample is taken. sFlow does not have time-based packet sampling. The sflow sample-rate command, when issued in CONFIGURATION mode, changes the default sampling rate. By default, the sampling rate of an interface is set to the same value as the current global default sampling rate.
PAGE 996
www.dell.com | support.dell.com Note: Sampling rate backoff can change the sampling rate value that is set in the hardware. This equation shows the relationship between actual sampling rate, sub-sampling rate, and the hardware sampling rate for an interface: Actual sampling rate = sub-sampling rate * hardware sampling rate Note the absence of a configured rate in the equation.
PAGE 997
Use the command sflow [extended-switch] [extended-router] [extended-gateway] enable command. By default packing of any of the extended information in the datagram is disabled. Use the command show sflow to confirm that extended information packing is enabled, as shown in Figure 48-6. Figure 48-6.
PAGE 998
www.dell.com | support.dell.com Important Points to Remember • • • • • The IP destination address has to be learned via BGP in order to export extended-gateway data, prior to FTOS version 7.8.1.0. If the IP destination address is not learned via BGP the Dell Force10 system does not export extended-gateway data, prior to FTOS version 7.8.1.0. FTOS 7.8.1.
PAGE 999
49 Simple Network Management Protocol Simple Network Management Protocol is supported on platforms ces SNMP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Note: On Dell Force10 routers, standard and private SNMP MIBs are supported, including all Get and a limited number of Set operations (such as set vlan and copy cmd). Protocol Overview Network management stations use Simple Network Management Protocol (SNMP) to retrieve or alter management data from network elements.
PAGE 1000
www.dell.com | support.dell.com Configuring SNMP requires only a single step: 1. Create a community. See page 1000.
PAGE 1001
Message 1 SNMP Enabled 22:31:23: %RPM1-P:CP %SNMP-6-SNMP_WARM_START: Agent Initialized - SNMP WARM_START. View your SNMP configuration, using the command show running-config snmp from EXEC Privilege mode, as shown in Figure 49-1. Figure 49-1. Creating an SNMP Community Force10#snmp-server community my-snmp-community ro 22:31:23: %RPM1-P:CP %SNMP-6-SNMP_WARM_START: Agent Initialized - SNMP WARM_START.
PAGE 1002
www.dell.com | support.dell.com Task Command Figure 49-4. Reading the Value of Many Managed Objects at Once > snmpwalk -v 2c -c mycommunity 10.11.131.161 .1.3.6.1.2.1.1 SNMPv2-MIB::sysDescr.0 = STRING: Force10 Networks Real Time Operating System Software Force10 Operating System Version: 1.0 Force10 Application Software Version: E_MAIN4.7.6.350 Copyright (c) 1999-2007 by Force10 Networks, Inc. Build Time: Mon May 12 14:02:22 PDT 2008 SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.6027.1.3.
PAGE 1003
Configure Contact and Location Information using SNMP You may configure system contact and location information from the Dell Force10 system or from the management station using SNMP. To configure system contact and location information from the Dell Force10 system: Task Command Command Mode Identify the system manager along with this person’s contact information (e.g E-mail address or phone number). You may use up to 55 characters.
PAGE 1004
www.dell.com | support.dell.com Subscribe to Managed Object Value Updates using SNMP By default, the Dell Force10 system displays some unsolicited SNMP messages (traps) upon certain events and conditions. You can also configure the system to send the traps to a management station. Traps cannot be saved on the system.
PAGE 1005
Table 49-2. Dell Force10 Enterprise-specific SNMP Traps Command Option Trap Examples envmon CARD_SHUTDOWN: %sLine card %d down - %s CARD_DOWN: %sLine card %d down - %s LINECARDUP: %sLine card %d is up CARD_MISMATCH: Mismatch: line card %d is type %s - type %s required.
PAGE 1006
www.dell.com | support.dell.com Table 49-2. Dell Force10 Enterprise-specific SNMP Traps Command Option Trap Examples stp (includes only STP notifications) %SPANMGR-5-STP_ROOT_CHANGE: STP root changed for vlan 1. My Bridge ID: 0:0001.e867.b1f8 Old Root: 0:0000.0000.0000 New Root: 0:0001.e867.b1f8. %SPANMGR-5-STP_NEW_ROOT: New Spanning Tree Root, Bridge ID Priority 32768, Address 0001.e801.fc35.
PAGE 1007
All of these tasks can be performed using IPv4 or IPv6 addresses. The examples in this section use IPv4 addresses; IPv6 addresses can be substituted for the IPv4 addresses in all of the examples. The relevant MIBs for these functions are: Table 49-3. MIB Objects for Copying Configuration Files via SNMP MIB Object OID Object Values Description copySrcFileType .1.3.6.1.4.1.6027.3.5.1.1.1.1.2 1 = FTOS file 2 = running-config 3 = startup-config Specifies the type of file to copy from.
PAGE 1008
www.dell.com | support.dell.com Table 49-3. MIB Objects for Copying Configuration Files via SNMP MIB Object OID Object Values Description copyUserName .1.3.6.1.4.1.6027.3.5.1.1.1.1.9 Username for the server. Username for for the FTP, TFTP, or SCP server. • If the copyUserName is specified so must copyUserPassword. copyUserPassword .1.3.6.1.4.1.6027.3.5.1.1.1.1.10 Password for the server. Password for the FTP, TFTP, or SCP server.
PAGE 1009
Note: In Unix, enter the command snmpset for help using this command. Place the file f10-copy-config.mib the directory from which you are executing the snmpset command or in the snmpset tool path. Table 49-4. Copying Configuration Files via SNMP Task Copy the running-config to the startup-config using the following command from the Unix machine: snmpset -v 2c -c public -m ./f10-copy-config.mib force10system-ip-address copySrcFileType.index i 2 copyDestFileType.
PAGE 1010
www.dell.com | support.dell.com Table 49-4. Copying Configuration Files via SNMP Task • • server-ip-address must be preceded by the keyword a. values for copyUsername and copyUserPassword must be preceded by the keyword s. Figure 49-10. Copying Configuration Files via SNMP and FTP to a Remote Server > snmpset -v 2c -c private -m ./f10-copy-config.mib 10.10.10.10 copySrcFileType.110 i 2 copyDestFileName.110 s /home/startup-config copyDestFileLocation.110 i 4 copyServerAddress.110 a 11.11.11.
PAGE 1011
Dell Force10 provides additional MIB Objects to view copy statistics. These are provided in Table 49-5. Table 49-5. MIB Objects for Copying Configuration Files via SNMP MIB Object OID Values Description copyState .1.3.6.1.4.1.6027.3.5.1.1.1.1.11 1= running 2 = successful 3 = failed Specifies the state of the copy operation. copyTimeStarted .1.3.6.1.4.1.6027.3.5.1.1.1.1.12 Time value Specifies the point in the up-time clock that the copy operation started. copyTimeCompleted .1.3.6.1.4.1.6027.
PAGE 1012
www.dell.com | support.dell.com Figure 49-13 shows the command syntax using MIB object names, and Figure 49-14 shows the same command using the object OIDs. In both cases, the object is followed by same index number used in the snmpset command. 1012 Figure 49-13. Obtaining MIB Object Values for a Copy Operation using Object-name Syntax > snmpget -v 2c -c private -m ./f10-copy-config.mib 10.11.131.140 copyTimeCompleted.110 FORCE10-COPY-CONFIG-MIB::copyTimeCompleted.110 = Timeticks: (1179831) 3:16:38.
PAGE 1013
Manage VLANs using SNMP The qBridgeMIB managed objects in the Q-BRIDGE-MIB, defined in RFC 2674, enable you to use SNMP manage VLANs. Create a VLAN Use the dot1qVlanStaticRowStatus object to create a VLAN. The snmpset operation in Figure 49-15 creates VLAN 10 by specifying a value of 4 for instance 10 of the dot1qVlanStaticRowStatus object. Figure 49-15. Creating a VLAN using SNMP > snmpset -v2c -c mycommunity 123.45.6.78 .1.3.6.1.2.1.17.7.1.4.3.1.5.10 i 4 SNMPv2-SMI::mib-2.17.7.1.4.3.1.5.
PAGE 1014
www.dell.com | support.dell.com Figure 49-17. Identifying the VLAN Interface Index Number Force10(conf)#do show interface vlan id 10 % Error: No such interface name.
PAGE 1015
Figure 49-18 shows the output for an S-Series. All hex pairs are 00, indicating that no ports are assigned to VLAN 10. In Figure 49-19, Port 0/2 is added to VLAN 10 as untagged. And the first hex pair changes from 00 to 04. Figure 49-19.
PAGE 1016
www.dell.com | support.dell.com Figure 49-20. Adding Untagged Ports to a VLAN using SNMP >snmpset -v2c -c mycommunity 10.11.131.185 .1.3.6.1.2.1.17.7.1.4.3.1.2.1107787786 x "40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" .1.3.6.1.2.1.17.7.1.4.3.1.4.
PAGE 1017
Enable and Disable a Port using SNMP Step Task Command Syntax Command Mode 1 Create an SNMP community on the Dell Force10 system. snmp-server community CONFIGURATION 2 From the Dell Force10 system, identify the interface index of the port for which you want to change the admin status. Or, from the management system, use the snmpwwalk command to identify the interface index.
PAGE 1018
www.dell.com | support.dell.com Each object is comprised an OID concatenated with an instance number. In the case of these objects, the instance number is the decimal equivalent of the MAC address; derive the instance number by converting each hex pair to its decimal equivalent. For example, the decimal equivalent of E8 is 232, and so the instance number for MAC address 00:01:e8:06:95:ac is .0.1.232.6.149.172.
PAGE 1019
Deriving Interface Indices FTOS assigns an interface number to each (configured or unconfigured) physical and logical interface. Display the interface index number using the command show interface from EXEC Privilege mode, as shown in Figure 49-25. Figure 49-25.
PAGE 1020
www.dell.com | support.dell.com Figure 49-27. Binary Representation of Interface Index 2 bits 7 bits 4 bits 14 bits 10 0010110 0011 00000000111010 Interface Type Card Type Slot Port Number Number For interface indexing, slot and port numbering begins with the binary one. If the Dell Force10 system begins slot and port numbering from 0, then the binary 1 represents slot and port 0.
PAGE 1021
If we learn mac address for the LAG, status will be shown for those as well dot3aCurAggVlanId SNMPv2-SMI::enterprises.6027.3.2.1.1.4.1.1.1.0.0.0.0.0.1.1 dot3aCurAggMacAddr SNMPv2-SMI::enterprises.6027.3.2.1.1.4.1.2.1.0.0.0.0.0.1.1 dot3aCurAggIndex SNMPv2-SMI::enterprises.6027.3.2.1.1.4.1.3.1.0.0.0.0.0.1.1 dot3aCurAggStatus SNMPv2-SMI::enterprises.6027.3.2.1.1.4.1.4.1.0.0.0.0.0.1.
PAGE 1022
www.dell.com | support.dell.
PAGE 1023
50 SONET/SDH SONET/SDH is supported on platform e SONET/SDH is supported on the E-Series ExaScale platform with FTOS 8.1.1.2 and later. FTOS supports two line cards with SONET—Packet-Over-SONET (POS) and PPP-over-SONET/SDH.
PAGE 1024
www.dell.com | support.dell.com • • • • Protection switching is not supported. POS interfaces cannot be mirrored ports. Configurable alarm thresholds (SF/SD BER, B1/B 2/B3 TC) are not supported. The CRC type and S1S0 flag cannot be changed. Configuring POS Interfaces POS interfaces require several configuration considerations, including • • • Encapsulation MTU Clock Settings Encapsulation The E-Series’ POS line card requires PPP encapsulation.
PAGE 1025
Configuring Maximum Transmission Unit (MTU) Maximum Transmission Unit is an integer value that represents the greatest number of bytes that any given interface on the system can handle. MTU settings allow the router to determine if a large packet needs to be fragmented before transmission. PPP must be enabled on a SONET interface before MTU can become configurable. MTU size can be changed in INTERFACE mode by entering the command mtu size. Figure 50-1.
PAGE 1026
www.dell.com | support.dell.com Figure 50-2. wanport command example interface TenGigabitEthernet 13/0 no ip address no shutdown Force10(conf-if-te-13/0)# Force10(conf-if-te-13/0)#wanport % Error: Port should be in shutdown mode, config ignored Te 13/0. Force10(conf-if-te-13/0)# error Force10(conf-if-te-13/0)#shutdown Force10(conf-if-te-13/0)# due to no shutdown state Figure 50-3 displays the active alarms for the interface. Figure 50-3.
PAGE 1027
While performance monitoring provides advanced alert of link degradation, alarms indicate a failure. Fault management involves alarm monitoring and generation, reporting, logging, correlation, and clearing. E-Series POS and 10GE WAN interfaces support the SONET alarms shown in Table 50-1: • • • Section alarms—SLOS, SLOF Line alarms—AIS, RDI, FEBE(REI), SD, SF Path Alarms—AIS, RDI, FEBE(REI), LOP Since E-Series is Terminal Equipment (TE), it must support the alarms in Table 50-1. Table 50-1.
PAGE 1028
www.dell.com | support.dell.com Use the alarm-report command to configure the SONET alarms that a POS or 10 GE WAN interface can activate.Table 50-2 defines the alarms that you can enable. Task Command Syntax Specify which POS/SDH alarms to report to the remote SNMP server. alarm-report {lais | lrdi | pais | plop | prdi | sd-ber | sf-ber | slof | slos} Command Mode INTERFACE To view active alarms and defects, use the show controllers sonet command in EXEC Privilege mode.
PAGE 1029
SONET TRAP Example SONET Traps on page 1031 describes the traps and OIDs for SONET alarms that are reported on an SNMP trap receiver. Figure 50-4 shows an example of a SONET trap. Figure 50-4. SONET Trap example 2010-10-06 22:43:53 10.11.203.4 [10.11.203.4]: SNMPv2-MIB::sysUpTime.0 = Timeticks: (6057792) SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.6027.3.3.2.2.0.18 SNMPv2-SMI::enterprises.6027.3.3.1.2.1.1.3.0 = SNMPv2-SMI::enterprises.6027.3.3.1.2.1.1.2.0 = SNMPv2-SMI::enterprises.6027.3.3.1.
PAGE 1030
www.dell.com | support.dell.com Task Command Syntax Delay triggering the line or path alarms with a 100ms delay. delay triggers {line [lrdi | sd-ber | sf-ber] | path [pais | prdi] } Command Mode INTERFACE By default, certain alarms (LOS, LOF, LAIS, PLOP) bring the line protocol down immediately. Use this command, with the line option, to delay that trigger event by 100ms. By default, path alarms (AIS, RDI, LOP) do not cause (or trigger) the interface line protocol to go down.
PAGE 1031
SONET MIB Table 50-3 lists the managed objects supported in the SONET MIB, as defined in RFC 2558. Table 50-3. SONET MIB: Managed Objects SONET Managed Object Description sonetMediumType Sonet or SDH depending on the configuration sonetMediumTimeElapsed Time in seconds (up to 900 seconds) since the line card is up. Resets after 900 seconds has elapsed sonetMediumValidIntervals The number of previous intervals for which valid data has been stored.
PAGE 1032
www.dell.com | support.dell.com 1032 Table 50-4. | SONET Traps and OIDs (continued) Trap OID Trap Object SONET_L_RDI Line Remote Defect Indication 1.3.6.1.4.1.6027.3.3.2.2.0.10 alarm state (1.3.6.1.4.1.6027.3.3.1.2.1.1.3), alarm type(1.3.6.1.4.1.6027.3.3.1.2.1.1.2), ifindex(1.3.6.1.4.1.6027.3.3.1.2.1.1.4), slot(1.3.6.1.4.1.6027.3.3.1.2.1.1.5), port(1.3.6.1.4.1.6027.3.3.1.2.1.1.6) SONET_L_FEBE Line Far-end Background Block Errors 1.3.6.1.4.1.6027.3.3.2.2.0.11 alarm state (1.3.6.1.4.1.6027.3.3.1.
PAGE 1033
Table 50-4. SONET Traps and OIDs (continued) Trap OID Trap Object SONET_P_PSE 1.3.6.1.4.1.6027.3.3.2.2.0.22 alarm state (1.3.6.1.4.1.6027.3.3.1.2.1.1.3), alarm type(1.3.6.1.4.1.6027.3.3.1.2.1.1.2), ifindex(1.3.6.1.4.1.6027.3.3.1.2.1.1.4), slot(1.3.6.1.4.1.6027.3.3.1.2.1.1.5), port(1.3.6.1.4.1.6027.3.3.1.2.1.1.6) SONET_P_NSE 1.3.6.1.4.1.6027.3.3.2.2.0.23 alarm state (1.3.6.1.4.1.6027.3.3.1.2.1.1.3), alarm type(1.3.6.1.4.1.6027.3.3.1.2.1.1.2), ifindex(1.3.6.1.4.1.6027.3.3.1.2.1.1.4), slot(1.3.6.1.4.
PAGE 1034
| SONET/SDH www.dell.com | support.dell.
PAGE 1035
51 Stacking S-Series Switches Stacking S-Series Switches is supported on platform s Note: S-Series Stackin is not supported on the S60 system. This chapter contains the following sections: • • • S-Series Stacking Overview on page 1035 Important Points to Remember on page 1042 S-Series Stacking Configuration Tasks on page 1051 S-Series Stacking Overview Up to eight S-Series systems can be interconnected so that all of the units function as a single unit.
PAGE 1036
www.dell.com | support.dell.com Figure 51-1. S-Series Stack Manager Redundancy Stack#show redundancy -- Stack-unit Status ------------------------------------------------Mgmt ID: 0 Stack-unit ID: 1 Stack-unit Redundancy Role: Primary Stack-unit State: Active Stack-unit SW Version: 7.8.1.0 Link to Peer: Up -- PEER Stack-unit Status ------------------------------------------------Stack-unit State: Standby Peer stack-unit ID: 2 Stack-unit SW Version: 7.8.1.
PAGE 1037
Figure 51-2. Electing the Stack Manager Stack>show system brief Stack MAC : 00:01:e8:d5:f9:6f -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Standby online S50V S50V 7.8.1.0 52 1 Management online S50N S50N 7.8.1.0 52 2 Member online S50V S50V 7.8.1.
PAGE 1038
www.dell.com | support.dell.com Figure 51-3. Adding a Standalone with a Lower MAC Address to a Stack— Before -------------------------------STANDALONE BEFORE CONNECTION---------------------------------Standalone#show system brief Stack MAC : 00:01:e8:d5:ef:81 -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Management online S50V S50V 7.8.1.
PAGE 1039
Figure 51-4. Adding a Standalone with a Lower MAC Address and Equal Priority to a Stack—After -------------------------------STANDALONE AFTER CONNECTION---------------------------------Standalone#%STKUNIT0-M:CP %POLLMGR-2-ALT_STACK_UNIT_STATE: Alternate Stack-unit is present 00:20:20: %STKUNIT0-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 1 present 00:20:22: %STKUNIT0-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 2 present Going for reboot.
PAGE 1040
www.dell.com | support.dell.com Figure 51-5. Before Adding a Standalone with a Lower MAC Address but Higher Priority to a Stack— -------------------------------STANDALONE BEFORE CONNECTION---------------------------------Standalone#show system brief Stack MAC : 00:01:e8:d5:ef:81 -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Member not present S50V 1 Member not present S50N 2 Management online S50V S50V 7.8.1.
PAGE 1041
Figure 51-6.
PAGE 1042
www.dell.com | support.dell.com Figure 51-7.
PAGE 1043
You may stack any combination of S-Series models that have the same FTOS version. Figure 51-8 shows two common stacking topologies, ring and cascade (also called daisy-chain). A ring topology provides some performance gains and stack integrity. Figure 51-8.
PAGE 1044
www.dell.com | support.dell.com To display the status of the stacking ports, including the topology: Task Command Syntax Command Mode Display the stacking ports. show system stack-ports EXEC Privilege Figure 51-9 shows a daisy-chain topology. Figure 51-10 shows the same stack converted to a ring by connecting stack-port 2/51 to 0/51; you may rearrange the stacking cables without triggering a unit reset, so long as the stack manager is never disconnected from the stack. Figure 51-9.
PAGE 1045
Figure 51-11. A A A Stacking Cable Redundancy B B Stacking Cable Redundancy B Stacking 002 LED Status Indicators on an S-Series Stack The stack unit is displayed in an LED panel on the front of each switch.
PAGE 1046
www.dell.com | support.dell.com To manually assign a new unit a position in the stack: Step Task Command Syntax Command Mode 1 While the unit is unpowered, install stacking modules in the new unit. 2 On the stack, determine the next available stack-unit number, and the management prioritity of the management unit. show system brief show system stack-unit EXEC Privilege 3 Create a virtual unit and assign it the next available stack-unit number.
PAGE 1047
Figure 51-13. Adding a Stack Unit with a Conflicting Stack Number—After ------------------------STANDALONE AFTER CONNECTION---------------------------------00:08:45: %STKUNIT1-M:CP %POLLMGR-2-ALT_STACK_UNIT_STATE: Alternate Stack-unit is present 00:08:45: %STKUNIT1-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 0 present 00:08:47: %STKUNIT1-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 2 present Going for reboot.
PAGE 1048
www.dell.com | support.dell.com Figure 51-15. Adding a Stack Unit with a Conflicting Stack Number—After ------------------------STANDALONE AFTER CONNECTION---------------------------------01:38:34: %STKUNIT0-M:CP %POLLMGR-2-ALT_STACK_UNIT_STATE: Alternate Stack-unit is present 01:38:34: %STKUNIT0-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 1 present 01:38:34: %STKUNIT0-M:CP %CHMGR-5-STACKUNITDETECTED: Stack unit 2 presentGoing for reboot. Reason is Stack merge Going for reboot.
PAGE 1049
Figure 51-16.
PAGE 1050
www.dell.com | support.dell.com Figure 51-17. Removing a Stack Member—After ----------------------------STANDALONE AFTER DISCONNECTION---------------------------------Standalone(stack-member-2)# Going for reboot.
PAGE 1051
Split an S-Series Stack To split a stack, unplug the desired stacking cables.You may do this at any time, whether the stack is powered or unpowered, and the units are online or offline. Each portion of the split stack retains the startup and running configuration of the original stack. For a parent stack that is split into two child stacks, A and B, each with multiple units: • • • • If one of the new stacks receives the primary and the secondary management units, it is unaffected by the split.
PAGE 1052
www.dell.com | support.dell.com Create a Virtual Stack Unit on an S-Series Stack Use virtual stack units to configure ports on the stack before adding a new unit, or to prevent FTOS from assigning a particular stack-number. Task Command Syntax Command Mode Create a virtual stack unit. stack-unit provision CONFIGURATION Display Information about an S-Series Stack Task Command Syntax Command Mode Display for stack-identity, status, and hardware information on every unit in a stack (Figure 51-18).
PAGE 1053
Figure 51-18. Displaying Information about an S-Series Stack—show system Force10#show system Stack MAC : 00:01:e8:d5:f9:6f -- Unit 0 -Unit Type Status Next Boot Required Type Current Type Master priority Hardware Rev Num Ports Up Time FTOS Version Jumbo Capable POE Capable Burned In MAC No Of MACs : : : : : : : : : : : : : : Member Unit online online S50V - 48-port E/FE/GE with POE (SB) S50V - 48-port E/FE/GE with POE (SB) 0 2.0 52 30 min, 7 sec 7.8.1.
PAGE 1054
www.dell.com | support.dell.com Figure 51-19. Displaying Information about an S-Series Stack—show system brief Force10#show system brief Stack MAC : 00:01:e8:d5:f9:6f -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Member online S50V S50V 7.8.1.0 52 1 Management online S50N S50N 7.8.1.0 52 2 Standby online S50V S50V 7.8.1.
PAGE 1055
Influence Management Unit Selection on an S-Series Stack Stack Priority is the system variable that FTOS uses to determine which units in the stack will be the primary and secondary management units. If multiple units tie for highest priority, then the unit with the highest MAC address prevails.
PAGE 1056
www.dell.com | support.dell.com Task Command Syntax Command Mode Reload a stack-unit reset stack-unit 0-7 EXEC Privilege Reload a member unit, from the unit itself reset-self EXEC Privilege Reset a stack-unit when the unit is in a problem state. reset stack-unit 0-7 hard EXEC Privilege Monitor an S-Series Stack with SNMP S-Series supports the following tables in f10-ss-chassis.
PAGE 1057
Figure 51-21. Recovering from a Stack Link Flapping Error --------------------------------------MANAGMENT UNIT----------------------------------------Error: Stack Port 50 has flapped 5 times within 10 seconds.Shutting down this st ack port now. Error: Please check the stack cable/module and power-cycle the stack. 10:55:20: %STKUNIT1-M:CP %KERN-2-INT: Error: Stack Port 50 has flapped 5 times w ithin 10 seconds.Shutting down this stack port now.
PAGE 1058
www.dell.com | support.dell.com Figure 51-23. Recovering from a Card Mismatch State on an S-Series Stack -----------------------------------STANDALONE UNIT BEFORE-----------------------------------Standalone#show system brief Stack MAC : 00:01:e8:d5:ef:81 -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Management online S50V S50V 7.8.1.
PAGE 1059
52 Broadcast Storm Control Broadcast Storm Control is supported on platforms: ces This chapter contains the following configuration topics: • • • Layer 3 Broadcast Storm Control on page 1060 Layer 2 Broadcast Storm Control on page 1061 Multicast Storm Control on page 1061 Storm Control Overview FTOS Storm Control is a preventative measure against unexpectedly high rates of broadcast or multicast packets; these traffic bursts are called storms.
PAGE 1060
www.dell.com | support.dell.com • • • The percentage of storm control is calculated based on the advertised rate of the line card, not by the speed setting of the interface. Do not apply per-VLAN QoS on an interface that has Storm Control enabled either on an interface or globally. On E-Series, bi-directional traffic (unknown-unicast and broadcast) along with egress Storm Control causes the configured traffic rates to be split between the involved ports.
PAGE 1061
Enable Broadcast Storm Control on all Interfaces The result of enabling Storm Control globally varies by platform: • • On the E-Series, enabling Storm Control from CONFIGURATION mode limits ingress and egress broadcast traffic on all interfaces. On the C-Series and S-Series, enabling Storm Control from CONFIGURATION mode limits only ingress broadcast traffic, but still on all interfaces.
PAGE 1062
| Broadcast Storm Control www.dell.com | support.dell.
PAGE 1063
53 Spanning Tree Protocol Spanning Tree Protocol is supported on platforms: ces STP is supported on the E-Series ExaScale platform with FTOS 8.1.1.2 and later. Protocol Overview Spanning Tree Protocol (STP) is a Layer 2 protocol—specified by IEEE 802.1d—that eliminates loops in a bridged topology by enabling only a single path through the network.
PAGE 1064
www.dell.com | support.dell.
PAGE 1065
Configuring Interfaces for Layer 2 Mode All interfaces on all switches that will participate in Spanning Tree must be in Layer 2 mode and enabled. Figure 53-1.
PAGE 1066
www.dell.com | support.dell.com Enabling Spanning Tree Protocol Globally Spanning Tree Protocol must be enabled globally; it is not enabled by default. To enable Spanning Tree globally for all Layer 2 interfaces: Step Task Command Syntax Command Mode 1 Enter the PROTOCOL SPANNING TREE mode. protocol spanning-tree 0 CONFIGURATION 2 Enable Spanning Tree.
PAGE 1067
Figure 53-4. Spanning Tree Enabled Globally root R1 R2 1/3 Forwarding 2/1 1/4 Blocking 2/2 1/1 1/2 3/1 3/2 3/3 3/4 R3 2/3 2/4 Port 290 (GigabitEthernet 2/4) is Blocking Port path cost 4, Port priority 8, Port Identifier 8.290 Designated root has priority 32768, address 0001.e80d.2462 Designated bridge has priority 32768, address 0001.e80d.2462 Designated port id is 8.
PAGE 1068
www.dell.com | support.dell.com Confirm that a port is participating in Spanning Tree using the show spanning-tree 0 brief command from EXEC privilege mode. Figure 53-6. show spanning-tree brief Command Example Force10#show spanning-tree 0 brief Executing IEEE compatible Spanning Tree Protocol Root ID Priority 32768, Address 0001.e80d.2462 We are the root of the spanning tree Root Bridge hello time 2, max age 20, forward delay 15 Bridge ID Priority 32768, Address 0001.e80d.
PAGE 1069
Modifying Global Parameters You can modify Spanning Tree parameters. The root bridge sets the values for forward-delay, hello-time, and max-age and overwrites the values set on other bridges participating in Spanning Tree. Note: Dell Force10 recommends that only experienced network administrators change the Spanning Tree parameters. Poorly planned modification of the Spanning Tree parameters can negatively impact network performance. Table 53-2 displays the default values for Spanning Tree. Table 53-2.
PAGE 1070
www.dell.com | support.dell.com View the current values for global parameters using the show spanning-tree 0 command from EXEC privilege mode. See Figure 53-5. Modifying Interface STP Parameters You can set the port cost and port priority values of interfaces in Layer 2 mode. • • Port cost is a value that is based on the interface type. The greater the port cost, the less likely the port will be selected to be a forwarding port.
PAGE 1071
To enable PortFast on an interface: Task Enable PortFast on an interface. Command Syntax Command Mode spanning-tree stp-id portfast INTERFACE [bpduguard [shutdown-on-violation]] Verify that PortFast is enabled on a port using the show spanning-tree command from the EXEC privilege mode or the show config command from INTERFACE mode; Dell Force10 recommends using the show config command, as shown in Figure 53-7. Figure 53-7.
PAGE 1072
www.dell.com | support.dell.com Figure 53-8 shows a scenario in which an edgeport might unintentionally receive a BPDU. The port on the Dell Force10 system is configured with Portfast. If the switch is connected to the hub, the BPDUs that the switch generates might trigger an undesirable topology change. If BPDU Guard is enabled, when the edge port receives the BPDU, the BPDU will be dropped, the port will be blocked, and a console message will be generated.
PAGE 1073
Figure 53-8. Enabling BPDU Guard Force10(conf-if-gi-3/41)# spanning-tree 0 portfast bpduguard shutdown-on-violation Force10(conf-if-gi-3/41)#show config ! interface GigabitEthernet 3/41 no ip address switchport spanning-tree 0 portfast bpduguard shutdown-on-violation no shutdown 3/41 Hub Switch with Spanning Tree Enabled To verify the Portfast BPDU loop guard configuration on a port or port-channel interface, enter the show command in global configuration mode.
PAGE 1074
www.dell.com | support.dell.com To change the bridge priority or specify that a bridge is the root or secondary root: Task Command Syntax Command Mode Assign a number as the bridge priority or designate it as the root or secondary root. priority-value range: 0 to 65535. The lower the number assigned, the more likely this bridge will become the root bridge. The default is 32768. • The primary option specifies a bridge priority of 8192. • The secondary option specifies a bridge priority of 16384.
PAGE 1075
In STP topology 2 (Figure 53-10 upper right), STP is enabled on device D on which a software bridge application is started to connect to the network. Because the priority of the bridge in device D is lower than the root bridge in Switch A, device D is elected as root, causing the link between Switches A and B to enter a blocking state. Network traffic then begins to flow in the directions indicated by the BPDU arrows in the topology.
PAGE 1076
www.dell.com | support.dell.com Figure 53-10.
PAGE 1077
Root Guard Configuration You enable STP root guard on a per-port or per-port-channel basis. FTOS Behavior: The following conditions apply to a port enabled with STP root guard: • Root guard is supported on any STP-enabled port or port-channel interface except when used as a stacking port.
PAGE 1078
www.dell.com | support.dell.com Configuring Spanning Trees as Hitless Configuring Spanning Trees as Hitless is supported only on platforms: ce You can configure Spanning Tree (STP), Rapid Spanning Tree (RSTP), Multiple Spanning Tree (MSTP), and Per-Vlan Spanning Tree (PVST+) to be hitless (all or none must be configured as hitless). When configured as hitless, critical protocol state information is synchronized between RPMs so that RPM failover is seamless, and no topology change is triggered.
PAGE 1079
As shown in STP topology 3 (Figure 53-12 bottom middle), after you enable loop guard on an STP port or port-channel on Switch C, if no BPDUs are received and the max-age timer expires, the port transitions from a blocked state to a loop-inconsistent state (instead of to a forwarding state). Loop guard blocks the STP port so that no traffic is transmitted and no loop is created. As soon as a BPDU is received on an STP port in a loop-inconsistent state, the port returns to a blocking state.
PAGE 1080
www.dell.com | support.dell.com Figure 53-12.
PAGE 1081
Loop Guard Configuration You enable STP loop guard on a per-port or per-port channel basis. FTOS Behavior: The following conditions apply to a port enabled with loop guard: • Loop guard is supported on any STP-enabled port or port-channel interface.
PAGE 1082
www.dell.com | support.dell.com 1082 Displaying STP Guard Configuration To verify the STP guard configured on port or port-channel interfaces, enter the show spanning-tree 0 guard [interface interface] command. Figure 53-13 shows an example for an STP network (instance 0) in which: • • • Root guard is enabled on a port that is in a root-inconsistent state. Loop guard is enabled on a port that is in a listening state.
PAGE 1083
54 System Time and Date Chapter 54, System Time and Date settings, and Network Time Protocol are supported on platforms: es c Time and Date and NTP are supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. System times and dates can be set and maintained through the Network Time Protocol (NTP). They are also set through FTOS CLIs and hardware settings.
PAGE 1084
www.dell.com | support.dell.com NTP is designed to produce three products: clock offset, roundtrip delay, and dispersion, all of which are relative to a selected reference clock. • • • Clock offset represents the amount to adjust the local clock to bring it into correspondence with the reference clock. Roundtrip delay provides the capability to launch a message to arrive at the reference clock at a specified time. Dispersion represents the maximum error of the local clock relative to the reference clock.
PAGE 1085
Figure 54-1. NTP Fields Source Port (123) Destination Port (123) Length NTP Packet Payload Checksum Range: +32 to -32 Status Leap Indicator Code: 00: No Warning 01: +1 second 10: -1 second 11: reserved Type Precision Est. Error Est.
PAGE 1086
www.dell.com | support.dell.com Enable NTP NTP is disabled by default. To enable it, specify an NTP server to which the Dell Force10 system will synchronize. Enter the command multiple times to specify multiple servers. You may specify an unlimited number of servers at the expense of CPU resources. Task Command Command Mode Specify the NTP server to which the Dell Force10 system will synchronize. You may specify an IPv4 or IPv6 address, or hostname that resolves to an IPv4 or IPv6 address.
PAGE 1087
Set the Hardware Clock with the Time Derived from NTP Task Command Command Mode Periodically update the system hardware clock with the time value derived from NTP. ntp update-calendar CONFIGURATION Figure 54-4.
PAGE 1088
www.dell.com | support.dell.com To disable NTP on an interface, use the following command in the INTERFACE mode: Command Syntax Command Mode Purpose ntp disable INTERFACE Disable NTP on the interface. To view whether NTP is configured on the interface, use the show config command in the INTERFACE mode. If ntp disable is not listed in the show config command output, then NTP is enabled. (The show config command displays only non-default configuration information.
PAGE 1089
Configure NTP authentication NTP authentication and the corresponding trusted key provide a reliable means of exchanging NTP packets with trusted time sources. NTP authentication begins when the first NTP packet is created following the configuration of keys. NTP authentication in FTOS uses the MD5 algorithm and the key is embedded in the synchronization packet that is sent to an NTP time source. FTOS Behavior: FTOS versions 8.2.1.
PAGE 1090
www.dell.com | support.dell.com Command Syntax Command Mode Purpose ntp server ip-address [key keyid] [prefer] [version number] CONFIGURATION Configure an NTP server. Configure the IP address of a server and the following optional parameters: • key keyid: Configure a text string as the key exchanged between the NTP server and client. • prefer: Enter the keyword to set this NTP server as the preferred server. • version number: Enter a number 1 to 3 as the NTP version.
PAGE 1091
• • • • • • • • Root Delay (sys.rootdelay, peer.rootdelay, pkt.rootdelay): This is a signed fixed-point number indicating the total roundtrip delay to the primary reference source at the root of the synchronization subnet, in seconds. Note that this variable can take on both positive and negative values, depending on clock precision and skew. Root Dispersion (sys.rootdispersion, peer.rootdispersion, pkt.
PAGE 1092
www.dell.com | support.dell.com Set the time and date for the switch hardware clock Command Syntax Command Mode Purpose calendar set time month day year EXEC Privilege Set the hardware clock to the current time and date. time: Enter the time in hours:minutes:seconds. For the hour variable, use the 24-hour format, for example, 17:15:00 is 5:15 pm. month: Enter the name of one of the 12 months in English. You can enter the name of a day to change the order of the display to time day month year.
PAGE 1093
The software clock runs only when the software is up. The clock restarts, based on the hardware clock, when the switch reboots. Command Syntax Command Mode Purpose clock set time month day year EXEC Privilege Set the system software clock to the current time and date. time: Enter the time in hours:minutes:seconds. For the hour variable, use the 24-hour format, for example, 17:15:00 is 5:15 pm. month: Enter the name of one of the 12 months in English.
PAGE 1094
www.dell.com | support.dell.com Set the timezone Coordinated Universal Time (UTC) is the time standard based on the International Atomic Time standard, commonly known as Greenwich Mean time. When determining system time, you must include the differentiator between UTC and your local timezone. For example, San Jose, CA is the Pacific Timezone with a UTC offset of -8. Command Syntax Command Mode Purpose clock timezone timezone-name offset CONFIGURATION Set the clock to the appropriate timezone.
PAGE 1095
Set Daylight Saving Time Once Set a date (and time zone) on which to convert the switch to daylight savings time on a one-time basis. Command Syntax Command Mode Purpose clock summer-time time-zone date start-month start-day start-year start-time end-month end-day end-year end-time [offset] CONFIGURATION Set the clock to the appropriate time zone and daylight savings time. time-zone: Enter the three-letter name for the time zone. This name is displayed in the show clock output.
PAGE 1096
www.dell.com | support.dell.com Command Syntax Command Mode Purpose Force10(conf)#clock summer-time pacific date Mar 14 2009 00:00 Nov 7 2009 00:00 Force10(conf)#02:02:13: %RPM0-P:CP %CLOCK-6-TIME CHANGE: Summertime configuration changed from "none" to "Summer time starts 00:00:00 Pacific Sat Mar 14 2009;Summer time ends 00:00:00 pacific Sat Nov 7 2009" Set Recurring Daylight Saving Time Set a date (and time zone) on which to convert the switch to daylight savings time on a specific day every year.
PAGE 1097
Command Syntax Command Mode Purpose start-year: Enter a four-digit number as the year. Range: 1993 to 2035 start-time: Enter the time in hours:minutes. For the hour variable, use the 24-hour format, example, 17:15 is 5:15 pm. end-week: If you entered a start-week, Enter the one of the following as the week that daylight savings ends: • • • week-number: enter a number from 1-4 as the number of the week to end daylight savings time.
PAGE 1098
www.dell.com | support.dell.
PAGE 1099
55 Uplink Failure Detection (UFD) Uplink Failure Detection (UFD) is supported on platform: s (S50 only) Feature Description Uplink Failure Detection (UFD) provides detection of the loss of upstream connectivity and, if used with NIC teaming, automatic recovery from a failed link. A switch provides upstream connectivity for devices, such as servers. If a switch loses its upstream connectivity, downstream devices also lose their connectivity.
PAGE 1100
www.dell.com | support.dell.com Figure 55-1. Uplink Failure Detection R1 R1 R1 X (A) S1 (B) S2 Server X S1 (C) S2 Server S1 X S2 Server How Uplink Failure Detection Works UFD creates an association between upstream and downstream interfaces. The association of uplink and downlink interfaces is called an uplink-state group. An interface in an uplink-state group can be a physical interface or a port-channel (LAG) aggregation of physical interfaces.
PAGE 1101
Figure 55-2. Uplink Failure Detection Example Core Network Layer 3 Network When an upstream port-channel link goes down ... UFD brings down a downstream link in the same uplinkstate group ... X X Primary links: Backup links: Uplink-state groups: Server traffic is diverted over a backup link to upstream devices. If only one of the upstream interfaces in an uplink-state group goes down, a specified number of downstream ports associated with the upstream interface are put into a link-down state.
PAGE 1102
www.dell.com | support.dell.com Important Points to Remember When you configure Uplink Failure Detection, the following conditions apply: • You can configure up to sixteen uplink-state groups. By default, no uplink-state groups are created. An uplink-state group is considered to be operationally up if it has at least one upstream interface in the link-up state. An uplink-state group is considered to be operationally down if it has no upstream interfaces in the link-up state.
PAGE 1103
Configuring Uplink Failure Detection To configure Uplink Failure Detection, follow these steps: Step 1 Command Syntax and Mode Description uplink-state-group group-id Creates an uplink-state group and enabling the tracking of upstream links on the switch/router. Valid group-id values are 1 to 16. To delete an uplink-state group, enter the no uplink-state-group group-id command.
PAGE 1104
www.dell.com | support.dell.com Step 5 Command Syntax and Mode Description description text (Optional) Enters a text description of the uplink-state group. Maximum length: 80 alphanumeric characters. Command Mode: UPLINK-STATE-GROUP 6 no enable Command Mode: UPLINK-STATE-GROUP (Optional) Disables upstream-link tracking without deleting the uplink-state group. Default: Upstream-link tracking is automatically enabled in an uplink-state group.
PAGE 1105
Message 1 shows the Syslog messages displayed when you clear the UFD-disabled state from all disabled downstream interfaces in an uplink-state group by entering the clear ufd-disable uplink-state-group group-id command. All downstream interfaces return to an operationally up state.
PAGE 1106
www.dell.com | support.dell.com 1106 Displaying Uplink Failure Detection To display information on the Uplink Failure Detection feature, enter any of the following show commands: | Show Command Syntax Description show uplink-state-group [group-id] [detail] Command Mode: EXEC Displays status information on a specified uplink-state group or all groups. Valid group-id values are 1 to 16.
PAGE 1107
Figure 55-3.
PAGE 1108
www.dell.com | support.dell.com Figure 55-4.
PAGE 1109
Sample Configuration: Uplink Failure Detection Figure 55-7 shows a sample configuration of Uplink Failure Detection on a switch/router in which you: • • • • • • Configure uplink-state group 3. Add downstream links Gigabitethernet 0/1, 0/2, 0/5, 0/9, 0/11, and 0/12. Configure two downstream links to be disabled if an upstream link fails. Add upstream links Gigabitethernet 0/3 and 0/4. Add a text description for the group. Verify the configuration with various show commands. Figure 55-7.
PAGE 1110
www.dell.com | support.dell.
PAGE 1111
56 Upgrade Procedures Find the upgrade procedures Go to the FTOS Release Notes for your system type to see all the requirements to upgrade to the desired FTOS version. Follow the procedures in the FTOS Release Notes for the software version you wish to upgrade to. Get Help with upgrades Direct any questions or concerns about FTOS Upgrade Procedures to Dell Force10 Technical Support Center. You can reach Technical Support: • • • On the Web: www.force10networks.
PAGE 1112
| Upgrade Procedures www.dell.com | support.dell.
PAGE 1113
57 VLAN VLANs are supported on platforms: ces This chapter contains the following configuration topics: • • • • • • • Create a VLAN on page 1117 Assign Interfaces to VLANs on page 1118 Enable Routing between VLANs on page 1119 Use a Native VLAN on Trunk Ports on page 1120 Change the Default VLAN ID on page 1121 Set the Null VLAN as the Default VLAN on page 1121 Enable VLAN Interface Counters on page 1122 Virtual LAN Overview A Local Area Network (LAN) is a collection of devices in the same broadcast dom
PAGE 1114
www.dell.com | support.dell.com Virtual LANs (VLANs) are a cost-effective method of segmenting and organizing a network. A single switch can be divided into multiple broadcast domains so that devices can be grouped and isolated; each logical segment is virtual LAN. Applying VLANs reduces broadcast traffic, introduces flexibility in the placement of devices on the network, and increases network security by allowing separate policies to be applied to each group.
PAGE 1115
VLAN Tagging Since a port may belong to more than one VLAN, the switch must be able to identify the VLAN two which a broadcast frame belongs. For this case, IEEE 802.1Q defines a method of marking frames to indicate the VLAN on which the frame originated. The marker, called a VLAN tag, is 4 bytes and is inserted after the source MAC in the Ethernet frame header, as shown in Figure 57-2.
PAGE 1116
www.dell.com | support.dell.com Figure 57-4. Switch Behavior for Tagged/Untagged Port Mismatch ports on either side of the link are untagged so traffic is forwarded but on the default VLAN tagged tagged tagged untagged untagged X (no config) X untagged tagged untagged (no config) ports on either side of the link are untagged so traffic is forwarded but on the default VLAN Default VLAN The Default VLAN and is part of the system startup configuration, and is by default VLAN 1.
PAGE 1117
• • Set the Null VLAN as the Default VLAN on page 1121 Enable VLAN Interface Counters on page 1122 Related Protocols and Topics The following protocols and topics are premised on VLANs, and contain more information about the utility of VLANs: • • • • 802.1X Chapter 18, GARP VLAN Registration Protocol. Chapter 47, Service Provider Bridging Chapter 41, Per-VLAN Spanning Tree Plus. Create a VLAN A VLAN is created when you assign it a VLAN ID. Task Command Syntax Command Mode Create a VLAN.
PAGE 1118
www.dell.com | support.dell.com Assign Interfaces to VLANs A port may either be an untagged member of a single VLAN, or a tagged member of perhaps multiple VLANs. • • Untagged Ports — ports that do not append an 802.1Q VLAN tag to frames on egress, and do not accept tagged frames on ingress (tagged frames are dropped). Untagged ports must be connected to VLAN-unaware devices. Tagged Ports — ports that append an 802.
PAGE 1119
Step Task Command Syntax Command Mode Force10#show vlan Codes: * - Default VLAN, G - GVRP VLANs * NUM 1 2 Status Inactive Active Q Ports T Po1(So 0/0-1) T Gi 3/0 3 Active T Po1(So 0/0-1) T Gi 3/1 4 Active T Po1(So 0/0-1) Force10(conf)#int vlan 4 Force10(conf-if-vlan)#untagged gi 3/2 Force10(conf-if-vlan)#show config ! interface Vlan 4 no ip address untagged GigabitEthernet 3/2 Force10#show vlan Codes: * - Default VLAN, G - GVRP VLANs * NUM 1 2 Status Inactive Active 3 Active 4 Active Q Port
PAGE 1120
www.dell.com | support.dell.com Figure 57-5. Communicating between VLANs VLAN 100 10.11.100.1/24 VLAN 200 10.11.200.1/24 Task Command Syntax Command Mode Assign an IP address to a VLAN interface. ip address address/mask INTERFACE VLAN Use a Native VLAN on Trunk Ports Traditionally, a port may either be an untagged member of a single VLAN or a tagged member of multiple VLANs. However, FTOS allows you to make a port an untagged member and a tagged member of VLANs, concurrently.
PAGE 1121
To configure a port so that it has a native VLAN: Step 1 Task Command Remove any Layer 2 or Layer 3 configurations from the interface. Command Mode INTERFACE If the port has any configurations on it when you enter the command portmode hybrid, FTOS rejects the configuration, citing the following message: % Error: Port is in Layer-2 mode . 2 Configure the interface for hybrid mode. portmode hybrid INTERFACE 3 Configure the interface for switchport mode.
PAGE 1122
www.dell.com | support.dell.com 1122 Enable VLAN Interface Counters Use a Native VLAN on Trunk Ports is available only on platform: ex Note: VLAN egress counters might be higher than expected because source-suppression drops are counted. | Task Command Syntax Command Mode Configure ingress, egress or both counters for VLAN interfaces.
PAGE 1123
58 Virtual Routing and Forwarding (VRF) Virtual Routing and Forwarding (VRF) (VRF) is supported only on platform: e VRF allows a physical router to partition itself into multiple Virtual Routers (VRs). The control and data plane are isolated in each VR so that traffic does NOT flow across VRs.Virtual Routing and Forwarding (VRF) allows multiple instances of a routing table to co-exist within the same router at the same time.
PAGE 1124
www.dell.com | support.dell.com Figure 58-1. VRF Network Example Edge Routers Customer Edge Routers Customer Edge Routers Provider Edge Routers Network without VRF Provider Edge Router with VRF Customer Edge Routers Provider Edge Router with VRF Customer Edge Routers Network with VRF VRF Configuration Notes On E-Series routers, Dell Force10 VRF supports up to 15 VRF instances: 1 to 14 and the default VRF (0).
PAGE 1125
Only Layer 3 interfaces can belong to a VRF. VRF is supported on following types of interface: • • • • • physical Ethernet interfaces physical Sonet interfaces port-channel interfaces (static & dynamic using LACP) VLAN interfaces loopback interfaces VRF supports route redistribution between routing protocols (including static routes) only when the routes are within the same VRF. FTOS uses both the VRF name and VRF ID to manage VRF instances.
PAGE 1126
www.dell.com | support.dell.com Table 58-1. Feature/Capability Supported? Note Layer 3 (IPv4/IPv6) ACLs, TraceLists, PBR, QoS on physical interfaces and LAGs ACLs supported on all VRF ports. TraceLists are common for entire line card (except on ExaScale). PBR supported on default-VRF only. QoS supported on all VRF ports. IPv4 ARP and IPv6 Neighbor Discovery Yes ARP is VRF-aware. IPv6 is supported only for default-VRF.
PAGE 1127
• On an E-Series Exascale platform, use the cam-profile command to set the CAM size. Then select and enable VRF microcode for use with the VRF CAM-profile template, and reload the system to activate the profile. You can set the CAM size to 40M (default) which supports both IPv4 and IPv6 or 10M which supports only IPv4. Note: Any physical (port or port channel) or VLAN interface assigned to a VRF uses two CAM entries instead of one for each route and host entry.
PAGE 1128
www.dell.com | support.dell.com Table 58-3. IPv4-v6-VRF CAM Profiles (Single CAM card) CAM Profile Table Allocation (K) EgIPv4ACL 11K Reserved 2K IPv6FIB 18K IPv6ACL 4K IPv6Flow 3K EgIPv6ACL 1K DHCP DHCP requests are not forwarded across VRF instances. The DHCP client and server must be on the same VRF instance. IP addressing Starting in release 8.4.1.0, you can configure identical or overlapping IP subnets on different interfaces if each interface belongs to a different VRF instance.
PAGE 1129
Load the VRF CAM Profile On an E-series Terascale platform, select the IPv4 or IPv6 CAM profile used to support VRF and reload the system to activate the profile. Step Task Command Syntax Command Mode 1 Select the appropriate CAM profile for your system. cam-profile [ipv4-vrf microcode ipv4-vrf | ipv4-v6-vrf microcode ipv4-v6-vrf] default-vrf | vrf-name CONFIGURATION 2 Reload the system to implement the new CAM profile.
PAGE 1130
www.dell.com | support.dell.com Task Command Syntax Command Mode Create a non-default VRF instance by specifying a name and VRF ID number, and enter VRF configuration mode. The default VRF 0 is automatically configured when a router with VRF loaded in CAM boots up. ip vrf vrf-name vrf-id CONFIGURATION VRF ID range: 1 to 14 and 0 (default VRF) Note: Starting in FTOS 8.4.2.
PAGE 1131
View VRF instance information To display information about VRF configuration, enter the show ip vrf command. Task Command Syntax Command Mode Display the interfaces assigned to a VRF instance. To display information on all VRF instances (including the default VRF 0), do not enter a value for vrf-name.
PAGE 1132
www.dell.com | support.dell.com Connect an OSPF process to a VRF instance OSPF routes are supported on all VRF instances. Refer to Chapter 33, Open Shortest Path First (OSPFv2 and OSPFv3) for complete OSPF configuration information. Assign an OSPF process to a VRF instance . Return to CONFIGURATION mode to enable the OSPF process. The OSPF Process ID is the identifying number assigned to the OSPF process, and the Router ID is the IP address associated with the OSPF process..
PAGE 1133
Figure 58-2. Set up OSPF and static routes cam-profile ipv4-vrf microcode ipv4-vrf ip vrf default-vrf 0 ip vrf blue 1 ip vrf orange 2 ip vrf green 3 7/0 9/18 7/1 7/2 3/0 R1 router ospf 1 vrf blue router-id 1.0.0.1 network 1.0.0.0/24 area 0 network 10.0.0.0/24 area 0 router ospf 2 vrf orange router-id 2.0.0.1 network 2.0.0.0/24 area 0 network 20.0.0.0/24 area 0 ip route vrf green 31.0.0.0/24 3.0.0.2 3/0 R2 9/19 9/20 router ospf 1 vrf blue router-id 1.0.0.2 network 11.0.0.0/24 area 0 network 1.0.0.
PAGE 1134
www.dell.com | support.dell.com Figure 58-3. Set up VRF interfaces interface GigabitEthernet 9/18 ip vrf forwarding blue ip address 11.0.0.1/24 no shutdown interface GigabitEthernet 7/0 ip vrf forwarding blue ip address 10.0.0.1/24 no shutdown interface GigabitEthernet 9/19 ip vrf forwarding orange ip address 21.0.0.1/24 no shutdown interface GigabitEthernet 7/1 ip vrf forwarding orange ip address 20.0.0.1/24 no shutdown interface GigabitEthernet 9/20 ip vrf forwarding green ip address 31.0.0.
PAGE 1135
The following example relates to the configuration shown in Figure 58-2 and Figure 58-3. ROUTER 1 cam-profile ipv4-vrf microcode ipv4-vrf ! ip vrf default-vrf 0 ! ip vrf blue 1 ! ip vrf orange 2 ! ip vrf green 3 ! interface TenGigabitEthernet 3/0 no ip address switchport no shutdown ! interface GigabitEthernet 7/0 ip vrf forwarding blue ip address 10.0.0.1/24 no shutdown ! interface GigabitEthernet 7/1 ip vrf forwarding orange ip address 20.0.0.
PAGE 1136
www.dell.com | support.dell.com ROUTER 1 continued router ospf 1 vrf blue router-id 1.0.0.1 network 1.0.0.0/24 area 0 network 10.0.0.0/24 area 0 ! router ospf 2 vrf orange router-id 2.0.0.1 network 2.0.0.0/24 area 0 network 20.0.0.0/24 area 0 ! ip route vrf green 31.0.0.0/24 3.0.0.
PAGE 1137
ROUTER 2 continued interface Vlan 192 ip vrf forwarding orange ip address 2.0.0.2/24 tagged TenGigabitEthernet 3/0 no shutdown ! interface Vlan 256 ip vrf forwarding green ip address 3.0.0.2/24 tagged TenGigabitEthernet 3/0 no shutdown ! router ospf 1 vrf blue router-id 1.0.0.2 network 11.0.0.0/24 area 0 network 1.0.0.0/24 area 0 passive-interface GigabitEthernet 9/18 ! router ospf 2 vrf orange router-id 2.0.0.2 network 21.0.0.0/24 area 0 network 2.0.0.
PAGE 1138
www.dell.com | support.dell.com . ROUTER 1 continued Force10#show ip ospf 1 neighbor Neighbor ID Pri State 1.0.0.2 1 FULL/DR Force10#sh ip ospf 2 neighbor Neighbor ID Pri State 2.0.0.2 1 FULL/DR Force10#show ip route vrf blue Dead Time Address 00:00:32 1.0.0.2 Interface Area Vl 128 0 Dead Time Address 00:00:37 2.0.0.
PAGE 1139
The following shows the output of the show commands on Router 2. ROUTER 2 Force10#show ip vrf VRF-Name VRF-ID Interfaces default-vrf 0 blue 1 orange Gi Te Gi Gi Gi Gi Gi Gi Gi Ma Ma Nu Vl Gi Vl 2 1/0-89, 3/0-3, 4/0-89, 5/0-89, 6/0-89, 9/0-17,21-47, 11/0-47, 12/0-47, 13/0-47, 0/0, 1/0, 0, 1 9/18, 128 Gi 9/19, Vl 192 Gi 9/20, Vl 256 green 3 Force10#show ip ospf 1 neighbor Neighbor ID Pri State 1.0.0.1 1 FULL/BDR ! Force10#sh ip ospf 2 neighbor Neighbor ID Pri State 2.0.0.
PAGE 1140
www.dell.com | support.dell.
PAGE 1141
59 Virtual Router Redundancy Protocol (VRRP) IPv4 Virtual Router Redundancy Protocol (VRRP) is available on platforms: IPv6 VRRP (VRRP version 3) is available on platforms: ces ces This chapter covers the following information: • • • • • VRRP Overview VRRP Benefits VRRP Implementation VRRP Configuration Sample Configurations Virtual Router Redundancy Protocol (VRRP) is designed to eliminate a single point of failure in a statically routed network.
PAGE 1142
www.dell.com | support.dell.com Figure 59-1 shows a typical network configuration using VRRP. Instead of configuring the hosts on the network 10.10.10.0 with the IP address of either Router A or Router B as their default router; their default router is the IP Address configured on the virtual router. When any host on the LAN segment wants to access the Internet, it sends packets to the IP address of the virtual router. In Figure 59-1 below, Router A is configured as the MASTER router.
PAGE 1143
VRRP Benefits With VRRP configured on a network, end-station connectivity to the network is not subject to a single point-of-failure. End-station connections to the network are redundant and they are not dependent on IGP protocols to converge or update routing tables.
PAGE 1144
www.dell.com | support.dell.com Table 59-1. Recommended VRRP Advertise Intervals Recommended Advertise Interval Groups/Interface Total VRRP Groups E-Series C-Series S-Series E-Series ExaScale E-Series TeraScale C-Series S-Series Between 1000 and 1200 7 seconds 7 seconds 7 seconds 512 255 100 100 Between 1200 and 1500 8 seconds 8 seconds 8 seconds 512 255 120 120 Note: 1500 VRRP groups are supported in FTOS Release 6.3.1.0 and later.
PAGE 1145
VRRP Configuration By default, VRRP is not configured.
PAGE 1146
www.dell.com | support.dell.com Figure 59-3. Command Example Display: show config for the Interface Force10(conf-if-gi-1/1)#show conf ! interface GigabitEthernet 1/1 ip address 10.10.10.1/24 ! vrrp-group 111 no shutdown Force10(conf-if-gi-1/1)# Note that the interface has an IP Address and is enabled Assign Virtual IP addresses Virtual routers contain virtual IP addresses configured for that VRRP Group (VRID).
PAGE 1147
• • If the virtual IP address and the interface’s primary/secondary IP address are the same, the priority on that VRRP group is automatically set to 255. The interface then becomes the MASTER/OWNER router of the VRRP group and the interface’s physical MAC address is changed to that of the owner VRRP group’s MAC address. (You can also configure a priority for the group even if the group is owned.
PAGE 1148
www.dell.com | support.dell.com Figure 59-6 shows the same VRRP group configured on multiple interfaces on different subnets. Note: show vrrp displays all of the active IPv4 groups, and show ipv6 vrrp displays all of the active IPv6 groups. Figure 59-6. Command Example Display: show vrrp Same VRRP Group (VRID) Force10#do show vrrp -----------------GigabitEthernet 1/1, VRID: 111, Net: 10.10.10.1 State: Master, Priority: 255, Master: 10.10.10.
PAGE 1149
Set VRRP Group (Virtual Router) Priority Setting a Virtual Router priority to 255 ensures that router is the “owner” virtual router for the VRRP group. VRRP elects the MASTER router by choosing the router with the highest priority. The default priority for a Virtual Router is 100. The higher the number, the higher the priority. If the MASTER router fails, VRRP begins the election process to choose a new MASTER router based on the next-highest priority.
PAGE 1150
www.dell.com | support.dell.com Configure VRRP Authentication Note: Authentication is not available for IPv6 VRRP. Simple authentication of VRRP packets ensures that only trusted routers participate in VRRP processes. When authentication is enabled, FTOS includes the password in its VRRP transmission, and the receiving router uses that password to verify the transmission.
PAGE 1151
Disable Preempt The preempt command is enabled by default, and it forces the system to change the MASTER router if another router with a higher priority comes online. Prevent the BACKUP router with the higher priority from becoming the MASTER router by disabling preempt. Note: All virtual routers in the VRRP group must be configured the same: all configured with preempt enabled or configured with preempt disabled.
PAGE 1152
www.dell.com | support.dell.com Change the Advertisement interval By default, the MASTER router transmits a VRRP advertisement to all members of the VRRP group every 1 second, indicating it is operational and is the MASTER router. If the VRRP group misses 3 consecutive advertisements, then the election process begins and the BACKUP virtual router with the highest priority transitions to MASTER.
PAGE 1153
Track an Interface or Object In previous releases, you could set FTOS to track the state of an interface for a specified virtual group. Starting in release 8.4.1.0, you can track additional objects for a virtual group, such as Layer 3 interfaces (IPv4 and IPv6), IPv4/IPv6 route reachability, and thresholds of IPv4/IPv6 route metrics. For information on how to track supported objects, refer to Chapter 32, “Object Tracking,” on page 693.
PAGE 1154
www.dell.com | support.dell.com To track an interface or configured object for a virtual group, use the track command in the VRRP mode: Task Command Syntax Command Mode Monitor an interface or a configured object and, optionally, reconfigure the cost value to be subtracted from the VRRP group priority if the status of the tracked object goes DOWN. track {interface | object-id} [priority-cost cost] Valid object IDs are from 1 to 65535. Cost range: 1-254.
PAGE 1155
Figure 59-16.
PAGE 1156
www.dell.com | support.dell.com VRRP on a VRF Interface VRRP is supported with Virtual Routing and Forwarding (VRF) only on platform: e Starting in release 8.4.1.0, you can configure the VRRP feature on interfaces that belong to a non-default Virtual Routing and Forwarding (VRF) instance on E-Series routers. In previous releases, the VRRP feature was not supported on interfaces that were configured for VRF. For a sample VRRP configuration on a VRF interface, see VRRP in VRF Configuration on page 1163.
PAGE 1157
Note: On E-Series routers, the VRID used by the VRRP protocol changes according to whether VRF microcode is loaded or not: • When VRF microcode is not loaded in CAM, the VRID for a VRRP group is the same as the VRID number configured with the vrrp-group or vrrp-ipv6-group command: Figure 59-19. VRID used when VRF microcode is not loaded Force10(conf)#interface GigabitEthernet 3/0e Force10(conf-if-gi-3/0)#ip address 1.1.1.
PAGE 1158
www.dell.com | support.dell.com Sample Configurations VRRP for IPv4 Configuration The configuration in Figure 59-21 shows how to enable IPv4 VRRP. This example does not contain comprehensive directions and is intended to provide guidance for only a typical VRRP configuration. You can copy and paste from the example to your CLI. Be sure you make the necessary changes to support your own IP addresses, interfaces, names, etc.
PAGE 1159
Figure 59-22. Configure VRRP for IPv4 Router 2 R2(conf)#int gi 2/31 R2(conf-if-gi-2/31)#ip address 10.1.1.1/24 R2(conf-if-gi-2/31)#vrrp-group 99 R2(conf-if-gi-2/31-vrid-99)#priority 200 R2(conf-if-gi-2/31-vrid-99)#virtual 10.1.1.3 R2(conf-if-gi-2/31-vrid-99)#no shut R2(conf-if-gi-2/31)#show conf ! interface GigabitEthernet 2/31 ip address 10.1.1.1/24 ! vrrp-group 99 priority 200 virtual-address 10.1.1.
PAGE 1160
www.dell.com | support.dell.com VRRP for IPv6 Configuration 1160 Figure 59-22 shows an example of a VRRP for IPv6 configuration in which the IPv6 VRRP group consists of two routers. This example does not contain comprehensive directions and is intended to provide guidance for only a typical VRRP configuration. You can copy and paste from the example to your CLI. Be sure you make the necessary changes to support your own IP addresses, interfaces, names, etc.
PAGE 1161
Figure 59-23. VRRP for IPv6 Topology Master State: Although both R2 and R3 have the same priority (100), R2 is the master in the VRRP group because the R2 interface has a higher IPv6 address.
PAGE 1162
www.dell.com | support.dell.com Figure 59-24.
PAGE 1163
VRRP in VRF Configuration The example in this section shows how to enable VRRP operation in a VRF virtualized network for the following scenarios: • • Multiple VRFs on physical interfaces running VRRP Multiple VRFs on VLAN interfaces running VRRP To view a VRRP in VRF configuration, use the show commands described in Displaying a VRRP in VRF Configuration on page 1168. Non-VLAN Scenario Figure 59-25. VRRP in VRF: Non-VLAN Example Switch-1 VRID 11 Node IP 10.10.1.5 Virtual IP 10.10.1.
PAGE 1164
www.dell.com | support.dell.com Both Switch-1 and Switch-2 have three VRF instances defined: VRF-1, VRF-2, and VRF-3. Each VRF has a separate physical interface to a LAN switch and an upstream VPN interface to connect to the Internet. Both Switch-1 and Switch-2 use VRRP groups on each VRF instance in order that there is one master and one backup router for each VRF. In VRF-1 and VRF-2, Switch-2 serves as owner-master of the VRRP group and Switch-1 serves as the backup.
PAGE 1165
Figure 59-27. VRRP in VRF: Switch-2 Non-VLAN Configuration Switch-2 S2(conf)#ip vrf default-vrf 0 ! S2(conf)#ip vrf VRF-1 1 ! S2(conf)#ip vrf VRF-2 2 ! S2(conf)#ip vrf VRF-3 3 ! S2(conf)#interface GigabitEthernet 12/1 S2(conf-if-gi-12/1)#ip vrf forwarding VRF-1 S2(conf-if-gi-12/1)#ip address 10.10.1.2/24 S2(conf-if-gi-12/1)#vrrp-group 11 % Info: The VRID used by the VRRP group 11 in VRF 1 will be 177. S2(conf-if-gi-12/1-vrid-101)#priority 255 S2(conf-if-gi-12/1-vrid-101)#virtual-address 10.10.1.
PAGE 1166
www.dell.com | support.dell.com Figure 59-28. 1166 VRRP in VRF: Switch-1 VLAN Configuration Switch-1 S1(conf)#ip vrf VRF-1 1 ! S1(conf)#ip vrf VRF-2 2 ! S1(conf)#ip vrf VRF-3 3 ! S1(conf)#interface GigabitEthernet 12/4 S1(conf-if-gi-12/4)#no ip address S1(conf-if-gi-12/4)#switchport S1(conf-if-gi-12/4)#no shutdown ! S1(conf-if-gi-12/4)#interface vlan 100 S1(conf-if-vl-100)#ip vrf forwarding VRF-1 S1(conf-if-vl-100)#ip address 10.10.1.
PAGE 1167
Figure 59-29. VRRP in VRF: Switch-2 VLAN Configuration Switch-2 S2(conf)#ip vrf VRF-1 1 ! S2(conf)#ip vrf VRF-2 2 ! S2(conf)#ip vrf VRF-3 3 ! S2(conf)#interface GigabitEthernet 12/4 S2(conf-if-gi-12/4)#no ip address S2(conf-if-gi-12/4)#switchport S2(conf-if-gi-12/4)#no shutdown ! S2(conf-if-gi-12/4)#interface vlan 100 S2(conf-if-vl-100)#ip vrf forwarding VRF-1 S2(conf-if-vl-100)#ip address 10.10.1.
PAGE 1168
www.dell.com | support.dell.com Displaying a VRRP in VRF Configuration To display information on a VRRP group that is configured on an interface that belongs to a VRF instance, enter the show running-config track [interface interface] command: Figure 59-30. Command Example: show running-config track interface Force10#show running-config interface gigabitethernet 13/4 interface GigabitEthernet 13/4 ip vrf forwarding red ip address 192.168.0.1/24 vrrp-group 4 virtual-address 192.168.0.
PAGE 1169
60 FTOS XML Feature FTOS XML Feature is supported on platforms: ce This chapter describes the FTOS XML Feature in the following major sections: • • • • • • • XML Functionality on page 1169 The Form of XML Requests and Responses on page 1170 The Configuration Request and Response on page 1171 The “Show” Request and Response on page 1172 Configuration Task List on page 1172 XML Error Conditions and Reporting on page 1176 Using display xml as a Pipe Option on page 1179 XML Functionality Through SSH/Telnet
PAGE 1170
www.dell.com | support.dell.com — show linecard slot ID — show linecard all — show sfm slot ID — show logging 1-65535 — — — — show logging reverse show sfm show sfm all show version — show running-config—Only the full report is supported, no options.
PAGE 1171
This tag tells the CLI to invoke the EXEC PRIVILEGE mode. These requests encapsulate “show” commands. Response Format Similarly, every response from FTOS begins with the XML declaration, followed by a “Response” tag: :: :: What goes between the Response tags depends on the type of response, as discussed next.
PAGE 1172
www.dell.com | support.dell.com The “Show” Request and Response To generate an XML request that encapsulates a “show” command (to request a report), you use the tag instead of the tag as the Operation type. The schema of a show request allows only one , as shown here for the show linecard command. (Note that “show line all” demonstrates that you can use both an abbreviated form of the command and options, just as in the standard CLI):
PAGE 1173
Run an FTOS XML session Use the following procedure to start, run, and close an FTOS XML session: Step Command Syntax Command Mode Purpose terminal xml EXEC Privilege Invoke XML interface in Telnet and SSH client sessions. 2 [Construct input to the CLI by following the XML request schema, as described in The Form of XML Requests and Responses on page 1170.] FTOS XML Cut and paste your XML request from a text editor or other type of XML presentation tool, or type your XML request line by line.
PAGE 1174
www.dell.com | support.dell.com Figure 60-2. Example of a Successful XML Session Force10# terminal xml Force10(xml)# Enter XML request with CTRL-Y or empty line Clear XML request with CTRL-C Exit XML mode with CTRL-Z: ip access standard test1
PAGE 1175
Configure a standard ACL To configure a standard ACL with XML, first enter FTOS XML mode, and then construct a configuration request, as described above. An example of a complete standard ACL configuration request message is: ip access list standard ToOspf seq 5 deny any seq 10 deny 10.2.0.0 /16 seq 15 deny 10.3.0.
PAGE 1176
www.dell.com | support.dell.com Create an egress ACL and apply rules to the ACL To create an egress ACL and apply rules to the ACL in one single XML request, first enter FTOS XML mode, and then construct the configuration request (see Run an FTOS XML session on page 1173). The following example shows a configuration request message that accomplishes this task:
PAGE 1177
• • • — Invalid CLI commands or keywords — Invalid range of data specified in the CLI command XML_SCHEMA_ERROR—This error is caused by: — Invalid XML method or operation tags — Invalid object hierarchy or value out of range APPLICATION_ERROR—This error is caused by a failure to process the request, or a problem on the FTOS task. NO_ERROR—The XML request processed successfully.
PAGE 1178
www.dell.com | support.dell.com XML schema error This following XML request has transposed the and tag sets: ip access standard test2 The XML response to that malformed request is:
PAGE 1179
The second command in this XML request also makes an invalid request: ip access standard test1 no permit host 2.2.3.4 log count bytes The error response contains a of “APPLICATION_ERROR”, of “APPLICATION_ERROR” and a of “% Error: Access-list entry does not exist.
PAGE 1180
www.dell.com | support.dell.com Figure 60-3. 1180 Example: show linecard 0 | display xml Force10>#show linecard 0 | display xml 0 online online EXW2PF3 - 2-port 10GE LAN/WAN PHY line card with XFP optics (EF3) EXW2PF3 - 2-port 10GE LAN/WAN PHY line card with XFP optics (EF3) 1.
PAGE 1181
61 C-Series Debugging and Diagnostics In addition to standard manageability features such as LEDs, SNMP alarms and traps, and Syslogging, the C-Series supports several diagnostic and debugging features that are crucial to isolating and resolving support issues during the operations and maintenance phase.
PAGE 1182
www.dell.com | support.dell.com Switch Fabric overview The switch fabric is formed through the installed RPMs and line cards via C-Series Switch Fabric (CSF) ASICs. Each RPM includes four CSFs, each of which provides eight Backplane Data (BDP) links, one link for each line card slot. In total, an RPM provides 32 BDP links of forwarding capacity. Each line card includes two CSFs.
PAGE 1183
FTOS Switch Agent (SWAGT) monitors the IDP and BDP links on the line cards. FTOS Link Monitoring task continually polls the status of the IDP and BDP links. If it finds an open link, the system brings down the link and reports the condition via a message similar to the one shown in Message 1.
PAGE 1184
www.dell.com | support.dell.com Figure 61-3. show sfm Command Example Force10#show sfm Switch Fabric State: up -- SFM 0 -Status : active Module Type : SFM - Switch Fabric Module Up Time : 1 day, 6 hr, 0 min -- SFM 1 -Status : not present Use the FTOS Syslogging feature to monitor the overall status of the switch fabric. Changes in switch fabric status are reported via messages similar those in Message 2.
PAGE 1185
Table 61-2. Poll Manager Syslog Message Description Message Description POLLMGR-2-POLLMGR_RP M_ECC_ERR_DETECT Indicates that the system detected a single-bit ECC memory error in the RPM CPU memory (SDRAM). The system tracks the number of multi-bit errors and resets the system after a certain number of such errors are recorded. Upon reset, the system writes a failure trace file to the TRACE_LOG directory for analysis by Dell Force10.
PAGE 1186
www.dell.com | support.dell.com Inter-CPU timeouts The CP monitors the health status of the other processors using heartbeat messaging exchange. FTOS automatically saves critical information about the IPC failure to NVRAM. Such information includes: • • • • Status counters on the internal Ethernet interface Traffic profile of the inter-CPU bus Kernel drops High CPU exception conditions Upon the next boot, this information is uploaded to a file in the CRASH_LOG directory.
PAGE 1187
FTOS actually saves up to three persistent files depending upon the type of failure.
PAGE 1188
www.dell.com | support.dell.com Figure 61-5. show environment rpm Command Example Force10#show environment rpm -- RPM Environment Status -Slot Status Temp Voltage -------------------------------------0 active 33C ok 1 not present Recognize an overtemperature condition An overtemperature condition occurs, for one of two reasons: • • The card genuinely is too hot. A sensor has malfunctioned. Inspect cards adjacent to the one reporting the condition to discover the cause.
PAGE 1189
2. Check air flow through the system. On the C-Series, air flows sideways from right to left. Ensure the air ducts are clean and that all fans are working correctly. 3. Once the software has determined that the temperature levels are within normal limits, the card can be re-powered safely. Use the power-on command in EXEC mode to bring the line card back online. In addition, Dell Force10 requires that you install blanks in all slots without a line card to control airflow for adequate system cooling.
PAGE 1190
www.dell.com | support.dell.com The TRACE_LOG_DIR/TRACE_CURR_BOOT directory can be reached by FTP or by using the show file command from the flash://TRACE_LOG_DIR directory. Note: At reload this directory is renamed to flash:/TRACE_LOG_DIR/TRACE_LAST_BOOT and a new empty flash:/TRACE_LOG_DIR/TRACE_CURR_BOOT directory is created. Automatic trace log updates The system automatically saves trace files to the internal flash.
PAGE 1191
To manually write the contents of an RPM log to the internal flash: Task Command Syntax Command Mode Write the RPM trace log to flash. upload trace-log cp [cmd-history | hw-trace | sw-trace EXEC Privilege ] To manually write the contents of a line card log to the internal flash: Task Command Syntax Command Mode Write the line card trace log to flash. upload trace-log linecard [0-7] | [hw-trace | sw-traceupload trace-log cp | [cmd-history | hw-trace | EXEC Privilege sw-trace ] Figure 61-7.
PAGE 1192
www.dell.com | support.dell.com When the trace messages are being saved on reload, Message 9 is displayed. Message 9 Saving Trace Messages Starting to save trace messages… Done. The CP and LP trace file names at chassis reload are: • • CP: reload_traceRPM0_CP LP: reload_traceLP[0-7] Figure 61-8. TRACE_LAST_BOOT Directory example Force10#cd /flash/TRACE_LOG_DIR/TRACE_LAST_BOOT Force10#dir hw_traceLP0.0 hw_traceLP2.3 hw_traceRPM0_CP.3 hw_traceLP0.1 hw_traceLP2.4 hw_traceRPM0_CP.4 hw_traceLP2.
PAGE 1193
Figure 61-9. Command Example: show command-history Force10#show command-history [6/16 16:22:3]: CMD-(CLI):[enable]by default from console [6/16 16:22:6]: CMD-(CLI):[show cam-profile]by default from console [6/16 16:38:9]: CMD-(TEL0):[enable]by admin from vty0 (10.11.48.30) [6/16 16:38:10]: CMD-(CLI):[show qos statistics]by default from console [6/16 16:38:21]: CMD-(TEL0):[show command-history]by admin from vty0 (10.11.48.
PAGE 1194
www.dell.com | support.dell.com Figure 61-11.
PAGE 1195
Table 61-3. show hardware Commands Command Description show hardware cpu data-plane View driver-level statistics for the data-plane port on the CPU for the specified line card or RPM. show hardware unit Views advanced counters, statistics, and register information for the FP and CSF ASICs. Recognizing a High CPU Condition A high CPU condition exist when any of the messages in Message 10 appear.
PAGE 1196
www.dell.com | support.dell.com Monitoring hardware components with SNMP The SNMP traps and OIDs in Table 61-4 provide information on C-Series hardware components. Table 61-4. SNMP Traps and OIDs OID String OID Name Description .1.3.6.1.4.1.6027.3.1.1.3.8 chRPMMajorAlarmStatus Fault status of the major alarm LED on the RPM .1.3.6.1.4.1.6027.3.1.1.3.9 chRPMMinorAlarmStatus Fault status of the minor alarm LED on the RPM .1.3.6.1.4.1.6027.3.1.1.4.0.
PAGE 1197
Table 61-4. SNMP Traps and OIDs OID String OID Name Description .1.3.6.1.4.1.6027.3.1.1.2.1.1.2 chSysPowerSupplyOperStatus Each entry in the chSysPowerSupplyTable includes a set of objects which describe the status of a particular power supply. .1.3.6.1.4.1.6027.3.1.1.4.0.13 chAlarmPowerSupplyDown Trap generated when the power supply status changes to non-operational .1.3.6.1.4.1.6027.3.1.1.4.0.17 chAlarmPowerSupplyClear Trap generated when the power supply status changes to operational. .1.3.
PAGE 1198
www.dell.com | support.dell.com Offline diagnostics Note: As the SFM on the C-Series is a logical concept only, the FORCE10-CHASSIS-MIB SFM-related SNMP alarms and traps are not used. The offline diagnostics test suite is useful for isolating faults and debugging hardware. Diagnostics are invoked from the FTOS CLI. While diagnostics are running, the status can be monitored via the CLI. The tests results are written to a file in flash memory and can be displayed on screen.
PAGE 1199
• The complete diagnostics test suite normally runs for 4 to 6 minutes; the 48-port 1-Gigabit line card takes slightly longer than the 4-port 10-Gigabit line card. Take the line card offline Place the line card in an offline state using the offline linecard command, as shown in Figure 61-12. Figure 61-12.
PAGE 1200
www.dell.com | support.dell.com Figure 61-15. show diag linecard Command Example Force10#show diag linecard 5 Diag status of Linecard slot 5: ------------------------------------------------------------Card is currently offline. Card alllevels diag issued at THU FEB 08, 2018 04:10:06 PM. Current diag status: Card diags are in progress. -------------------------------------------------------------00:54:19 : Diagnostic test results are stored on file: flash:/TestReport -LC-5.
PAGE 1201
Figure 61-16. Viewing Offline Diagnostics Test Results Force10#show diag linecard 5 Diag status of Linecard slot 5: ------------------------------------------------------------------Card is currently offline. Card alllevels diag issued at THU FEB 08, 2018 04:10:05 PM. Current diag status: Card diags are done. Duration of execution: 3 min 35 sec. Diagonostic test results located: flash:/TestReport-LC-5.
PAGE 1202
www.dell.com | support.dell.com Figure 61-17. Viewing Offline Diagnostics Test Results (continued) Test 107 - NVRAM Address Line test .................................. PASS Test 108 - NVRAM Data Line Test ..................................... PASS Test 110 - NVRAM Read Write test .................................... PASS .Test 111 - FLASH Write Read test .................................... PASS Test 112 - FPGA Registers Verification Test ......................... PASS Test 113 - FPGA Level1 Test ......
PAGE 1203
Buffer tuning Buffer Tuning allows you to modify the way your switch allocates buffers from its available memory, and helps prevent packet drops during a temporary burst of traffic. The C-Series and S-Series ASICs implement the key functions of queuing, feature lookups, and forwarding lookups in hardware. • • Forwarding Processor (FP) ASICs provide Ethernet MAC functions, queueing and buffering, as well as store feature and forwarding tables for hardware-based lookup and forwarding decisions.
PAGE 1204
www.dell.com | support.dell.com • Available packet pointers (2k per interface). Each packet is managed in the buffer using a unique packet pointer. Thus, each interface can manage up to 2k packets. You can configure dynamic buffers per port on both 1G and 10G FPs and per queue on CSFs. By default, the FP dynamic buffer allocation is 10 times oversubscribed.
PAGE 1205
Buffer tuning commands Task Command Command Mode Define a buffer profile for the FP queues. buffer-profile fp fsqueue CONFIGURATION Define a buffer profile for the CSF queues. buffer-profile csf csqueue CONFIGURATION Change the dedicated buffers on a physical 1G interface. buffer dedicated BUFFER PROFILE Change the maximum amount of dynamic buffers an interface can request. buffer dynamic BUFFER PROFILE Change the number of packet-pointers per queue.
PAGE 1206
www.dell.com | support.dell.com FTOS Behavior: When you remove a buffer-profile using the command no buffer-profile [fp | csf] from CONFIGURATION mode, the buffer-profile name still appears in the output of show buffer-profile [detail | summary]. After a line card reset, the buffer profile correctly returns to the default values, but the profile name remains.
PAGE 1207
Figure 61-20. Displaying Buffer Profile Allocations Force10#show running-config interface tengigabitethernet 2/0 ! interface TenGigabitEthernet 2/0 no ip address mtu 9252 switchport no shutdown buffer-policy myfsbufferprofile Force10#sho buffer-profile detail int gi 0/10 Interface Gi 0/10 Buffer-profile fsqueue-fp Dynamic buffer 1256.00 (Kilobytes) Queue# Dedicated Buffer Buffer Packets (Kilobytes) 0 3.00 256 1 3.00 256 2 3.00 256 3 3.00 256 4 3.00 256 5 3.00 256 6 3.00 256 7 3.
PAGE 1208
www.dell.com | support.dell.com Use a pre-defined buffer profile FTOS provides two pre-defined buffer profiles, one for single queue (i.e non-QoS) applications, and one for four queue (i.e QoS) applications. Task Command Syntax Command Mode Apply one of two pre-defined buffer profiles for all port-pipes in the system. buffer-profile global [1Q|4Q] CONFIGURATION You must reload the system for the global buffer-profile to take effect (Message 12).
PAGE 1209
Figure 61-21.
PAGE 1210
www.dell.com | support.dell.
PAGE 1211
62 E-Series TeraScale Debugging and Diagnostics This chapter addresses E-Series TeraScale Debugging and Diagnostics TeraScale platforms. Refer to Chapter 63, E-Series ExaScale Debugging and Diagnostics for information relating to that platform. In addition to the FTOS high availability features, E-Series and FTOS support several diagnostics and debug features that are integral components to delivering maximum uptime.
PAGE 1212
www.dell.com | support.dell.com • • • • Write the contents of the trace buffer on page 1230 Recognize a high CPU condition on page 1231 Configure an action upon a hardware error on page 1231 Core dumps on page 1232 Note: These diagnostics and debugability features are available on TeraScale systems only, unless specifically noted. Overview The FTOS diagnostics and debugging features are a proactive approach to maximizing system uptime and reducing meantime to resolution (MTTR) when a problem occurs.
PAGE 1213
Figure 62-1. Dataplane Loopback If three consecutive packets are lost, an error message is logged and then one of the following happens: • The RPM-SFM runtime loopback test failure initiates an SFM walk whenever it is enabled, feasible and necessary. The system automatically places each SFM (in sequential order) in an offline state, runs the loopback test, and then places the SFM back in an active state. This continues until the system determines a working SFM combination.
PAGE 1214
www.dell.com | support.dell.com • An SFM walk will not be able to identify multiple faulty SFMs, faulty linecards, or faulty RPM. In this case, the following event is logged. Message 2 SFM walk Event Log %TSM-2-RPM_LOOPBACK_FAIL: RPM-SFM dataplane loopback test failed %TSM-2-SFM_WALK_START: Automatic SFM walk-through started %TSM-2-SFM_WALK_FAIL: Automatic SFM walk-through failed to identify single faulty SFM • If a line card runtime loopback test fails, the system does not launch an SFM walk.
PAGE 1215
Task Command Mode Disable the automatic SFM walk that is launched after an RPM-SFM runtime loopback test failure. To re-enable the automatic SFM walk, use the no dataplane-diag disable sfm-walk command. dataplane-diag disable sfm-walk CONFIGURATION Note: Disabling the sfm-walk command prevents the sfm-bringdown command from taking effect.
PAGE 1216
www.dell.com | support.dell.com Task Command Mode Execute a manual dataplane loopback test: • all-loopback – Both the RPM and the line card dataplane loopback test is done. • rpm-loopback – Only the RPM dataplane loopback test is done. This test can be run when the switch fabric is in either an operational or a non-operational state.
PAGE 1217
Note: Execute this command only during an offline diagnostics; this command may bring down the switch fabric. When there are a full set of SFMs online, powering down one SFM will reduce the total bandwidth supported by the chassis, and may affect data flow. A warning message is issued at the command line that requires user confirmation to proceed with the command (Figure 62-3). Figure 62-3. power-off sfm command with data traffic warning message Force10#power-off sfm 0 SFM0 is active.
PAGE 1218
www.dell.com | support.dell.com Reset the SFM When the SFM is taken offline due to an error condition, you can execute the reset sfm command and initiate a manual recovery. Task Command Mode Reset a specific SFM module (power-off and then power-on). reset sfm slot-number EXEC When an error is detected on an SFM module, this command is a manual recovery mechanism. Since this command can be used with live traffic running, the switch fabric will not go down if the switch fabric is in an UP state.
PAGE 1219
The PCDFO polling feature monitors data received over the switch fabric. When a DFO error is detected, no automatic action is initiated by the system. The message issued is similar to: Message 4 PCDFO error message %RPM1-P:CP %CHMGR-2-SFM_PCDFO: PCDFO error detected for SFM4 The following graphic illustrates the E600 and E1200 switch fabric architecture. Each ingress and egress Buffer and Traffic Management (BTM) ASIC maintains nine channel connections to the TeraScale Switch Fabric (TSF) ASIC.
PAGE 1220
www.dell.com | support.dell.com For the transient case, PCDFO errors are not reported to the log. The hardware system automatically recovers from the error state, and the dataplane continues to function properly. In persistent case, PCDFO errors will appear in the log, and the error state is likely to remain if not handled. With PCDFO error data alone, it is impossible to arrive at a conclusion which will pinpoint the cause for PCDFO error or reason for packets drop.
PAGE 1221
The three CPUs use Fast Ethernet connections to communicate to each other and to the line card CPUs using Inter-Processor Communication (IPC). The CP monitors the health status of the other processors using heartbeat messaging exchange. Message 6 CP monitor %RPM1-P:CP %RPM0-S:CP %RPM0-S:CP %RPM0-P:CP %IPC-2-STATUS: target rp2 not responding %RAM-6-FAILOVER_REQ: RPM failover request from active peer: Auto failover on failure %RAM-6-ELECTION_ROLE: RPM0 is transitioning to Primary RPM.
PAGE 1222
www.dell.com | support.dell.com In a dual RPM system, the two RPMs send synchronization messages via inter-RPM communication (IRC). As described in the High Availability chapter, an RPM failover can be triggered by loss of the heartbeat (similar to a keepalive message) between the two RPMs.
PAGE 1223
Show hardware commands The show hardware command tree consists of privileged EXEC commands created or changed specially for use with the E-Series. These commands display information from a hardware sub-component, such as the Buffer and Traffic Management (BTM) ASIC and the Forwarding and Packet Classification (FPC) ASIC. They should be used only under the guidance of Dell Force10 technical support staff. The following table lists the show hardware commands.
PAGE 1224
www.dell.com | support.dell.com • • • • total run count total failure count consecutive failure count error code The diagnostics tests are grouped into three levels: Level 0—Check the inventory of devices. Verify the existence of devices (e.g., device ID test). Level 1—Verify the devices are accessible via designated paths (e.g., line integrity tests). Test the internal parts (e.g., registers) of devices. Level 2—Perform on-board loopback tests on various data paths (e.g., data port-pipe and Ethernet).
PAGE 1225
3. Execute the show diag command to view a report of the test results. Force10#show diag linecard 4 Diag status of Linecard slot 4: ------------------------------------------------------------------Card is currently offline. Card level0 diag issued at TUE Mar 27, 2007 05:19:35 AM. Current diag status: Card diags are done (FAIL). Duration of execution: 0 min 0 sec.
PAGE 1226
www.dell.com | support.dell.com To enable Parity Error Correction: Step Task Command Command Mode 1 Verify that the line card has sufficient memory to enable this feature, as shown in Figure 62-8. show processes memory lp EXEC Privilege 2 Enable Parity Error Correction hardware monitor linecard asic fpc parity-correction CONFIGURATION 3 Reload the linecard. reset linecard EXEC Privilege FTOS displays Message 8 on the console, when you enable Parity Error Correction.
PAGE 1227
The line card status does not reflect transient errors until FTOS encounters five recoverable or 50 phantom transient errors on a card within an hour, as shown in Figure 62-9. The text “Last Event” indicates the last type of parity error (transient or real) that occurred. Use SNMP to poll the number of transient errors using the objects chSysCardParityPhantomError and chSysCardParityRecoverableError.
PAGE 1228
www.dell.com | support.dell.com Trace logs In addition to the syslog buffer, FTOS buffers trace messages which are continuously written by various FTOS software tasks to report hardware and software events and status information. Each trace message provides the date, time, and name of the FTOS process. All messages are stored in a ring buffer and can be saved to a file either manually or automatically upon failover.
PAGE 1229
Manual reload condition When the chassis is reloaded manually (through the CLI), trace messages in all of the buffers (software and hardware) in CP and linecards are saved to the flash as reload_traceRPM0_CP and reload_traceLP1 in flash:/TRACE_LOG_DIR/TRACE_CURR_BOOT. After reload, you can see these files in flash:/ TRACE_LOG_DIR/TRACE_LAST_BOOT. When the trace messages are being saved on reload, Message 13 is displayed. Message 13 Saving Trace Messages Starting to save trace messages… Done.
PAGE 1230
www.dell.com | support.dell.com Figure 62-10. show command-history Command Example Force10#show command-history [12/5 10:57:8]: CMD-(CLI):service password-encryption [12/5 10:57:12]: CMD-(CLI):hostname Force10 [12/5 10:57:12]: CMD-(CLI):ip telnet server enable [12/5 10:57:12]: CMD-(CLI):line console 0 [12/5 10:57:12]: CMD-(CLI):line vty 0 9 [12/5 10:57:13]: CMD-(CLI):boot system rpm0 primary flash://FTOS-CB-1.1.1.2E2.
PAGE 1231
Recognize a high CPU condition A high CPU condition exists when any of the messages in Message 14 appear. Message 14 High CPU Condition Feb 13 13:56:16: %RPM1-S:CP %CHMGR-5-TASK_CPU_THRESHOLD: Cpu usage above threshold for task "sysAdmTsk"(100.00%) in CP. Feb 13 13:56:20: %RPM1-S:CP %CHMGR-5-CPU_THRESHOLD: Overall cp cpu usage above threshold. Cpu5SecUsage (100) Feb 13 13:56:20: %RPM1-S:CP %CHMGR-5-TASK_CPU_THRESHOLD_CLR: Cpu usage drops below threshold for task "sysAdmTsk"(0.00%) in CP.
PAGE 1232
www.dell.com | support.dell.
PAGE 1233
Kernel core dump—The E-Series supports kernel core dumps for CP and for RP1/RP2 using a naming convention of f10{cp|rp{1|2}}.kcore.gz. RP kernel core dumps are enabled by default. New files are written in flash until space is exhausted, in which case the write is aborted. CP kernel core dumps are disabled by default. Enable them using the command logging coredump cp from CONFIGURATION mode. If you use the keyword cp with this command, the system creates a file, named f10cp.kcore.
PAGE 1234
www.dell.com | support.dell.com Line card core dumps are disabled by default. To enable line card core dumps and specify the shutdown mode: Step 1 Task Command Syntax Command Mode Enable line card core dumps and specify the shutdown mode. logging coredump linecard {all | {0-13}} [port-shutdown | no-port-shutdown] EXEC Privilege Note: In the absence of port-shutdown and no-port-shutdown, the option no-port-shutdown is applied.
PAGE 1235
63 E-Series ExaScale Debugging and Diagnostics This chapter addresses E-Series ExaScale Debugging and Diagnostics ExaScale platforms. Refer to Chapter 62, E-Series TeraScale Debugging and Diagnostics for information relating to that platform. In addition to the FTOS high availability features, FTOS supports several diagnostics and debug features that are integral components to delivering maximum uptime.
PAGE 1236
www.dell.com | support.dell.com • • RPM core dumps on page 1263 Line card core dumps on page 1265 Overview The FTOS diagnostics and debugging features are a proactive approach to maximizing system uptime and reducing meantime to resolution (MTTR) when a problem occurs.
PAGE 1237
System health checks An automatic runtime loopback test monitors the overall health status of the dataplane. This loopback test runs while the system’s switch fabric is up, detecting potential blockages in the system’s usual data transfer path. Line card loopback checks Periodically, each line card sends a packet through the dataplane channels, verifying the packet is returned, and then verifying the dataplane is functioning as expected.
PAGE 1238
www.dell.com | support.dell.com • If the loopback packet does not return to the CPU within 1 sec, another loopback packet sent out. • Each loopback packet test failure appears in the show trace linecard output. • Additionally, a system message appears (Message 2). Message 2 Loopback test packet fail message WAGT-(tsa):Rcvd TSM_SWAGT_X3_ALLCHN_LOOPBACK_REQ msg • • • If both packets fail, a failed test result is sent to the internal FTOS task manager (TSM). Another test is initiated 45 seconds later.
PAGE 1239
Figure 63-2.
PAGE 1240
www.dell.com | support.dell.com 5. eFPTM to the 6. LC-Switch back to the 7. Line card CPU (LC-CPU) Like the line card to SFM results, line card S3 loopback tests results are displayed when you use the show trace linecard command. Messages appear indicating whether the test was successful or not (Message 4).
PAGE 1241
Task Command Mode Execute a manual dataplane loopback test: • all-loopback – dataplane loopback test on all line cards This test can be run when the switch fabric is in either an operational or a non-operational state. diag sfm [all-loopback] EXEC Privilege If the line card-SFM loopback test detects an SFM failure, an attempt is made to isolate a single faulty SFM by automatically walking the SFMs. For this failure case, error messages similar to the runtime loopback test error are generated.
PAGE 1242
www.dell.com | support.dell.com Note: Execute this command only during an offline diagnostics; this command may bring down the switch fabric. When there are a full set of SFMs online, powering down one SFM will reduce the total bandwidth supported by the chassis, and may affect data flow. A warning message is issued at the command line that requires user confirmation to proceed with the command (Figure 63-5) Figure 63-5.
PAGE 1243
Reset the SFM When the SFM is taken offline due to an error condition, you can execute the reset sfm command and initiate a manual recovery. Task Command Mode Reset a specific SFM module (power-off and then power-on). reset sfm slot-number EXEC When an error is detected on an SFM module, this command is a manual recovery mechanism. Since this command can be used with live traffic running, the switch fabric will not go down if the switch fabric is in an UP state.
PAGE 1244
www.dell.com | support.dell.com The PCDFO polling feature monitors data received over the switch fabric. When a DFO error is detected, no automatic action is initiated by the system. The message issued is similar to the following. Message 5 DFO Error Message %RPM1-P:CP %CHMGR-2-SFM_PCDFO: PCDFO error detected for SFM4 Figure 63-10 illustrates the SFM architecture. Each ingress and egress FPTM maintaing ten (10) channels connections to the ExaScale Switch Fabric. Figure 63-10.
PAGE 1245
• • Bad epoch timing Mis-configuration of backplane There are two PCDFO error types: Transient and Systematic. Transient error are non-persistent events that occur as one-events during normal operation. Systematic errors are repeatable events. For example, some hardware device or component is malfunctioning in such a way that it persistently exhibits incorrect behavior. For the transient case, PCDFO errors are not reported to the log.
PAGE 1246
www.dell.com | support.dell.com The three CPUs use Fast Ethernet connections to communicate to each other and to the line card CPUs using Inter-Processor Communication (IPC). The CP monitors the health status of the other processors using heartbeat messaging exchange.
PAGE 1247
In a dual RPM system, the two RPMs send synchronization messages via inter-RPM communication (IRC). As described in the High Availability chapter, an RPM failover can be triggered by loss of the heartbeat (similar to a keepalive message) between the two RPMs.
PAGE 1248
www.dell.com | support.dell.com show control-traffic 1248 Figure 63-11 illustrates the locations in the traffic path associated with each command.
PAGE 1249
Figure 63-11.
PAGE 1250
www.dell.com | support.dell.com show ipc-traffic 1250 Figure 63-11 illustrates the locations in the traffic path associated with each command.
PAGE 1251
Figure 63-12.
PAGE 1252
www.dell.com | support.dell.com show hardware commands The show hardware commands give information regarding the state of the hardware. The command syntax defines the FPTM functional area: • • BTM commands relate to the Buffer and Traffic Manager. FPC commands relate to the Flexible Packet Classification.
PAGE 1253
SFM0 SFM1 SFM2 SFM3 SFM4 T S F 3 T S F 3 T S F 3 T S F 3 T S F 3 SFM9 T S F 3 SFM8 T S F 3 SFM7 T S F 3 SFM6 T S F 3 SFM5 T S F 3 • • • show hardware sfm all tsf link-status show hardware sfm {0-9| all} tsf {counters | details | status} clear hardware sfm {0-9| all} tsf {errors | status} SFMs Figure 63-13.
PAGE 1254
www.dell.com | support.dell.com Global commands Global commands simplify troubleshooting by providing information on the egress and ingress at the same time. The global commands do not point to any specific register. To get information about the registers, use the specific commands (btm, fpc).
PAGE 1255
• • • Display the replication configuration for RPIs. This is used to troubleshoot why multicast streams are not reaching all receivers. show hardware linecard {0-13} port-set {0-1 | all} btm {ingress | egress | all} replication-config Display up to 32 WRED high/low threshold registers and WRED curve registers. show hardware linecard {0-13} port-set {0-1 | all} btm {ingress | egress | all} wred-config Display the rate police/limiting configurations; use formula in 1.1.5.6 Rate Calculation.
PAGE 1256
www.dell.com | support.dell.com Identify a suspect SFM Step 1 Task Command Mode Capture the link status view from the SFM. show hardware sfm all tsf link-status EXEC Privilege In this example. SFM7 has a failure reported against 3 line cards.
PAGE 1257
Identify a suspect line card 1 show hard linecard {0-13 | all} port-set all tsf link-status Capture the link status view from a line card.
PAGE 1258
www.dell.com | support.dell.com Table 63-1. Line card restart causes and reasons Causes Displayed Reasons Under voltage condition power brick failed and hard reset by rpm Figure 63-14.
PAGE 1259
Core dumps provides information regarding RPM and line card kernel and application events. Both the RPM and line cards have full and mini core dumps. A third reference file available is the console output file Figure 63-15 is an illustration of the trace file and core dump file organization, content, and file names. Figure 63-15. System informational files Command History: show command history Software Trace: sw_trace_RPM[0|1]CP.
PAGE 1260
www.dell.com | support.dell.com Automatic trace log updates The system automatically saves software trace files to the internal flash. The files are saved to the TRACE_LOG_DIR directory on the flash, and are named so that they can be viewed in a logical order. The first automatic trace file is labeled sw_trace_RPM0CP.0. Up to five trace logs are saved before the system begins overwriting them (sw_trace_RPM0CP.1, and so on until sw_trace_RPM0CP.4). Trace file sw_trace_RPM0CP.
PAGE 1261
When the trace messages are being saved on reload, Message 9 is displayed. Message 9 Saving Trace Messages Starting to save trace messages… Done. The trace file names at a chassis reload are: • • CP: reload_traceRPM[0|1]_CP LP: reload_traceLPnumber CP/RP1/RP2 software exceptions When an RPM resets due to an RP1 or RP2 software exception, the trace files are saved to flash:/ TRACE_LOG_DIR directory.
PAGE 1262
www.dell.com | support.dell.com Command history The command-history trace feature captures all commands entered by all users of the system with a time stamp and writes these messages to a dedicated trace log buffer. When the show command-history command is entered, the system displays a trace message for each executed command. No password information is saved to the file. The trace messages are not saved to a file or directory on the internal system flash.
PAGE 1263
• • Writes a crash log file to the CRASH_LOG directory. Writes a core dump file to the CORE_DUMP directory for kernel or application core dumps. Crash logs The CRASH_LOG directory saves critical information about a task crash on a line card in a format which can be read with the command show file.
PAGE 1264
www.dell.com | support.dell.com Full core dumps RP core dumps are enabled by default. CP core dumps are disabled by default. The core dump file is sent by FTP to the internal flash in the CORE_DUMP_DIR directory once the crashed RPM is back up. Enable full RPM application and kernel core dumps with the following: Task Command Syntax Command Mode Enable RPM core dumps and specify the shutdown mode.
PAGE 1265
Figure 63-18.
PAGE 1266
www.dell.com | support.dell.com The full line card core dump takes approximately 5 to10 minutes to upload the line card full core dump from compact flash partition to memory on the RPM (approximately 5 minutes to dump to compact flash partition and approximately 5 minutes after the line card resets to FTP to the RPM flash). During this time, the physical interfaces remain in their current state, which is normally operationally up.
PAGE 1267
Follow these steps to locate the line card core dump files. The mini core dump file is a text (.txt) file so it can be easily read. The full core dump files are gz files and can only be read by Dell Force10 TAC. Step 1 Task Syntax Command Mode List the files in the directory. dir EXEC Privilege Force10#dir Directory of flash: 1 2 3 drwx drwx drwx 8192 512 4096 Jan 01 1980 00:00:00 +00:00 . Jun 17 2009 12:27:15 +00:00 ..
PAGE 1268
www.dell.com | support.dell.com Console output The console output files contain console output of a line card or RP1/RP2 information to a file on the internal system flash. The contents are simple and contain basic failure details for and RPM boot failure or a line card exception when a core dump was not successfully saved. The files are generated for the following exceptions.
PAGE 1269
Step Task Syntax Command Mode Force10#cd NVTRACE_LOG_DIR Force10#dir Directory of flash:/NVTRACE_LOG_DIR 1 2 3 4 5 6 7 8 4 drwx drwx -rwx -rwx -rwx -rwx -rwx -rwx 4096 8192 5114 8266 8263 8263 4842 4419 Nov Jan May Jun Jun Jun Jun Jun Show the content of a log file. 09 01 27 01 02 02 02 02 2007 1980 2009 2009 2009 2009 2009 2009 19:55:38 00:00:00 11:08:02 00:02:24 11:15:54 11:22:00 12:00:20 12:22:48 +00:00 +00:00 +00:00 +00:00 +00:00 +00:00 +00:00 +00:00 . .. show_console_lp2_20090527_110758.
PAGE 1270
www.dell.com | support.dell.
PAGE 1271
64 S-Series Debugging and Diagnostics The chapter contains the following major sections: • • • • • • • Offline diagnostics Trace logs on page 1275 Hardware watchdog timer on page 1276 Buffer tuning on page 1276 Troubleshooting packet loss on page 1282 Application core dumps on page 1287 Mini core dumps on page 1287 Offline diagnostics The offline diagnostics test suite is useful for isolating faults and debugging hardware.
PAGE 1272
www.dell.com | support.dell.com Important Points to Remember • You can only perform offline diagnostics on an offline standalone unit or offline member unit of a stack of three or more. You cannot perform diagnostics on the management or standby unit in a stack of two or more (Message 1). Message 1 Offline Diagnostics on Master/Standby Error Running Diagnostics on master/standby unit is not allowed on stack. • • • • Perform offline diagnostics on one stack member at a time.
PAGE 1273
Figure 64-2. Verifying the Offline/Online Status of an S-Series Stack Unit Force10#show system brief | no-more Stack MAC : 00:01:e8:d6:02:39 -- Stack Info -Unit UnitType Status ReqTyp CurTyp Version Ports --------------------------------------------------------------------------0 Standby online S25V S25V 4.7.7.220 28 1 Management offline S50N S50N 4.7.7.220 52 2 Member online S25P S25P 4.7.7.
PAGE 1274
www.dell.com | support.dell.com Figure 64-3. Running Offline Diagnostics on an S-Series Standalone Unit Force10#diag stack-unit 1 alllevels Warning - diagnostic execution will cause multiple link flaps on the peer side - advisable to shut directly connected ports Proceed with Diags [confirm yes/no]: yes 00:03:35: %S50N:1 %DIAGAGT-6-DA_DIAG_STARTED: Starting diags on stack unit 1 00:03:35 : Approximate time to complete these Diags ...
PAGE 1275
Figure 64-5. Viewing the Results of Offline Diagnostics on a Standalone Unit Force10#show file flash://TestReport-SU-0.txt **********************************S-Series Diagnostics******************** Stack Unit Board Serial Number : DL267160098 CPU Version : MPC8541, Version: 1.1 PLD Version : 5 Diag image based on build : E_MAIN4.7.7.206 Stack Unit Board Voltage levels - 3.300000 V, 2.500000 V, 1.800000 V, 1.250000 V, 1.200000 V, 2.
PAGE 1276
www.dell.com | support.dell.com Auto Save on Crash or Rollover Exception information on for master or standby units is stored in the flash:/TRACE_LOG_DIR directory. This directory contains files that save trace information when there has been a task crash or timeout. On a master unit, the TRACE_LOG_DIR files can be reached by FTP or by using the show file command from the flash://TRACE_LOG_DIR directory.
PAGE 1277
1. CSF – Output queues going from the CSF. 2. FP Uplink—Output queues going from the FP to the CSF IDP links. 3. Front-End Link—Output queues going from the FP to the front-end PHY. All ports support eight queues, 4 for data traffic and 4 for control traffic. All 8 queues are tunable. Physical memory is organized into cells of 128 bytes. The cells are organized into two buffer pools— dedicated buffer and dynamic buffer.
PAGE 1278
www.dell.com | support.dell.com Figure 64-6. Buffer Tuning Points CSF Unit 3 1 IDP Switch Links 2 FP Unit 1 3 Front-end Links PHY PHY Deciding to tune buffers Dell Force10 recommends exercising caution when configuring any non-default buffer settings, as tuning can significantly affect system performance. The default values work for most cases. As a guideline, consider tuning buffers if traffic is very bursty (and coming from several interfaces).
PAGE 1279
Buffer tuning commands Task Command Command Mode Define a buffer profile for the FP queues. buffer-profile fp fsqueue CONFIGURATION Define a buffer profile for the CSF queues. buffer-profile csf csqueue CONFIGURATION Change the dedicated buffers on a physical 1G interface. buffer dedicated BUFFER PROFILE Change the maximum amount of dynamic buffers an interface can request. buffer dynamic BUFFER PROFILE Change the number of packet-pointers per queue.
PAGE 1280
www.dell.com | support.dell.com Figure 64-7. Display the Default Buffer Profile Force10#show buffer-profile detail interface gigabitethernet 0/1 Interface Gi 0/1 Buffer-profile Dynamic buffer 194.88 (Kilobytes) Queue# Dedicated Buffer Buffer Packets (Kilobytes) 0 2.50 256 1 2.50 256 2 2.50 256 3 2.50 256 4 9.38 256 5 9.38 256 6 9.38 256 7 9.38 256 Figure 64-8.
PAGE 1281
Using a pre-defined buffer profile FTOS provides two pre-defined buffer profiles, one for single-queue (i.e non-QoS) applications, and one for four-queue (i.e QoS) applications. Task Command Mode Apply one of two pre-defined buffer profiles for all port pipes in the system. buffer-profile global [1Q|4Q] CONFIGURATION You must reload the system for the global buffer profile to take effect (Message 3).
PAGE 1282
www.dell.com | support.dell.com Figure 64-9.
PAGE 1283
Figure 64-10.
PAGE 1284
www.dell.com | support.dell.com Figure 64-11.
PAGE 1285
Figure 64-12.
PAGE 1286
www.dell.com | support.dell.com Displaying Stack Port Statistics The show hardware stack-unit stack-port command displays input and output statistics for a stack-port interface, as shown in Figure 64-14. Figure 64-14.
PAGE 1287
Application core dumps Application core dumps are disabled by default. A core dump file can be very large. Due to memory requirements the file can only be sent directly to an FTP server. It is not stored on the local flash. Enable full application core dumps with the following: Task Command Syntax Command Mode Enable RPM core dumps and specify the shutdown mode. You may specify an IPv4 or IPv6 address for the server.
PAGE 1288
www.dell.com | support.dell.com Figure 64-16.
PAGE 1289
65 Standards Compliance This appendix contains the following sections: • • • IEEE Compliance RFC and I-D Compliance MIB Location Note: Unless noted, when a standard cited here is listed as supported by FTOS, FTOS also supports predecessor standards. One way to search for predecessor standards is to use the http://tools.ietf.org/ website. Click on “Browse and search IETF documents”, enter an RFC number, and inspect the top of the resulting document for obsolescence citations to related RFCs.
PAGE 1290
www.dell.com | support.dell.com • • • Dell Force10 — PVST+ SFF-8431 — SFP+ Direct Attach Cable (10GSFP+Cu) MTU — 9,252 bytes RFC and I-D Compliance The following standards are supported by FTOS, and are grouped by related protocol. The columns showing support by platform indicate which version of FTOS first supports the standard. Note: Checkmarks () in the E-Series column indicate that FTOS support was added before FTOS version 7.5.1.
PAGE 1291
General IPv4 Protocols FTOS support, per platform RFC# Full Name E-Series E-Series S-Series C-Series TeraScale ExaScale 791 Internet Protocol 7.6.1 7.5.1  8.1.1 792 Internet Control Message Protocol 7.6.1 7.5.1  8.1.1 826 An Ethernet Address Resolution Protocol 7.6.1 7.5.1  8.1.1 1027 Using ARP to Implement Transparent Subnet Gateways 7.6.1 7.5.1  8.1.1 1035 DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION (client) 7.6.1 7.5.1  8.1.
PAGE 1292
www.dell.com | support.dell.com General IPv6 Protocols 1292 FTOS support, per platform | RFC# Full Name 1886 E-Series E-Series TeraScale ExaScale S-Series C-Series DNS Extensions to support IP version 6 7.8.1 7.8.1  8.2.1 1981 (Partial) Path MTU Discovery for IP version 6 7.8.1 7.8.1  8.2.1 2460 Internet Protocol, Version 6 (IPv6) Specification 7.8.1 7.8.1  8.2.1 2461 (Partial) Neighbor Discovery for IP Version 6 (IPv6) 7.8.1 7.8.1  8.2.
PAGE 1293
Border Gateway Protocol (BGP) FTOS support, per platform S-Series C-Series E-Series TeraScale E-Series ExaScale RFC# Full Name 1997 BGP Communities Attribute 7.8.1 7.7.1  8.1.1 2385 Protection of BGP Sessions via the TCP MD5 Signature Option 7.8.1 7.7.1  8.1.1 2439 BGP Route Flap Damping 7.8.1 7.7.1  8.1.1 2545 Use of BGP-4 Multiprotocol Extensions for IPv6 Inter-Domain Routing 7.8.1  8.2.1 2796 BGP Route Reflection: An Alternative to Full Mesh Internal BGP (IBGP) 7.8.
PAGE 1294
www.dell.com | support.dell.com Intermediate System to Intermediate System (IS-IS) FTOS support, per platform S-Series C-Series E-Series E-Series TeraScale ExaScale RFC# Full Name 1142 OSI IS-IS Intra-Domain Routing Protocol (ISO DP 10589)  8.1.1 1195 Use of OSI IS-IS for Routing in TCP/IP and Dual Environments  8.1.1 2763 Dynamic Hostname Exchange Mechanism for IS-IS  8.1.1 2966 Domain-wide Prefix Distribution with Two-Level IS-IS  8.1.
PAGE 1295
Multiprotocol Label Switching (MPLS) FTOS support, per platform S-Series C-Series E-Series TeraScale E-Series ExaScale RFC# Full Name 2702 Requirements for Traffic Engineering Over MPLS 8.3.1 3031 Multiprotocol Label Switching Architecture 8.3.1 3032 MPLS Label Stack Encoding 8.3.1 3209 RSVP-TE: Extensions to RSVP for LSP Tunnels 8.3.1 3630 Traffic Engineering (TE) Extensions to OSPF Version 2 8.3.
PAGE 1296
www.dell.com | support.dell.com Multicast FTOS support, per platform S-Series C-Series E-Series TeraScale E-Series ExaScale Host Extensions for IP Multicasting 7.8.1 7.7.1  8.1.1 2236 Internet Group Management Protocol, Version 2 7.8.1 7.7.1  8.1.1 2710 Multicast Listener Discovery (MLD) for IPv6  8.2.1 3376 Internet Group Management Protocol, Version 3 3569 An Overview of Source-Specific Multicast (SSM) 3618 RFC# Full Name 1112 7.8.1 7.7.1  8.1.1 7.8.1 SSM for IPv4 7.7.
PAGE 1297
Network Management FTOS support, per platform S-Series C-Series E-Series TeraScale E-Series ExaScale Structure and Identification of Management Information for TCP/IP-based Internets 7.6.1 7.5.1  8.1.1 1156 Management Information Base for Network Management of TCP/IP-based internets 7.6.1 7.5.1  8.1.1 1157 A Simple Network Management Protocol (SNMP) 7.6.1 7.5.1  8.1.1 1212 Concise MIB Definitions 7.6.1 7.5.1  8.1.
PAGE 1298
www.dell.com | support.dell.com Network Management (continued) 1298 FTOS support, per platform | S-Series C-Series E-Series TeraScale E-Series ExaScale Coexistence Between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework 7.6.1 7.5.1  8.1.1 2578 Structure of Management Information Version 2 (SMIv2) 7.6.1 7.5.1  8.1.1 2579 Textual Conventions for SMIv2 7.6.1 7.5.1  8.1.1 2580 Conformance Statements for SMIv2 7.6.1 7.5.1  8.1.
PAGE 1299
Network Management (continued) FTOS support, per platform C-Series E-Series ExaScale Full Name 3815 Definitions of Managed Objects for the Multiprotocol Label Switching (MPLS), Label Distribution Protocol (LDP) 5060 Protocol Independent Multicast MIB 7.8.1 7.8.1 7.7.1 8.1.1 ANSI/TIA-1057 The LLDP Management Information Base extension module for TIA-TR41.4 Media Endpoint Discovery information 7.7.1 7.6.1 7.6.1 8.1.1 draft-grant-tacacs -02 The TACACS+ Protocol 7.6.1 7.5.1  8.1.1 7.8.
PAGE 1300
www.dell.com | support.dell.com Network Management (continued) FTOS support, per platform RFC# Full Name S-Series FORCE10-CS-C HASSIS-MIB Dell Force10 C-Series Enterprise Chassis MIB FORCE10-IF-EX TENSION-MIB Dell Force10 Enterprise IF Extension MIB (extends the Interfaces portion of the MIB-2 (RFC 1213) by providing proprietary SNMP OIDs for other counters displayed in the ”show interfaces” output) 7.6.1 FORCE10-LINK AGG-MIB Dell Force10 Enterprise Link Aggregation MIB 7.6.
PAGE 1301
MIB Location Dell Force10 MIBs are under the Force10 MIBs subhead on the Documentation page of iSupport: https://www.force10networks.com/csportal20/KnowledgeBase/Documentation.aspx You also can obtain a list of selected MIBs and their OIDs at the following URL: https://www.force10networks.com/csportal20/MIBs/MIB_OIDs.aspx Some pages of iSupport require a login. To request an iSupport account, go to: https://www.force10networks.com/CSPortal20/Support/AccountRequest.
PAGE 1302
| Standards Compliance www.dell.com | support.dell.
PAGE 1303
Index Numerics 10/100/1000 Base-T Ethernet line card, auto negotiation 471 100/1000 Ethernet interfaces port channels 445 4-Byte AS Numbers 220 802.1AB 1289 802.1D 1289 802.1p 1289 802.1p/Q 1289 802.1Q 1289 802.1s 1289 802.1w 1289 802.1X 1289 802.3ab 1289 802.3ac 1289 802.3ad 1289 802.3ae 1289 802.3af 1289 802.3ak 1289 802.3i 1289 802.3u 1289 802.3x 1289 802.
PAGE 1304
www.dell.com | support.dell.
PAGE 1305
flowcontrol 468 Force 10 Resilient Ring Protocol 351 forward delay 921, 1069 FRRP 351 FRRP Master Node 351 FRRP Transit Node 352 FTOS 715 FTOS XML session management 1173 FTP 70 G GARP VLAN Registration Protocol (GVRP) graceful restart 406 grep option 45 GVRP (GARP VLAN Registration Protocol) 389 389 H Hash algorithm 455 hash algorithm, LAG 348, 447, 449, 452 hashing algorithms for flows and fragments 452 hello time 921, 1069 High Availability cache boot 410 core dumps 408 definition 395 graceful restart
PAGE 1306
www.dell.com | support.dell.
PAGE 1307
LSAs 708 AS Boundary 715 AS External 715 Network 715 Network Summary 715 NSSA External 716 Opaque Area-local 715 Opaque Link-local 716 Router 715 types supported 715 LSPs 524 M MAC hashing scheme 454 management interface 436 accessing 439 configuring a management interface 439 configuring IP address 439 definition 439 IP address consideration 439 management interface, switch 435 max age 921, 1069 MBGP 268 Member VLAN (FRRP) 353 MIB Location 1301 minimum oper up links in a port channel 450 mirror, port 829,
PAGE 1308
www.dell.com | support.dell.
PAGE 1309
adding routes 898 auto summarization default 894 changing RIP version 898 configuring interfaces to run RIP 896 debugging RIP 902 default values 894 default version 895 disabling RIP 896 ECMP paths supported 894 enabling RIP 895 route information 897 setting route metrics 901 summarizing routes 901 timer values 894 version 1 description 893 version default on interfaces 894 RIP routes, maximum 894 RIPv1 893 RIPv2 894 root bridge 920, 1069 route maps configuring match commands 166 configuring set commands 16
PAGE 1310
www.dell.com | support.dell.
PAGE 1311
remote authentication and local authorization TACACS+ authentication, support for local authorization 965 VTYlines local authentication and authorization 964 965 W warm upgrade 409 X XML 1169, 1173 XML CLI apply ACL 1175 configure extended ACL 1175 configure standard ACL 1175 create egress ACL and apply rules error conditions 1177 error responses 1176 show commands supported 1169 XML CLI Limitations 1176 XML CLI request 1173 XML mode 1170 XML namespace 1176 1176 Index | 1311
PAGE 1312
| Index www.dell.com | support.dell.