Monthly Archives: March 2016

BGP Free Core

“BGP Free Core” is a typical topology in MPLS Service Provider Networks where you run IGP+Label. This allows traffic to transit over devices which don’t know traffic final destination, instead they look only for labels, bring more performance at the end. MPLS allow applications such as L2VPN, L3VPN and much more.

bgp-free-core

Normal Forwarding

In normal forwarding traffic towards to destination will go hop-by-hop (lookup next-hop) until reach destination

R4#show ip route
Codes: L – local, C – connected, S – static, R – RIP, M – mobile, B – BGP
D – EIGRP, EX – EIGRP external, O – OSPF, IA – OSPF inter area
N1 – OSPF NSSA external type 1, N2 – OSPF NSSA external type 2
E1 – OSPF external type 1, E2 – OSPF external type 2
i – IS-IS, su – IS-IS summary, L1 – IS-IS level-1, L2 – IS-IS level-2
ia – IS-IS inter area, * – candidate default, U – per-user static route
o – ODR, P – periodic downloaded static route, H – NHRP, l – LISP
a – application route
+ – replicated route, % – next hop override

Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 20 subnets, 2 masks
i L2     10.1.1.1/32 [115/30] via 10.4.12.12, 00:13:18, GigabitEthernet1.412
[115/30] via 10.2.4.2, 00:13:18, GigabitEthernet1.24
i L2     10.1.2.0/24 [115/20] via 10.2.4.2, 00:13:18, GigabitEthernet1.24
i L2     10.1.11.0/24 [115/30] via 10.4.12.12, 00:13:18, GigabitEthernet1.412
[115/30] via 10.2.4.2, 00:13:18, GigabitEthernet1.24
i L2     10.1.12.0/24 [115/20] via 10.4.12.12, 00:15:50, GigabitEthernet1.412
i L2     10.2.2.2/32 [115/20] via 10.2.4.2, 00:13:18, GigabitEthernet1.24
C        10.2.4.0/24 is directly connected, GigabitEthernet1.24
L        10.2.4.4/32 is directly connected, GigabitEthernet1.24
i L2     10.2.11.0/24 [115/20] via 10.2.4.2, 00:13:18, GigabitEthernet1.24
i L2     10.2.12.0/24 [115/20] via 10.4.12.12, 00:13:18, GigabitEthernet1.412
[115/20] via 10.2.4.2, 00:13:18, GigabitEthernet1.24
i L2     10.2.13.0/24 [115/20] via 10.4.13.13, 00:13:18, GigabitEthernet1.413
[115/20] via 10.2.4.2, 00:13:18, GigabitEthernet1.24
C        10.4.4.4/32 is directly connected, Loopback0
C        10.4.12.0/24 is directly connected, GigabitEthernet1.412
L        10.4.12.4/32 is directly connected, GigabitEthernet1.412
C        10.4.13.0/24 is directly connected, GigabitEthernet1.413
L        10.4.13.4/32 is directly connected, GigabitEthernet1.413
i L2     10.11.11.11/32
[115/30] via 10.4.12.12, 00:13:18, GigabitEthernet1.412
[115/30] via 10.2.4.2, 00:13:18, GigabitEthernet1.24
i L2     10.11.12.0/24 [115/20] via 10.4.12.12, 00:15:50, GigabitEthernet1.412
i L2     10.12.12.12/32
[115/20] via 10.4.12.12, 00:15:50, GigabitEthernet1.412
i L2     10.12.13.0/24 [115/20] via 10.4.13.13, 00:15:50, GigabitEthernet1.413
[115/20] via 10.4.12.12, 00:15:50, GigabitEthernet1.412
i L2     10.13.13.13/32
[115/20] via 10.4.13.13, 00:15:50, GigabitEthernet1.413

R4#show ip cef
Prefix               Next Hop             Interface
0.0.0.0/0            no route
0.0.0.0/8            drop
0.0.0.0/32           receive
10.1.1.1/32          10.2.4.2             GigabitEthernet1.24
10.4.12.12           GigabitEthernet1.412
10.1.2.0/24          10.2.4.2             GigabitEthernet1.24
10.1.11.0/24         10.2.4.2             GigabitEthernet1.24
10.4.12.12           GigabitEthernet1.412
10.1.12.0/24         10.4.12.12           GigabitEthernet1.412
10.2.2.2/32          10.2.4.2             GigabitEthernet1.24
10.2.4.0/24          attached             GigabitEthernet1.24
10.2.4.0/32          receive              GigabitEthernet1.24
10.2.4.2/32          attached             GigabitEthernet1.24
10.2.4.4/32          receive              GigabitEthernet1.24
10.2.4.255/32        receive              GigabitEthernet1.24
10.2.11.0/24         10.2.4.2             GigabitEthernet1.24

What is the exact path(or multiple)?

R4#trace 10.1.1.1
Type escape sequence to abort.
Tracing the route to 10.1.1.1
VRF info: (vrf in name/id, vrf out name/id)
1 10.2.4.2 3 msec
10.4.12.12 4 msec
10.2.4.2 3 msec
2 10.1.12.1 3 msec
10.1.2.1 3 msec
10.1.12.1 2 msec

CSR-4#show mpls forwarding-table
no MPLS apps enabled or MPLS not enabled on any interfaces

MPLS Forwarding

On MPLS we have LIB and LFIB. LIB essentially holds all the labels and associated information, while LFIB do the forwarding based on incoming labeled packets. CEF is a pre-requirement to run MPLS.
For MPLS the routing table (RIB) still the same as we see on Normal Forwarding.

This is the LFIB table….

R4#show mpls forwarding-table
Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id     Switched      interface
16         Pop Label  10.12.12.12/32   0             Gi1.412    10.4.12.12
17         Pop Label  10.13.13.13/32   0             Gi1.413    10.4.13.13
18         Pop Label  10.1.12.0/24     0             Gi1.412    10.4.12.12
19         Pop Label  10.2.12.0/24     0             Gi1.24     10.2.4.2
Pop Label  10.2.12.0/24     0             Gi1.412    10.4.12.12
20         Pop Label  10.11.12.0/24    0             Gi1.412    10.4.12.12
21         Pop Label  10.12.13.0/24    0             Gi1.412    10.4.12.12
Pop Label  10.12.13.0/24    0             Gi1.413    10.4.13.13
22         Pop Label  10.2.13.0/24     0             Gi1.24     10.2.4.2
Pop Label  10.2.13.0/24     0             Gi1.413    10.4.13.13
23         22         10.11.11.11/32   0             Gi1.24     10.2.4.2
24001      10.11.11.11/32   0             Gi1.412    10.4.12.12
24         16         10.1.1.1/32      0             Gi1.24     10.2.4.2
24003      10.1.1.1/32      0             Gi1.412    10.4.12.12
25         17         10.1.11.0/24     0             Gi1.24     10.2.4.2
24004      10.1.11.0/24     0             Gi1.412    10.4.12.12
26         Pop Label  10.2.11.0/24     0             Gi1.24     10.2.4.2
27         Pop Label  10.1.2.0/24      0             Gi1.24     10.2.4.2
28         Pop Label  10.2.2.2/32      0             Gi1.24     10.2.4.2

Doing a trace to R1 we get a labeled path

R4#trace 10.1.1.1
Type escape sequence to abort.
Tracing the route to 10.1.1.1
VRF info: (vrf in name/id, vrf out name/id)
1 10.2.4.2 [MPLS: Label 16 Exp 0] 3 msec
10.4.12.12 [MPLS: Label 24003 Exp 0] 10 msec
10.2.4.2 [MPLS: Label 16 Exp 0] 3 msec
2 10.1.12.1 3 msec
10.1.2.1 3 msec *

Hot and Cold Potato in ISP Kingdom

Some ISP’s tend to use different strategies or priorities in handling traffic across Backbone, some maybe because running out of capacity or by policy. In hot-potato routing, an ISP hands off traffic to a downstream ISP as quickly as it can “closest exit routing”. In opposite way Cold-potato routing ISP carries traffic as far as possible on its own network before deliver it to a downstream ISP “best exit routing”. In general, an ISP’s routing policy would follow an hot-potato or cold-potato routing.

Following a small diagram with an Cold-potato (blue) and Hot-potato (red) flows

hotcold-potato2

Cisco IOS-XR Basics

IOS-XR code is really new for me, so i will write a few posts about it. So i will start with the basics. You can see this Operating System on CRS generations, ASR 9000 and NCS Box’s.

Configure Username and Group

The root-system means priviledge 15 in normal IOS

RP/0/0/CPU0:XR-4(config)#username cocheno
RP/0/0/CPU0:XR-4(config-un)# group root-system
RP/0/0/CPU0:XR-4(config-un)# password cocheno

The predefined groups are as follows:

  • cisco-support: This group is used by the Cisco support team.
  • netadmin: Has the ability to control and monitor all system and network parameters.
  • operator: A demonstration group with basic privileges.
  • root-lr: Has the ability to control and monitor the specific secure domain router.
  • root-system: Has the ability to control and monitor the entire system.
  • sysadmin: Has the ability to control and monitor all system parameters but cannot configure network protocols.
  • serviceadmin: Service administration tasks, for example, Session Border Controller (SBC).

Configure Hostname

RP/0/0/CPU0:XR(config)#hostname XR-4
RP/0/0/CPU0:XR(config)#commit

Assigning IP Addresses

IOS-XR has some alias configured, it will interpret correctly if you not use ipv4 in this case

RP/0/0/CPU0:XR-4(config)#int gigabitEthernet 0/0/0/0.201
RP/0/0/CPU0:XR-4(config-subif)#encapsulation dot1q 201
RP/0/0/CPU0:XR-4(config-subif)#ip?
ipv4 ipv6
RP/0/0/CPU0:XR-4(config-subif)#ip add 10.202.201.40 255.255.255.0

Check where your are in config hierarchy

RP/0/0/CPU0:XR-4(config-subif)#pwdSun Mar 6 17:37:05.948 UTC
interface GigabitEthernet0/0/0/0.201
RP/0/0/CPU0:XR-5(config-subif)#

Save Config

Saving the Config is a 2 step, you work on a candidate config instead of running-config protecting you from misconfig.

Showing config before commit it in running-config

RP/0/0/CPU0:XR-4(config)#show configuration
Sun Mar 6 16:03:23.913 UTC
Building configuration…
!! IOS XR Configuration 5.2.2
interface GigabitEthernet0/0/0/0.201
ipv4 address 10.202.201.40 255.255.255.0
encapsulation dot1q 201
!
endRP/0/0/CPU0:XR-4(config)#commit
Sun Mar 6 16:05:19.315 UTC

we can also assign a label to the commit, and rollback based on it as well

RP/0/0/CPU0:XR-4(config)#commit label IPV4_v201

Rolling back change we did previously

RP/0/0/CPU0:XR-4#rollback configuration last 1
Sun Mar 6 16:10:35.003 UTC
Loading Rollback Changes.
Loaded Rollback Changes in 1 sec
Committing.
4 items committed in 1 sec (3)items/sec
Updating.
Updated Commit database in 1 sec
Configuration successfully rolled back 1 commits.

You can use a time based commit, you need to accept the commit in 120 seconds, or it will rollback the changes

RP/0/0/CPU0:XR-4(config)#commit confirmed 120

Check the last system commits

RP/0/0/CPU0:XR-4(config)#show config commit list detail
Sun Mar 6 16:21:30.499 UTC1) CommitId: 1000000004 Label: IPV4_v201
UserId: cisco Line: con0_0_CPU0
Client: CLI Time: Sun Mar 6 16:21:28 2016
Comment: NONE2) CommitId: 1000000003 Label: NONE
UserId: cisco Line: con0_0_CPU0
Client: Rollback Time: Sun Mar 6 16:10:36 2016
Comment: NONE

 

RP/0/0/CPU0:XR-4#show configuration rollback changes last 1
Sun Mar 6 16:24:50.435 UTC
Building configuration…
!! IOS XR Configuration 5.2.2
no interface GigabitEthernet0/0/0/0.201
end

Configure Telnet/SSH

RP/0/0/CPU0:XR-4(config)#telnet vrf default ipv4 server max-servers 5
RP/0/0/CPU0:XR-4#crypto key generate dsa
Sun Mar 6 17:52:29.135 UTC
The name for the keys will be: the_default
Choose the size of your DSA key modulus. Modulus size can be 512, 768, or 1024 bits. Choosing a key modulus
How many bits in the modulus [1024]:
Generating DSA keys …
Done w/ crypto generate keypair
[OK]RP/0/0/CPU0:XR-4#conf t
Sun Mar 6 17:52:44.114 UTC
RP/0/0/CPU0:XR-4(config)#domain name cocheno.com
RP/0/0/CPU0:XR-4(config)#ssh server v2
RP/0/0/CPU0:XR-4(config)#commit

Check SSH Sessions

RP/0/0/CPU0:XR-5#show ssh
Sun Mar 6 17:55:15.633 UTC
SSH version : Cisco-2.0id pty location state userid host ver authentication
—————————————————————————————————————
Incoming sessions
0 vty0 0/0/CPU0 SESSION_OPEN cisco 10.202.201.150 v2 password

Check commit failures

RP/0/0/CPU0:XR-4(config)#show configuration failed

After you change candidate config, you can abort without commit it

RP/0/0/CPU0:XR-4(config)#abort

Replace the entire config by the candidate, if your candidate is empty will you have factory default

RP/0/0/CPU0:XR-4(config)#commit replace
Sun Mar 6 16:47:46.101 UTCThis commit will replace or remove the entire running configuration. This
operation can be service affecting.
Do you wish to proceed? [no]:

Check Point R80 in March

Check Point R80 will be available later this March, after Check Point rescheduled it for a few times, you can check it on Press Release. Having Multiple administrators managing policies at same time it´s a big improvement, so you don’t need to ask your team to log off because you need implement an urgent rule!

Benefits of R80:

  • The introduction of ‘one console, one policy
  • Better aligning security with business processes and network architectures
  • Integration of threat management for a single view into risk across a network