Users Guide

ManualsBrandsDell ManualsAccess PlatformsOS9

Dell EMC Networking OS Configuration

Guide for the S5048F–ON System

9.14.2.8

September 2020

Rev. A00

Summary of content (1068 pages)

PAGE 1
Dell EMC Networking OS Configuration Guide for the S5048F–ON System 9.14.2.8 September 2020 Rev.
PAGE 2
Notes, cautions, and warnings NOTE: A NOTE indicates important information that helps you make better use of your product. CAUTION: A CAUTION indicates either potential damage to hardware or loss of data and tells you how to avoid the problem. WARNING: A WARNING indicates a potential for property damage, personal injury, or death. © 2020 Dell Inc. or its subsidiaries. All rights reserved. Dell, EMC, and other trademarks are trademarks of Dell Inc. or its subsidiaries.
PAGE 3
Contents Chapter 1: About this Guide......................................................................................................... 31 Audience...............................................................................................................................................................................31 Conventions.........................................................................................................................................................................
PAGE 4
Removing a Command from EXEC Mode..............................................................................................................57 Moving a Command from EXEC Privilege Mode to EXEC Mode.................................................................... 57 Allowing Access to CONFIGURATION Mode Commands..................................................................................57 Allowing Access to Different Modes...........................................................................
PAGE 5
Configuring Critical VLAN .............................................................................................................................................. 88 Configuring MAC addresses for a do1x Profile.......................................................................................................... 89 Configuring Request Identity Re-Transmissions........................................................................................................
PAGE 6
Applying Egress Layer 3 ACLs (Control-Plane)..................................................................................................124 Configuring UDF ACL..................................................................................................................................................... 124 IP Prefix Lists....................................................................................................................................................................
PAGE 7
Advanced BGP configuration tasks............................................................................................................................. 191 Route-refresh and Soft-reconfiguration...............................................................................................................191 Aggregating Routes...................................................................................................................................................194 Filtering BGP...............
PAGE 8
Protocol to CPU Queue Mapping..........................................................................................................................240 Configuring Protocol to CPU Queue Mapping....................................................................................................241 Displaying CoPP Configuration .............................................................................................................................242 Chapter 12: Data Center Bridging (DCB)...............
PAGE 9
QoS dot1p Traffic Classification and Queue Assignment......................................................................................284 Configuring the Dynamic Buffer Method..................................................................................................................284 Sample DCB Configuration...........................................................................................................................................
PAGE 10
Support for moving /128 IPv6 Prefixes and /32 IPv4 Prefixes .....................................................................312 Chapter 15: FIP Snooping...........................................................................................................313 Fibre Channel over Ethernet.........................................................................................................................................313 Ensure Robustness in a Converged Ethernet Network...........................
PAGE 11
Configure GVRP Registration...................................................................................................................................... 343 Configure a GARP Timer............................................................................................................................................... 344 Chapter 19: Internet Group Management Protocol (IGMP)........................................................ 345 IGMP Protocol Overview........................................
PAGE 12
Interfaces in Port Channels.................................................................................................................................... 373 Configuration Tasks for Port Channel Interfaces..............................................................................................373 Creating a Port Channel..........................................................................................................................................
PAGE 13
Adding description for IPv4 and IPv6 static routes..........................................................................................408 Configure Static Routes for the Management Interface...................................................................................... 409 Using the Configured Source IP Address in ICMP Messages..............................................................................409 Configuring the Duration to Establish a TCP Connection..................................
PAGE 14
Secure Shell (SSH) Over an IPv6 Transport.............................................................................................................431 Configuration Tasks for IPv6........................................................................................................................................ 431 Adjusting Your CAM-Profile....................................................................................................................................
PAGE 15
Maximum Values in the Routing Table.................................................................................................................465 Change the IS-IS Metric Style in One Level Only............................................................................................. 465 Leaks from One Level to Another.........................................................................................................................466 Sample Configurations......................................
PAGE 16
Optional TLVs.................................................................................................................................................................. 498 Management TLVs....................................................................................................................................................498 TIA-1057 (LLDP-MED) Overview...............................................................................................................................
PAGE 17
MSDP Sample Configurations......................................................................................................................................538 Chapter 30: Multicast Listener Discovery Protocol.................................................................... 541 MLD timers....................................................................................................................................................................... 544 Reducing Host Response Burstiness...........
PAGE 18
Chapter 33: Object Tracking......................................................................................................580 Object Tracking Overview............................................................................................................................................ 580 Track Layer 2 Interfaces.......................................................................................................................................... 581 Track Layer 3 Interfaces...................
PAGE 19
Overview........................................................................................................................................................................... 626 Implementing PBR...........................................................................................................................................................627 Configuration Task List for Policy-based Routing..................................................................................................
PAGE 20
Private VLAN Concepts................................................................................................................................................ 668 Using the Private VLAN Commands.......................................................................................................................... 669 Configuration Task List..................................................................................................................................................
PAGE 21
Specifying Policy-Based Rate Shaping in Packets Per Second...........................................................................706 Configuring Policy-Based Rate Shaping.................................................................................................................... 707 Configuring Weights and ECN for WRED ................................................................................................................ 707 Configuring WRED and ECN Attributes............................
PAGE 22
Configuration Task List for AAA Accounting.......................................................................................................741 RADIUS Accounting.................................................................................................................................................. 743 AAA Authentication........................................................................................................................................................
PAGE 23
Configuring the Protocol Type Value for the Outer VLAN Tag..................................................................... 789 Configuring Dell EMC Networking OS Options for Trunk Ports....................................................................789 Debugging VLAN Stacking......................................................................................................................................790 VLAN Stacking in Multi-Vendor Networks...................................................
PAGE 24
Enabling an SNMP Agent to Notify Syslog Server Failure.................................................................................... 815 Copy Configuration Files Using SNMP.......................................................................................................................816 Copying a Configuration File................................................................................................................................... 818 Copying Configuration Files via SNMP...........
PAGE 25
MIB Objects for Viewing the System Image on Flash Partitions...................................................................850 Monitor Port-Channels..................................................................................................................................................850 Troubleshooting SNMP Operation.............................................................................................................................. 851 Transceiver Monitoring...........................
PAGE 26
Enabling NTP.............................................................................................................................................................. 881 Configuring NTP Broadcasts..................................................................................................................................882 Disabling NTP on an Interface...............................................................................................................................
PAGE 27
Chapter 58: Virtual Link Trunking (VLT)....................................................................................909 Overview...........................................................................................................................................................................909 VLT Terminology.........................................................................................................................................................
PAGE 28
Proxy Gateway in VLT Domains.................................................................................................................................. 973 LLDP VLT Proxy Gateway in a Square VLT Topology..................................................................................... 976 Configuring a Static VLT Proxy Gateway..................................................................................................................977 Configuring an LLDP VLT Proxy Gateway...................
PAGE 29
VRRP Overview..............................................................................................................................................................1012 VRRP Benefits................................................................................................................................................................ 1013 VRRP Implementation..........................................................................................................................................
PAGE 30
Installing CA certificate..........................................................................................................................................1064 Information about Creating Certificate Signing Requests (CSR)..................................................................... 1064 Creating Certificate Signing Requests (CSR).................................................................................................. 1064 Information about installing trusted certificates............
PAGE 31
1 About this Guide This guide describes the protocols and features the Dell EMC Networking Operating System (OS) supports and provides configuration instructions and examples for implementing them. For complete information about all the CLI commands, see the Dell EMC Command Line Reference Guide for your system. The S5048F-ON platform is available with Dell EMC Networking OS version 9.12(1.0) and beyond. Though this guide contains information about protocols, it is not intended to be a complete reference.
PAGE 32
2 Configuration Fundamentals The Dell EMC Networking Operating System (OS) command line interface (CLI) is a text-based interface you can use to configure interfaces and protocols. The CLI is largely the same for each platform except for some commands and command outputs. The CLI is structured in modes for security and management purposes. Different sets of commands are available in each mode, and you can limit user access to modes using privilege levels.
PAGE 33
● EXEC mode is the default mode and has a privilege level of 1, which is the most restricted level. Only a limited selection of commands is available, notably the show commands, which allow you to view system information. ● EXEC Privilege mode has commands to view configurations, clear counters, manage configuration files, run diagnostics, and enable or disable debug operations. The privilege level is 15, which is unrestricted.
PAGE 34
QOS POLICY RSTP ROUTE-MAP ROUTER BGP BGP ADDRESS-FAMILY ROUTER ISIS ISIS ADDRESS-FAMILY ROUTER OSPF ROUTER OSPFV3 ROUTER RIP SPANNING TREE TRACE-LIST VLT DOMAIN VRRP UPLINK STATE GROUP GRUB Navigating CLI Modes The Dell EMC Networking OS prompt changes to indicate the CLI mode. The following table lists the CLI mode, its prompt, and information about how to access and exit the CLI mode.
PAGE 35
Table 1.
PAGE 36
Table 1.
PAGE 37
The do Command You can enter an EXEC mode command from any CONFIGURATION mode (CONFIGURATION, INTERFACE, SPANNING TREE, and so on.) without having to return to EXEC mode by preceding the EXEC mode command with the do command. The following example shows the output of the do command.
PAGE 38
Obtaining Help Obtain a list of keywords and a brief functional description of those keywords at any CLI mode using the ? or help command: ● To list the keywords available in the current mode, enter ? at the prompt or after a keyword. ● Enter ? after a command prompt to list all of the available keywords. The output of this command is the same as the help command.
PAGE 39
Short-Cut Key Action Combination CNTL-R Re-enters the previous command. CNTL-U Deletes the line. CNTL-W Deletes the previous word. CNTL-X Deletes the line. CNTL-Z Ends continuous scrolling of command outputs. Esc B Moves the cursor back one word. Esc F Moves the cursor forward one word. Esc D Deletes all characters from the cursor to the end of the word. Command History The Dell EMC Networking OS maintains a history of previously-entered commands for each mode.
PAGE 40
The except keyword displays text that does not match the specified text. The following example shows this command used in combination with the show system brief command. Example of the except Keyword DellEMC#show system brief | except 1 Stack MAC Reload-Type : 4c:76:25:e5:49:40 : normal-reload [Next boot : normal-reload] The find keyword displays the output of the show command beginning from the first occurrence of specified text.
PAGE 41
If either of these messages appears, Dell EMC Networking recommends coordinating with the users listed in the message so that you do not unintentionally overwrite each other’s configuration changes. Configuring alias command You can configure shorter alias names for single–line command input using the alias command. To configure the alias name, perform the following steps: 1. Configure the terminal to enter the Global Configuration mode. EXEC Privilege mode DellEMC#configure terminal 2.
PAGE 42
Name: showipbr10 Definition: show ip interface brief | grep tengig ignore-case ----------------------------------------------------------------------------------------------------------------------------------Name: showipbr40 Definition: show ip interface brief | grep fortygig ignore-case -----------------------------------------------------------------DellEMC# 3. Display the details of a specific alias.
PAGE 43
3 Getting Started This chapter describes how you start configuring your system. When you power up the chassis, the system performs a power-on self test (POST) and system then loads the Dell EMC Networking Operating System. Boot messages scroll up the terminal window during this process. No user interaction is required if the boot process proceeds without interruption. When the boot process completes, the system status LEDs remain online (green) and the console monitor displays the EXEC mode prompt.
PAGE 44
Accessing the Console Port To access the console port, follow these steps: For the console port pinout, refer to Accessing the RJ-45 Console Port with a DB-9 Adapter. 1. Install an RJ-45 copper cable into the console port. Use a rollover (crossover) cable to connect the console port to a terminal server. 2. Connect the other end of the cable to the DTE terminal server. 3.
PAGE 45
1. Power on the PC. 2. Connect the USB-A end of cable into an available USB port on the PC. 3. Connect the micro USB-B end of cable into the micro USB-B console port on the system. 4. Power on the system. 5. Install the necessary USB device drivers. (To download the drivers, go to https://www.dell.com/support.) For assistance, contact Dell EMC Networking Technical Support. 6. Open your terminal software emulation program to access the system. 7.
PAGE 46
interface ManagementEthernet slot/port 2. Assign an IP address to the interface. INTERFACE mode ip address ip-address/mask ● ip-address: an address in dotted-decimal format (A.B.C.D). ● mask: a subnet mask in /prefix-length format (/ xx). 3. Enable the interface. INTERFACE mode no shutdown Configure a Management Route Define a path from the system to the network from which you are accessing the system remotely.
PAGE 47
○ privilege level: Assign a privilege levels to the user. The range is from 0 to 15. ○ role role-name: Assign a role name for the user. Dell EMC Networking OS encrypts type 5 secret and type 7 password based on dynamic-salt option such that the encrypted password is different when an user is configured with the same password. NOTE: dynamic-salt option is shown only with secret and password options.
PAGE 48
Configuration File Management Files can be stored on and accessed from various storage media. Rename, delete, and copy files on the system from EXEC Privilege mode. Copy Files to and from the System The command syntax for copying files is similar to UNIX. The copy command uses the format copy source-file-url destination-file-url. NOTE: For a detailed description of the copy command, refer to the Dell EMC Networking OS Command Reference.
PAGE 49
Destination file name [FTOS-S5048F-ON-9.12.1.0.bin]: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 26292881 bytes successfully copied core1#$//copy ftp://myusername:mypassword@10.10.10.10//Dell/ Dell-EF-8.2.1.0.bin flash:// Destination file name [Dell-EF-8.2.1.0.bin.bin]: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 26292881 bytes successfully copied DellEMC#copy ftp://myusername:mypassword@192.168.1.1/file_path/FTOS-Z9100-ON-9.8.1.0.bin flash://FTOS-S5048F-ON-9.12.1.
PAGE 50
Source file name []: test.c User name to login remote host: username Example of Logging in to Copy from NFS Mount DellEMC#copy nfsmount:///test flash: Destination file name [test]: test2 ! 5592 bytes successfully copied DellEMC# DellEMC#copy nfsmount:///test.txt ftp://10.16.127.35 Destination file name [test.txt]: User name to login remote host: username Password to login remote host: ! Example of Copying to NFS Mount DellEMC#copy flash://test.txt nfsmount:/// Destination file name [test.
PAGE 51
NOTE: When you load the startup configuration or a configuration file from a network server such as TFTP to the running configuration, the configuration is added to the running configuration. This does not replace the existing running configuration. Commands in the configuration file has precedence over commands in the running configuration.
PAGE 52
15 -rw- 27674906 Jul 06 2007 02:23:22 boot-flash --More-DellEMC#dir flash: Directory of flash: 1 2 3 4 5 6 7 8 9 10 11 12 13 drwx drwx d--drwx drwx drwx drwx drwx -rwx -rwx -rwx -rwx -rwx 4096 3072 4096 4096 4096 4096 4096 4096 53285 630 2760 294418 54238335 Jan Sep Aug Sep Aug Aug Aug Aug Sep Sep Sep Sep Sep 01 06 09 04 09 09 09 09 01 02 04 04 06 1980 2015 2015 2015 2015 2015 2015 2015 2015 2015 2015 2015 2017 00:00:00 12:41:26 06:52:28 18:58:20 06:56:32 06:56:32 06:56:32 06:56:32 18:08:54 17:53:14 1
PAGE 53
The output of the show file-systems command in the following example shows the total capacity, amount of free memory, file structure, media type, read/write privileges for each storage device in use.
PAGE 54
DellEMC(conf)#no service timestamps log DellEMC# show command-history - Repeated 1 time. [1d0h26m]: CMD-(CLI):[configure]by default from console - Repeated 1 time. [May 17 15:53:10]: CMD-(CLI):[no service timestamps log]by default from console [May 17 15:53:16]: CMD-(CLI):[write memory]by default from console - Repeated 3 times. [May 17 15:53:22]: CMD-(CLI):[show logging]by default from console - Repeated 1 time. [May 17 15:53:36]: CMD-(CLI):[write memory]by default from console - Repeated 5 times.
PAGE 55
CONFIGURATION MODE DellEMC(conf)#ip http vrf {management | } Verify Software Images Before Installation To validate the software image on the flash drive, you can use the MD5 message-digest algorithm or SHA256 Secure Hash Algorithm, after the image is transferred to the system but before the image is installed. The validation calculates a hash value of the downloaded image file on system’s flash drive, and, optionally, compares it to a Dell EMC Networking published hash for that file.
PAGE 56
4 Management This chapter describes the different protocols or services used to manage the Dell EMC Networking system.
PAGE 57
Removing a Command from EXEC Mode To remove a command from the list of available commands in EXEC mode for a specific privilege level, use the privilege exec command from CONFIGURATION mode. In the command, specify a level greater than the level given to a user or terminal line, then the first keyword of each command you wish to restrict.
PAGE 58
privilege configure level level {interface | line | route-map | router} {command-keyword ||...|| command-keyword} ● Allow access to a CONFIGURATION, INTERFACE, LINE, ROUTE-MAP, and/or ROUTER mode command. CONFIGURATION mode privilege {configure |interface | line | route-map | router} level level {command ||...
PAGE 59
CONFIGURATION mode username username privilege level NOTE: When you assign a privilege level between 2 and 15, access to the system begins at EXEC mode, but the prompt is hostname#, rather than hostname>. Configuring Logging The Dell EMC Networking OS tracks changes in the system using event and error messages. By default, Dell EMC Networking OS logs these messages on: ● the internal buffer ● console and terminal lines ● any configured syslog servers To disable logging, use the following commands.
PAGE 60
● Uncontrolled shutdown. Security Logs The security log contains security events and information. RBAC restricts access to audit and security logs based on the CLI sessions’ user roles. The types of information in this log consist of the following: ● Establishment of secure traffic flows, such as SSH. ● Violations on secure flows or certificate issues. ● Adding and deleting of users.
PAGE 61
Clearing Audit Logs To clear audit logs, use the clear logging auditlog command in Exec mode. When RBAC is enabled, only the system administrator user role can issue this command. Example of the clear logging auditlog Command DellEMC# clear logging auditlog Configuring Logging Format To display syslog messages in a RFC 3164 or RFC 5424 format, use the logging version {0 | 1} command in CONFIGURATION mode. By default, the system log version is set to 0.
PAGE 62
Figure 2. Setting Up a Secure Connection to a Syslog Server Pre-requisites To configure a secure connection from the switch to the syslog server: 1. On the switch, enable the SSH server DellEMC(conf)#ip ssh server enable 2. On the syslog server, create a reverse SSH tunnel from the syslog server to the Dell OS switch, using following syntax: ssh -R :: user@remote_host -nNf In the following example the syslog server IP address is 10.156.166.
PAGE 63
Log Messages in the Internal Buffer All error messages, except those beginning with %BOOTUP (Message), are log in the internal buffer.
PAGE 64
In the previous lines, local7 is the logging facility level and debugging is the severity level. Track Login Activity Dell EMC Networking OS enables you to track the login activity of users and view the successful and unsuccessful login events.
PAGE 65
Unsuccessful login attempt(s) in last 30 day(s): 0 Successful login attempt(s) in last 30 day(s): 1 -----------------------------------------------------------------Example of the show login statistics all command The show login statistics all command displays the successful and failed login details of all users in the last 30 days or the custom defined time period.
PAGE 66
The following is sample output of the show login statistics unsuccessful-attempts time-period days command. DellEMC# show login statistics unsuccessful-attempts time-period 15 There were 0 unsuccessful login attempt(s) for user admin in last 15 day(s). The following is sample output of the show login statistics unsuccessful-attempts user login-id command. DellEMC# show login statistics unsuccessful-attempts user admin There were 3 unsuccessful login attempt(s) for user admin in last 12 day(s).
PAGE 67
During the next authentication attempt, the system does not allow any attempt to login since maximum VTY sessions have reached and hence no clear-line option. NOTE: If the maximum number of VTY lines are more than the concurrent sessions and the same user is attempting to login second time or more, the system displays the Maximum concurrent sessions for the user reached message. You are allowed to clear the existing session and login.
PAGE 68
Changing System Logging Settings You can change the default settings of the system logging by changing the severity level and the storage location. The default is to log all messages up to debug level, that is, all system messages. By changing the severity level in the logging commands, you control the number of system messages logged. To specify the system logging settings, use the following commands. ● Specify the minimum severity level for logging to the logging buffer.
PAGE 69
Oct 10 10:43:46 %S5048F-ON:1 %KERN-2-INT: scsibus0: detached Oct 10 10:43:46 %S5048F-ON:1 %KERN-2-INT: sd0: detached Oct 10 10:43:46 %S5048F-ON:1 %KERN-2-INT: sd0(umass0:0:0:0): generic HBA error Oct 10 10:43:45 %S5048F-ON:1 %KERN-2-INT: umass0: at uhub1 port 1 (addr 3) disconnected Oct 10 10:16:22 %STKUNIT1-M:CP %SYS-5-CONFIG_I: Configured from vty0 ( 10.16.127.143 )by admin Oct 10 10:07:32 %STKUNIT1-M:CP %SEC-5-AUTHENTICATION_ENABLE_SUCCESS: Enable authentication success on vty0 ( 10.16.127.
PAGE 70
Required SMARTSCRIPTS Package(>= 9.7) not found, SupportAssist uninstalled.
PAGE 71
%TSM-6-SFM_DISCOVERY: Found SFM 1 %TSM-6-SFM_DISCOVERY: Found SFM 2 %TSM-6-SFM_DISCOVERY: Found SFM 3 %TSM-6-SFM_DISCOVERY: Found SFM 4 %TSM-6-SFM_DISCOVERY: Found SFM 5 %TSM-6-SFM_DISCOVERY: Found SFM 6 %TSM-6-SFM_DISCOVERY: Found SFM 7 %TSM-6-SFM_SWITCHFAB_STATE: Switch Fabric: UP %TSM-6-SFM_DISCOVERY: Found SFM 8 %TSM-6-SFM_DISCOVERY: Found 9 SFMs %CHMGR-5-CHECKIN: Checkin from line card 5 (type EX1YB, 1 ports) %TSM-6-PORT_CONFIG: Port link status for LC 5 => portpipe 0: OK portpipe 1: N/A %CHMGR-5-LINEC
PAGE 72
service timestamps log datetime msec service timestamps debug datetime msec ! logging trap debugging logging facility user logging source-interface Loopback 0 logging 10.10.10.4 DellEMC# Synchronizing Log Messages You can configure Dell EMC Networking OS to filter and consolidate the system messages for a specific line by synchronizing the message output. Only the messages with a severity at or below the set level appear. This feature works on the terminal and console connections available on the system.
PAGE 73
To disable time stamping on syslog messages, use the no service timestamps [log | debug] command. Example 1: Default configuration service timestamps log datetime or service timestamps log datetime localtime DellEMC(conf)#service timestamps log datetime DellEMC#show clock 15:42:42.804 IST Fri May 17 2019 Example 2: service timestamps log datetime utc DellEMC(conf)#service timestamps log datetime utc DellEMC#show clock 15:47:05.
PAGE 74
File Transfer Services With Dell EMC Networking OS, you can configure the system to transfer files over the network using the file transfer protocol (FTP). One FTP application is copying the system image files over an interface on to the system; however, FTP is not supported on virtual local area network (VLAN) interfaces. If you want the FTP or TFTP server to use a VRF table that is attached to an interface, you must configure the FTP or TFTP server to use a specific routing table.
PAGE 75
○ encryption-type: enter 0 for plain text or 7 for encrypted text. ○ password: enter a text string. NOTE: You cannot use the change directory (cd) command until you have configured ftp-server topdir. To view the FTP configuration, use the show running-config ftp command in EXEC privilege mode. Configuring FTP Client Parameters To configure FTP client parameters, use the following commands.
PAGE 76
processes either IPv4 or IPv6 rules, but not both. Using this configuration, you can set up two different types of access classes with each class processing either IPv4 or IPv6 rules separately. To apply an IP ACL to a line, Use the following command. ● Apply an ACL to a VTY line. LINE mode access-class access-list-name [ipv4 | ipv6] NOTE: If you already have configured generic IP ACL on a terminal line, then you cannot further apply IPv4 or IPv6 specific filtering on top of this configuration.
PAGE 77
radius Prompt for a username and password and use a RADIUS server to authenticate. tacacs+ Prompt for a username and password and use a TACACS+ server to authenticate. 1. Configure an authentication method list. You may use a mnemonic name or use the keyword default. The default authentication method for terminal lines is local and the default method list is empty.
PAGE 78
Using Telnet to get to Another Network Device To telnet to another device, use the following commands. NOTE: The device allows 120 Telnet sessions per minute, allowing the login and logout of 10 Telnet sessions, 12 times in a minute. If the system reaches this non-practical limit, the Telnet service is stopped for 10 minutes. You can use console and SSH service to access the system during downtime. ● Telnet to a device with an IPv4 or IPv6 address.
PAGE 79
! Locks configuration mode exclusively. DellEMC(conf)# If another user attempts to enter CONFIGURATION mode while a lock is in place, the following appears on their terminal (message 1): % Error: User "" on line console0 is in exclusive configuration mode.
PAGE 80
Restoring the Factory Default Settings Restoring the factory-default settings deletes the existing NVRAM settings, startup configuration, and all configured settings such as, stacking or fanout. To restore the factory default settings, use the restore factory-defaults stack-unit {stack—unit—number | all} {clear-all | nvram | bootvar} command in EXEC Privilege mode. CAUTION: There is no undo for this command.
PAGE 81
Important Points to Remember ● The Chassis remains in boot prompt if none of the partitions contain valid images. ● To enable TFTP boot after restoring factory default settings, you must stop the boot process in BLI.
PAGE 82
5 802.1X 802.1X is a port-based Network Access Control (PNAC) that provides an authentication mechanism to devices wishing to attach to a LAN or WLAN. A device connected to a port that is enabled with 802.1X is disallowed from sending or receiving packets on the network until its identity is verified (through a username and password, for example). 802.
PAGE 83
● The device attempting to access the network is the supplicant. The supplicant is not allowed to communicate on the network until the authenticator authorizes the port. It can only communicate with the authenticator in response to 802.1X requests. ● The device with which the supplicant communicates is the authenticator. The authenticator is the gate keeper of the network. It translates and forwards requests and responses between the authentication server and the supplicant.
PAGE 84
Figure 5. EAP Port-Authentication EAP over RADIUS 802.1X uses RADIUS to shuttle EAP packets between the authenticator and the authentication server, as defined in RFC 3579. EAP messages are encapsulated in RADIUS packets as a type of attribute in Type, Length, Value (TLV) format. The Type value for EAP messages is 79. Figure 6. EAP Over RADIUS RADIUS Attributes for 802.1X Support Dell EMC Networking systems include the following RADIUS attributes in all 802.
PAGE 85
Configuring 802.1X Configuring 802.1X on a port is a one-step process. For more information, refer to Enabling 802.1X. Related Configuration Tasks ● ● ● ● ● ● Configuring Request Identity Re-Transmissions Forcibly Authorizing or Unauthorizing a Port Re-Authenticating a Port Configuring Timeouts Configuring a Guest VLAN Configuring an Authentication-Fail VLAN Important Points to Remember ● Dell EMC Networking OS supports 802.
PAGE 86
Enabling 802.1X Enable 802.1X globally. Figure 7. 802.1X Enabled 1. Enable 802.1X globally. CONFIGURATION mode dot1x authentication 2. Enter INTERFACE mode on an interface or a range of interfaces. INTERFACE mode interface [range] 3. Enable 802.1X on the supplicant interface only. INTERFACE mode dot1x authentication Verify that 802.1X is enabled globally and at the interface level using the show running-config | find dot1x command from EXEC Privilege mode.
PAGE 87
no ip address dot1x authentication no shutdown ! DellEMC# To view 802.1X configuration information for an interface, use the show dot1x interface command. In the following example, the bold lines show that 802.1X is enabled on all ports unauthorized by default. DellEMC#show dot1x interface twentyFiveGigE 1/1 802.
PAGE 88
Configuring the Static MAB and MAB Profile Enable MAB (mac-auth-bypass) before using the dot1x static-mab command to enable static mab. To enable static MAB and configure a static MAB profile, use the following commands. ● Configure static MAB and static MAB profile on dot1x interface. INTERFACE mode dot1x static-mab profile profile-name Eenter a name to configure the static MAB profile name. The profile name length is limited to a maximum of 32 characters.
PAGE 89
interface twentyFiveGigE 1/2 switchport dot1x critical-vlan 300 no shutdown DellEMC#show dot1x interface twentyFiveGigE 1/2 802.
PAGE 90
NOTE: There are several reasons why the supplicant might fail to respond; for example, the supplicant might have been booting when the request arrived or there might be a physical layer problem. To configure re-transmissions, use the following commands. ● Configure the amount of time that the authenticator waits before re-transmitting an EAP Request Identity frame. INTERFACE mode dot1x tx-period number The range is from 1 to 65535 (1 year) The default is 30.
PAGE 91
Auth PAE State: Backend State: Initialize Initialize Forcibly Authorizing or Unauthorizing a Port The 802.1X ports can be placed into any of the three states: ● ForceAuthorized — an authorized state. A device connected to this port in this state is never subjected to the authentication process, but is allowed to communicate on the network. Placing the port in this state is same as disabling 802.1X on the port. ● ForceUnauthorized — an unauthorized state.
PAGE 92
The range is from 1 to 31536000. The default is 3600. ● Configure the maximum number of times the supplicant can be re-authenticated. INTERFACE mode dot1x reauth-max number The range is from 1 to 10. The default is 2. The bold lines show that re-authentication is enabled and the new maximum and re-authentication time period. DellEMC(conf-if-tf-1/1)#dot1x reauthentication interval 7200 DellEMC(conf-if-tf-1/1)#dot1x reauth-max 10 DellEMC(conf-if-tf-1/1)#do show dot1x interface twentyFiveGigE 1/1 802.
PAGE 93
Port Control: FORCE_AUTHORIZED Port Auth Status: UNAUTHORIZED Re-Authentication: Disable Untagged VLAN id: None Guest VLAN: Disable Guest VLAN id: NONE Auth-Fail VLAN: Disable Auth-Fail VLAN id: NONE Auth-Fail Max-Attempts: NONE Tx Period: 90 seconds Quiet Period: 120 seconds ReAuth Max: 10 Supplicant Timeout: 15 seconds Server Timeout: 15 seconds Re-Auth Interval: 7200 seconds Max-EAP-Req: 10 Auth Type: Auth PAE State: Backend State: SINGLE_HOST Initialize Initialize Enter the tasks the user should do af
PAGE 94
Figure 8. Dynamic VLAN Assignment 1. Configure 8021.x globally (refer to Enabling 802.1X) along with relevant RADIUS server configurations (refer to the illustration inDynamic VLAN Assignment with Port Authentication). 2. Make the interface a switchport so that it can be assigned to a VLAN. 3. Create the VLAN to which the interface will be assigned. 4. Connect the supplicant to the port configured for 802.1X. 5.
PAGE 95
● If a port is already forwarding on the Guest VLAN when 802.1X is enabled, the port is moved out of the Guest VLAN and the authentication process begins. Configuring a Guest VLAN If the supplicant does not respond within a determined amount of time ([reauth-max + 1] * tx-period, the system assumes that the host does not have 802.1X capability and the port is placed in the Guest VLAN. NOTE: For more information about configuring timeouts, refer to Configuring Timeouts.
PAGE 96
Example of Viewing Configured Authentication 802.
PAGE 97
6 Access Control List (ACL) VLAN Groups and Content Addressable Memory (CAM) This section describes the access control list (ACL) virtual local area network (VLAN) group, and content addressable memory (CAM) enhancements.
PAGE 98
The ACL manager does not notify the ACL agent in the following cases: ● The ACL VLAN group is created. ● The ACL VLAN group is deleted and it does not contain VLAN members. ● The ACL is applied or removed from a group and the ACL group does not contain a VLAN member. ● The description of the ACL group is added or removed.
PAGE 99
acl-vlan-group {group name} 2. Add a description to the ACL VLAN group. CONFIGURATION (conf-acl-vl-grp) mode description description 3. Add VLAN member(s) to an ACL VLAN group. CONFIGURATION (conf-acl-vl-grp) mode member vlan {VLAN-range} 4. Display all the ACL VLAN groups or display a specific ACL VLAN group, identified by name.
PAGE 100
Viewing CAM Usage View the amount of CAM space available, used, and remaining in each partition (including IPv4Flow and Layer 2 ACL subpartitions) using the show cam-usage command in EXEC Privilege mode. Display Layer 2, Layer 3, ACL, or all CAM usage statistics. EXCE Privilege mode show cam usage [acl | router | switch] The following output shows CAM blocks usage for Layer 2 and Layer 3 ACLs and other processes that use CAM space: In S5048F–ON, ACL filters support more than 200 egress ACL rules.
PAGE 101
1 | | | | | | | | | | | | | | | | | | | | | | | | | | | | 0 | IN-L2 ACL | IN-L3 ACL | IN-L3 ECMP GRP | IN-L3 FIB | IN-V6 ACL | IN-NLB ACL | IPMAC ACL | OUT-L2 ACL | OUT-L3 ACL | OUT-V6 ACL 2 0 | IN-L2 ACL | IN-L3 ACL | IN-L3 FIB | IN-V6 ACL | IN-NLB ACL | IPMAC ACL | OUT-L2 ACL | OUT-L3 ACL | OUT-V6 ACL 3 0 | IN-L2 ACL | IN-L3 ACL | IN-L3 FIB | IN-V6 ACL | IN-NLB ACL | IPMAC ACL | OUT-L2 ACL | OUT-L3 ACL | OUT-V6 ACL Codes: * - cam usage is above 90%.
PAGE 102
| | OUT-V6 ACL | Codes: * - cam usage is above 90%.
PAGE 103
ACL Optimization to Increase Number of Supported IPv4 ACLs You can configure the Dell EMC Networking OS to support more number of IPv4 ACLs.
PAGE 104
7 Access Control Lists (ACLs) This chapter describes access control lists (ACLs), prefix lists, and route-maps. At their simplest, access control lists (ACLs), prefix lists, and route-maps permit or deny traffic based on MAC and/or IP addresses. This chapter describes implementing IP ACLs, IP prefix lists and route-maps. For MAC ACLS, refer to Layer 2.
PAGE 105
• • • • • • • • • Configure Layer 2 and Layer 3 ACLs Assign an IP ACL to an Interface Applying an IP ACL Configure Ingress ACLs Configure Egress ACLs Configuring UDF ACL IP Prefix Lists ACL Resequencing Route Maps IP Access Control Lists (ACLs) In Dell EMC Networking switch/routers, you can create two different types of IP ACLs: standard or extended. A standard ACL filters packets based on the source IP packet.
PAGE 106
Save the new CAM settings to the startup-config (use write-mem or copy run start) then reload the system for the new settings to take effect. CAM Optimization When you enable this command, if a policy map containing classification rules (ACL and/or dscp/ ip-precedence rules) is applied to more than one physical interface on the same port-pipe, only a single copy of the policy is written (only one FP entry is used). When you disable this command, the system behaves as described in this chapter.
PAGE 107
● L2 Egress Access list In the Dell EMC Networking OS versions prior to 9.13(0.0), the system does not install any of your ACL rules if the available CAM space is lesser than what is required for your set of ACL rules. Effective with the Dell EMC Networking OS version 9.13(0.0), the system installs your ACL rules until all the allocated CAM memory is used. If there is no implicit permit in your rule, the Dell EMC Networking OS ensures that an implicit deny is installed at the end of your rule.
PAGE 108
DellEMC(conf)#interface tw 1/1 DellEMC(conf-if-tf-1/1)#service-policy input pmap Configure ACL Range Profiles Dell EMC Networking OS allows L3 ACLs to configure range of L4 source and destination ports using the operators and range of ports. This results in multiple ACL entries that use more space in the forwarding table. Staring from Dell EMC Networking OS 9.11(0.0), you can configure the range of L4 source and destination ports as part of L3 ACLs, which results in only one ACL entry.
PAGE 109
○ Two or more match clauses within the same route-map sequence have the same match commands (though the values are different), matching a packet against these clauses is a logical OR operation. ○ Two or more match clauses within the same route-map sequence have different match commands, matching a packet against these clauses is a logical AND operation. ● If no match is found in a route-map sequence, the process moves to the next route-map sequence until a match is found, or there are no more sequences.
PAGE 110
level stub-area DellEMC# To delete all instances of that route map, use the no route-map map-name command. To delete just one instance, add the sequence number to the command syntax. DellEMC(conf)#no route-map zakho 10 DellEMC(conf)#end DellEMC#show route-map route-map zakho, permit, sequence 20 Match clauses: interface downtwentyFiveGigE 1/1 Set clauses: tag 35 level stub-area DellEMC# The following example shows a route map with multiple instances.
PAGE 111
In the following example, instance 10 permits the route having a tag value of 1000 and instances 20 and 30 deny the route having a tag value of 1000. In this scenario, Dell EMC Networking OS scans all the instances of the route-map for any permit statement. If there is a match anywhere, the route is permitted. However, other instances of the route-map deny it.
PAGE 112
match ipv6 route-source {access-list-name | prefix-list prefix-list-name} ● Match routes with a specific value. CONFIG-ROUTE-MAP mode match metric metric-value ● Match BGP routes based on the ORIGIN attribute. CONFIG-ROUTE-MAP mode match origin {egp | igp | incomplete} ● Match routes specified as internal or external to OSPF, ISIS level-1, ISIS level-2, or locally generated.
PAGE 113
set tag tag-value ● Specify a value as the route’s weight. CONFIG-ROUTE-MAP mode set weight value To create route map instances, use these commands. There is no limit to the number of set commands per route map, but the convention is to keep the number of set filters in a route map low. Set commands do not require a corresponding match command. Configure a Route Map for Route Redistribution Route maps on their own cannot affect traffic and must be included in different commands to affect routing traffic.
PAGE 114
Continue Clause Normally, when a match is found, set clauses are executed, and the packet is then forwarded; no more route-map modules are processed. If you configure the continue command at the end of a module, the next module (or a specified module) is processed even after a match is found. The following example shows a continue clause at the end of a route-map module. In this example, if a match is found in the route-map “test” module 10, module 30 is processed.
PAGE 115
Layer 4 ACL Rules Examples The following examples show the ACL commands for Layer 4 packet filtering. Permit an ACL line with L3 information only, and the fragments keyword is present: If a packet’s L3 information matches the L3 information in the ACL line, the packet's FO is checked. ● If a packet's FO > 0, the packet is permitted. ● If a packet's FO = 0, the next ACL entry is processed.
PAGE 116
CONFIG-STD-NACL mode seq sequence-number {deny | permit} {source [mask] | any | host ip-address} [count [byte] [dscp] [order] [monitor [session-id]] [fragments] NOTE: When assigning sequence numbers to filters, keep in mind that you might need to insert a new filter. To prevent reconfiguring multiple filters, assign sequence numbers in multiples of five.
PAGE 117
ip access-list standard acl1 seq 5 permit 10.1.0.0/16 monitor 177 DellEMC(config-std-nacl)# To view all configured IP ACLs, use the show ip accounting access-list command in EXEC Privilege mode. The following examples shows how to view a standard ACL filter sequence for an interface.
PAGE 118
seq 40 permit udp any eq 434 any gt mobile-ip seq 45 deny udp any eq 53 any lt ntp Configure Filters, ICMP Packets To create a filter for ICMP packets with a specified sequence number, use the following commands. 1. Create either an extended IPv4 or IPv6 ACL and assign it a unique name. CONFIGURATION mode ip access-list extended access-list-name ipv6 access-list extended access-list-name 2. Configure an extended IP ACL filter for ICMP packets.
PAGE 119
! Extended Ingress IP access list icmp on twentyFiveGigE 1/1 Total cam count 11 seq 5 permit icmp any any echo count (50 packets) seq 10 permit icmp any any echo-reply count (50 packets) seq 15 permit icmp any any host-unreachable count (50 packets) seq 20 permit icmp any any host-unknown count (50 packets) seq 25 permit icmp any any network-unknown count (50 packets) seq 30 permit icmp any any net-unreachable count (50 packets) seq 35 permit icmp any any packet-too-big count (50 packets) seq 40 permit icmp
PAGE 120
seq 40 permit icmp any any dest-unreachable count (43 packets) seq 45 permit icmp any any port-unreachable count (25 packets) Configure Filters, TCP Packets To create a filter for TCP packets with a specified sequence number, use the following commands. 1. Create an extended IP ACL and assign it a unique name. CONFIGURATION mode ip access-list extended access-list-name 2. Configure an extended IP ACL filter for TCP packets.
PAGE 121
CONFIG-EXT-NACL mode {deny | permit} tcp {source mask] | any | host ip-address}} [count [byte]] [order] [monitor [session-id]] [fragments] ● Configure a deny or permit filter to examine UDP packets. CONFIG-EXT-NACL mode {deny | permit} udp {source mask | any | host ip-address}} [count [byte]] [order] [monitor [session-id]] [fragments] When you use the log keyword, the CP logs details about the packets that match.
PAGE 122
Assign an IP ACL to an Interface To pass traffic through a configured IP ACL, assign that ACL to a physical interface, a port channel interface, or a VLAN. The IP ACL is applied to all traffic entering a physical or port channel interface and the traffic is either forwarded or dropped depending on the criteria and actions specified in the ACL. The same ACL may be applied to different interfaces and that changes its functionality.
PAGE 123
View the number of packets matching the ACL. Configure Ingress ACLs Ingress ACLs are applied to interfaces and to traffic entering the system. These system-wide ACLs eliminate the need to apply ACLs onto each interface and achieves the same results. By localizing target traffic, it is a simpler implementation. To create an ingress ACL, use the ip access-group command in EXEC Privilege mode. The example shows applying the ACL, rules to the newly created access group, and viewing the access list.
PAGE 124
DellEMC(conf-if-tf-1/1)#end DellEMC#configure terminal DellEMC(conf)#ip access-list extended abcd DellEMC(config-ext-nacl)#permit tcp any any DellEMC(config-ext-nacl)#deny icmp any any DellEMC(config-ext-nacl)#permit 1.1.1.2 DellEMC(config-ext-nacl)#end DellEMC#show ip accounting access-list ! Extended Ingress IP access list abcd on gigethernet 0/0 seq 5 permit tcp any any seq 10 deny icmp any any seq 15 permit 1.1.1.
PAGE 125
2. Change the default CAM allocation settings or reconfigure new CAM allocation settings and enable IPV4 UDF.
PAGE 126
IpMacAcl : VmanQos : EcfmAcl : FcoeAcl : iscsiOptAcl : ipv4pbr : vrfv4Acl : Openflow : fedgovacl : nlbclusteracl: 0 0 2 4 0 0 0 0 0 0 -- stack-unit 1 -Current Settings(in block sizes) 1 block = 256 entries L2Acl : 2 Ipv4Acl : 2 Ipv6Acl : 0 Ipv4Qos : 2 L2Qos : 1 L2PT : 0 IpMacAcl : 0 VmanQos : 0 EcfmAcl : 2 FcoeAcl : 4 iscsiOptAcl : 0 ipv4pbr : 0 vrfv4Acl : 0 Openflow : 0 fedgovacl : 0 nlbclusteracl: 0 0 0 0 0 0 0 0 0 0 0 Next Boot(in block sizes) 1 8(UdfEnabled) 2 0 2 0 0 0 0 0 0 0 0 0 0 0 DellEMC# Dell
PAGE 127
DellEMC# 4. Create a UDF packet format in the UDF TCAM table. CONFIGURATION mode udf-tcam name seq number DellEMC(conf)#udf-tcam ipnip seq 1 5. Configure a UDF ID to parse packet headers using the specified number of offset and required bytes. CONFIGURATION-UDF TCAM mode key description udf-id id packetbase PacketBase offset bytes length bytes DellEMC(conf-udf-tcam)#key innerL3header udf-id 6 packetbase innerL3Header offset 0 length 2 6. View the UDF TCAM configuration.
PAGE 128
permit ip {source mask | any | host ip-address} {destination mask | any | host ipaddress} udf-pkt-format name udf-qualifier-value name DellEMC(config-ext-nacl)#permit ip any any udf-pkt-format ipinip udf-qualifier-value ipnip_val1 12. View the UDF TCAM configuration.
PAGE 129
● Use a prefix list for route redistribution For a complete listing of all commands related to prefix lists, refer to the Dell EMC Networking OS Command Line Interface Reference Guide. Creating a Prefix List To create a prefix list, use the following commands. 1. Create a prefix list and assign it a unique name. You are in PREFIX LIST mode. CONFIGURATION mode ip prefix-list prefix-name 2. Create a prefix list with a sequence number and a deny or permit action.
PAGE 130
● le max-prefix-length: is the maximum prefix length to be matched (0 to 32). The example shows a prefix list in which the sequence numbers were assigned by the software. The filters were assigned sequence numbers based on the order in which they were configured (for example, the first filter was given the lowest sequence number). The show config command in PREFIX LIST mode displays two filters with the sequence numbers 5 and 10. DellEMC(conf-nprefixl)#permit 123.23.0.0 /16 DellEMC(conf-nprefixl)#deny 133.
PAGE 131
● Enter RIP mode. CONFIGURATION mode router rip ● Apply a configured prefix list to incoming routes. You can specify an interface. If you enter the name of a nonexistent prefix list, all routes are forwarded. CONFIG-ROUTER-RIP mode distribute-list prefix-list-name in [interface] ● Apply a configured prefix list to outgoing routes. You can specify an interface or type of route. If you enter the name of a non-existent prefix list, all routes are forwarded.
PAGE 132
For example, the following table contains some rules that are numbered in increments of 1. You cannot place new rules between these packets, so apply resequencing to create numbering space, as shown in the second table. In the same example, apply resequencing if more than two rules must be placed between rules 7 and 10. You can resequence IPv4 and IPv6 ACLs, prefixes, and MAC ACLs. No CAM writes happen as a result of resequencing, so there is no packet loss; the behavior is similar Hot-lock ACLs.
PAGE 133
remark 6 this remark has no corresponding rule remark 8 this remark corresponds to permit ip any host 1.1.1.2 seq 8 permit ip any host 1.1.1.2 seq 10 permit ip any host 1.1.1.3 seq 12 permit ip any host 1.1.1.4 Remarks that do not have a corresponding rule are incremented as a rule. These two mechanisms allow remarks to retain their original position in the list. The following example shows remark 10 corresponding to rule 10 and as such, they have the same number before and after the command is entered.
PAGE 134
8 Bidirectional Forwarding Detection (BFD) BFD is a protocol that is used to rapidly detect communication failures between two adjacent systems. It is a simple and lightweight replacement for existing routing protocol link state detection mechanisms. It also provides a failure detection solution for links on which no routing protocol is used. BFD is a simple hello mechanism. Two neighboring systems running BFD establish a session using a three-way handshake.
PAGE 135
BFD Packet Format Control packets are encapsulated in user datagram protocol (UDP) packets. The following illustration shows the complete encapsulation of a BFD control packet inside an IPv4 packet. Figure 9. BFD in IPv4 Packet Format Field Description Diagnostic Code The reason that the last session failed. State The current local session state. Refer to BFD Sessions. Flag A bit that indicates packet function.
PAGE 136
Field Description Your Discriminator A random number generated by the remote system to identify the session. Discriminator values are necessary to identify the session to which a control packet belongs because there can be many sessions running on a single interface. Desired Min TX Interval The minimum rate at which the local system would like to send control packets to the remote system.
PAGE 137
State Description Init The local system is communicating. Up Both systems are exchanging control packets. The session is declared down if: ● A control packet is not received within the detection time. ● Sufficient echo packets are lost. ● Demand mode is active and a control packet is not received in response to a poll packet. BFD Three-Way Handshake A three-way handshake must take place between the systems that participate in the BFD session.
PAGE 138
Session State Changes The following illustration shows how the session state on a system changes based on the status notification it receives from the remote system. For example, if a session on a system is down and it receives a Down status notification from the remote system, the session state on the local system changes to Init. Figure 11.
PAGE 139
● ● ● ● ● Configure BFD for OSPFv3 Configure BFD for IS-IS Configure BFD for BGP Configure BFD for VRRP Configuring Protocol Liveness Configure BFD for Physical Ports Configuring BFD for physical ports is supported on the C-Series and E-Series platforms only. BFD on physical ports is useful when you do not enable the routing protocol. Without BFD, if the remote system fails, the local system does not remove the connected route until the first failed attempt to send a packet.
PAGE 140
Remote Addr: 2.2.2.
PAGE 141
Establishing Sessions for Static Routes for Default VRF Sessions are established for all neighbors that are the next hop of a static route on the default VRF. Figure 12. Establishing Sessions for Static Routes To establish a BFD session, use the following command. ● Establish BFD sessions for all neighbors that are the next hop of a static route.
PAGE 142
For more information on prefix lists, see IP Prefix Lists. To enable BFD sessions on specific neighbors, perform the following steps: Enter the following command to enable BFD session on specific next-hop neighbors: CONFIGURATION ip route bfd prefix-list prefix-list-name The BFD session is established for the next-hop neighbors that are specified in the prefix-list. ● The absence of a prefix-list causes BFD sessions to be enabled on all the eligible next-hop neighbors.
PAGE 143
Configure BFD for OSPF When you use BFD with OSPF, the OSPF protocol registers with the BFD manager. BFD sessions are established with all neighboring interfaces participating in OSPF. If a neighboring interface fails, the BFD agent notifies the BFD manager, which in turn notifies the OSPF protocol that a link state change has occurred. Configuring BFD for OSPF is a two-step process: 1. Enable BFD globally. 2. Establish sessions with OSPF neighbors.
PAGE 144
To establish BFD with all OSPF neighbors or with OSPF neighbors on a single interface, use the following commands. ● Enable BFD globally. CONFIGURATION mode bfd enable ● Establish sessions with all OSPF neighbors. ROUTER-OSPF mode bfd all-neighbors ● Establish sessions with OSPF neighbors on a single interface. INTERFACE mode ip ospf bfd all-neighbors To view the established sessions, use the show bfd neighbors command. The bold line shows the OSPF BFD sessions.
PAGE 145
The following example shows the show bfd neighbors command output. show bfd neighbors * Ad Dn B C I O O3 R M V VT - Active session role Admin Down BGP CLI ISIS OSPF OSPFv3 Static Route (RTM) MPLS VRRP Vxlan Tunnel LocalAddr * 5.1.1.1 RemoteAddr 5.1.1.2 Interface Po 30 State Rx-int Tx-int Mult Up 200 200 3 Clients O * 6.1.1.1 6.1.1.2 Vl 30 Up 200 200 3 O * 7.1.1.1 7.1.1.
PAGE 146
Number Number Number Number Number of of of of of packets received from neighbor: 78 packets sent to neighbor: 78 state changes: 1 messages from IFA about port state change: 0 messages communicated b/w Manager and Agent: 4 Session Discriminator: 7 Neighbor Discriminator: 2 Local Addr: 6.1.1.1 Local MAC Addr: 00:a0:c9:00:00:02 Remote Addr: 6.1.1.
PAGE 147
Actual parameters: TX: 300ms, RX: 250ms, Multiplier: 3 Role: Active Delete session on Down: False Client Registered: CLI Uptime: 00:02:04 Statistics: Number of packets received from neighbor: 376 Number of packets sent to neighbor: 314 Number of state changes: 2 Number of messages from IFA about port state change: 0 Number of messages communicated b/w Manager and Agent: 6 DellEMC# Changing OSPF Session Parameters Configure BFD sessions with default intervals and a default role.
PAGE 148
Related Configuration Tasks ● Changing OSPFv3 Session Parameters ● Disabling BFD for OSPFv3 Establishing Sessions with OSPFv3 Neighbors You can establish BFD sessions with all OSPFv3 neighbors at once or with all neighbors out of a specific interface. Sessions are only established when the OSPFv3 adjacency is in the Full state. To establish BFD with all OSPFv3 neighbors or with OSPFv3 neighbors on a single interface, use the following commands. ● Establish sessions with all OSPFv3 neighbors.
PAGE 149
ipv6 ospf bfd all-neighbors ● To disable BFD on a specific OSPFv3 enabled interface, use the ipv6 ospf bfd all-neighbors disable command. You can also use the no bfd enable command to disable BFD on a specific interface. NOTE: You can create upto a maximum of 128 BFD sessions (combination of OSPFv2 and OSPFv3 with a timer of 300*300*3) for both default and nondefault VRFs.
PAGE 150
interface. If you change a parameter globally, the change affects all OSPFv3 neighbors sessions. If you change a parameter at the interface level, the change affects all OSPFv3 sessions on that interface. To change parameters for all OSPFv3 sessions or for OSPFv3 sessions on a single interface, use the following commands. To view session parameters, use the show bfd neighbors detail command. ● Change parameters for all OSPFv3 sessions.
PAGE 151
Establishing Sessions with IS-IS Neighbors BFD sessions can be established for all IS-IS neighbors at once or sessions can be established for all neighbors out of a specific interface. Figure 14. Establishing Sessions with IS-IS Neighbors To establish BFD with all IS-IS neighbors or with IS-IS neighbors on a single interface, use the following commands. ● Establish sessions with all IS-IS neighbors. ROUTER-ISIS mode bfd all-neighbors ● Establish sessions with IS-IS neighbors on a single interface.
PAGE 152
LocalAddr * 2.2.2.2 RemoteAddr Interface State Rx-int Tx-int Mult Clients 2.2.2.1 Tf 1/1 Up 100 100 3 I Changing IS-IS Session Parameters BFD sessions are configured with default intervals and a default role. The parameters that you can configure are: Desired TX Interval, Required Min RX Interval, Detection Multiplier, and system role. These parameters are configured for all IS-IS sessions or all IS-IS sessions out of an interface.
PAGE 153
Figure 15. Establishing Sessions with BGP Neighbors The sample configuration shows alternative ways to establish a BFD session with a BGP neighbor: ● By establishing BFD sessions with all neighbors discovered by BGP (the bfd all-neighbors command). ● By establishing a BFD session with a specified BGP neighbor (the neighbor {ip-address | peer-group-name} bfd command) BFD packets originating from a router are assigned to the highest priority egress queue to minimize transmission delays.
PAGE 154
CONFIGURATION mode bfd enable 2. Specify the AS number and enter ROUTER BGP configuration mode. CONFIGURATION mode router bgp as-number 3. Add a BGP neighbor or peer group in a remote AS. CONFIG-ROUTERBGP mode neighbor {ip-address | peer-group name} remote-as as-number 4. Enable the BGP neighbor. CONFIG-ROUTERBGP mode neighbor {ip-address | peer-group-name} no shutdown 5. Add a BGP neighbor or peer group in a remote AS. CONFIG-ROUTERBGP mode neighbor {ipv6-address | peer-group name} remote-as as-number 6.
PAGE 155
The BGP link with the neighbor returns to normal operation and uses the BFD session parameters globally configured with the bfd all-neighbors command or configured for the peer group to which the neighbor belongs. ● Disable a BFD for BGP session with a specified neighbor. ROUTER BGP mode neighbor {ip-address | ipv6–address |peer-group-name} bfd disable ● Remove the disabled state of a BFD for BGP session with a specified neighbor.
PAGE 156
neighbor 2.2.2.2 remote-as 1 neighbor 2.2.2.2 no shutdown neighbor 3.3.3.2 remote-as 1 neighbor 3.3.3.2 no shutdown bfd all-neighbors The following example shows viewing all BFD neighbors. R2# show bfd neighbors * - Active session role Ad Dn - Admin Down B - BGP C - CLI I - ISIS O - OSPF R - Static Route (RTM) M - MPLS V - VRRP LocalAddr * 1.1.1.3 * 2.2.2.3 * 3.3.3.3 RemoteAddr 1.1.1.2 2.2.2.2 3.3.3.
PAGE 157
Delete session on Down: True Client Registered: BGP Uptime: 00:02:22 Statistics: Number of packets received from neighbor: 1428 Number of packets sent to neighbor: 1428 Number of state changes: 1 Number of messages from IFA about port state change: 0 Number of messages communicated b/w Manager and Agent: 4 The following example shows viewing BFD summary information. The bold line shows the message displayed when you enable BFD for BGP connections. R2# show ip bgp summary BGP router identifier 10.0.0.
PAGE 158
Foreign host: 2.2.2.2, Foreign port: 179 E1200i_R2# R2# show ip bgp neighbors 2.2.2.3 BGP neighbor is 2.2.2.3, remote AS 1, external link Member of peer-group pg1 for session parameters BGP version 4, remote router ID 12.0.0.4 BGP state ESTABLISHED, in this state for 00:05:33 ... Neighbor is using BGP neighbor mode BFD configuration Peer active in peer-group outbound optimization ... R2# show ip bgp neighbors 2.2.2.4 BGP neighbor is 2.2.2.
PAGE 159
Establishing Sessions with All VRRP Neighbors BFD sessions can be established for all VRRP neighbors at once, or a session can be established with a particular neighbor. Figure 16. Establishing Sessions with All VRRP Neighbors To establish sessions with all VRRP neighbors, use the following command. ● Establish sessions with all VRRP neighbors.
PAGE 160
LocalAddr RemoteAddr Interface State Rx-int Tx-int Mult Clients * 2.2.5.1 2.2.5.2 Tf 1/1 Down 1000 1000 3 V To view session state information, use the show vrrp command. The bold line shows the VRRP BFD session. DellEMC(conf-if-tf-1/1)#do show vrrp -----------------twentyFiveGigE 1/1, VRID: 1, Net: 2.2.5.1 VRF:0 default State: Backup, Priority: 1, Master: 2.2.5.
PAGE 161
Configuring Protocol Liveness Protocol liveness is a feature that notifies the BFD manager when a client protocol is disabled. When you disable a client, all BFD sessions for that protocol are torn down. Neighbors on the remote system receive an Admin Down control packet and are placed in the Down state. To enable protocol liveness, use the following command. ● Enable Protocol Liveness.
PAGE 162
The output for the debug bfd event command is the same as the log messages that appear on the console by default.
PAGE 163
9 Border Gateway Protocol (BGP) Border Gateway Protocol (BGP) is an interdomain routing protocol that manages routing between edge routers. BGP uses an algorithm to exchange routing information between switches enabled with BGP. BGP determines a path to reach a particular destination using certain attributes while avoiding routing loops. BGP selects a single path as the best path to a destination network or host. You can also influence BGP to select different path by altering some of the BGP attributes.
PAGE 164
The devices within an AS (AS1 or AS2, as seen in the following illustration) exchange routing information using Internal BGP (IBGP), whereas the devices in different AS communicate using External BGP (EBGP). IBGP provides routers inside the AS with the knowledge to reach routers external to the AS. EBGP routers exchange information with other EBGP routers as well as IBGP routers to maintain connectivity and accessibility. Figure 17.
PAGE 165
Figure 18. BGP Routers in Full Mesh The number of BGP speakers each BGP peer must maintain increases exponentially. Network management quickly becomes impossible. AS4 Number Representation Dell EMC Networking OS supports multiple representations of 4-byte AS numbers: asplain, asdot+, and asdot. NOTE: The ASDOT and ASDOT+ representations are supported only with the 4-Byte AS numbers feature. If 4-Byte AS numbers are not implemented, only ASPLAIN representation is supported.
PAGE 166
● All AS numbers between 0 and 65535 are represented as a decimal number, when entered in the CLI and when displayed in the show commands outputs. ● AS Numbers larger than 65535 is represented using ASDOT notation as .. For example: AS 65546 is represented as 1.10. ASDOT representation combines the ASPLAIN and ASDOT+ representations.
PAGE 167
DellEMC(conf-router_bgp)#do sho ip bgp BGP table version is 28093, local router ID is 172.30.1.57 AS4 SUPPORT DISABLED DellEMC(conf-router_bgp)#no bgp four-octet-as-support DellEMC(conf-router_bgp)#sho conf ! router bgp 100 neighbor 172.30.1.250 local-as 65057 DellEMC(conf-router_bgp)#do show ip bgp BGP table version is 28093, local router ID is 172.30.1.57 Four-Byte AS Numbers You can use the 4-Byte (32-bit) format when configuring autonomous system numbers (ASNs).
PAGE 168
State Description Idle BGP initializes all resources, refuses all inbound BGP connection attempts, and initiates a TCP connection to the peer. Connect In this state the router waits for the TCP connection to complete, transitioning to the OpenSent state if successful. If that transition is not successful, BGP resets the ConnectRetry timer and transitions to the Active state when the timer expires. Active The router resets the ConnectRetry timer to zero and returns to the Connect state.
PAGE 169
Best Path Selection Criteria Paths for active routes are grouped in ascending order according to their neighboring external AS number (BGP best path selection is deterministic by default, which means the bgp non-deterministic-med command is NOT applied). The best path in each group is selected based on specific criteria. Only one “best path” is selected at a time. If any of the criteria results in more than one path, BGP moves on to the next option in the list.
PAGE 170
6. Prefer the path with the lowest multi-exit discriminator (MED) attribute. The following criteria apply: a. This comparison is only done if the first (neighboring) AS is the same in the two paths; the MEDs are compared only if the first AS in the AS_SEQUENCE is the same for both paths. b. If you entered the bgp always-compare-med command, MEDs are compared for all paths. c. Paths with no MED are treated as “worst” and assigned a MED of 4294967295. 7.
PAGE 171
Figure 20. BGP Local Preference Multi-Exit Discriminators (MEDs) If two ASs connect in more than one place, a multi-exit discriminator (MED) can be used to assign a preference to a preferred path. MED is one of the criteria used to determine the best path, so keep in mind that other criteria may impact selection, as shown in the illustration in Best Path Selection Criteria. One AS assigns the MED a value and the other AS uses that value to decide the preferred path.
PAGE 172
Figure 21. Multi-Exit Discriminators NOTE: Configuring the set metric-type internal command in a route-map advertises the IGP cost as MED to outbound EBGP peers when redistributing routes. The configured set metric value overwrites the default IGP cost. If the outbound route-map uses MED, it overwrites IGP MED. Origin The origin indicates the origin of the prefix, or how the prefix came into BGP. There are three origin codes: IGP, EGP, INCOMPLETE.
PAGE 173
The AS path is shown in the following example. The origin attribute is shown following the AS path information (shown in bold).
PAGE 174
IPv4 and IPv6 address family The IPv4 address family configuration in Dell EMC Networking OS is used for identifying routing sessions for protocols that use IPv4 address. You can specify multicast within the IPv4 address family. The default of address family configuration is IPv4 unicast. You can configure the VRF instances for IPv4 address family configuration. The IPv6 address family configuration is used for identifying routing sessions for protocols that use IPv6 address.
PAGE 175
Table 8. BGP Default Values (continued) Item Default Graceful Restart feature Disabled Local preference 100 MED 0 Route Flap Damping Parameters half-life = 15 minutes reuse = 750 suppress = 2000 max-suppress-time = 60 minutes Distance external distance = 20 internal distance = 200 local distance = 200 Timers keepalive = 60 seconds holdtime = 180 seconds Add-path Disabled Implement BGP with Dell EMC Networking OS The following sections describe how to implement BGP on Dell EMC Networking OS.
PAGE 176
Table 9.
PAGE 177
If you use the “no prepend” option, the Local-AS does not prepend to the updates received from the eBGP peer. If you do not select “no prepend” (the default), the Local-AS is added to the first AS segment in the AS-PATH. If an inbound route-map is used to prepend the as-path to the update from the peer, the Local-AS is added first. For example, consider the topology described in the previous illustration.
PAGE 178
● To return all values on an snmpwalk for the f10BgpM2Peer sub-OID, use the -C c option, such as snmpwalk -v 2c -C c -c public. ● An SNMP walk may terminate pre-maturely if the index does not increment lexicographically. Dell EMC Networking recommends using options to ignore such errors. ● Multiple BPG process instances are not supported. Thus, the f10BgpM2PeerInstance field in various tables is not used to locate a peer.
PAGE 179
Restrictions Dell EMC Networking OS supports only one BGP routing configuration and autonomous system (AS), but supports multiple address family configuration. Enabling BGP By default, BGP is disabled on the system. Dell EMC Networking OS supports one autonomous system (AS) and assigns the AS number (ASN). To enable the BGP process and begin exchanging information, assign an AS number and use commands in ROUTER BGP mode to configure a BGP neighbor.
PAGE 180
Following is the configuration steps: DellEMC# configure terminal DellEMC(conf)# router bgp 65535 DellEMC(conf-router_bgp)# neighbor 20.20.20.1 remote-as 20 DellEMC(conf-router_bgp)# neighbor 20.20.20.1 no shutdown DellEMC(conf-router_bgp)#exit DellEMC(conf)# The following example shows verifying the BGP configuration using the show running-config bgp command.. DellEMC#show running-config bgp ! router bgp 65535 neighbor 20.20.20.1 remote-as 20 neighbor 20.20.20.
PAGE 181
OutQ : Added 0, Withdrawn 0 Allow local AS number 0 times in AS-PATH attribute Prefixes accepted 0, withdrawn 0 by peer, martian prefixes ignored 0 Prefixes advertised 0, denied 0, withdrawn 0 from peer Connections established 0; dropped 0 Last reset never No active TCP connection Enabling four-byte autonomous system numbers You can enable 4-byte support for configuring autonomous system numbers (ASN). To enable 4-byte support for the BGP process, use the following command.
PAGE 182
Peering sessions are reset when you change the router ID of a BGP router. Upon changing the router ID, the system automatically restarts the BGP instance for the configuration to take effect. DellEMC# configure terminal DellEMC(conf)# router bgp 400 DellEMC(conf-router_bgp)# bgp router-id 1.1.1.1 Following is the sample output of show ip bgp ipv4 multicast summary command. DellEMC# show ip bgp summary BGP router identifier 1.1.1.
PAGE 183
neighbor 172.30.1.250 route-map rmap1 in neighbor 172.30.1.250 password 7 5ab3eb9a15ed02ff4f0dfd4500d6017873cfd9a267c04957 neighbor 172.30.1.250 no shutdown 5332332 9911991 65057 18508 12182 7018 46164 i The following example shows the bgp asnotation asdot command output. DellEMC(conf-router_bgp)#bgp asnotation asdot DellEMC(conf-router_bgp)#sho conf ! router bgp 100 bgp asnotation asdot bgp four-octet-as-support neighbor 172.30.1.250 remote-as 18508 neighbor 172.30.1.250 local-as 65057 neighbor 172.30.1.
PAGE 184
neighbor {ip-address | ipv6–address | peer-group-name} activate NOTE: Neighbors have to be activated using neighbor activate command in the respective address family. To exchange other address prefix types (IPv4 multicast or IPv6 unicast), the neighbors must be activated under the respective address family configuration such as address-family ipv4 multicast (for IPv4 multicast) andaddress-family ipv6 unicast(for IPv6). DellEMC(conf)# router bgp 10 DellEMC(conf-router_bgp)# neighbor 20.20.20.
PAGE 185
Following is an example to enable BGP configuration in the router B. RouterB# configure terminal RouterB(conf)# router bgp 45000 RouterB(conf-router_bgp)# bgp router-id 172.17.1.99 RouterB(conf-router_bgp)# timers bgp 70 120 RouterB(conf-router_bgp)# neighbor 192.168.1.2 remote-as 40000 RouterB(conf-router_bgp)# exit RouterB(conf)# The show ip bgp summary displays BGP configuration. Following is the sample output for show ip bgp summary command for router A.
PAGE 186
After you create a peer group, you can configure route policies for it. For information about configuring route policies for a peer group, refer to Filtering BGP Routes. See Example-Configuring BGP peer groups for configuring multiple BGP neighbors and enabling peer groups. Configuring Peer Groups To configure a peer group, use the following commands. 1. Enter the router configuration mode and the AS number. CONFIG mode router bgp as-number 2. Create a peer group by assigning a name to it.
PAGE 187
A neighbor may keep its configuration after it was added to a peer group if the neighbor’s configuration is more specific than the peer group’s and if the neighbor’s configuration does not affect outgoing updates. NOTE: When you configure a new set of BGP policies for a peer group, always reset the peer group by entering the clear ip bgp peer-group peer-group-name command in EXEC Privilege mode. To view the configuration, use the show config command in CONFIGURATION ROUTER BGP mode.
PAGE 188
Example of Enabling BGP (Router 1) R1# conf R1(conf)#int loop 0 R1(conf-if-lo-0)#ip address 192.168.128.1/32 R1(conf-if-lo-0)#no shutdown R1(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.1/24 no shutdown R1(conf-if-lo-0)#int tf 1/21 R1(conf-if-tf-1/21)#ip address 10.0.1.21/24 R1(conf-if-tf-1/21)#no shutdown R1(conf-if-tf-1/21)#show config ! interface twentyFiveGigE 1/21 ip address 10.0.1.21/24 no shutdown R1(conf-if-tf-1/21)#int tf 1/31 R1(conf-if-tf-1/31)#ip address 10.0.3.
PAGE 189
router bgp 99 network 192.168.128.0/24 neighbor 192.168.128.2 remote-as 99 neighbor 192.168.128.2 update-source Loopback 0 neighbor 10.0.3.33 no shutdown neighbor 10.0.3.33 remote-as 100 Example of Enabling BGP (Router 2) R2# conf R2(conf)#int loop 0 R2(conf-if-lo-0)#ip address 192.168.128.2/32 R2(conf-if-lo-0)#no shutdown R2(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.2/24 no shutdown R2(conf-if-lo-0)#int tf 2/11 R2(conf-if-tf-2/11)#ip address 10.0.1.
PAGE 190
R3(conf-if-tf-3/21)#router bgp 100 R3(conf-router_bgp)#show config ! router bgp 100 R3(conf-router_bgp)#neighbor 10.0.3.31 remote 99 R3(conf-router_bgp)#neighbor 10.0.3.31 no shut R3(conf-router_bgp)#neighbor 10.0.2.2 remote 99 R3(conf-router_bgp)#neighbor 10.0.2.2 no shut R3(conf-router_bgp)#show config ! router bgp 100 neighbor 10.0.3.31 remote 99 neighbor 10.0.3.31 no shut neighbor 10.0.2.2 remote 99 neighbor 10.0.2.
PAGE 191
network 192.168.128.0/24 neighbor AAA peer-group neighbor AAA no shutdown neighbor BBB peer-group neighbor BBB no shutdown neighbor 192.168.128.1 remote-as 99 neighbor 192.168.128.1 peer-group CCC neighbor 192.168.128.1 update-source Loopback 0 neighbor 192.168.128.1 no shutdown neighbor 192.168.128.3 remote-as 100 neighbor 192.168.128.3 peer-group BBB neighbor 192.168.128.3 update-source Loopback 0 neighbor 192.168.128.
PAGE 192
BGP soft-reconfiguration clears the policies without resetting the TCP connection. To reset a BGP connection using BGP soft-reconfiguration, use the clear ip bgp command in EXEC Privilege mode at the system prompt. When you change the BGP inbound policy locally, you need to process the updates received from a peer. The route-refresh capability allows the local peer to reset inbound information dynamically by exchanging route-refresh requests to supporting peers.
PAGE 193
individual neighbor. If the neighbor is part of a peer-group and when neighbor soft-reconfiguration inbound is removed from the peer group, you need to do a hard reset for the peer-group. If neighbor soft-reconfiguration inbound command is not configured ever in the router, then doing a soft reset is enough for the route-refresh updates to be sent.
PAGE 194
May 8 15:28:12 : BGP: 20.1.1.2 rcvd UPDATE w/ attr: origin ?, path 200, nexthop 20.1.1.2, metric 0, DellEMC(conf-router_bgp)#do clear ip bgp 20::2 soft in May 8 15:40:08 : BGP: 20::2 sending ROUTE_REFRESH AFI/SAFI (1/1) May 8 15:40:08 : BGP: 20::2 sending ROUTE_REFRESH AFI/SAFI (2/1) May 8 15:40:08 : BGP: 20::2 UPDATE rcvd packet len 56 May 8 15:40:08 : BGP: 20::2 rcvd UPDATE w/ attr: origin ?, path 200, nexthop 20.1.1.
PAGE 195
● Create an aggregate entry in the BGP routing table. CONFIG-ROUTER-BGP mode aggregate—address address-mask Use the aggregate-address command without any keywords to create an aggregate entry if any specific BGP routes are available in the specified range. DellEMC# configure terminal DellEMC(conf)# router bgp 100 DellEMC(conf-router_bgp)# aggregate-address 10.1.1.0/24 DellEMC(conf-router_bgp)# exit DellEMC(conf)# Following is the sample output of show ip bgp command.
PAGE 196
Filtering BGP The following section describes the methods used to filter the updates received from BGP neighbors. Following are the filtering methods of BGP updates: ● Filtering using IP prefix lists ● Filtering using route maps ● Filtering using AS-PATH information ● Filtering using community lists Regular Expressions as Filters Regular expressions are used to filter AS paths or community lists.
PAGE 197
neighbor AAA no shutdown neighbor 10.155.15.2 remote-as 32 neighbor 10.155.15.2 shutdown DellEMC(conf-router_bgp)#neigh 10.155.15.2 filter-list 1 in DellEMC(conf-router_bgp)#ex DellEMC(conf)#ip as-path access-list Eagle DellEMC(config-as-path)#deny 32$ DellEMC(config-as-path)#ex DellEMC(conf)#router bgp 99 DellEMC(conf-router_bgp)#neighbor AAA filter-list Eagle in DellEMC(conf-router_bgp)#show conf ! router bgp 99 neighbor AAA peer-group neighbor AAA filter-list Eaglein neighbor AAA no shutdown neighbor 10.
PAGE 198
CONFIGURATION mode ip prefix-list prefix-name 2. Create multiple prefix list filters with a deny or permit action. CONFIG-PREFIX LIST mode seq sequence-number {deny | permit} {any | ip-prefix [ge | le] } ● ge: minimum prefix length to be matched. ● le: maximum prefix length to me matched. For information about configuring prefix lists, refer to Access Control Lists (ACLs). 3. Return to CONFIGURATION mode. CONFIG-PREFIX LIST mode exit 4. Enter ROUTER BGP mode. CONFIGURATION mode router bgp as-number 5.
PAGE 199
CONFIG-ROUTE-MAP mode {match | set} For information about configuring route maps, see Access Control Lists (ACLs). 3. Return to CONFIGURATION mode. CONFIG-ROUTE-MAP mode exit 4. Enter ROUTER BGP mode. CONFIGURATION mode router bgp as-number 5. Filter routes based on the criteria in the configured route map.
PAGE 200
AS-PATH ACL mode exit 4. Enter ROUTER BGP mode. CONFIGURATION mode router bgp as-number 5. Use a configured AS-PATH ACL for route filtering and manipulation. CONFIG-ROUTER-BGP mode neighbor {ip-address | ipv6-address | peer-group-name} filter-list as-path-name {in | out} If you assign an non-existent or empty AS-PATH ACL, the software allows all routes. To view all BGP path attributes in the BGP database, use the show ip bgp paths command in EXEC Privilege mode.
PAGE 201
CONFIG-ROUTER-BGP mode neighbor {ip-address | ipv6-address | peer-group-name} route-map map-name {in | out} DellEMC# configure terminal DellEMC(conf)# router bgp 400 DellEMC(conf-router_bgp)# neighbor 10.10.10.1 remote-as 500 DellEMC(conf-router_bgp)# neighbor 10.10.10.
PAGE 202
Sent 45 messages, 5 notifications, Received 6 updates, Sent 0 updates Route refresh request: received 0, Minimum time between advertisement Minimum time before advertisements 0 in queue sent 0 runs is 5 seconds start is 0 seconds Capabilities received from neighbor for IPv4 Unicast : MULTIPROTO_EXT(1) ROUTE_REFRESH(2) CISCO_ROUTE_REFRESH(128) Capabilities advertised to neighbor for IPv4 Unicast : MULTIPROTO_EXT(1) ROUTE_REFRESH(2) CISCO_ROUTE_REFRESH(128) fall-over enabled Update source set to Loopback 0
PAGE 203
Configuring Passive Peering When you enable a peer-group, the software sends an OPEN message to initiate a TCP connection. If you enable passive peering for the peer group, the software does not send an OPEN message, but it responds to an OPEN message. When a BGP neighbor connection with authentication configured is rejected by a passive peer-group, Dell EMC Networking OS does not allow another passive peer-group on the same subnet to connect with the BGP neighbor.
PAGE 204
To enable graceful restart, use the following command. bgp graceful-restart [restart-time seconds] [stale-path-time seconds] [role receiver-only] To return to the default, use the no bgp graceful-restart command. ● Enable graceful restart for the BGP node. CONFIG-ROUTER-BGP mode bgp graceful-restart ● Set maximum restart time, in seconds, to restart and bring-up all the peers. CONFIG-ROUTER-BGP mode bgp graceful-restart [restart-time time-in-seconds] The default is 120 seconds.
PAGE 205
redistribute ospf process-id [match external {1 | 2} | match internal] [metric-type {external | internal}] [route-map map-name] Configure the following parameters: ○ ospf: Indicates that you are redistributing OSPF routes in BGP. ○ process-id: the range is from 1 to 65535. ○ match internal, external1, and external2: Specify the type of OSPF routes to be redistributed into BGP. ○ metric-type: external or internal.
PAGE 206
The above configuration example shows how to enable BGP additional paths to be sent and received with a maximum of two additional paths to the peers. You can configure the neighbor to send and receive additional paths using the neighbor addpathcommand at the address family configuration level. Configuring IP Community Lists Within Dell EMC Networking OS, you have multiple methods of manipulating routing attributes. One attribute you can manipulate is the COMMUNITY attribute.
PAGE 207
deny 704:666 deny 705:666 deny 14551:666 DellEMC# Configuring an IP Extended Community List To configure an IP extended community list, use these commands. 1. Create a extended community list and enter the EXTCOMMUNITY-LIST mode. CONFIGURATION mode ip extcommunity-list extcommunity-list-name 2. Two types of extended communities are supported.
PAGE 208
Configure BGP attributes Following sections explain how to configure the BGP attributes such as MED, COMMUNITY, WEIGHT, and LOCAL_PREFERENCE. Changing MED Attributes By default, Dell EMC Networking OS uses the MULTI_EXIT_DISC or MED attribute when comparing EBGP paths received from different BGP neighbors or peers from the same AS for the same route. You can configure the device to compare the MED attributes from neighbors or peers in different AS using the bgp always-compare-med command.
PAGE 209
Configure a community list by denying or permitting specific community numbers or types of community. ● community-number: use AA:NN format where AA is the AS number (2 or 4 Bytes) and NN is a value specific to that autonomous system. ● local-AS: routes with the COMMUNITY attribute of NO_EXPORT_SUBCONFED and are not sent to EBGP peers. ● no-advertise: routes with the COMMUNITY attribute of NO_ADVERTISE and are not advertised. ● no-export: routes with the COMMUNITY attribute of NO_EXPORT.
PAGE 210
value: the range is from 0 to 4294967295. The default is 100. DellEMC# configure terminal DellEMC(conf)# router bgp 400 DellEMC(conf_router_bgp)# neighbor 10.10.10.1 remote-as 500 DellEMC(conf_router_bgp)# bgp default local-preference 150 DellEMC(conf_router_bgp)# exit In the above example configuration, the default LOCAL_PREFERENCE value is changed to 150 for all the updates from AS 500 to AS 400. The default value is 100.
PAGE 211
● Disable next hop processing and configure the router (route reflector) as the next hop for a BGP neighbor. CONFIG-ROUTER-BGP mode neighbor {ip-address | ipv6-address | peer-group-name} next-hop-self [all] If you do not use the all keyword, the next hop of only eBGP-learned routes is updated by the route reflector. If you use the all keyword, the next hop of both eBGP- and iBGP-learned routes are updated by the route reflector. ● Sets the next hop address.
PAGE 212
○ number: Maximum number of parallel paths. The range is from 2 to 64. DellEMC# configure terminal DellEMC(conf)# router bgp 400 DellEMC(conf-router_bgp)# maximum-paths ibgp 5 DellEMC(conf-router_bgp)# exit In the above example configuration, the maximum number of parallel internal BGP routes is set to 5, so that only 5 routes can be installed in a routing table. The show ip bgp network command includes multipath information for that network.
PAGE 213
● Assign a cluster ID or an IP address to a router reflector cluster. CONFIG-ROUTER-BGP mode bgp cluster-id ip-address | number ○ ip-address: IP address as the route reflector cluster ID. ○ number: A route reflector cluster ID as a number from 1 to 4294967295. You can have multiple clusters in an AS. When a BGP cluster contains only one route reflector, the cluster ID is the route reflector’s router ID. For redundancy, a BGP cluster may contain two or more route reflectors.
PAGE 214
○ reuse: the range is from 1 to 20000. This number is compared to the flapping route’s Penalty value. If the Penalty value is less than the reuse value, the flapping route is once again advertised (or no longer suppressed). Withdrawn routes are removed from history state. The default is 750. ○ suppress: the range is from 1 to 20000. This number is compared to the flapping route’s Penalty value.
PAGE 215
DellEMC(conf-router_bgp)#bgp dampening 2 2000 ? <1-20000> Value to start suppressing a route (default = 2000) DellEMC(conf-router_bgp)#bgp dampening 2 2000 3000 ? <1-255> Maximum duration to suppress a stable route (default = 60) DellEMC(conf-router_bgp)#bgp dampening 2 2000 3000 10 ? route-map Route-map to specify criteria for dampening To view a count of dampened routes, history routes, and penalized routes when you enable route dampening, look at the seventh line of the show ip bgp summary command o
PAGE 216
○ holdtime: Time interval, in seconds, between the last keepalive message and declaring the BGP peer is dead. The range is from 3 to 65536. The default is 180 seconds. DellEMC# configure terminal DellEMC(conf)# router bgp 400 DellEMC(conf-router_bgp)# network 10.1.1.0 mask 255.255.255.
PAGE 217
To enable or disable BGP neighbors corresponding to the IPv4 unicast address families, use the following commands: 1. Enter the router bgp mode using the following command: CONFIGURATION Mode router bgp as-number 2. Shut down the BGP neighbors corresponding to the IPv4 unicast address family using the following command: shutdown address-family-ipv4-unicast To enable or disable BGP neighbors corresponding to IPv4 multicast address family: 1.
PAGE 218
Route Map Continue The BGP route map continue feature, continue [sequence-number], (in ROUTE-MAP mode) allows movement from one route-map entry to a specific route-map entry (the sequence number). If you do not specify a sequence number, the continue feature moves to the next sequence number (also known as an “implied continue”). If a match clause exists, the continue feature executes only after a successful match occurs. If there are no successful matches, continue is ignored.
PAGE 219
Configuring a BGP VRF address family To perform BGP configuration between two neighbors that must exchange IPv6 or IPv4 VRF information, use the following commands. Following are the steps to configure BGP VRF address-family between two peers. ● Configure a VRF routing table. CONFIG mode ip vrf vrf-name For more information on VRF configuration, see Virtual Routing and Forwarding (VRF). ● Enter the router configuration mode and the AS number.
PAGE 220
bgp router-id 1.1.1.1 network 10.10.21.0/24 bgp four-octet-as-support neighbor 20.20.20.1 remote-as 65550 neighbor 20.20.20.1 no shutdown ! address-family ipv4 vrf vrf1 neighbor 50.0.0.2 maximum-prefix 10000 warning-only neighbor 50.0.0.2 remote-as 200 neighbor 50.0.0.2 no shutdown exit-address-family ! address-family ipv4 multicast vrf vrf1 neighbor 50.0.0.2 activate exit-address-family ! address-family ipv6 unicast vrf vrf1 neighbor 50.0.0.
PAGE 221
Allowing an AS Number to Appear in its Own AS Path This command allows you to set the number of times a particular AS number can occur in the AS path. The allow-as feature permits a BGP speaker to allow the ASN to be present for a specified number of times in the update received from the peer, even if that ASN matches its own. The AS-PATH loop is detected if the local ASN is present more than the specified number of times in the command.
PAGE 222
● Exchange of IPv4 multicast route information occurs through the use of two new attributes called MP_REACH_NLRI and MP_UNREACH_NLRI, for feasible and withdrawn routes, respectively. ● If the peer has not been activated in any AFI/SAFI, the peer remains in Idle state. Most Dell EMC Networking OS BGP IPv4 unicast commands are extended to support the IPv4 multicast RIB using extra options to the command.
PAGE 223
Example-Configuring IPv4 and IPv6 neighbors The following example configurations show how to enable BGP and set up some peer under IPv4 and IPv6 address families. To support your own IP addresses, interfaces, names, and so on, you can copy and paste from these examples to your CLI. Be sure that you make the necessary changes.
PAGE 224
BGP local RIB : Routes to be Added 0, Replaced 0, Withdrawn 0 1 neighbor(s) using 24576 bytes of memory Neighbor 20.20.20.2 R1# AS 200 MsgRcvd 10 MsgSent 20 TblVer 0 InQ 0 OutQ Up/Down State/Pfx 0 00:06:11 0 Following is the output of show ip bgp ipv6 unicast summary command for the above configuration example. R1#show ip bgp ipv6 unicast summary BGP router identifier 1.1.1.
PAGE 225
Configure IPv6 NH Automatically for IPv6 Prefix Advertised over IPv4 Neighbor You can configure the system to pick the next hop IPv6 address dynamically for IPv6 prefix advertised over an IPv4 neighbor configured under IPv6 address family. If there is no IPv6 address configured on the local interface, the system uses the IPv4 mapped IPv6 address. If there are multiple IPv6 addresses configured on the interface, the system uses the lowest IPv6 address configured on that interface.
PAGE 226
! exit-address-family Example configuration performed in R2 DellEMC# configure terminal DellEMC(conf)# router bgp 20 DellEMC(conf-router_bgp)# neighbor 10.1.1.1 remote-as 655 DellEMC(conf-router_bgp)# neighbor 10.1.1.1 no shutdown DellEMC(conf-router_bgp)# address-family ipv6 unicast DellEMC(conf-router_bgpv6_af)# neighbor 10.1.1.1 activate DellECM(conf-router_bgpv6_af)# exit Following is the show running-config command output for the above configuration.
PAGE 227
● View information about local BGP state changes and other BGP events. EXEC Privilege mode debug ip bgp [ip-address | peer-group peer-group-name] events [in | out] ● View information about BGP KEEPALIVE messages. EXEC Privilege mode debug ip bgp [ip-address | peer-group peer-group-name] keepalive [in | out] ● View information about BGP notifications received from or sent to neighbors.
PAGE 228
For address family: IPv4 Unicast BGP table version 1395, neighbor version 1394 Prefixes accepted 1 (consume 4 bytes), 0 withdrawn by peer Prefixes advertised 0, rejected 0, 0 withdrawn from peer Connections established 3; dropped 2 Last reset 00:00:12, due to Missing well known attribute Notification History 'UPDATE error/Missing well-known attr' Sent : 1 Recv: 0 'Connection Reset' Sent : 1 Recv: 0 Last notification (len 21) sent 00:26:02 ago ffffffff ffffffff ffffffff ffffffff 00160303 03010000 Last notifi
PAGE 229
10 Content Addressable Memory (CAM) CAM is a type of memory that stores information in the form of a lookup table. On Dell EMC Networking systems, CAM stores Layer 2 (L2) and Layer 3 (L3) forwarding information, access-lists (ACLs), flows, and routing policies.
PAGE 230
Table 11. Default Cam Allocation Settings (continued) CAM Allocation Setting nlbclusteracl 0 NOTE: When you reconfigure CAM allocation, use the nlbclusteracl number command to change the number of NLB ARP entries. The range is from 0 to 2. The default value is 0. At the default value of 0, eight NLB ARP entries are available for use. This platform supports upto 512 CAM entries. Select 1 to configure 256 entries. Select 2 to configure 1024 entries.
PAGE 231
cam-acl {default | l2acl number ipv4acl number ipv6acl number ipv4qos number l2qos number l2pt number ipmacacl number vman-qos | vman-dual-qos number ecfmacl number nlbcluster number ipv4pbr number openflow number | fcoe number [vrfv4acl number] NOTE: If you do not enter the allocation values for the CAM regions, the value is 0. 3. Execute write memory and verify that the new settings are written to the CAM on the next boot. EXEC Privilege mode show cam-acl 4. Reload the system.
PAGE 232
Ipv6Acl : Ipv4Qos : L2Qos : L2PT : IpMacAcl : VmanQos : EtsAcl : FcoeAcl : ipv4pbr : vrfv4Acl : Openflow : fedgovacl : nlbclusteracl: 0 2 2 0 1 0 0 0 0 0 0 0 0 3 2 0 0 0 0 0 0 0 0 0 0 0 DellEMC# NOTE: If you change the cam-acl setting from CONFIGURATION mode, the output of this command does not reflect any changes until you save the running-configuration and reload the chassis.
PAGE 233
Example of the show cam-usage Command DellEMC#show cam-usage Stackunit|Portpipe|Pipeline| CAM Partition | Total CAM | Used CAM |Available CAM ========|========|========|=================|=============|=============|============== 1 | 0 | 0 | IN-L2 ACL | 0 | 0 | 0 | | | IN-L3 ACL | 512 | 1 | 511 | | | IN-L3 ECMP GRP | 2048 | 0 | 2048 | | | IN-V6 ACL | 256 | 0 | 256 | | | IN-NLB ACL | 0 | 0 | 0 | | | IPMAC ACL | 256 | 0 | 256 | | | IN-L3-UDFMIRRACL| 256 | 3 | 253 (IN-V6-MIRR ACL) | | | IN-L3-MIRR ACL | 0 | 0
PAGE 234
Dell EMC Networking OS supports the ability to view the actual CAM usage before applying a service-policy. The test camusage service-policy command provides this test framework. For more information, refer to Pre-Calculating Available QoS CAM Space. Syslog Error When the Table is Full In the Dell EMC Networking OS, the table full condition is displayed as CAM full only for LPM. But now the LPM is split into two tables. There are two syslog errors that are displayed: 1. /65 to /128 Table full. 2.
PAGE 235
Hardware forwarding-table mode is changed. Save the configuration and reload to take effect.
PAGE 236
11 Control Plane Policing (CoPP) Control plane policing (CoPP) uses access control list (ACL) rules and quality of service (QoS) policies to create filters for a system’s control plane. That filter prevents traffic not specifically identified as legitimate from reaching the system control plane, rate-limits, traffic to an acceptable level.
PAGE 237
Figure 28. CoPP Implemented Versus CoPP Not Implemented Topics: • Configure Control Plane Policing Configure Control Plane Policing The system can process a maximum of 8500 packets per second (PPS). Protocols that share a single queue may experience flaps if one of the protocols receives a high rate of control traffic even though per protocol CoPP is applied. This happens because queue-based rate limiting is applied first.
PAGE 238
Configuring CoPP for Protocols This section lists the commands necessary to create and enable the service-policies for CoPP. For complete information about creating ACLs and QoS rules, refer to Access Control Lists (ACLs) and Quality of Service (QoS). The basics for creating a CoPP service policy are to create a Layer 2, Layer 3, and/or an IPv6 ACL rule for the desired protocol type. Then, create a QoS input policy to rate-limit the protocol traffics according to the ACL.
PAGE 239
DellEMC(conf)#mac access-list extended lacp cpu-qos DellEMC(conf-mac-acl-cpuqos)#permit lacp DellEMC(conf-mac-acl-cpuqos)#exit DellEMC(conf)#ipv6 access-list ipv6-icmp cpu-qos DellEMC(conf-ipv6-acl-cpuqos)#permit icmp DellEMC(conf-ipv6-acl-cpuqos)#exit DellEMC(conf)#ipv6 access-list ipv6-vrrp cpu-qos DellEMC(conf-ipv6-acl-cpuqos)#permit vrrp DellEMC(conf-ipv6-acl-cpuqos)#exit The following example shows creating the QoS input policy.
PAGE 240
1. Create a QoS input policy for the router and assign the policing. CONFIGURATION mode qos-policy-input name cpu-qos 2. Create an input policy-map to assign the QoS policy to the desired service queues.l. CONFIGURATION mode policy-map--input name cpu-qos service-queue queue-number qos-policy name 3. Enter Control Plane mode. CONFIGURATION mode control-plane-cpuqos 4. Assign a CPU queue-based service policy on the control plane in cpu-qos mode.
PAGE 241
Table 15.
PAGE 242
Displaying CoPP Configuration The CLI provides show commands to display the protocol traffic assigned to each control-plane queue and the current rate-limit applied to each queue. Other show commands display statistical information for trouble shooting CoPP operation. To view the rates for each queue, use the show cpu-queue rate cp command.
PAGE 243
Example of Viewing Queue Mapping for IPv6 Protocols DellEMC#show ipv6 protocol-queue-mapping Protocol Src-Port Dst-Port TcpFlag ---------------------------TCP (BGP) any/179 179/any _ UDP (DHCPV6) 546/547 546/547 _ ICMPV6 NA any any _ ICMPV6 RA any any _ ICMPV6 NS any any _ ICMPV6 RS any any _ ICMPV6 any any _ VRRPV6 any any _ OSPFV3 any any _ DellEMC# Queue ----Q9 Q10 Q6 Q6 Q5 Q5 Q6 Q10 Q9 EgPort -----_ _ _ _ _ _ _ _ _ Rate (kbps) ----------_ _ _ _ _ _ _ _ _ Control Plane Policing (CoPP) 243
PAGE 244
12 Data Center Bridging (DCB) Data center bridging (DCB) refers to a set of enhancements to Ethernet local area networks used in data center environments, particularly with clustering and storage area networks.
PAGE 245
A CNA is a computer input/output device that combines the functionality of a host bus adapter (HBA) with a network interface controller (NIC). Multiple adapters on different devices for several traffic types are no longer required.
PAGE 246
Figure 29. Illustration of Traffic Congestion The system supports loading two DCB_Config files: ● FCoE converged traffic with priority 3. ● iSCSI storage traffic with priority 4. ● FCoE converged traffic with priority 3. In the Dell EMC Networking OS, PFC is implemented as follows: ● PFC is supported on specified 802.1p priority traffic (dot1p 0 to 7) and is configured per interface.
PAGE 247
NOTE: Use the following command to enable etsacl: cam-acl l2acl 2 ipv4acl 2 ipv6acl 0 ipv4qos 0 l2qos 0 l2pt 0 ipmacacl 0 vman-qos 0 fcoeacl 2 etsacl 3. After executing this command, you must save the configuration and then reload the system. The following figure shows how ETS allows you to allocate bandwidth when different traffic types are classed according to 802.1p priority and mapped to priority groups. Figure 30.
PAGE 248
Data Center Bridging in a Traffic Flow The following figure shows how DCB handles a traffic flow on an interface. Figure 31. DCB PFC and ETS Traffic Handling Buffer Organization This section describes the buffer organization on the platform. A single chip architecture can allocate or share all its resource on all the ports. However, the system runs on a different 2x2 chip design. In this design, all ports are assigned to four port-sets.
PAGE 249
(KB) (KB) ---------------------------------------------------------------------------------------------------1 0.0 4727 2656 1040 1040 576 1 0.1 4727 2656 1040 1040 576 1 0.2 4727 2656 1040 1040 576 1 0.
PAGE 250
PFC Total Buffer: Maximum buffer available for lossless queues. PFC Shared Buffer: Buffer used by ingress priority groups for shared usage. PFC Headroom Buffer: Buffer used by ingress priority group for shared headroom usage. PFC Available Buffer: Current buffer available for new lossless queues to be Provisioned.
PAGE 251
Table 17. XPE Numbering on Dell EMC Networking OS (continued) XPE Numbering XPE A of MMU Slice S 0.1 XPE B of MMU Slice R 0.2 XPE B of MMU Slice S 0.3 Enabling Data Center Bridging DCB is automatically configured when you configure FCoE or iSCSI optimization. Data center bridging supports converged enhanced Ethernet (CEE) in a data center network. DCB is disabled by default. It must be enabled to support CEE.
PAGE 252
Important Points to Remember ● If you remove a dot1p priority-to-priority group mapping from a DCB map (no priority pgid command), the PFC and ETS parameters revert to their default values on the interfaces on which the DCB map is applied. By default, PFC is not applied on specific 802.1p priorities; ETS assigns equal bandwidth to each 802.1p priority. As a result, PFC and lossless port queues are disabled on 802.
PAGE 253
CONFIGURATION mode priority-group group-num {bandwidth bandwidth | strict-priority} pfc on The range for priority group is from 0 to 7. Set the bandwidth in percentage. The percentage range is from 1 to 100% in units of 1%. Committed and peak bandwidth is in megabits per second. The range is from 0 to 100000. Committed and peak burst size is in kilobytes. Default is 50. The range is from 0 to 100000. The pfc on command enables priority-based flow control. 3.
PAGE 254
pfc no-drop queues queue-range For the dot1p-queue assignments, refer to the dot1p Priority-Queue Assignment table. The maximum number of lossless queues globally supported on the switch is two. The range is from 0 to 7. Separate the queue values with a comma; specify a priority range with a dash; for example, pfc no-drop queues 1,7 or pfc no-drop queues 2-7. The default: No lossless queues are configured. 3. Configure to drop the unknown unicast packets flooding on lossless priorities.
PAGE 255
As soon as you apply a DCB map with PFC enabled on an interface, DCBx starts exchanging information with a peer. The IEEE802.1Qbb, CEE and CINIEEE802.1Qbb and CEE versions of PFC TLV are supported. DCBx also validates PFC configurations that are received in TLVs from peer devices. By applying a DCB map with PFC enabled, you enable PFC operations on ingress port traffic. To achieve complete lossless handling of traffic, configure PFC priorities on all DCB egress ports.
PAGE 256
Applying a DCB Map on a Port When you apply a DCB map with PFC enabled on a switch interface, a memory buffer for PFC-enabled priority traffic is automatically allocated. The buffer size is allocated according to the number of PFC-enabled priorities in the assigned map. To apply a DCB map to an Ethernet port, follow these steps: Table 18. DCB Map to an Ethernet Port Step Task Command Command Mode 1 Enter interface configuration mode on an Ethernet port.
PAGE 257
Configuring no-drop queues is applicable only on the interfaces which do not need PFC. Example: Port A —> Port B Port C —> Port B PFC no-drop queues are configured for queues 1, 2 on Port B. PFC capability is enabled on priorities 3, 4 on PORT A and C. Port B acting as Egress During the congestion, [traffic pump on priorities 3 and 4 from PORT A and PORT C is at full line rate], PORT A and C send out the PFCs to rate the traffic limit.
PAGE 258
Table 20. Configuring Lossless Queues on a Port Interface (continued) Step Task Command Command Mode Range: 0-3. Separate queue values with a comma; specify a priority range with a dash; for example: pfc no-drop queues 1,3 or pfc no-drop queues 2-3 Default: No lossless queues are configured.
PAGE 259
The number of lossless queues supported on the system is dependent on the availability of total buffers for PFC. However, modifying the buffer allocation per queue impacts this default behavior. The number of lossless queues supported on the system is dependent on the availability of total buffers for PFC. The default configuration in the system guarantees a minimum of 9 KB per queue. However, modifying the buffer allocation per queue impacts this default behavior.
PAGE 260
Table 21. Buffer usage statistics when shared headroom is not used (continued) Parameter Description NOTE: 76KB is the headroom space that is required per PG [or a lossless queue] on a 40 Gigabit port in a worst case scenario to guarantee lossless behavior. Total buffer required for 2 lossless queues on 12 ports 12*2*94 + 208 = 2464KB NOTE: Out of the 2464KB, 1824KB [12*2*76KB] is reserved only for the headroom, which might never be utilized in most of the cases.
PAGE 261
continue to be the ingress threshold limit for bursty traffic. This attribute determines the maximum buffer a PG can use from the shared head room pool. Viewing Shared Head Room Usage You can obtain an instantaneous usage count for the shared hear room pool. To view the head room usage count: Enter the following show command: EXEC-Privilege Mode show hardware buffer headroom-pool [detail] buffer-info NOTE: The detail option display the current headroom pool usage in each of the Pipelines in the device.
PAGE 262
● When Peer sends a PFC message for Priority 2, based on above PRIO2COS table (TABLE 2), Queue 1Queue 2 is halted. ● Queue 1Queue 2 starts buffering the packets with Dot1p 2. This causes PG6 buffer counter to increase on the ingress, since P-dot1p 2 is mapped to PG6. ● As the PG6 watermark threshold is reached, PFC generates for dot1p 2.
PAGE 263
SNMP Support for PFC and Buffer Statistics Tracking Buffer Statistics Tracking (BST) feature provides a mechanism to aid in Resource Monitoring and Tuning of Buffer Allocation. The Max Use Count mode provides the maximum value of the counters accumulated over a period of time. Priority Flow Control (PFC) provides a link level flow control mechanism, which is controlled independently for each frame priority. The goal of this mechanism is to ensure zero loss under congestion in DCB networks.
PAGE 264
In ingress, the buffers are accounted at per PG basis and would indicate the number of the packets that has ingress this port PG but still queued up in egress pipeline. However, there is no direct mapping between the PG and Queue. Packet is assigned an internal priority on the ingress pipeline based on the queue to which it is destined. This Internal-priority to Queue mapping has been modified and enhanced as follows for the device: Table 24.
PAGE 265
Table 25. Dot1p to Queue Mapping (continued) Packet-Dot1p Queue 7 7 Table 25. Dot1p to Queue Mapping Dot1p Priority Queue 0 1 1 0 2 2 3 3 4 4 5 5 6 6 7 7 PFC and ETS Configuration Examples This section contains examples of how to configure and apply DCB policies on an interface.
PAGE 266
Generation of PFC for a Priority for Untagged Packets In order to generate PFC for a particular priority for untagged packets, and configuring PFC for that priority, you should find the queue number associated with priority from TABLE 1 and Associate a DCB map to forward the matched DSCP packet to that queue. PFC frames gets generated with PFC priority associated with the queue when the queue gets congested.
PAGE 267
Dell EMC Networking OS Behavior: A priority group consists of 802.1p priority values that are grouped for similar bandwidth allocation and scheduling, and that share latency and loss requirements. All 802.1p priorities mapped to the same queue must be in the same priority group. Configure all 802.1p priorities in priority groups associated with an ETS output policy. You can assign each dot1p priority to only one priority group. By default, all 802.
PAGE 268
● Traffic in priority groups is assigned to strict-queue or weighted round-robin (WRR) scheduling in an ETS configuration and is managed using the ETS bandwidth-assignment algorithm. Dell EMC Networking OS de-queues all frames of strict-priority traffic before servicing any other queues. A queue with strict-priority traffic can starve other queues in the same port. ● ETS-assigned bandwidth allocation and strict-priority scheduling apply only to data queues, not to control queues.
PAGE 269
Hierarchical Scheduling in ETS Output Policies ETS supports up to three levels of hierarchical scheduling. For example, you can apply ETS output policies with the following configurations: Priority group 1 Assigns traffic to one priority queue with 20% of the link bandwidth and strict-priority scheduling. Priority group 2 Assigns traffic to one priority queue with 30% of the link bandwidth.
PAGE 270
● Configure Enhanced Transmission Selection DCBx supports the following versions: CIN, CEE, and IEEE2.5CEE and IEEE2.5. Prerequisite: For DCBx, enable LLDP on all DCB devices. DCBx Operation DCBx performs the following operations: ● Discovers DCB configuration (such as PFC and ETS) in a peer device. ● Detects DCB mis-configuration in a peer device; that is, when DCB features are not compatibly configured on a peer device and the local switch.
PAGE 271
Configuration source The port is configured to serve as a source of configuration information on the switch. Peer DCB configurations received on the port are propagated to other DCBx auto-configured ports. If the peer configuration is compatible with a port configuration, DCBx is enabled on the port. On a configuration-source port, the link with a DCBx peer is enabled when the port receives a DCB configuration that can be internally propagated to other auto-configured ports.
PAGE 272
is not compatible, a warning message is logged and the DCBx frame error counter is incremented. Although DCBx is operationally disabled, the port keeps the peer link up and continues to exchange DCBx packets. If a compatible peer configuration is later received, DCBx is enabled on the port. ● If there is no configuration source, a port may elect itself as the configuration source.
PAGE 273
DCBx Example The following figure shows how to use DCBx. The external 40GbE ports on the base module (ports 33 and 37) of two switches are used for uplinks configured as DCBx autoupstream ports. The device is connected to third-party, top-of-rack (ToR) switches through uplinks. The ToR switches are part of a Fibre Channel storage network. The internal ports (ports 1-32) connected to the 10GbE backplane are configured as auto-downstream ports. Figure 32.
PAGE 274
3. Configure the DCBx version used on the interface, where: auto configures the port to operate using the DCBx version received from a peer. PROTOCOL LLDP mode [no] DCBx version {auto | cee | cin | ieee-v2.5} ● cee: configures the port to use CEE (Intel 1.01). ● cin: configures the port to use Cisco-Intel-Nuova (DCBx 1.0). ● ieee-v2.5: configures the port to use IEEE 802.1Qaz (Draft 2.5). The default is Auto. 4. Configure the DCBx port role the interface uses to exchange DCB information.
PAGE 275
configure 2. Enter LLDP Configuration mode to enable DCBx operation. CONFIGURATION mode [no] protocol lldp 3. Configure the DCBx version used on all interfaces not already configured to exchange DCB information. PROTOCOL LLDP mode [no] DCBx version {auto | cee | cin | ieee-v2.5} ● auto: configures all ports to operate using the DCBx version received from a peer. ● cee: configures a port to use CEE (Intel 1.01). cin configures a port to use Cisco-Intel-Nuova (DCBx 1.0). ● ieee-v2.
PAGE 276
DCBx Error Messages The following syslog messages appear when an error in DCBx operation occurs. LLDP_MULTIPLE_PEER_DETECTED: DCBx is operationally disabled after detecting more than one DCBx peer on the port interface. LLDP_PEER_AGE_OUT: DCBx is disabled as a result of LLDP timing out on a DCBx peer interface. DSM_DCBx_PEER_VERSION_CONFLICT: A local port expected to receive the IEEE, CIN, or CEE version in a DCBx TLV from a remote peer but received a different, conflicting DCBx version.
PAGE 277
Verifying the DCB Configuration To display DCB configurations, use the following show commands. Table 26. Displaying DCB Configurations Command Output show qos dot1p-queue mapping Displays the current 802.1p priority-queue mapping. Displays the data center bridging status, number of PFCenabled ports, and number of PFC-enabled queues. show qos priority-groups Displays the ETS priority groups configured on the switch, including the 802.1p priority classes and ID of each group.
PAGE 278
PfcMode:ON -------------------PG:0 TSA:ETS BW:50 PFC:OFF Priorities:0 1 2 5 6 7 PG:1 TSA:ETS BW:50 Priorities:3 4 PFC:ON The following example shows the show interfaces pfc summary command.
PAGE 279
Table 27. show interface pfc summary Command Description (continued) Fields Description Operational status (local port) DCBx operational status (enabled or disabled) with a list of the configured PFC priorities. Port state for current operational PFC configuration: ● Init: Local PFC configuration parameters were exchanged with peer. ● Recommend: Remote PFC configuration parameters were received from peer. ● Internally propagated: PFC configuration parameters were received from configuration source.
PAGE 280
Hu 1/49 Hu 1/49 Hu 1/49 Hu 1/49 Hu 1/49 DellEMC# DellEMC# P3 P4 P5 P6 P7 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 The following example shows the show interface ets summary command.
PAGE 281
1 2 3 4 5 6 7 Priority# Bandwidth TSA 0 1 2 3 4 5 6 7 Remote Parameters: ------------------Remote is disabled Local Parameters : -----------------Local is enabled TC-grp Priority# 0 0,1,2,3,4,5,6,7 1 2 3 4 5 6 7 0% 0% 0% 0% 0% 0% 0% ETS ETS ETS ETS ETS ETS ETS 13% 13% 13% 13% 12% 12% 12% 12% ETS ETS ETS ETS ETS ETS ETS ETS Bandwidth 100% 0% 0% 0% 0% 0% 0% 0% TSA ETS ETS ETS ETS ETS ETS ETS ETS Priority# Bandwidth 0 13% 1 13% 2 13% 3 13% 4 12% 5 12% 6 12% 7 12% Oper status is init Conf TLV Tx Status i
PAGE 282
Table 28. show interface ets detail Command Description (continued) Field Description exchange, the Willing bit received in ETS TLVs from the remote peer is included. Local Parameters ETS configuration on local port, including Admin mode (enabled when a valid TLV is received from a peer), priority groups, assigned dot1p priorities, and bandwidth allocation.
PAGE 283
F-Application priority for FCOE enabled f-Application Priority for FCOE disabled I-Application priority for iSCSI enabled i-Application Priority for iSCSI disabled ----------------------------------------------------------------------Interface twentyFiveGigE 1/14 Remote Mac Address 00:01:e8:8a:df:a0 Port Role is Auto-Upstream DCBx Operational Status is Enabled Is Configuration Source? FALSE Local DCBx Compatibility mode is CEE Local DCBx Configured mode is CEE Peer Operating version is CEE Local DCBx TLVs T
PAGE 284
Table 29. show interface DCBx detail Command Description (continued) Field Description Local DCBx Status: Acknowledgment Number Acknowledgement number transmitted in Control TLVs. Local DCBx Status: Protocol State Current operational state of DCBx protocol: ACK or IN-SYNC. Peer DCBx Status: DCBx Operational Version DCBx version advertised in Control TLVs received from peer device. Peer DCBx Status: DCBx Max Version Supported Highest DCBx version supported in Control TLVs received from peer device.
PAGE 285
CONFIGURATION mode dcb pfc-shared-buffer-size value dcb pfc-total-buffer-size value Add dcb pfc-headroom-buffer-size value The buffer size range is from 0 to 4727. The Default value for PFC total buffer is 2656 KB and that of PFC shared buffer and headroom buffer is 1040 KB. 3. Configure the number of PFC queues. CONFIGURATION mode dcb enable pfc-queues pfc-queues The number of ports supported based on lossless queues configured depends on the buffer. The default number of PFC queues in the system is two.
PAGE 286
Figure 33. PFC and ETS Applied to LAN, IPC, and SAN Priority Traffic QoS Traffic Classification: The service-class dynamic dot1p command has been used in Global Configuration mode to map ingress dot1p frames to the queues shown in the following table. For more information, refer to QoS dot1p Traffic Classification and Queue Assignment.
PAGE 287
The following describes the priority group-bandwidth assignment. Priority Group Bandwidth Assignment IPC 5% SAN 50% LAN 45% PFC and ETS Configuration Command Examples The following examples show PFC and ETS configuration commands to manage your data center traffic. 1. Enabling DCB DellEMC(conf)#dcb enable 2. Configure DCB map and enable PFC, and ETS DellEMC(conf)# service-class dynamic dot1p Or DellEMC(conf)# interface twentyFiveGigE 1/1 DellEMC(conf-if-tf-1/1)# service-class dynamic dot1p 3.
PAGE 288
13 Dynamic Host Configuration Protocol (DHCP) DHCP is an application layer protocol that dynamically assigns IP addresses and other configuration parameters to network endstations (hosts) based on configuration policies determined by network administrators.
PAGE 289
Option Number and Description Subnet Mask Option 1 Specifies the client’s subnet mask. Router Option 3 Specifies the router IP addresses that may serve as the client’s default gateway. Domain Name Server Option 6 Domain Name Option 15 Specifies the domain name servers (DNSs) that are available to the client. Specifies the domain name that clients should use when resolving hostnames via DNS.
PAGE 290
1. The client initially broadcasts a DHCPDISCOVER message on the subnet to discover available DHCP servers. This message includes the parameters that the client requires and might include suggested values for those parameters. 2. Servers unicast or broadcast a DHCPOFFER message in response to the DHCPDISCOVER that offers to the client values for the requested parameters. Multiple servers might respond to a single DHCPDISCOVER; the client might wait a period of time and then act on the most preferred offer.
PAGE 291
● All platforms support Dynamic ARP Inspection on 16 VLANs per system. For more information, refer to Dynamic ARP Inspection. NOTE: If the DHCP server is on the top of rack (ToR) and the VLTi (ICL) is down due to a failed link, when a VLT node is rebooted in BMP (Bare Metal Provisioning) mode, it is not able to reach the DHCP server, resulting in BMP failure.
PAGE 292
DHCP mode show config After an IP address is leased to a client, only that client may release the address. Dell EMC Networking OS performs a IP + MAC source address validation to ensure that no client can release another clients address. This validation is a default behavior and is separate from IP+MAC source address validation.
PAGE 293
Configure a Method of Hostname Resolution Dell systems are capable of providing DHCP clients with parameters for two methods of hostname resolution—using DNS or NetBIOS WINS. Using DNS for Address Resolution A domain is a group of networks. DHCP clients query DNS IP servers when they need to correlate host names to IP addresses. 1. Create a domain. DHCP domain-name name 2. Specify in order of preference the DNS servers that are available to a DHCP client.
PAGE 294
Debugging the DHCP Server To debug the DHCP server, use the following command. ● Display debug information for DHCP server. EXEC Privilege mode debug ip dhcp server [events | packets] Using DHCP Clear Commands To clear DHCP binding entries, address conflicts, and server counters, use the following commands. ● Clear DHCP binding entries for the entire binding table. EXEC Privilege mode. clear ip dhcp binding ● Clear a DHCP binding entry for an individual IP address. EXEC Privilege mode.
PAGE 295
Configuring the DHCP Client System This section describes how to configure and view an interface as a DHCP client to receive an IP address. Dell EMC Networking OS Behavior: The ip address dhcp command enables DHCP server-assigned dynamic addresses on an interface. The setting persists after a switch reboot. To stop DHCP transactions and save the dynamically acquired IP address, use the shutdown command on the interface.
PAGE 296
● To display dynamic IP address lease information currently assigned to a DHCP client interface, use the show ip dhcp lease [interface type slot/port[/subport]] command. ● To display log messages for all DHCP packets sent and received on DHCP client interfaces, use the debug ip dhcp client packets [interface type slot/port[/subport] command.
PAGE 297
○ The chaddr (change address) in the DHCP header of the packet is the same as the interface’s MAC address. ● An entry in the DHCP snooping table is not added for a DHCP client interface. DHCP Server A switch can operate as a DHCP client and a DHCP server. DHCP client interfaces cannot acquire a dynamic IP address from the DHCP server running on the switch. Acquire a dynamic IP address from another DHCP server.
PAGE 298
Interface level DHCP relay source IPv4 or IPv6 configuration You can configure interface specific DHCP relay source IPv4 or IPv6 configuration. If the DHCP relay source interface is configured on the interface level, the DHCP relay forwards the packets from these interfaces to the DHCP server using the interface.
PAGE 299
Dell(conf-if-vl-4)# tagged TenGigE 1/4 Dell(conf-if-vl-4)# ip helper-address vrf vrf1 100.0.0.1 Dell(conf-if-vl-4)# ipv6 helper-address vrf vrf1 100::1 Configure Secure DHCP DHCP as defined by RFC 2131 provides no authentication or security mechanisms. Secure DHCP is a suite of features that protects networks that use dynamic address allocation from spoofing and attacks.
PAGE 300
ip dhcp relay information-option remote-id DHCPv6 relay agent options The DHCPv6 relay agent inserts Options 18 and 37 before forwarding DHCPv6 packets to the server. These DHCPv6 options are enabled by default and are not configurable. Interface ID (Option 18) Remote ID (Option 37) Interface on which the client-originated message is received. The interface-ID is 12 bytes long and is constructed using three ifindexes: Logical, Received, and Physical. Each of the ifindex is 4 bytes long.
PAGE 301
NOTE: If you enable DHCP Option 82 using the ip dhcp relay command, by default, the remote-ID field contains the MAC address of the relay agent. If you configure the remote ID as the host name in a VLT setup, configure different host names on both VLT peers. If you configure the remote ID with your own string, ensure that your strings are different on both VLT peers. DHCP Snooping in a VLT Setup In a VLT setup, the DHCP snooping binding table synchronizes between the VLT nodes.
PAGE 302
Adding a Static IPV6 DHCP Snooping Binding Table To add a static entry in the snooping database, use the following command. ● Add a static entry in the snooping binding table. EXEC Privilege mode ipv6 dhcp snooping binding mac address vlan-id vlan-id ipv6 ipv6-address interface interface-type | interface-number lease value Clearing the Binding Table To clear the binding table, use the following command. ● Delete all of the entries in the binding table.
PAGE 303
Invalid Binding List of List of List of Binding Entry Entry lease expired Trust Ports DHCP Snooping Enabled Vlans DAI Trust ports : 0 : 0 :Tf 1/4 :Vl 10 :Tf 1/4 View the DHCP snooping binding table using the show ip dhcp snooping binding command. DellEMC#show ip dhcp snooping binding Codes : S - Static D - Dynamic IP Address MAC Address Expires(Sec) Type VLAN Interface ========================================================================= 10.1.1.254 00:00:a0:00:00:02 162 D Vl 200 Tw 1/4 10.1.1.
PAGE 304
View the DHCP snooping statistics with the show ipv6 dhcp snooping command. DellEMC#show ipv6 dhcp snooping binding Codes : S - Static D – Dynamic IPv6 Address MAC Address Expires(Sec) Type VLAN Interface ========================================================================= 11:11::22 11:22:11:22:11:22 120331 S Vl 100 Tf 1/1 33::22 11:22:11:22:11:23 120331 S Vl 200 Tf 1/3 333:22::22 11:22:11:22:11:24 120331 D Vl 300 Tf 1/2 Debugging the IPv6 DHCP To debug the IPv6 DHCP, use the following command.
PAGE 305
The lack of authentication in ARP makes it vulnerable to spoofing. ARP spoofing is a technique attackers use to inject false IPto-MAC mappings into the ARP cache of a network device. It is used to launch man-in-the-middle (MITM), and denial-ofservice (DoS) attacks, among others. A spoofed ARP message is one in which the MAC address in the sender hardware address field and the IP address in the sender protocol field are strategically chosen by the attacker.
PAGE 306
configure terminal 2. Select the interface to be configured. CONFIGURATION mode interface interface-name 3. Configure ARP packet inspection rate limiting. INTERFACE CONFIGURATION mode arp inspection-limit {rate pps [interval seconds]} The rate packet per second (pps) range is from 1 to 2048. The default is 15. The rate burst interval range is from 1 to 15 seconds. The default is 1.
PAGE 307
system verifies that the source IP address is one that is associated with the incoming port and optionally that the client belongs to the permissible VLAN. If an attacker is impostering as a legitimate client, the source address appears on the wrong ingress port and the system drops the packet. If the IP address is fake, the address is not on the list of permissible addresses for the port and the packet is dropped. Similarly, if the IP address does not belong to the permissible VLAN, the packet is dropped.
PAGE 308
ip dhcp source-address-validation ipmac vlan vlan-id Dell EMC Networking OS creates an ACL entry for each IP+MAC address pair and optionally with its VLAN ID in the binding table and applies it to the interface. To display the IP+MAC ACL for an interface for the entire system, use the show ip dhcp snooping source-addressvalidation [interface] command in EXEC Privilege mode.
PAGE 309
14 Equal Cost Multi-Path (ECMP) This chapter describes configuring ECMP. This chapter describes configuring ECMP. Topics: • • ECMP for Flow-Based Affinity Link Bundle Monitoring ECMP for Flow-Based Affinity ECMP for flow-based affinity includes link bundle monitoring. Configuring the Hash Algorithm TeraScale has one algorithm that is used for link aggregation groups (LAGs), ECMP, and NH-ECMP, and ExaScale can use three different algorithms for each of these features.
PAGE 310
Configuring the Hash Algorithm Seed Deterministic ECMP sorts ECMPs in order even though RTM provides them in a random order. However, the hash algorithm uses as a seed the lower 12 bits of the chassis MAC, which yields a different hash result for every chassis. This behavior means that for a given flow, even though the prefixes are sorted, two unrelated chassis can select different hops.
PAGE 311
Managing ECMP Group Paths To avoid path degeneration, configure the maximum number of paths for an ECMP route that the L3 CAM can hold. When you do not configure the maximum number of routes, the CAM can hold a maximum ECMP per route. To configure the maximum number of paths, use the following command. NOTE: For the new settings to take effect, save the new ECMP settings to the startup-config (write-mem) then reload the system. ● Configure the maximum number of paths per ECMP group. CONFIGURATION mode.
PAGE 312
NOTE: An ecmp-group index is generated automatically for each unique ecmp-group when you configure multipath routes to the same network. The system can generate a maximum of 512 unique ecmp-groups. The ecmp-group indices are generated in even numbers (0, 2, 4, 6... 1022) and are for information only. You can configure ecmp-group with id 2 for link bundle monitoring. This ecmp-group is different from the ecmp-group index 2 that is created by configuring routes and is automatically generated.
PAGE 313
15 FIP Snooping The Fibre Channel over Ethernet (FCoE) Transit feature is supported on Ethernet interfaces. When you enable the switch for FCoE transit, the switch functions as a FIP snooping bridge. NOTE: FIP snooping is not supported on Fibre Channel interfaces or in a switch stack.
PAGE 314
Table 33. FIP Functions FIP Function Description FIP VLAN discovery FCoE devices (ENodes) discover the FCoE VLANs on which to transmit and receive FIP and FCoE traffic. FIP discovery FCoE end-devices and FCFs are automatically discovered. Initialization FCoE devices learn ENodes from the FLOGI and FDISC to allow immediate login and create a virtual link with an FCoE switch. Maintenance A valid virtual link between an FCoE device and an FCoE switch is maintained and the LOGO functions properly.
PAGE 315
Port-based ACLs These ACLs are applied on all three port modes: on ports directly connected to an FCF, server-facing ENode ports, and bridge-to-bridge links. Port-based ACLs take precedence over global ACLs. FCoE-generated ACLs These take precedence over user-configured ACLs. A user-configured ACL entry cannot deny FCoE and FIP snooping frames. The following illustration shows a switch used as a FIP snooping bridge in a converged Ethernet network.
PAGE 316
● Process FIP VLAN discovery requests and responses, advertisements, solicitations, FLOGI/FDISC requests and responses, FLOGO requests and responses, keep-alive packets, and clear virtual-link messages. Using FIP Snooping There are four steps to configure FCoE transit. 1. 2. 3. 4. Enable the FCoE transit feature on a switch. Enable FIP snooping globally on all Virtual Local Area Networks (VLANs) or individual VLANs on a FIP snooping bridge.
PAGE 317
CAM ACL Table DellEMC(conf)#do sh cam-acl -- Chassis Cam ACL -Current Settings(in 1 block = 256 Double Wide Regions: : Triple Wide Regions: L2Acl : 2 Ipv4Acl : 2 Ipv6Acl : 0 Ipv4Qos : 0 L2Qos : 0 L2PT : 0 IpMacAcl : 0 VmanQos : 0 EtsAcl : 1 FcoeAcl : 2 iscsiOptAcl : 2 ipv4pbr : 0 vrfv4Acl : 0 Openflow : 0 fedgovacl : 0 nlbclusteracl : 0 ipv4udfmirracl: 0 ipv4mirracl : 0 block sizes) entries L2Acl, Ipv4Acl, Ipv4Qos, L2Qos, L2PT FcoeAcl, ipv4pbr, vrfv4Acl Ipv6Acl, VmanQos, Openflow, ipv4udfmirracl -- stack-
PAGE 318
st-sjc-s5000-29# Enabling the FCoE Transit Feature The following sections describe how to enable FCoE transit. NOTE: FCoE transit is disabled by default. To enable this feature, you must follow the Configure FIP Snooping. As soon as you enable the FCoE transit feature on a switch-bridge, existing VLAN-specific and FIP snooping configurations are applied.
PAGE 319
Configure a Port for a Bridge-to-FCF Link If a port is directly connected to an FCF, configure the port mode as FCF. Initially, all FCoE traffic is blocked; only FIP frames are allowed to pass. FCoE traffic is allowed on the port only after a successful fabric login (FLOGI) request/response and confirmed use of the configured FC-MAP value for the VLAN. FLOGI and fabric discovery (FDISC) request/response packets are trapped to the CPU. They are forwarded after the necessary ACLs are installed.
PAGE 320
2. Save the configuration on the switch. EXEC Privilege mode. write memory 3. Reload the switch to enable the configuration. EXEC Privilege mode. reload After the switch is reloaded, DCB/DCBx is enabled. 4. Enable the FCoE transit feature on a switch. CONFIGURATION mode. feature fip-snooping 5. Enable FIP snooping on all VLANs or on a specified VLAN. CONFIGURATION mode or VLAN INTERFACE mode. fip-snooping enable 6. Configure the port for bridge-to-FCF links.
PAGE 321
Table 35. Displaying FIP Snooping Information (continued) Command Output show fip-snooping system Displays information on the status of FIP snooping on the switch (enabled or disabled), including the number of FCoE VLANs, FCFs, ENodes, and currently active sessions. show fip-snooping vlan Displays information on the FCoE VLANs on which FIP snooping is enabled. The following example shows the show fip-snooping sessions command.
PAGE 322
The following table describes the show fip-snooping enode command fields. Table 37. show fip-snooping enode Command Description Field Description ENode MAC MAC address of the ENode. ENode Interface Slot/port number of the interface connected to the ENode. FCF MAC MAC address of the FCF. VLAN VLAN ID number used by the session. FC-ID Fibre Channel session ID assigned by the FCF. The following example shows the show fip-snooping fcf command.
PAGE 323
DellEMC# show fip-snooping statistics int twentyFiveGigE 1/11 Number of Vlan Requests :1 Number of Vlan Notifications :0 Number of Multicast Discovery Solicits :1 Number of Unicast Discovery Solicits :0 Number of FLOGI :1 Number of FDISC :16 Number of FLOGO :0 Number of Enode Keep Alive :4416 Number of VN Port Keep Alive :3136 Number of Multicast Discovery Advertisement :0 Number of Unicast Discovery Advertisement :0 Number of FLOGI Accepts :0 Number of FLOGI Rejects :0 Number of FDISC Accepts :0 Number of
PAGE 324
Table 39. show fip-snooping statistics Command Descriptions (continued) Field Description Number of FLOGO Number of FIP-snooped FLOGO frames received on the interface. Number of ENode Keep Alives Number of FIP-snooped ENode keep-alive frames received on the interface. Number of VN Port Keep Alives Number of FIP-snooped VN port keep-alive frames received on the interface. Number of Multicast Discovery Advertisements Number of FIP-snooped multicast discovery advertisements received on the interface.
PAGE 325
FCoE Transit Configuration Example The following illustration shows a switch used as a FIP snooping bridge for FCoE traffic between an ENode (server blade) and an FCF (ToR switch). The ToR switch operates as an FCF and FCoE gateway. Figure 38. Configuration Example: FIP Snooping on a Switch In this example, DCBx and PFC are enabled on the FIP snooping bridge and on the FCF ToR switch.
PAGE 326
Example of Configuring the ENode Server-Facing Port DellEMC(conf)# interface twentyFiveGigE 1/1 DellEMC(conf-if-tf-1/1)# portmode hybrid DellEMC(conf-if-tf-1/1)# switchport DellEMC(conf-if-tf-1/1)# protocol lldp DellEMC(conf-if-tf-1/1-lldp)# dcbx port-role auto-downstream NOTE: A port is enabled by default for bridge-ENode links.
PAGE 327
16 Flex Hash and Optimized Boot-Up This chapter describes the Flex Hash enhancements. Topics: • • • • Flex Hash Capability Overview Configuring the Flex Hash Mechanism RDMA Over Converged Ethernet (RoCE) Overview Preserving 802.1Q VLAN Tag Value for Lite Subinterfaces Flex Hash Capability Overview The flex hash functionality enables you to configure a packet search key and matches packets based on the search key.
PAGE 328
2. Use the load-balance flexhash command to specify whether IPv4 or IPv6 packets must be subjected to the flex hash functionality, a unique protocol number, the offset of hash fields from the start of the L4 header to be used for hash calculation, and a meaningful description to associate the protocol number with the name.
PAGE 329
If a VLAN is split into multiple, different sub-VLANs, each VLAN is denoted by a unique 8021.Q tag to enable the nodes that receive the traffic frames determine the VLAN for which the frames are destined. Typically, a Layer 3 physical interface processes only untagged or priority-tagged packets. Tagged packets that are received on Layer 3 physical interfaces are dropped.
PAGE 330
17 Force10 Resilient Ring Protocol (FRRP) FRRP provides fast network convergence to Layer 2 switches interconnected in a ring topology, such as a metropolitan area network (MAN) or large campuses. FRRP is similar to what can be achieved with the spanning tree protocol (STP), though even with optimizations, STP can take up to 50 seconds to converge (depending on the size of network and node of failure) and may require 4 to 5 seconds to reconverge.
PAGE 331
Ring Status The ring failure notification and the ring status checks provide two ways to ensure the ring remains up and active in the event of a switch or port failure. Ring Checking At specified intervals, the Master node sends a ring health frame (RHF) through the ring. If the ring is complete, the frame is received on its secondary port and the Master node resets its fail-period timer and continues normal operation.
PAGE 332
Figure 39. Example of Multiple Rings Connected by Single Switch Important FRRP Points FRRP provides a convergence time that can generally range between 150ms and 1500ms for Layer 2 networks. The Master node originates a high-speed frame that circulates around the ring. This frame, appropriately, sets up or breaks down the ring. ● ● ● ● ● ● ● ● ● ● The Master node transmits ring status check frames at specified intervals. You can run multiple physical rings on the same switch.
PAGE 333
Important FRRP Concepts The following table lists some important FRRP concepts. Concept Explanation Ring ID Each ring has a unique 8-bit ring ID through which the ring is identified (for example, FRRP 101 and FRRP 202, as shown in the illustration in Member VLAN Spanning Two Rings Connected by One Switch. Control VLAN Each ring has a unique Control VLAN through which tagged ring health frames (RHF) are sent. Control VLANs are used only for sending RHF, and cannot be used for any other purpose.
PAGE 334
● ● ● ● The control VLAN cannot have members that are not ring ports. If multiple rings share one or more member VLANs, they cannot share any links between them. Member VLANs across multiple rings are not supported in Master nodes. Each ring has only one Master node; all others are transit nodes. FRRP Configuration These are the tasks to configure FRRP.
PAGE 335
Interface: ● ● ● ● ● For For For For For a a a a a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port/subport information. 25-Gigabit Ethernet interface, enter the keyword twentyFiveGigE then the slot/por[/subport]t information. 40-Gigabit Ethernet interface, enter the keyword fortyGigE then the slot/port/subport information. 50-Gigabit Ethernet interface, enter the keyword fiftyGigE then the slot/port/subport information.
PAGE 336
● For a 100-Gigabit Ethernet interface, enter the keyword hundredGigE then the slot/port information. 3. Assign the Primary and Secondary ports and the Control VLAN for the ports on the ring. CONFIG-FRRP mode. interface primary interface secondary interface control-vlan vlan id Interface: ● ● ● ● ● For For For For For a a a a a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port/subport information.
PAGE 337
Viewing the FRRP Configuration To view the configuration for the FRRP group, use the following command. ● Show the configuration for this FRRP group. CONFIG-FRRP mode. show configuration Viewing the FRRP Information To view general FRRP information, use one of the following commands. ● Show the information for the identified FRRP group. EXEC or EXEC PRIVELEGED mode. show frrp ring-id Ring ID: the range is from 1 to 255. ● Show the state of all FRRP groups. EXEC or EXEC PRIVELEGED mode.
PAGE 338
no shutdown ! interface Vlan 201 no ip address tagged twentyFiveGigE 1/24,1/31 no shutdown ! protocol frrp 101 interface primary twentyFiveGigE 1/24 secondary twentyFiveGigE 1/31 control-vlan 101 member-vlan 201 mode master no disable Example of R2 TRANSIT interface twentyFiveGigE 1/14 no ip address switchport no shutdown ! interface twentyFiveGigE 1/11 no ip address switchport no shutdown ! interface Vlan 101 no ip address tagged twentyFiveGigE 1/14,1/11 no shutdown ! interface Vlan 201 no ip address tagge
PAGE 339
FRRP Support on VLT Using FRRP rings, you can inter-connect VLT domains across data centers. These FRRP rings make use of Layer2 VLANs that spawn across Data Centers and provide resiliency by detecting node or link level failures. You can configure a simple FRRP ring that connects a VLT device in one data center to a VLT devices in two or more Data Centers.
PAGE 340
rings. The secondary port P2 is tagged to the control VLAN (V1). VLTi is implicitly tagged to the member VLANs when these VLANs are configured in the VLT peer. As a result of the VLT Node2 configuration on R2, the primary interface VLTi and the secondary interface P1 act as forwarding ports for the member VLANs (M1 to M10). In the FRRP ring R2, the primary interface for VLT Node1 (transit node) is the VLTi.
PAGE 341
18 GARP VLAN Registration Protocol (GVRP) The generic attribute registration protocol (GARP) VLAN registration protocol (GVRP), defined by the IEEE 802.1q specification, is a Layer 2 network protocol that provides for automatic VLAN configuration of switches. GVRP-compliant switches use GARP to register and de-register attribute values, such as VLAN IDs, with each other.
PAGE 342
Configure GVRP To begin, enable GVRP. To facilitate GVRP communications, enable GVRP globally on each switch. Then, GVRP configuration is per interface on a switch-by-switch basis. Enable GVRP on each port that connects to a switch where you want GVRP information exchanged. In the following example, GVRP is configured on VLAN trunk ports. Figure 42. Global GVRP Configuration Example Basic GVRP configuration is a two-step process: 1. Enabling GVRP Globally 2.
PAGE 343
gvrp enable DellEMC(conf)#protocol gvrp DellEMC(config-gvrp)#no disable DellEMC(config-gvrp)#show config ! protocol gvrp no disable DellEMC(config-gvrp)# To inspect the global configuration, use the show gvrp brief command. Enabling GVRP on a Layer 2 Interface To enable GVRP on a Layer 2 interface, use the following command. ● Enable GVRP on a Layer 2 interface.
PAGE 344
no shutdown DellEMC(conf-if-tf-1/2)# Configure a GARP Timer Set GARP timers to the same values on all devices that are exchanging information using GVRP. There are three GARP timer settings. ● Join — A GARP device reliably transmits Join messages to other devices by sending each Join message two times. To define the interval between the two sending operations of each Join message, use this parameter. The Dell EMC Networking OS default is 200ms.
PAGE 345
19 Internet Group Management Protocol (IGMP) Internet group management protocol (IGMP) is a Layer 3 multicast protocol that hosts use to join or leave a multicast group. Multicast is premised on identifying many hosts by a single destination IP address; hosts represented by the same IP address are a multicast group. Multicast routing protocols (such as protocol-independent multicast [PIM]) use the information in IGMP messages to discover which groups are active and to populate the multicast routing table.
PAGE 346
Figure 43. IGMP Messages in IP Packets Join a Multicast Group There are two ways that a host may join a multicast group: it may respond to a general query from its querier or it may send an unsolicited report to its querier. Responding to an IGMP Query The following describes how a host can join a multicast group. 1. One router on a subnet is elected as the querier. The querier periodically multicasts (to all-multicast-systems address 224.0.0.1) a general query to all hosts on the subnet. 2.
PAGE 347
IGMP Version 3 Conceptually, IGMP version 3 behaves the same as version 2. However, there are differences. ● Version 3 adds the ability to filter by multicast source, which helps multicast routing protocols avoid forwarding traffic to subnets where there are no interested receivers. ● To enable filtering, routers must keep track of more state information, that is, the list of sources that must be filtered.
PAGE 348
Joining and Filtering Groups and Sources The following illustration shows how multicast routers maintain the group and source information from unsolicited reports. 1. The first unsolicited report from the host indicates that it wants to receive traffic for group 224.1.1.1. 2. The host’s second report indicates that it is only interested in traffic from group 224.1.1.1, source 10.11.1.1. Include messages prevents traffic from all other sources in the group from reaching the subnet.
PAGE 349
Leaving and Staying in Groups The following illustration shows how multicast routers track and refresh state changes in response to group-and-specific and general queries. 1. Host 1 sends a message indicating it is leaving group 224.1.1.1 and that the included filter for 10.11.1.1 and 10.11.1.2 are no longer necessary. 2.
PAGE 350
● ● ● ● ● ● Adjusting Timers Preventing a Host from Joining a Group Enabling IGMP Immediate-Leave IGMP Snooping Fast Convergence after MSTP Topology Changes Designating a Multicast Router Interface Viewing IGMP Enabled Interfaces Interfaces that are enabled with PIM-SM are automatically enabled with IGMP. To view IGMP-enabled interfaces, use the following command. ● View IGMP-enabled IPv4 interfaces. EXEC Privilege mode show ip igmp interface ● View IGMP-enabled IPv6 interfaces.
PAGE 351
Viewing IGMP Groups To view both learned and statically configured IGMP groups, use the following command. ● View both learned and statically configured IGMP groups. EXEC Privilege mode show ip igmp groups show ipv6 mld groups DellEMC#show ip igmp groups Total Number of Groups: 2 IGMP Connected Group Membership Group Address Interface 225.1.1.1 twentyFiveGigE 1/1 225.1.2.1 twentyFiveGigE 1/1 Mode IGMPV2 IGMPV2 Uptime 00:11:19 00:10:19 Expires 00:01:50 00:01:50 Last Reporter 165.87.34.100 165.87.31.
PAGE 352
ipv6 mld query-max-response-time ● Adjust the last member query interval. INTERFACE mode ip igmp last-member-query-interval ● Adjust the amount of time the querier waits, for the initial query response, before sending the next IPv6 query. Interface mode ipv6 mld last-member-query-interval Enabling IGMP Immediate-Leave If the querier does not receive a response to a group-specific or group-and-source query, it sends another (querier robustness value).
PAGE 353
CONFIGURATION mode ip igmp snooping enable ● View the configuration. CONFIGURATION mode show running-config ● Disable snooping on a VLAN.
PAGE 354
● Statically specify a port in a VLAN as connected to a multicast router. INTERFACE VLAN mode ip igmp snooping mrouter ● View the ports that are connected to multicast routers. EXEC Privilege mode. show ip igmp snooping mrouter Configuring the Switch as Querier To configure the switch as a querier, use the following command. Hosts that do not support unsolicited reporting wait for a general query before sending a membership report.
PAGE 355
The management EIS feature is applicable only for the out-of-band (OOB) management port. References in this section to the management default route or static route denote the routes configured using the management route command. The management default route can be either configured statically or returned dynamically by the DHCP client. A static route points to the management interface or a forwarding router.
PAGE 356
Table 40. Association Between Applications and Port Numbers (continued) Application Name Port Number Client Server 8008 HTTP server port for confd application 8888 secure HTTP server port for confd application If you configure a source interface is for any EIS management application, EIS might not coexist with that interface and the behavior is undefined in such a case.
PAGE 357
When the feature is disabled using the no management egress-interface-selection command, the following operations are performed: ● All management application configuration is removed. ● All routes installed in the management EIS routing table are removed. Handling of Management Route Configuration When the EIS feature is enabled, the following processing occurs: ● All existing management routes (connected, static and default) are duplicated and added to the management EIS routing table.
PAGE 358
● For the clear arp-cache command, upon receiving the ARP delete request, the route corresponding to the destination IP is identified. The ARP entries learned in the management EIS routing table are also cleared. ● Therefore, a separate control over clearing the ARP entries learned via routes in the EIS table is not present. If the ARP entry for a destination is cleared in the default routing table, then if an ARP entry for the destination exists in the EIS table, that entry is also cleared.
PAGE 359
Table 41. Mapping of Management Applications and Traffic Type Traffic type / Application type Switch initiated traffic Switch-destined traffic Transit Traffic EIS Management Application Management is the preferred egress port selected based on route lookup in EIS table. If the management port is down or the route lookup fails, packets are dropped.
PAGE 360
EIS Behavior for ICMP: ICMP packets do not have TCP/UDP ports. To do an EIS route lookup for ICMP-based applications (ping and traceroute) using the source ip option, the management port IP address should be specified as the source IP address. If management port is down or route lookup fails, packets are dropped. Default Behavior: Route lookup is done in the default routing table and appropriate egress port is selected. Table 42.
PAGE 361
Table 43. Behavior of Various Applications for Switch-Destined Traffic (continued) Protocol Behavior when EIS is Enabled Behavior when EIS is Disabled ssh EIS Behavior Default Behavior Snmp (snmp mib response) EIS Behavior Default Behavior telnet EIS Behavior Default Behavior icmp (ping and traceroute) EIS Behavior for ICMP Default Behavior Interworking of EIS With Various Applications Stacking ● The management EIS is enabled on the master and the standby unit.
PAGE 362
20 Interfaces This chapter describes interface types, both physical and logical, and how to configure them with Dell EMC Networking Operating System (OS). The system supports 10–Gigabit, 25–Gigabit, 40–Gigbit, 50–Gigabit, and 100–Gigabit QSFP 28 interfaces. NOTE: Only Dell-qualified optics are supported on these interfaces. Non-Dell 40G optics are set to error-disabled state.Non-Dell optics for 40–Gigbit, 25–Gigabit, 50–Gigabit, and 100–Gigabit are set to error-disabled state.
PAGE 363
• • • • • • • • • • • • • • • • • • • Non Dell-Qualified Transceivers Splitting 100G Ports Link Dampening Link Bundle Monitoring Using Ethernet Pause Frames for Flow Control Configure the MTU Size on an Interface Configuring wavelength for 10–Gigabit SFP+ optics Port-Pipes CR4 Auto-Negotiation Setting the Speed of Ethernet Interfaces Speed Setting on 25G Interfaces Configuring 10G speed on 25G ports FEC Configuration View Advanced Interface Information Configuring the Traffic Sampling Size Globally Dynamic
PAGE 364
NOTE: The CLI output may be incorrectly displayed as 0 (zero) for the Rx/Tx power values. To obtain the correct power information, perform a simple network management protocol (SNMP) query. The following example shows the configuration and status information for one interface.
PAGE 365
! interface hundredGigE 1/51 no ip address shutdown ! interface hundredGigE 1/52 no ip address shutdown Resetting an Interface to its Factory Default State You can reset the configurations applied on an interface to its factory default state. To reset the configuration, perform the following steps: 1. View the configurations applied on an interface.
PAGE 366
● For a 100-Gigabit Ethernet interface, enter the keyword hundredGigE then the slot/port information. 2. Enable the interface. INTERFACE mode no shutdown To confirm that the interface is enabled, use the show config command in INTERFACE mode. To leave INTERFACE mode, use the exit command or end command. You cannot delete a physical interface. Physical Interfaces The Management Ethernet interface is a single RJ-45 Fast Ethernet port on a switch.
PAGE 367
Table 45. Layer Modes (continued) Type of Interface Possible Modes Requires Creation Layer 3 Default State Shutdown (disabled for Layer 3) Configuring Layer 2 (Data Link) Mode Do not configure switching or Layer 2 protocols such as spanning tree protocol (STP) on an interface unless the interface has been set to Layer 2 mode. To set Layer 2 data transmissions through an individual interface, use the following command. ● Enable Layer 2 data transmissions through an individual interface.
PAGE 368
If an interface is in the incorrect layer mode for a given command, an error message is displayed (shown in bold). In the following example, the ip address command triggered an error message because the interface is in Layer 2 mode and the ip address command is a Layer 3 command only. DellEMC(conf-if)#show config ! interface twentyFiveGigE 1/2 no ip address switchport no shutdown DellEMC(conf-if)#ip address 10.10.1.1 /24 % Error: Port is in Layer 2 mode Tf 1/2.
PAGE 369
Important Points to Remember ● Deleting a management route removes the route from both the EIS routing table and the default routing table. ● If the management port is down or route lookup fails in the management EIS routing table, the outgoing interface is selected based on route lookup from the default routing table. ● If a route in the EIS table conflicts with a front-end port route, the front-end port route has precedence.
PAGE 370
Configuring a Management Interface on an Ethernet Port You can manage the system through any port using remote access such as Telnet. To configure an IP address for the port, use the following commands. There is no separate management routing table, so configure all routes in the IP routing table (the ip route command). ● Configure an IP address. INTERFACE mode ip address ip-address mask ● Enable the interface. INTERFACE mode no shutdown ● The interface is the management interface.
PAGE 371
NOTE: You cannot assign an IP address to the default VLAN, which is VLAN 1 (by default). To assign another VLAN ID to the default VLAN, use the default vlan-id vlan-id command. To assign an IP address to an interface, use the following command. ● Configure an IP address and mask on the interface. INTERFACE mode ip address ip-address mask [secondary] ○ ip-address mask: enter an address in dotted-decimal format (A.B.C.D). The mask must be in slash format (/24).
PAGE 372
Configuring Port Delay To configure a delayed bring up of all interfaces during switch boot up, use the following command: ● Enter the CONFIGURATION mode. CONFIGURATION mode Use the port-delay-restore command and ensure to specify a value between 1 second and 300 seconds. DellEMC(conf)#port-delay-restore 300 Use the no port-delay-restore command to disable the feature.
PAGE 373
Port Channel Implementation Dell EMC Networking OS supports static and dynamic port channels. ● Static — Port channels that are statically configured. ● Dynamic — Port channels that are dynamically configured using the link aggregation control protocol (LACP). For details, see Link Aggregation Control Protocol (LACP). The port channel ID ranges from 1 to 1281 to 4096. As soon as you configure a port channel, Dell EMC Networking OS treats it like a physical interface. For example, IEEE 802.
PAGE 374
Creating a Port Channel You can create up to 1284096 port channels with up to 16 port members per group on the platform. To configure a port channel, use the following commands. 1. Create a port channel. CONFIGURATION mode interface port-channel id-number 2. Ensure that the port channel is active. INTERFACE PORT-CHANNEL mode no shutdown After you enable the port channel, you can place it in Layer 2 or Layer 3 mode.
PAGE 375
DellEMC# Tf 1/8 (Up) Tf 1/13 (Up) Tf 1/14 (Up) The following example shows the port channel’s mode (L2 for Layer 2 and L3 for Layer 3 and L2L3 for a Layer 2-port channel assigned to a routed VLAN), the status, and the number of interfaces belonging to the port channel. DellEMC>show interface port-channel 20 Port-channel 20 is up, line protocol is up Hardware address is 00:01:e8:01:46:fa Internet address is 1.1.120.
PAGE 376
2. Change to the second port channel INTERFACE mode. INTERFACE PORT-CHANNEL mode interface port-channel id number 3. Add the interface to the second port channel. INTERFACE PORT-CHANNEL mode channel-member interface The following example shows moving an interface from port channel 4 to port channel 3.
PAGE 377
● Remove the port channel with tagging enabled from the VLAN. INTERFACE VLAN mode no tagged port-channel id number or no untagged port-channel id number ● Identify which port channels are members of VLANs. EXEC Privilege mode show vlan Configuring VLAN Tags for Member Interfaces To configure and verify VLAN tags for individual members of a port channel, perform the following: 1. Configure VLAN membership on individual ports INTERFACE mode DellEMC(conf-if)#vlan tagged 2,3-4 2.
PAGE 378
● Delete a port channel. CONFIGURATION mode no interface portchannel channel-number ● Disable a port channel. shutdown When you disable a port channel, all interfaces within the port channel are operationally down also. Load Balancing Through Port Channels Dell EMC Networking OS uses hash algorithms for distributing traffic evenly over channel members in a port channel (LAG). The hash algorithm distributes traffic among Equal Cost Multi-path (ECMP) paths and LAG members.
PAGE 379
CONFIGURATION mode hash-algorithm {algorithm-number | {ecmp {crc16 | crc16cc | crc32MSB | crc32LSB | crcupper | dest-ip | lsb | xor1 | xor2 | xor4 | xor8 | xor16} [number] hg {crc16 | crc16cc | crc32MSB | crc32LSB | xor1 | xor2 | xor4 | xor8 | xor16} stack-unit stack-unit-number | port-set port-pipe | hg-seed seed-value stack-unit | lag {checksum | crc | xor} [number] nh-ecmp {checksum | crc | xor}[number] stack—unit number ip-sa-mask value ip-da-mask value | seed seed-value } For more information about alg
PAGE 380
NOTE: Non-existing interfaces are excluded from the interface range prompt. NOTE: When creating an interface range, interfaces appear in the order they were entered and are not sorted. The show range command is available under Interface Range mode. This command allows you to display all interfaces that have been validated under the interface range context. The show configuration command is also available under Interface Range mode.
PAGE 381
DellEMC(conf)#interface range twentyFiveGigE 1/1 - 1/3 , twentyFiveGigE 1/1 - 1/5 , twentyFiveGigE 1/1 - 1/5 , twentyFiveGigE 1/1 - 1/5 , DellEMC(conf-if-range-tf-1/1-1/5)# Exclude a Smaller Port Range The following is an example show how the smaller of two port ranges is omitted in the interface-range prompt.
PAGE 382
Define the Interface Range The following example shows how to define an interface-range macro named “test” to select Ten Gigabit Ethernet interfaces 5/1 through 5/4. Example of the define interface-range Command for Macros DellEMC(config)# define interface-range test twentyFiveGigE 1/1 - 1/4 Choosing an Interface-Range Macro To use an interface-range macro, use the following command. ● Selects the interfaces range to be configured using the values saved in a named interface-range macro.
PAGE 383
Output bytes: Input packets: Output packets: 64B packets: Over 64B packets: Over 127B packets: Over 255B packets: Over 511B packets: Over 1023B packets: Error statistics: Input underruns: Input giants: Input throttles: Input CRC: Input IP checksum: Input overrun: Output underruns: Output throttles: m l T q - 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 Bps pps pps pps pps pps pps pps pps 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 pps pps pps pps pps pps pps pps 0 0 0 0 0 0 0 0 Change mode Page up In
PAGE 384
The following command output displays that the interface is in error-disabled state: DellEMC#show interfaces fortyGigE 1/50/1 fortyGigE 1/50/1 is up, line protocol is down(error-disabled[Transceiver Unsupported]) Hardware is DellEMCEth, address is 34:17:eb:f2:25:c6 Current address is 34:17:eb:f2:25:c6 Non-qualified pluggable media present, QSFP type is 40GBASE-SR4 Wavelength is 850nm No power Interface index is 2103813 Internet address is not set Mode of IPv4 Address Assignment : NONE DHCP Client-ID :3417eb
PAGE 385
○ number: enter the port number of the 100G port to be split. The range is from 1 to 32. ● Split a 100G port into four 10G ports. CONFIGURATION Mode stack-unit stack-unit-number port number portmode quad speed 10G ○ stack-unit-number: enter the stack member unit identifier on which the port resides. ○ number: enter the port number of the 100G port to be split. The range is from 1 to 32.
PAGE 386
Configuration Example of Link Dampening The figure shows a how link dampening works in a sample scenario when an interface is configured with dampening. The following figure shows the interface state change, accumulation and decay of penalty, and the interface advertised state based on the set dampening parameters.
PAGE 387
Figure 48. Interface State Change Consider an interface periodically flaps as shown above. Every time the interface goes down, a penalty (1024) is added. In the above example, during the first interface flap (flap 1), the penalty is added to 1024. And, the accumulated penalty will exponentially decay based on the set half-life, which is set as 10 seconds in the above example. During the second interface flap (flap 2), again the penalty (1024) is accumulated.
PAGE 388
Enabling Link Dampening To enable link dampening, use the following command. ● Enable link dampening. INTERFACE mode dampening To view the link dampening configuration on an interface, use the show config command. R1(conf-if-tf-1/1)#show config ! interface twentyFiveGigE 1/1 ip address 10.10.19.1/24 dampening 1 2 3 4 no shutdown To view dampening information on all or specific dampened interfaces, use the show interfaces dampening command from EXEC Privilege mode.
PAGE 389
Configure MTU Size on an Interface In Dell EMC Networking OS, Maximum Transmission Unit (MTU) is defined as the entire Ethernet packet (Ethernet header + FCS + payload). The following table lists the range for each transmission media. Transmission Media MTU Range (in bytes) Ethernet 594-12000 = link MTU 576-9234 = IP MTU Link Bundle Monitoring Monitoring linked LAG bundles allows traffic distribution amounts in a link to be monitored for unfair distribution at any given time.
PAGE 390
The globally assigned 48-bit Multicast address 01-80-C2-00-00-01 is used to send and receive pause frames. To allow fullduplex flow control, stations implementing the pause operation instruct the MAC to enable reception of frames with destination address equal to this multicast address. The PAUSE frame is defined by IEEE 802.3x and uses MAC Control frames to carry the PAUSE commands. Ethernet pause frames are supported on full duplex only.
PAGE 391
For example, for VLAN packets, if the IP MTU is 1400, the Link MTU must be no less than 1422: 1400-byte IP MTU + 22-byte VLAN Tag = 1422-byte link MTU The following table lists the various Layer 2 overheads found in the Dell EMC Networking OS and the number of bytes. Table 46.
PAGE 392
Port-Pipes A port pipe is a Dell EMC Networking-specific term for the hardware packet-processing elements that handle network traffic to and from a set of front-end I/O ports. The physical, front-end I/O ports are referred to as a port-set. In the command-line interface, a port pipe is entered as port-set port-pipe-number. CR4 Auto-Negotiation You can configure interface type as CR4 with auto-negotiation enabled. Many DAC cable link issues are resolved by setting the interface type as CR4.
PAGE 393
speed {10 | 100 | 1000 | 10000 | auto} NOTE: If you use an active optical cable (AOC), you can convert the QSFP+ port to a 10 Gigabit SFP+ port or 1 Gigabit SFP port. You can use the speed command to enable the required speed. 6. Optionally, set full- or half-duplex. INTERFACE mode duplex {half | full} 7. Disable auto-negotiation on the port. INTERFACE mode no negotiation auto If the speed was set to 1000, do not disable auto-negotiation. 8. Verify configuration changes.
PAGE 394
1 1 1 1 1 1 1 1 1 1 1 2 3 4 5 6 7 8 9 10 11 12 SFP+ SFP28 SFP28 SFP28 Media not present Media not present Media not present Media not present 10GBASE-CU1M Media not present Media not present Media not present 25GBASE-CR1-3M 25GBASE-CR1-3M 25GBASE-CR1-3M or or or or accessible accessible accessible accessible CN0V250M3BM4307 or accessible or accessible or accessible CN07696259N0MU7 CN07696259N0MU7 CN07696259N0MU7 Yes Yes Yes Yes Oct 4 18:24:52 %S5048F-ON:1 %IFAGT-5-INSERT_OPTICS_PLUS: Optics SFP+ in
PAGE 395
The system generates a syslog warning that the change of speed will be applied for all 4 ports in the group and prompts for confirmation. Following is the sample syslog warning displayed after executing the speed command on the interface: %Warning:Port with SFP28-DAC inserted on a port group alone will be supported & its group of 4 ports will be configured with speed 10G.
PAGE 396
! interface hundredGigE 1/49 no ip address shutdown intf-type cr4 autoneg fec enable Example of the fec enable cl74 command on a 25G interface. DellEMC(conf-if-tf-1/3)#fec en cl74 DellEMC(conf-if-tf-1/3)#show config ! interface twentyFiveGigE 1/3 no ip address no shutdown fec enable cl74 Example of the fec enable cl108 command on a 25G interface.
PAGE 397
AutoNegotiation is ON Forward Error Correction(FEC) configured is cl91 FEC status is cl91Interface index is 2101774 Internet address is not set Mode of IPv4 Address Assignment : NONE DHCP Client-ID :001232124213 MTU 9416 bytes, IP MTU 9398 bytes LineSpeed 100000 Mbit Flowcontrol rx off tx off ARP type: ARPA, ARP Timeout 04:00:00 Last clearing of "show interface" counters 00:31:23 Queueing strategy: fifo Input Statistics: 32992398774 packets, 2243483116632 bytes 0 64-byte pkts, 32992398774 over 64-byte pkts,
PAGE 398
Vlan 2 Name: twentyFiveGigE 1/3 802.1QTagged: True Vlan membership: Vlan 2 Name: twentyFiveGigE 1/4 802.1QTagged: True Vlan membership: Vlan 2 --More-- Configuring the Interface Sampling Size Although you can enter any value between 30 and 299 seconds (the default), software polling is done once every 15 seconds. So, for example, if you enter “19”, you actually get a sample of the past 15 seconds. All LAG members inherit the rate interval configuration from the LAG.
PAGE 399
0 over 255-byte pkts, 0 over 511-byte pkts, 0 over 1023-byte pkts Received 0 input symbol errors, 0 runts, 0 giants, 0 throttles 0 CRC, 0 IP Checksum, 0 overrun, 0 discarded 0 packets output, 0 bytes, 0 underruns Output 0 Multicasts, 0 Broadcasts, 0 Unicasts 0 IP Packets, 0 Vlans, 0 MPLS 0 throttles, 0 discarded Rate info (interval 100 seconds): Input 00.00 Mbits/sec, 0 packets/sec, 0.00% of line-rate Output 00.00 Mbits/sec, 0 packets/sec, 0.
PAGE 400
DellEMC#show int po 20 Port-channel 20 is up, line protocol is up Hardware address is 4c:76:25:f4:ab:02, Current address is 4c:76:25:f4:ab:02 Interface index is 1258301440 Minimum number of links to bring Port-channel up is 1 Internet address is not set Mode of IPv4 Address Assignment : NONE DHCP Client-ID :4c7625f4ab02 MTU 1554 bytes, IP MTU 1500 bytes LineSpeed 80000 Mbit Members in this channel: Hu 1/49(U) Hu 1/50(U) ARP type: ARPA, ARP Timeout 04:00:00 Queueing strategy: fifo Input Statistics: 13932 pac
PAGE 401
● Clear the counters used in the show interface commands for all VRRP groups, VLANs, and physical interfaces or selected ones. Without an interface specified, the command clears all interface counters. EXEC Privilege mode clear counters [interface] [vrrp [vrid] | learning-limit] (OPTIONAL) Enter the following interface keywords and slot/port or number information: ○ ○ ○ ○ ○ ○ ○ For a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port/subport information.
PAGE 402
Table 48.
PAGE 403
Table 48. Standard and Compressed Configurations Uncompressed Compressed ! interface Vlan 5 tagged tw 1/1 no ip address shutdown ! interface Vlan 100 no ip address no shutdown ! interface Vlan 1000 ip address 1.1.1.1/16 no shutdown Uncompressed config size – 52 lines write memory compressed The write memory compressed CLI will write the operating configuration to the startup-config file in the compressed mode. In stacking scenario, it will also take care of syncing it to all the standby and member units.
PAGE 404
oui oui-value DellEMC(Conf)#interface fiftyGigE 1/49/1 DellEMC(Conf-fi-1/49/1)# oui 0x123456 DellEMC(Config)interface twentyfiveGigE 1/50/1 DellEMC(Conf-tf-1/49/1)# oui 0x78abcd 404 Interfaces
PAGE 405
21 IPv4 Routing The Dell EMC Networking Operating System (OS) supports various IP addressing features. This chapter describes the basics of domain name service (DNS), address resolution protocol (ARP), and routing principles and their implementation in the Dell EMC Networking OS.
PAGE 406
IP Addresses Dell EMC Networking OS supports IP version 4 (as described in RFC 791), classful routing, and variable length subnet masks (VLSM). With VLSM, you can configure one network with different masks. Supernetting, which increases the number of subnets, is also supported. To subnet, you add a mask to the IP address to separate the network and host portions of the IP address.
PAGE 407
INTERFACE mode no shutdown 3. Configure a primary IP address and mask on the interface. INTERFACE mode ip address ip-address mask [secondary] ● ip-address mask: the IP address must be in dotted decimal format (A.B.C.D). The mask must be in slash prefixlength format (/24). ● secondary: add the keyword secondary if the IP address is the interface’s backup IP address. You can configure up to eight secondary IP addresses.
PAGE 408
S 6.1.2.5/32 S 6.1.2.6/32 S 6.1.2.7/32 S 6.1.2.8/32 S 6.1.2.9/32 S 6.1.2.10/32 S 6.1.2.11/32 S 6.1.2.12/32 S 6.1.2.13/32 S 6.1.2.14/32 S 6.1.2.15/32 S 6.1.2.16/32 S 6.1.2.17/32 S 11.1.1.0/24 Direct, Lo 0 --More-- via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.2, via 6.1.20.
PAGE 409
Configure Static Routes for the Management Interface When an IP address that a protocol uses and a static management route exists for the same prefix, the protocol route takes precedence over the static management route. To configure a static route for the management port, use the following command. ● Assign a static route to point to the management interface or forwarding router.
PAGE 410
occurs on the device. You can set the wait time to be 10 seconds or lower. If the device does not contain any BGP connections with the BGP neighbors across WAN links, you must set this interval to a higher value, depending on the complexity of your network and the configuration attributes. To configure the duration for which the device waits for the ACK packet to be sent from the requesting host to establish the TCP connection, perform the following steps: 1.
PAGE 411
ip name-server ip-address [ip-address2 ... ip-address6] The order you entered the servers determines the order of their use. To view current bindings, use the show hosts command. DellEMC>show host Default domain is force10networks.com Name/address lookup uses domain service Name servers are not set Host Flags TTL Type Address -------- ----- ------- ------ks (perm, OK) - IP 2.2.2.2 patch1 (perm, OK) - IP 192.68.69.2 tomm-3 (perm, OK) - IP 192.68.99.2 gxr (perm, OK) - IP 192.71.18.2 f00-3 (perm, OK) - IP 192.
PAGE 412
To keep the default setting for these parameters, press the ENTER key. The following text is example output of DNS using the traceroute command. DellEMC#traceroute www.force10networks.com Translating "www.force10networks.com"...domain server (10.11.0.1) [OK] Type Ctrl-C to abort. ---------------------------------------------------------------------Tracing the route to www.force10networks.com (10.11.84.
PAGE 413
○ ip-address: IP address in dotted decimal format (A.B.C.D). ○ mac-address: MAC address in nnnn.nnnn.nnnn format. ○ interface: enter the interface type slot/port information. These entries do not age and can only be removed manually. To remove a static ARP entry, use the no arp ip-address command. To view the static entries in the ARP cache, use the show arp static command in EXEC privilege mode.
PAGE 414
ARP Learning via Gratuitous ARP Gratuitous ARP can mean an ARP request or reply. In the context of ARP learning via gratuitous ARP on Dell EMC Networking OS, the gratuitous ARP is a request.
PAGE 415
Figure 50. ARP Learning via ARP Request with ARP Learning via Gratuitous ARP Enabled Whether you enable or disable ARP learning via gratuitous ARP, the system does not look up the target IP. It only updates the ARP entry for the Layer 3 interface with the source IP of the request. Configuring ARP Retries You can configure the number of ARP retries. The default backoff interval remains at 20 seconds. To set and display ARP retries, use the following commands. ● Set the number of ARP retries.
PAGE 416
Enabling ICMP Unreachable Messages By default, ICMP unreachable messages are disabled. When enabled, ICMP unreachable messages are created and sent out all interfaces. To disable and re-enable ICMP unreachable messages, use the following commands. ● To disable ICMP unreachable messages. INTERFACE mode no ip unreachable ● Set Dell EMC Networking OS to create and send ICMP unreachable messages on the interface.
PAGE 417
forwards the packet to SW2 and sends an ICMP redirect message to Host H. Host H learns of the new route using the ICMP redirect message and sends all future packets to the remote branch office host to SW2. To enable ICMP or ICMP6 redirect messages, use the icmp6-redirect enable command. NOTE: The icmp6-redirect enable command is applicable for both ICMP and ICMP6 redirects. By default, Dell EMC Networking OS supports redirects on VLAN interfaces.
PAGE 418
To view the interfaces and ports on which you enabled UDP helper, use the show ip udp-helper command from EXEC Privilege mode. DellEMC#show ip udp-helper -------------------------------------------------Port UDP port list -------------------------------------------------tf 1/1 1000 Configuring a Broadcast Address To configure a broadcast address, use the following command. ● Configure a broadcast address on an interface. ip udp-broadcast-address DellEMC(conf-if-vl-100)#ip udp-broadcast-address 1.1.255.
PAGE 419
2. If you enable UDP helper (using the ip udp-helper udp-port command), and the UDP destination port of the packet matches the UDP port configured, the system changes the destination address to the configured broadcast 1.1.255.255 and routes the packet to VLANs 100 and 101. If you do not configure an IP broadcast address (using the ip udp-broadcastaddress command) on VLANs 100 or 101, the packet is forwarded using the original destination IP address 255.255.255.255.
PAGE 420
UDP Helper with Configured Broadcast Addresses Incoming packets with a destination IP address matching the configured broadcast address of any interface are forwarded to the matching interfaces. In the following illustration, Packet 1 has a destination IP address that matches the configured broadcast address of VLAN 100 and 101. If you enabled UDP helper and the UDP port number matches, the packet is flooded on both VLANs with an unchanged destination address. Packet 2 is sent from a host on VLAN 101.
PAGE 421
to 137.138.17.6 2017-08-05 11:59:36 %RELAY-I-PACKET, BOOTP REPLY (Unicast) received at interface 194.12.129.98 BOOTP Reply, XID = 0x9265f901, secs = 0 hwaddr = 00:02:2D:8D:46:DC, giaddr = 172.21.50.193, hops = 2 2017-08-05 11:59:36 %RELAY-I-BOOTREPLY, Forwarded BOOTREPLY for 00:02:2D:8D:46:DC to 128.141.128.90 Packet 0.0.0.0:68 -> 255.255.255.
PAGE 422
22 IPv6 Routing Internet protocol version 6 (IPv6) routing is the successor to IPv4. Due to the rapid growth in internet users and IP addresses, IPv4 is reaching its maximum usage. IPv6 will eventually replace IPv4 usage to allow for the constant expansion. This chapter provides a brief description of the differences between IPv4 and IPv6, and the Dell EMC Networking support of IPv6. This chapter is not intended to be a comprehensive description of IPv6.
PAGE 423
recommended MTU for IPv6 is 1280. Greater MTU settings increase the processing efficiency because each packet carries more data while protocol overheads (for example, headers) or underlying per-packet delays remain fixed. Figure 55. Path MTU discovery process Stateless Autoconfiguration When a booting device comes up in IPv6 and asks for its network prefix, the device can get the prefix (or prefixes) from an IPv6 router on its link.
PAGE 424
The router redirect functionality in the neighbor discovery protocol (NDP) is similar to IPv4 router redirect messages. NDP uses ICMPv6 redirect messages (Type 137) to inform nodes that a better router exists on the link. IPv6 Headers The IPv6 header has a fixed length of 40 bytes. This fixed length provides 16 bytes each for source and destination information and 8 bytes for general header information.
PAGE 425
NOTE: All packets in the flow must have the same source and destination addresses. Payload Length (16 bits) The Payload Length field specifies the packet payload. This is the length of the data following the IPv6 header. IPv6 Payload Length only includes the data following the header, not the header itself. The Payload Length limit of 2 bytes requires that the maximum packet payload be 64 KB. However, the Jumbogram option type Extension header supports larger packet sizes when required.
PAGE 426
Source Address (128 bits) The Source Address field contains the IPv6 address for the packet originator. Destination Address (128 bits) The Destination Address field contains the intended recipient’s IPv6 address. This can be either the ultimate destination or the address of the next hop router. Extension Header Fields Extension headers are used only when necessary. Due to the streamlined nature of the IPv6 header, adding extension headers do not severely impact performance.
PAGE 427
Addressing IPv6 addresses are normally written as eight groups of four hexadecimal digits, where each group is separated by a colon (:). For example, 2001:0db8:0000:0000:0000:0000:1428:57ab is a valid IPv6 address. If one or more four-digit group(s) is 0000, the zeros may be omitted and replaced with two colons(::). For example, 2001:0db8:0000:0000:0000:0000:1428:57ab can be shortened to 2001:0db8::1428:57ab. Only one set of double colons is supported in a single address.
PAGE 428
Generally, ICMPv6 uses two message types: ● Error reporting messages indicate when the forwarding or delivery of the packet failed at the destination or intermediate node. These messages include Destination Unreachable, Packet Too Big, Time Exceeded and Parameter Problem messages. ● Informational messages provide diagnostic functions and additional host functions, such as Neighbor Discovery and Multicast Listener Discovery. These messages also include Echo Request and Echo Reply messages.
PAGE 429
With ARP, each node broadcasts ARP requests on the entire link. This approach causes unnecessary processing by uninterested nodes. With NDP, each node sends a request only to the intended destination via a multicast address with the unicast address used as the last 24 bits. Other hosts on the link do not participate in the process, greatly increasing network bandwidth efficiency. Figure 58.
PAGE 430
The following example configures a RDNNS server with an IPv6 address of 1000::1 and a lifetime of 1 second.
PAGE 431
ICMP redirects are not sent DAD is enabled, number of DAD attempts: 3 ND reachable time is 20120 milliseconds ND base reachable time is 30000 milliseconds ND advertised reachable time is 0 milliseconds ND advertised retransmit interval is 0 milliseconds ND router advertisements are sent every 198 to 600 seconds ND router advertisements live for 1800 seconds ND advertised hop limit is 64 IPv6 hop limit for originated packets is 64 ND dns-server address is 1000::1 with lifetime of 1 seconds ND dns-server addr
PAGE 432
● ● ● ● L2 ACL(l2acl): 5 IPv6 L3 ACL (ipv6acl): 0 L3 QoS (ipv4qos): 1 L2 QoS (l2qos): 1 To have the changes take effect, save the new CAM settings to the startup-config (write-mem or copy run start) then reload the system for the new settings. ● Allocate space for IPV6 ACLs. Enter the CAM profile name then the allocated amount. CONFIGURATION mode cam-acl { ipv6acl } When not selecting the default option, enter all of the profiles listed and a range for each. The total space allocated must equal 13.
PAGE 433
CONFIGURATION mode ipv6 route [vrf vrf-name] prefix interface-type slot/port [/subport] forwarding router tag ○ vrf vrf-name:(OPTIONAL) name of the VRF.
PAGE 434
Displaying IPv6 Information View specific IPv6 configuration with the following commands. ● List the IPv6 show options.
PAGE 435
ff02::1 ff02::1:ff8b:386e ND MTU is 0 ICMP redirects are not sent DAD is enabled, number of DAD attempts: 3 ND reachable time is 32000 milliseconds ND base reachable time is 30000 milliseconds ND retransmit interval is 1000 milliseconds ND hop limit is 64 Showing IPv6 Routes To view the global IPv6 routing information, use the following command. ● Show IPv6 routing information for the specified route type.
PAGE 436
C 912::/64 [0/0] Direct, Lo 2, 00:02:33 O IA 999::1/128 [110/2] via fe80::201:e8ff:fe8b:3166, Te 1/24/1, 00:01:30 L fe80::/10 [0/0] Direct, Nu 0, 00:34:42 DellEMC# The following example shows the show ipv6 route static command.
PAGE 437
Configuring IPv6 RA Guard The IPv6 Router Advertisement (RA) guard allows you to block or reject the unwanted router advertisement guard messages that arrive at the network device platform. To configure the IPv6 RA guard, perform the following steps: 1. Configure the terminal to enter the Global Configuration mode. EXEC Privilege mode configure terminal 2. Enable the IPv6 RA guard. CONFIGURATION mode ipv6 nd ra-guard enable 3. Create the policy.
PAGE 438
reachable—time value The reachability time range is from 0 to 3,600,000 milliseconds. 14. Set the advertised retransmission time. POLICY LIST CONFIGURATION mode retrans—timer value The retransmission time range is from 100 to 4,294,967,295 milliseconds. 15. Display the configurations applied on the RA guard policy mode.
PAGE 439
23 iSCSI Optimization This chapter describes how to configure internet small computer system interface (iSCSI) optimization, which enables qualityof-service (QoS) treatment for iSCSI traffic.
PAGE 440
NOTE: After a switch is reloaded, powercycled, or upgraded, the system may display the ACL_AGENT-3ISCSI_OPT_MAX_SESS_LIMIT_REACHED: Monitored iSCSI sessions reached maximum limit log message. This cannot be inferred as the maximum supported iSCSI sessions are reached. Also, number of iSCSI sessions displayed on the system may show any number equal to or less than the maximum.
PAGE 441
Application of Quality of Service to iSCSI Traffic Flows You can configure iSCSI CoS mode. This mode controls whether CoS (dot1p priority) queue assignment and/or packet marking is performed on iSCSI traffic. When you enable iSCSI CoS mode, the CoS policy is applied to iSCSI traffic. When you disable iSCSI CoS mode, iSCSI sessions and connections are still detected and displayed in the status tables, but no CoS policy is applied to iSCSI traffic.
PAGE 442
Detection and Auto-Configuration for Dell EqualLogic Arrays The iSCSI optimization feature includes auto-provisioning support with the ability to detect directly connected Dell EqualLogic storage arrays and automatically reconfigure the switch to enhance storage traffic flows. The switch uses the link layer discovery protocol (LLDP) to discover Dell EqualLogic devices on the network. LLDP is enabled by default. For more information about LLDP, refer to Link Layer Discovery Protocol (LLDP).
PAGE 443
● Additional updates to connections (including aging updates) that are learnt on VLT lag members are synced to the peer. ● When receiving an iSCSI login request on a non-VLT interface followed by a response from a VLT interface, the session is not synced since it is initially learnt on a non-VLT interface through the request packet. ● The peer generates a new connection log that sees the login response packet.
PAGE 444
Table 49. iSCSI Optimization Defaults (continued) Parameter Default Value iSCSI optimization target ports iSCSI well-known ports 3260 and 860 are configured as default (with no IP address or name) but can be removed as any other configured target. iSCSI session monitoring Disabled. The CAM allocation for iSCSI is set to zero (0). iSCSI Optimization Prerequisites The following are iSCSI optimization prerequisites. ● iSCSI optimization requires LLDP on the switch.
PAGE 445
7. (Optional) Configure the iSCSI target ports and optionally the IP addresses on which iSCSI communication is monitored. CONFIGURATION mode [no] iscsi target port tcp-port-1 [tcp-port-2...tcp-port-16] [ip-address address] ● tcp-port-n is the TCP port number or a list of TCP port numbers on which the iSCSI target listens to requests. You can configure up to 16 target TCP ports on the switch in one command or multiple commands. The default is 860, 3260. Separate port numbers with a comma.
PAGE 446
Displaying iSCSI Optimization Information To display information on iSCSI optimization, use the following show commands. ● Display the currently configured iSCSI settings. show iscsi ● Display information on active iSCSI sessions on the switch. show iscsi sessions ● Display detailed information on active iSCSI sessions on the switch . To display detailed information on specified iSCSI session, enter the session’s iSCSI ID.
PAGE 447
Initiator:iqn.2010-11.com.ixia.ixload:initiator-iscsi-2c Up Time:00:00:01:28(DD:HH:MM:SS) Time for aging out:00:00:09:34(DD:HH:MM:SS) ISID:806978696102 Initiator Initiator Target Target Connection IP Address TCP Port IP Address TCPPort ID 10.10.0.53 33432 10.10.0.
PAGE 448
24 Intermediate System to Intermediate System The intermediate system to intermediate system (IS-IS) protocol that uses a shortest-path-first algorithm. Dell EMC Networking supports both IPv4 and IPv6 versions of IS-IS.
PAGE 449
Figure 60. ISO Address Format Multi-Topology IS-IS Multi-topology IS-IS (MT IS-IS) allows you to create multiple IS-IS topologies on a single router with separate databases. Use this feature to place a virtual physical topology into logical routing domains, which can each support different routing and security policies. All routers on a LAN or point-to-point must have at least one common supported topology when operating in Multi-Topology ISIS mode.
PAGE 450
Graceful Restart Graceful restart is a protocol-based mechanism that preserves the forwarding table of the restarting router and its neighbors for a specified period to minimize the loss of packets. A graceful-restart router does not immediately assume that a neighbor is permanently down and so does not trigger a topology change. Normally, when an IS-IS router is restarted, temporary disruption of routing occurs due to events in both the restarting router and the neighbors of the restarting router.
PAGE 451
● ● ● ● Processes IPv6 information received in the PDUs. Computes routes to IPv6 destinations. Downloads IPv6 routes to the RTM for installing in the FIB. Accepts external IPv6 information and advertises this information in the PDUs. The following table lists the default IS-IS values. Table 50.
PAGE 452
In IS-IS, neighbors form adjacencies only when they are same IS type. For example, a Level 1 router never forms an adjacency with a Level 2 router. A Level 1-2 router forms Level 1 adjacencies with a neighboring Level 1 router and forms Level 2 adjacencies with a neighboring Level 2 router. NOTE: Even though you enable IS-IS globally, enable the IS-IS process on an interface for the IS-IS process to exchange protocol information and form adjacencies. To configure IS-IS globally, use the following commands.
PAGE 453
The default IS type is level-1-2. To change the IS type to Level 1 only or Level 2 only, use the is-type command in ROUTER ISIS mode. To view the IS-IS configuration, enter the show isis protocol command in EXEC Privilege mode or the show config command in ROUTER ISIS mode. DellEMC#show isis protocol IS-IS Router: System Id: EEEE.EEEE.EEEE IS-Type: level-1-2 Manual area address(es): 47.0004.004d.0001 Routing for area address(es): 21.2223.2425.2627.2829.3031.3233 47.0004.004d.
PAGE 454
NOTE: When you do not enable transition mode, you do not have IPv6 connectivity between routers operating in singletopology mode and routers operating in multi-topology mode. 2. Exclude this router from other router’s SPF calculations. ROUTER ISIS AF IPV6 mode set-overload-bit 3. Set the minimum interval between SPF calculations.
PAGE 455
● Configure graceful restart timer T3 to set the time used by the restarting router as an overall maximum time to wait for database synchronization to complete. ROUTER-ISIS mode graceful-restart t3 {adjacency | manual seconds} ○ adjacency: the restarting router receives the remaining time value from its peer and adjusts its T3 value so if user has configured this option. ○ manual: allows you to specify a fixed value that the restarting router should use. The range is from 50 to 120 seconds.
PAGE 456
LSP Interval: 33 Next IS-IS LAN Level-1 Hello in 4 seconds Next IS-IS LAN Level-2 Hello in 6 seconds LSP Interval: 33 Restart Capable Neighbors: 2, In Start: 0, In Restart: 0 DellEMC# Changing LSP Attributes IS-IS routers flood link state PDUs (LSPs) to exchange routing information. LSP attributes include the generation interval, maximum transmission unit (MTU) or size, and the refresh interval. You can modify the LSP attribute defaults, but it is not necessary.
PAGE 457
Configuring the IS-IS Metric Style All IS-IS links or interfaces are associated with a cost that is used in the shortest path first (SPF) calculations. The possible cost varies depending on the metric style supported. If you configure narrow, transition, or narrow transition metric style, the cost can be a number between 0 and 63. If you configure wide or wide transition metric style, the cost can be a number between 0 and 16,777,215.
PAGE 458
Configuring the IS-IS Cost When you change from one IS-IS metric style to another, the IS-IS metric value could be affected. For each interface with IS-IS enabled, you can assign a cost or metric that is used in the link state calculation. To change the metric or cost of the interface, use the following commands. ● Assign an IS-IS metric. INTERFACE mode isis metric default-metric [level-1 | level-2] ○ default-metric: the range is from 0 to 63 if the metric-style is narrow, narrow-transition, or transition.
PAGE 459
ROUTER ISIS mode is-type {level-1 | level-1-2 | level-2} To view which IS-type is configured, use the show isis protocol command in EXEC Privilege mode. The show config command in ROUTER ISIS mode displays only non-default information. If you do not change the IS-type, the default value (level-1-2) is not displayed. The default is Level 1-2 router. When the IS-type is Level 1-2, the software maintains two Link State databases, one for each level.
PAGE 460
● Apply a configured prefix list to all incoming IPv4 IS-IS routes. ROUTER ISIS mode distribute-list prefix-list-name in [interface] Enter the type of interface and the interface information: ○ ○ ○ ○ ○ ○ ○ ○ For For For For For For For For a a a a a a a a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port/subport information. 25-Gigabit Ethernet interface, enter the keyword twentyFiveGigE then the slot/port/subport information.
PAGE 461
You can configure one of the optional parameters: ○ connected: for directly connected routes. ○ ospf process-id: for OSPF routes only. ○ rip: for RIP routes only. ○ static: for user-configured routes. ○ bgp: for BGP routes only. ● Deny RTM download for pre-existing redistributed IPv6 routes. ROUTER ISIS-AF IPV6 mode distribute-list redistributed-override in Redistributing IPv4 Routes In addition to filtering routes, you can add routes from other routing instances or protocols to the IS-IS process.
PAGE 462
● Include BGP, directly connected, RIP, or user-configured (static) routes in IS-IS. ROUTER ISIS mode redistribute {bgp as-number | connected | rip | static} [level-1 level-1-2 | level-2] [metric metric-value] [metric-type {external | internal}] [route-map map-name] Configure the following parameters: ○ ○ ○ ○ level-1, level-1-2, or level-2: assign all redistributed routes to a level. The default is level-2. metric-value: the range is from 0 to 16777215. The default is 0.
PAGE 463
Setting the Overload Bit Another use for the overload bit is to prevent other routers from using this router as an intermediate hop in their shortest path first (SPF) calculations. For example, if the IS-IS routing database is out of memory and cannot accept new LSPs, Dell EMC Networking OS sets the overload bit and IS-IS traffic continues to transit the system. To set or remove the overload bit manually, use the following commands. ● Set the overload bit in LSPs.
PAGE 464
To view specific information, enter the following optional parameter: ○ interface: Enter the type of interface and slot/port information to view IS-IS information on that interface only. ● View the events that triggered IS-IS shortest path first (SPF) events for debugging purposes. EXEC Privilege mode debug isis spf-triggers ● View sent and received LSPs.
PAGE 465
Maximum Values in the Routing Table IS-IS metric styles support different cost ranges for the route. The cost range for the narrow metric style is 0 to 1023, while all other metric styles support a range of 0 to 0xFE000000. Change the IS-IS Metric Style in One Level Only By default, the IS-IS metric style is narrow. When you change from one IS-IS metric style to another, the IS-IS metric value (configured with the isis metric command) could be affected.
PAGE 466
Table 52. Metric Value When the Metric Style Changes (continued) Beginning Metric Style Final Metric Style Resulting IS-IS Metric Value wide transition narrow transition default value (10) if the original value is greater than 63. A message is sent to the console. wide transition transition truncated value (the truncated value appears in the LSP only).
PAGE 467
Table 54.
PAGE 468
Figure 61. IPv6 IS-IS Sample Topography The following is a sample configuration for enabling IPv6 IS-IS. IS-IS Sample Configuration — Congruent Topology DellEMC(conf-if-tf-1/17)#show config ! interface twentyFiveGigE 1/17 ip address 24.3.1.1/24 ipv6 address 24:3::1/76 ip router isis ipv6 router isis no shutdown DellEMC(conf-router_isis)#show config ! router isis metric-style wide level-1 metric-style wide level-2 net 34.0000.0000.AAAA.
PAGE 469
IS-IS Sample Configuration — Multi-topology Transition DellEMC(conf-if-tf-1/17)#show config ! interface twentyFiveGigE 1/17 ipv6 address 24:3::1/76 ipv6 router isis no shutdown DellEMC(conf-if-tf-1/17)# DellEMC(conf-router_isis)#show config ! router isis net 34.0000.0000.AAAA.
PAGE 470
25 Link Aggregation Control Protocol (LACP) A link aggregation group (LAG), referred to as a port channel by the Dell EMC Networking OS, can provide both load-sharing and port redundancy across line cards. You can enable LAGs as static or dynamic.
PAGE 471
NOTE: There is no configuration on the interface because that condition is required for an interface to be part of a LAG. ● You can configure link dampening on individual members of a LAG. LACP Modes Dell EMC Networking OS provides three modes for configuration of LACP — Off, Active, and Passive. ● Off — In this state, an interface is not capable of being part of a dynamic LAG. LACP does not run on any port that is configured to be in this state.
PAGE 472
● ● ● ● Configuring the LAG Interfaces as Dynamic Setting the LACP Long Timeout Monitoring and Debugging LACP Configuring Shared LAG State Tracking Creating a LAG To create a dynamic port channel (LAG), use the following command. First you define the LAG and then the LAG interfaces. ● Create a dynamic port channel (LAG). CONFIGURATION mode interface port-channel ● Create a dynamic port channel (LAG).
PAGE 473
Setting the LACP Long Timeout PDUs are exchanged between port channel (LAG) interfaces to maintain LACP sessions. PDUs are transmitted at either a slow or fast transmission rate, depending upon the LACP timeout value. The timeout value is the amount of time that a LAG interface waits for a PDU from the remote system before bringing the LACP session down. The default timeout value is 1 second. You can configure the default timeout value to be 30 seconds.
PAGE 474
Figure 62. Shared LAG State Tracking To avoid packet loss, redirect traffic through the next lowest-cost link (R3 to R4). Dell EMC Networking OS has the ability to bring LAG 2 down if LAG 1 fails, so that traffic can be redirected. This redirection is what is meant by shared LAG state tracking. To achieve this functionality, you must group LAG 1 and LAG 2 into a single entity, called a failover group.
PAGE 475
Figure 63. Configuring Shared LAG State Tracking The following are shared LAG state tracking console messages: ● 2d1h45m: %RPM0-P:CP %IFMGR-5-OSTATE_DN: Changed interface state to down: Po 1 ● 2d1h45m: %RPM0-P:CP %IFMGR-5-OSTATE_DN: Changed interface state to down: Po 2 To view the status of a failover group member, use the show interface port-channel command.
PAGE 476
LACP Basic Configuration Example The screenshots in this section are based on the following example topology. Two routers are named ALPHA and BRAVO, and their hostname prompts reflect those names. Figure 64. LACP Basic Configuration Example Configure a LAG on ALPHA The following example creates a LAG on ALPHA.
PAGE 477
0 runts, 0 giants, 0 throttles 0 CRC, 0 overrun, 0 discarded Output Statistics 136 packets, 16718 bytes, 0 underruns 0 64-byte pkts, 15 over 64-byte pkts, 121 over 127-byte pkts 0 over 255-byte pkts, 0 over 511-byte pkts, 0 over 1023-byte pkts 136 Multicasts, 0 Broadcasts, 0 Unicasts 0 Vlans, 0 throttles, 0 discarded, 0 collisions, 0 wreddrops Rate info (interval 299 seconds): Input 00.00 Mbits/sec,0 packets/sec, 0.00% of line-rate Output 00.00 Mbits/sec,0 packets/sec, 0.
PAGE 478
Figure 66.
PAGE 479
Figure 67.
PAGE 480
Bravo(conf-if-po-10)#switch Bravo(conf-if-po-10)#no shut Bravo(conf-if-po-10)#show config ! interface Port-channel 10 no ip address switchport no shutdown ! Bravo(conf-if-po-10)#exit Bravo(conf)#int twentyFiveGigE 1/3 Bravo(conf)#no ip address Bravo(conf)#no switchport Bravo(conf)#shutdown Bravo(conf-if-tf-1/3)#port-channel-protocol lacp Bravo(conf-if-tf-1/3-lacp)#port-channel 10 mode active Bravo(conf-if-tf-1/3-lacp)#no shut Bravo(conf-if-tf-1/3)#end ! interface twentyFiveGigE 1/3 no ip address ! port-chan
PAGE 481
Figure 68.
PAGE 482
Figure 69.
PAGE 483
Figure 70. Inspecting the LAG Status Using the show lacp command The point-to-point protocol (PPP) is a connection-oriented protocol that enables layer two links over various different physical layer connections. It is supported on both synchronous and asynchronous lines, and can operate in Half-Duplex or Full-Duplex mode. It was designed to carry IP traffic but is general enough to allow any type of network layer datagram to be sent over a PPP connection.
PAGE 484
26 Layer 2 This chapter describes the Layer 2 features supported on the device. Topics: • • • • • • • Manage the MAC Address Table MAC Learning Limit Disabling MAC Address Learning on the System Enabling port security NIC Teaming Configure Redundant Pairs Far-End Failure Detection Manage the MAC Address Table You can perform the following management tasks in the MAC address table.
PAGE 485
The range is from 10 to 1000000. Configuring a Static MAC Address A static entry is one that is not subject to aging. Enter static entries manually. To create a static MAC address entry, use the following command. ● Create a static MAC address entry in the MAC address table. CONFIGURATION mode mac-address-table static Displaying the MAC Address Table To display the MAC address table, use the following command. ● Display the contents of the MAC address table.
PAGE 486
NOTE: The CAM-check failure message beginning in Dell EMC Networking OS version 8.3.1.0 is different from versions 8.2.1.1 and earlier, which read: % Error: ACL returned error % Error: Remove existing limit configuration if it was configured before Setting the MAC Learning Limit To set a MAC learning limit on an interface, use the following command. ● Specify the number of MAC addresses that the system can learn off a Layer 2 interface.
PAGE 487
mac learning-limit station-move The mac learning-limit station-move command allows a MAC address already in the table to be learned from another interface. For example, if you disconnect a network device from one interface and reconnect it to another interface, the MAC address is learned on the new interface. When the system detects this “station move,” the system clears the entry learned on the original interface and installs a new entry on the new interface.
PAGE 488
INTERFACE mode station-move-violation shutdown-original ● Shut down the second port to learn the MAC address. INTERFACE mode station-move-violation shutdown-offending ● Shut down both the first and second port to learn the MAC address. INTERFACE mode station-move-violation shutdown-both ● Display a list of all of the interfaces configured with MAC learning limit or station move violation.
PAGE 489
Enabling port security You can enable or disable port security feature globally on the Dell EMC Networking OS. You can configure all the MAC address learning limit configurations, only if the port security is enabled on the Dell EMC Networking OS. If the port security feature is disabled, all the interface level configurations are reset and all dynamically learnt MAC addresses on the interfaces configured with MAC address learning limit are cleared.
PAGE 490
Figure 72. Configuring the mac-address-table station-move refresh-arp Command Configure Redundant Pairs Networks that employ switches that do not support the spanning tree protocol (STP) — for example, networks with digital subscriber line access multiplexers (DSLAM) — cannot have redundant links between switches because they create switching loops (as shown in the following illustration).
PAGE 491
Figure 73. Configuring Redundant Layer 2 Pairs without Spanning Tree You configure a redundant pair by assigning a backup interface to a primary interface with the switchport backup interface command. Initially, the primary interface is active and transmits traffic and the backup interface remains down. If the primary fails for any reason, the backup transitions to an active Up state. If the primary interface fails and later comes back up, it remains as the backup interface for the redundant pair.
PAGE 492
02:28:04: %RPM0-P:CP %IFMGR-5-OSTATE_DN: Changed interface state to down: Tw 1/12 02:28:04: %RPM0-P:CP %IFMGR-5-STATE_ACT_STBY: Changed interface state to standby: tw 1/13 Example of Configuring Redundant Layer 2 Pairs DellEMC(conf-if-range-tf-1/1-1/2)#switchport backup interface twentyFiveGigE 1/1 DellEMC(conf-if-range-tf-1/1-1/2)#show config ! interface twentyFiveGigE 1/1 no ip address switchport switchport backup interface twentyFiveGigE 1/2 no shutdown ! interface twentyFiveGigE 1/2 no ip address switch
PAGE 493
Far-End Failure Detection Far-end failure detection (FEFD) is a protocol that senses remote data link errors in a network. FEFD responds by sending a unidirectional report that triggers an echoed response after a specified time interval. You can enable FEFD globally or locally on an interface basis. Disabling the global FEFD configuration does not disable the interface configuration. Figure 74.
PAGE 494
5. If the FEFD system has been set to Aggressive mode and neighboring echoes are not received after three intervals, the state changes to Err-disabled. You must manually reset all interfaces in the Err-disabled state using the fefd reset [interface] command in EXEC privilege mode (it can be done globally or one interface at a time) before the FEFD enabled system can become operational again. Table 55.
PAGE 495
To display information about the state of each interface, use the show fefd command in EXEC privilege mode. DellEMC#show fefd FEFD is globally 'ON', interval is 3 seconds, mode is 'Normal'.
PAGE 496
Debugging FEFD To debug FEFD, use the first command. To provide output for each packet transmission over the FEFD enabled connection, use the second command. ● Display output whenever events occur that initiate or disrupt an FEFD enabled connection. EXEC Privilege mode debug fefd events ● Provide output for each packet transmission over the FEFD enabled connection.
PAGE 497
27 Link Layer Discovery Protocol (LLDP) This chapter describes how to configure and use the link layer discovery protocol (LLDP). Topics: • • • • • • • • • • • • • • • 802.
PAGE 498
TLVs are encapsulated in a frame called an LLDP data unit (LLDPDU) (shown in the following table), which is transmitted from one LLDP-enabled device to its LLDP-enabled neighbors. LLDP is a one-way protocol. LLDP-enabled devices (LLDP agents) can transmit and/or receive advertisements, but they cannot solicit and do not respond to advertisements. There are five types of TLVs. All types are mandatory in the construction of an LLDPDU except Optional TLVs.
PAGE 499
Figure 77. Organizationally Specific TLV IEEE Organizationally Specific TLVs Eight TLV types have been defined by the IEEE 802.1 and 802.3 working groups as a basic part of LLDP; the IEEE OUI is 00-80C2. You can configure the Dell EMC Networking system to advertise any or all of these TLVs. Table 57. Optional TLV Types Type TLV Description 4 Port description A user-defined alphanumeric string that describes the port. Dell EMC Networking OS does not currently support this TLV.
PAGE 500
Table 57. Optional TLV Types (continued) Type TLV Description configurable) in the LLDP-MED implementation. 127 Power via MDI Dell EMC Networking supports the LLDP-MED protocol, which recommends that Power via MDI TLV be not implemented, and therefore Dell EMC Networking implements Extended Power via MDI TLV only. 127 Link Aggregation Indicates whether the link is capable of being aggregated, whether it is currently in a LAG, and the port identification of the LAG.
PAGE 501
Table 58. TIA-1057 (LLDP-MED) Organizationally Specific TLVs (continued) Type SubType TLV Description ● LLDP device class 127 2 Network Policy Indicates the application type, VLAN ID, Layer 2 Priority, and DSCP value.
PAGE 502
When you enable LLDP-MED in Dell EMC Networking OS (using the advertise med command), the system begins transmitting this TLV. Figure 78. LLDP-MED Capabilities TLV Table 59. Dell EMC Networking OS LLDP-MED Capabilities Bit Position TLV Dell EMC Networking OS Support 0 LLDP-MED Capabilities Yes 1 Network Policy Yes 2 Location Identification Yes 3 Extended Power via MDI-PSE Yes 4 Extended Power via MDI-PD No 5 Inventory No 6–15 reserved No Table 60.
PAGE 503
Table 61. Network Policy Applications Type Application Description 0 Reserved — 1 Voice Specify this application type for dedicated IP telephony handsets and other appliances supporting interactive voice services. 2 Voice Signaling Specify this application type only if voice control packets use a separate network policy than voice data.
PAGE 504
Important Points to Remember ● LLDP is enabled by default. ● Dell EMC Networking systems support up to eight neighbors per interface. ● Dell EMC Networking systems support a maximum of 8000 total neighbors per system. If the number of interfaces multiplied by eight exceeds the maximum, the system does not configure more than 8000. ● INTERFACE level configurations override all CONFIGURATION level configurations. ● LLDP is not hitless.
PAGE 505
protocol lldp 2. Enable LLDP. PROTOCOL LLDP mode no disable Disabling and Undoing LLDP To disable or undo LLDP, use the following command. ● Disable LLDP globally or for an interface. disable To undo an LLDP configuration, precede the relevant command with the keyword no. Enabling LLDP on Management Ports LLDP on management ports is enabled by default. To enable LLDP on management ports, use the following command. 1. Enter Protocol LLDP mode. CONFIGURATION mode protocol lldp 2.
PAGE 506
1. Enter LLDP mode. CONFIGURATION or INTERFACE mode protocol lldp 2. Advertise one or more TLVs. PROTOCOL LLDP mode advertise {dcbx-appln-tlv | dcbx-tlv | dot3-tlv | interface-port-desc | management-tlv | med } Include the keyword for each TLV you want to advertise. ● ● ● ● For For For For management TLVs: system-capabilities, system-description. 802.1 TLVs: port-protocol-vlan-id, port-vlan-id . 802.3 TLVs: max-frame-size.
PAGE 507
protocol lldp advertise dot1-tlv port-protocol-vlan-id port-vlan-id advertise dot3-tlv max-frame-size advertise management-tlv system-capabilities system-description hello 10 no disable DellEMC(conf-lldp)# DellEMC(conf-lldp)#exit DellEMC(conf)#interface twentyFiveGigE 1/31 DellEMC(conf-if-tf-1/31)#show config ! interface twentyFiveGigE 1/31 no ip address switchport no shutdown DellEMC(conf-if-tf-1/31)#protocol lldp DellEMC(conf-if-tf-1/31-lldp)#show config ! protocol lldp DellEMC(conf-if-tf-1/31-lldp)# Vie
PAGE 508
Remote Chassis ID Subtype: Mac address (4) Remote Chassis ID: d8:9e:f3:b2:61:20 Remote Port Subtype: Interface name (5) Remote Port ID: ethernet1/1/23 Remote Port Description: ethernet1/1/23 Local Port ID: ManagementEthernet 1/1 Locally assigned remote Neighbor Index: 2 Remote TTL: 120 Information valid for next 94 seconds Time since last information change of this neighbor: 5d5h9m Remote MTU: 1532 Remote System Name: swlab2-maa-tor-C4 Remote Management Address (IPv4): 100.104.70.
PAGE 509
======================================================================== Configuring LLDPDU Intervals LLDPDUs are transmitted periodically; the default interval is 30 seconds. To configure LLDPDU intervals, use the following command. ● Configure a non-default transmit interval.
PAGE 510
protocol lldp advertise dot1-tlv port-protocol-vlan-id port-vlan-id advertise dot3-tlv max-frame-size advertise management-tlv system-capabilities system-description no disable R1(conf-lldp)#mode ? rx Rx only tx Tx only R1(conf-lldp)#mode tx R1(conf-lldp)#show config ! protocol lldp advertise dot1-tlv port-protocol-vlan-id port-vlan-id advertise dot3-tlv max-frame-size advertise management-tlv system-capabilities system-description mode tx no disable R1(conf-lldp)#no mode R1(conf-lldp)#show config ! protoco
PAGE 511
no disable R1(conf-lldp)# Debugging LLDP You can view the TLVs that your system is sending and receiving. To view the TLVs, use the following commands. ● View a readable version of the TLVs. debug lldp brief ● View a readable version of the TLVs plus a hexadecimal version of the entire LLDPDU, including unrecognized TLVs. debug lldp detail To stop viewing the LLDP TLVs sent and received by the system, use the no debug lldp command. Figure 81.
PAGE 512
Relevant Management Objects Dell EMC Networking OS supports all IEEE 802.1AB MIB objects. The following tables list the objects associated with: ● ● ● ● received and transmitted TLVs the LLDP configuration on the local agent IEEE 802.1AB Organizationally Specific TLVs received and transmitted LLDP-MED TLVs Table 62.
PAGE 513
Table 63.
PAGE 514
Table 64. LLDP 802.
PAGE 515
Table 65.
PAGE 516
28 Microsoft Network Load Balancing Network load balancing (NLB) is a clustering functionality that is implemented by Microsoft on Windows 2000 Server and Windows Server 2003 operating systems (OSs). NLB uses a distributed methodology or pattern to equally split and balance the network traffic load across a set of servers that are part of the cluster or group.
PAGE 517
Limitations of the NLB Feature The following limitations apply to switches on which you configure NLB: ● The NLB Unicast mode uses switch flooding to transmit all packets to all the servers that are part of the VLAN. When a large volume of traffic is processed, the clustering performance might be impacted in a small way. This limitation is applicable to switches that perform unicast flooding in the software. ● The ip vlan-flooding command applies globally across the system and for all VLANs.
PAGE 518
There might be some ARP table entries that are resolved through ARP packets, which had the Ethernet MAC SA different from the MAC information inside the ARP packet. This unicast data traffic flooding occurs only for those packets that use these ARP entries. Enabling a Switch for Multicast NLB To enable a switch for Multicast NLB mode, perform the following steps: 1.
PAGE 519
29 Multicast Source Discovery Protocol (MSDP) Multicast source discovery protocol (MSDP) is supported on Dell EMC Networking OS. Protocol Overview MSDP is a Layer 3 protocol that connects IPv4 protocol-independent multicast-sparse mode (PIM-SM) domains. A domain in the context of MSDP is a contiguous set of routers operating PIM within a common boundary defined by an exterior gateway protocol, such as border gateway protocol (BGP).
PAGE 520
Figure 83.
PAGE 521
Implementation Information The Dell EMC Networking OS implementation of MSDP is in accordance with RFC 3618 and Anycast RP is in accordance with RFC 3446. Configure Multicast Source Discovery Protocol Configuring MSDP is a four-step process. 1. Enable an exterior gateway protocol (EGP) with at least two routing domains. Refer to the following figures. The MSDP Sample Configurations show the OSPF-BGP configuration used in this chapter for MSDP.
PAGE 522
Figure 84.
PAGE 523
Figure 85.
PAGE 524
Figure 86.
PAGE 525
Figure 87. Configuring MSDP Enable MSDP Enable MSDP by peering RPs in different administrative domains. 1. Enable MSDP. CONFIGURATION mode ip multicast-msdp 2. Peer PIM systems in different administrative domains. CONFIGURATION mode ip msdp peer connect-source R3(conf)#ip multicast-msdp R3(conf)#ip msdp peer 192.168.0.
PAGE 526
Multicast sources in remote domains are stored on the RP in the source-active cache (SA cache). The system does not create entries in the multicast routing table until there is a local receiver for the corresponding multicast group. R3#show ip msdp peer Peer Addr: 192.168.0.1 Local Addr: 192.168.0.
PAGE 527
Clearing the Source-Active Cache To clear the source-active cache, use the following command. ● Clear the SA cache of all, local, or rejected entries, or entries for a specific group. CONFIGURATION mode clear ip msdp sa-cache [group-address | local | rejected-sa] Enabling the Rejected Source-Active Cache To cache rejected sources, use the following command. Active sources can be rejected because the RPF check failed, the SA limit is reached, the peer RP is unreachable, or the SA message has a format error.
PAGE 528
Figure 88.
PAGE 529
Figure 89.
PAGE 530
Figure 90. MSDP Default Peer, Scenario 4 Specifying Source-Active Messages To specify messages, use the following command. ● Specify the forwarding-peer and originating-RP from which all active sources are accepted without regard for the RPF check. CONFIGURATION mode ip msdp default-peer ip-address list If you do not specify an access list, the peer accepts all sources that peer advertises. All sources from RPs that the ACL denies are subject to the normal RPF check. DellEMC(conf)#ip msdp peer 10.0.50.
PAGE 531
DellEMC#ip msdp sa-cache rejected-sa MSDP Rejected SA Cache 3 rejected SAs received, cache-size 32766 UpTime GroupAddr SourceAddr RPAddr 00:33:18 229.0.50.64 24.0.50.64 200.0.1.50 00:33:18 229.0.50.65 24.0.50.65 200.0.1.50 00:33:18 229.0.50.66 24.0.50.66 200.0.1.50 LearnedFrom 10.0.50.2 10.0.50.2 10.0.50.2 Reason Rpf-Fail Rpf-Fail Rpf-Fail Limiting the Source-Active Messages from a Peer To limit the source-active messages from a peer, use the following commands. 1.
PAGE 532
Preventing MSDP from Caching a Remote Source To prevent MSDP from caching a remote source, use the following commands. 1. OPTIONAL: Cache sources that the SA filter denies in the rejected SA cache. CONFIGURATION mode ip msdp cache-rejected-sa 2. Prevent the system from caching remote sources learned from a specific peer based on source and group. CONFIGURATION mode ip msdp sa-filter list out peer list ext-acl As shown in the following example, R1 is advertising source 10.11.4.2.
PAGE 533
MSDP Source-Active Cache - 1 entries GroupAddr SourceAddr RPAddr LearnedFrom 239.0.0.1 10.11.4.2 192.168.0.1 local R3(conf)#do show ip msdp sa-cache MSDP Source-Active Cache - 1 entries GroupAddr SourceAddr RPAddr LearnedFrom 239.0.0.1 10.11.4.2 192.168.0.1 192.168.0.1 Expire 70 UpTime 00:27:20 Expire 1 UpTime 00:10:29 [Router 3] R3(conf)#do show ip msdp sa-cache R3(conf)# To display the configured SA filters for a peer, use the show ip msdp peer command from EXEC Privilege mode.
PAGE 534
CONFIGURATION mode clear ip msdp peer peer-address R3(conf)#do show ip msdp peer Peer Addr: 192.168.0.1 Local Addr: 192.168.0.3(639) Connect Source: Lo 0 State: Established Up/Down Time: 00:04:26 Timers: KeepAlive 30 sec, Hold time 75 sec SourceActive packet count (in/out): 5/0 SAs learned from this peer: 0 SA Filtering: Input (S,G) filter: myremotefilter Output (S,G) filter: none R3(conf)#do clear ip msdp peer 192.168.0.1 R3(conf)#do show ip msdp peer Peer Addr: 192.168.0.1 Local Addr: 0.0.0.
PAGE 535
Anycast RP relieves these limitations by allowing multiple RPs per group, which can be distributed in a topologically significant manner according to the locations of the sources and receivers. 1. All the RPs serving a given group are configured with an identical anycast address. 2. Sources then register with the topologically closest RP. 3. RPs use MSDP to peer with each other using a unique address. Figure 91.
PAGE 536
4. Peer each RP with every other RP using MSDP, specifying the unique Loopback address as the connect-source. CONFIGURATION mode ip msdp peer 5. Advertise the network of each of the unique Loopback addresses throughout the network. ROUTER OSPF mode network Reducing Source-Active Message Flooding RPs flood source-active messages to all of their peers away from the RP.
PAGE 537
! ip ip ip ip ip multicast-msdp msdp peer 192.168.0.3 connect-source Loopback 1 msdp peer 192.168.0.22 connect-source Loopback 1 msdp mesh-group AS100 192.168.0.22 msdp originator-id Loopback 1! ip pim rp-address 192.168.0.1 group-address 224.0.0.0/4 The following example shows an R2 configuration for MSDP with Anycast RP. ip multicast-routing ! interface twentyFiveGigE 2/1 ip pim sparse-mode ip address 10.11.4.1/24 no shutdown ! interface twentyFiveGigE 2/11 ip pim sparse-mode ip address 10.11.1.
PAGE 538
ip address 10.11.6.34/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 192.168.0.3/32 no shutdown ! router ospf 1 network 10.11.6.0/24 area 0 network 192.168.0.3/32 area 0 redistribute static redistribute connected redistribute bgp 200 ! router bgp 200 redistribute ospf 1 neighbor 192.168.0.22 remote-as 100 neighbor 192.168.0.22 ebgp-multihop 255 neighbor 192.168.0.22 update-source Loopback 0 neighbor 192.168.0.22 no shutdown ! ip multicast-msdp ip msdp peer 192.168.0.
PAGE 539
! ip pim rp-address 192.168.0.1 group-address 224.0.0.0/4 MSDP Sample Configuration: R2 Running-Config ip multicast-routing ! interface twentyFiveGigE 1/1 ip pim sparse-mode ip address 10.11.4.1/24 no shutdown ! interface twentyFiveGigE 1/11 ip pim sparse-mode ip address 10.11.1.21/24 no shutdown ! interface twentyFiveGigE 1/31 ip pim sparse-mode ip address 10.11.0.23/24 no shutdown ! interface Loopback 0 ip address 192.168.0.2/32 no shutdown ! router ospf 1 network 10.11.1.0/24 area 0 network 10.11.4.
PAGE 540
redistribute connected redistribute bgp 200 ! router bgp 200 redistribute ospf 1 neighbor 192.168.0.2 remote-as 100 neighbor 192.168.0.2 ebgp-multihop 255 neighbor 192.168.0.2 update-source Loopback 0 neighbor 192.168.0.2 no shutdown ! ip multicast-msdp ip msdp peer 192.168.0.1 connect-source Loopback 0 ! ip route 192.168.0.2/32 10.11.0.23 MSDP Sample Configuration: R4 Running-Config ip multicast-routing ! interface twentyFiveGigE 1/1 ip pim sparse-mode ip address 10.11.5.
PAGE 541
30 Multicast Listener Discovery Protocol Dell Networking OS Supports Multicast Listener Discovery (MLD) protocol. Multicast Listener Discovery (MLD) is a Layer 3 protocol that IPv6 routers use to learn of the multicast receivers that are directly connected to them and the groups in which the receivers are interested. Multicast routing protocols (like PIM) use the information learned from MLD to route multicast traffic to all interested receivers.
PAGE 542
Joining a Multicast Group The Querier periodically sends a General Query to the all-nodes multicast address FF02::1. A host that wants to join a multicast group responds to the general query with a report that contains the group address; the report is also addressed to the group (in the IPv6 Destination Address field). To avoid duplicate reporting, any host that hears a report from another host for the same group in which it itself is interested cancels its report for that group.
PAGE 543
| | * * | | +-+ | | * * | | * Source Address [2] * | | * * | | +. -+ . . . . . . +-+ | | * * | | * Source Address [N] * | | * * | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Version 2 multicast listener reports are sent by IP nodes to report (to neighboring routers) the current multicast listening state, or changes in the multicast listening state, of their interfaces.
PAGE 544
| | * Source Address [1] * | | * * | | +-+ | | * * | | * Source Address [2] * | | * * | | +-+ . . . . . . . . . +-+ | | * * | | * Source Address [N] * | | * * | | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | | . . . Auxiliary Data . . .
PAGE 545
report when the timer expires. Increasing this value spreads host responses over a greater period of time, and so reduces response burstiness. To adjust the query response time, use the following command: INTERFACE Mode ipv6 mld query-max-resp-time Configuring MLD Version To configure MLD version on the system, follow this procedure: Select the MLD version INTERFACE Mode ipv6 mld version {1 | 2} If you do not configure the MLD version, the system defaults to version 2.
PAGE 546
retransmissions. Lowering the Last Listener Query Interval reduces the time to detect that there are no remaining receivers for a group, and so can reduce the amount of unnecessarily forwarded traffic. To adjust the last-member query interval, use the following command: INTERFACE Mode ipv6 mld last-member-query-interval Displaying MLD groups table Display MLD groups. Group information can be filtered.
PAGE 547
Enable MLD Snooping MLD is automatically enabled when you enable IPv6 PIM, but MLD snooping must be explicitly enabled. To enable MLD snooping, use the following command: CONFIGURATION Mode ipv6 mld snooping enable Disable MLD Snooping When MLD is enabled globally, it is by default enabled on all the VLANs.
PAGE 548
2. To display the MLD explicit-tracking table, use the following command. EXEC Pivilege show ipv6 mld snooping groups explicit Display the MLD Snooping Table 1. To display the MLD snooping table, use the following command: EXEC Privilege show ipv6 mroute snooping vlan 2.
PAGE 549
31 Multiple Spanning Tree Protocol (MSTP) Multiple spanning tree protocol (MSTP) — specified in IEEE 802.1Q-2003 — is a rapid spanning tree protocol (RSTP)-based spanning tree variation that improves per-VLAN spanning tree plus (PVST+). MSTP allows multiple spanning tree instances and allows you to map many VLANs to one spanning tree instance to reduce the total number of required instances. Protocol Overview MSTP — specified in IEEE 802.
PAGE 550
• • • • • • • Modifying Global Parameters Modifying the Interface Parameters Setting STP path cost as constant Configuring an EdgePort Flush MAC Addresses after a Topology Change MSTP Sample Configurations Debugging and Verifying MSTP Configurations Spanning Tree Variations The Dell EMC Networking OS supports four variations of spanning tree, as shown in the following table. Table 66. Spanning Tree Variations Dell EMC Networking Term IEEE Specification Spanning Tree Protocol (STP) 802 .
PAGE 551
● Enabling SNMP Traps for Root Elections and Topology Changes ● Configuring Spanning Trees as Hitless Enable Multiple Spanning Tree Globally MSTP is not enabled by default. To enable MSTP globally, use the following commands. When you enable MSTP, all physical, VLAN, and port-channel interfaces that are enabled and in Layer 2 mode are automatically part of the MSTI 0. ● Within an MSTI, only one path from any bridge to any other bridge is enabled.
PAGE 552
no disable MSTI 1 VLAN 100 MSTI 2 VLAN 200-300 All bridges in the MSTP region must have the same VLAN-to-instance mapping. To view which instance a VLAN is mapped to, use the show spanning-tree mst vlan command from EXEC Privilege mode.
PAGE 553
Designated bridge has priority 32768, address 0001.e809.c24a Designated port id is 128.384, designated path cost 20000 Number of transitions to forwarding state 1 BPDU (MRecords): sent 39291, received 7547 The port is not in the Edge port mode Influencing MSTP Root Selection MSTP determines the root bridge, but you can assign one bridge a lower priority to increase the probability that it becomes the root bridge. To change the bridge priority, use the following command.
PAGE 554
● Change the region revision number. PROTOCOL MSTP mode revision number To view the current region name and revision, use the show spanning-tree mst configuration command from EXEC Privilege mode.
PAGE 555
To view the current values for MSTP parameters, use the show running-config spanning-tree mstp command from EXEC privilege mode.
PAGE 556
The range is from 0 to 240, in increments of 16. The default is 128. To view the current values for these interface parameters, use the show config command from INTERFACE mode. Setting STP path cost as constant You can set the path cost to be constant for port-channel regardless of the operation status of the port-channel member ports. To set the STP path cost, use the port-channel path-cost custom command from the PROTOCOL SPANNING-TREE mode.
PAGE 557
no ip address switchport spanning-tree mstp edge-port spanning-tree MSTI 1 priority 144 no shutdown Flush MAC Addresses after a Topology Change Dell EMC Networking OS has an optimized MAC address flush mechanism for RSTP, MSTP, and PVST+ that flushes addresses only when necessary, which allows for faster convergence during topology changes. However, you may activate the flushing mechanism defined by 802.
PAGE 558
! (Step 2) interface twentyFiveGigE 1/21 no ip address switchport no shutdown ! interface twentyFiveGigE 1/31 no ip address switchport no shutdown ! (Step 3) interface Vlan 100 no ip address tagged twentyFiveGigE 1/21,1/31 no shutdown ! interface Vlan 200 no ip address tagged twentyFiveGigE 1/21,1/31 no shutdown ! interface Vlan 300 no ip address tagged twentyFiveGigE 1/21,1/31 no shutdown Router 2 Running-Configuration This example uses the following steps: 1.
PAGE 559
tagged twentyFiveGigE 1/3,1/4 no shutdown (Step 1) protocol spanning-tree mstp no disable name Tahiti revision 123 MSTI 1 VLAN 100 MSTI 2 VLAN 200,300 ! (Step 2) interface twentyFiveGigE 1/11 no ip address switchport no shutdown ! interface twentyFiveGigE 1/31 no ip address switchport no shutdown ! (Step 3) interface Vlan 100 no ip address tagged twentyFiveGigE 1/11,1/31 no shutdown ! interface Vlan 200 no ip address tagged twentyFiveGigE 1/11,1/31 no shutdown ! interface Vlan 300 no ip address tagged twent
PAGE 560
no shutdown ! interface Vlan 200 no ip address tagged twentyFiveGigE 1/1,1/2 no shutdown ! interface Vlan 300 no ip address tagged twentyFiveGigE 1/1,1/2 no shutdown (Step 1) protocol spanning-tree mstp no disable name Tahiti revision 123 MSTI 1 VLAN 100 MSTI 2 VLAN 200,300 ! (Step 2) interface twentyFiveGigE 1/11 no ip address switchport no shutdown ! interface twentyFiveGigE 1/21 no ip address switchport no shutdown ! (Step 3) interface Vlan 100 no ip address tagged twentyFiveGigE 1/11,1/21 no shutdown !
PAGE 561
switchport protected 0 exit interface 1/0/32 no shutdown spanning-tree port mode enable switchport protected 0 exit (Step 3) interface vlan 100 tagged 1/0/31 tagged 1/0/32 exit interface vlan 200 tagged 1/0/31 tagged 1/0/32 exit interface vlan 300 tagged 1/0/31 tagged 1/0/32 exit Debugging and Verifying MSTP Configurations To debut and verify MSTP configuration, use the following commands. ● Display BPDUs. EXEC Privilege mode debug spanning-tree mstp bpdu ● Display MSTP-triggered topology change messages.
PAGE 562
protocol spanning-tree mstp name Tahiti revision 123 MSTI 1 VLAN 100 MSTI 2 VLAN 200,300 The following example shows viewing the debug log of a successful MSTP configuration. DellEMC#debug spanning-tree mstp bpdu MSTP debug bpdu is ON DellEMC# 4w0d4h : MSTP: Sending BPDU on Tf 1/1 : ProtId: 0, Ver: 3, Bpdu Type: MSTP, Flags 0x6e CIST Root Bridge Id: 32768:0001.e806.953e, Ext Path Cost: 0 Regional Bridge Id: 32768:0001.e806.
PAGE 563
32 Multicast Features NOTE: Multicast routing is supported on secondary IP addresses; it is not supported on IPv6. NOTE: Multicast routing is supported across default and non-default virtual routing and forwarding (VRFs).
PAGE 564
Protocol Ethernet Address RIP 01:00:5e:00:00:09 NTP 01:00:5e:00:01:01 VRRP 01:00:5e:00:00:12 PIM-SM 01:00:5e:00:00:0d ● ● ● ● The Dell EMC Networking OS implementation of MTRACE is in accordance with IETF draft draft-fenner-traceroute-ipm. Multicast is not supported on secondary IP addresses. If you enable multicast routing, egress Layer 3 ACL is not applied to multicast data traffic. Multicast traffic can be forwarded to a maximum of 15 VLANs with the same outgoing interface.
PAGE 565
● Limit the total number of multicast routes on the system. CONFIGURATION mode ip multicast-limit The range is from 1 to . The default is 4000. NOTE: The IN-L3-McastFib CAM partition stores multicast routes and is a separate hardware limit that exists per portpipe. Any software-configured limit may supersede this hardware space limitation. The opposite is also true, the CAM partition might not be exhausted at the time the system-wide route limit is reached using the ip multicast-limit command.
PAGE 566
Figure 94. Preventing a Host from Joining a Group The following table lists the location and description shown in the previous illustration. Table 68. Preventing a Host from Joining a Group — Description Location Description 1/21/1 ● ● ● ● Interface twentyfiveGigE 1/21 ip pim sparse-mode ip address 10.11.12.1/24 no shutdown 1/31/1 ● ● ● ● Interface twentyfiveGigE 1/21 ip pim sparse-mode ip address 10.11.13.
PAGE 567
Table 68. Preventing a Host from Joining a Group — Description (continued) Location Description 2/11/1 ● ● ● ● Interface twentyfiveGigE 1/21 ip pim sparse-mode ip address 10.11.12.2/24 no shutdown 2/31/1 ● ● ● ● Interface twentyfiveGigE 1/21 ip pim sparse-mode ip address 10.11.23.1/24 no shutdown 3/1/1 ● ● ● ● Interface twentyfiveGigE 1/21 ip pim sparse-mode ip address 10.11.5.1/24 no shutdown 3/11/1 ● ● ● ● Interface twentyfiveGigE 1/21 ip pim sparse-mode ip address 10.11.13.
PAGE 568
Initially, a single PIM-SM tree called a shared tree to distribute traffic. It is called shared because all traffic for the group, regardless of the source, or the location of the source, must pass through the RP. The shared tree is unidirectional; that is, all multicast traffic flows only from the RP to the receivers. Once a receiver receives traffic from the RP, PM-SM switches to SPT to forward multicast traffic, which connects the receiver directly to the source.
PAGE 569
Figure 95. Preventing a Source from Transmitting to a Group The following table lists the location and description shown in the previous illustration. Table 70. Preventing a Source from Transmitting to a Group — Description Location Description 1/21 ● ● ● ● Interface TwentyfiveGigE 1/1 ip pim sparse-mode ip address 10.11.12.1/24 no shutdown 1/31 ● ● ● ● Interface TwentyfiveGigE 1/2 ip pim sparse-mode ip address 10.11.13.
PAGE 570
Table 70. Preventing a Source from Transmitting to a Group — Description (continued) Location Description 2/11 ● ● ● ● Interface TwentyfiveGigE 2/11 ip pim sparse-mode ip address 10.11.12.2/24 no shutdown 2/31 ● ● ● ● Interface TwentyfiveGigE 2/31 ip pim sparse-mode ip address 10.11.23.1/24 no shutdown 3/1 ● ● ● ● Interface TwentyfiveGigE 3/1 ip pim sparse-mode ip address 10.11.5.1/24 no shutdown 3/11 ● ● ● ● Interface TwentyfiveGigE 3/11 ip pim sparse-mode ip address 10.11.13.
PAGE 571
Understanding Multicast Traceroute (mtrace) Multicast Traceroute (mtrace) is a multicast diagnostic facility used for tracing multicast paths. Mtrace enables you to trace the path that a multicast packet takes from its source to the destination. When you initiate mtrace from a source to a destination, an mtrace Query packet with IGMP type 0x1F is sent to the last-hop multicast router for the given destination. The mtrace query packet is forwarded hop-by-hop untill it reaches the last-hop router.
PAGE 572
● MTRACE Transit — when a Dell EMC Networking system is an intermediate router between the source and destination in an MTRACE query, Dell EMC Networking OS computes the RPF neighbor for the source, fills in the request, and forwards the request to the RPF neighbor. When a Dell EMC Networking system is the last hop to the destination, Dell EMC Networking OS sends a response to the query. To print the network path, use the following command.
PAGE 573
Table 71. mtrace Command Output — Explained (continued) Command Output Description From source (?) to destination (?) In case the provided source or destination IP can be resolved to a hostname the corresponding name will be displayed. In cases where the IP cannot be resolved, it is displayed as (?) 0 1.1.1.1 --> Destination The first row in the table corresponds to the destination provided by the user. -1 1.1.1.1 PIM Reached RP/Core 103.103.103.
PAGE 574
Table 72. Supported Error Codes (continued) Error Code Error Name Description 0x81 NO_SPACE There is not enough room to insert another response data block in the packet. mtrace Scenarios This section describes various scenarios that may result when an mtrace command is issued. The following table describes various scenarios when the mtrace command is issued: Table 73.
PAGE 575
Table 73. Mtrace Scenarios (continued) Scenario You invoke a weak mtrace request by specifying only the source without specifying the mulicast tree or multicast group information for the source. Mtrace traces a path towards the source by using the RPF neighbor at each node. Output R1>mtrace 103.103.103.3 Type Ctrl-C to abort. Querying reverse path for source 103.103.103.
PAGE 576
Table 73. Mtrace Scenarios (continued) Scenario When you issue the mtrace command with the source and multicast group information, if a multicast route is not present on a particular node, then the NO ROUTE error code is displayed on the node. In this scenario, the Source Network/Mask column for that particular node displays the the value as default.
PAGE 577
Table 73. Mtrace Scenarios (continued) Scenario Output ----------------------------------------------------------------- If the destination provided in the command is not a valid receiver for the multicast group, the last hop router for the destination provides the WRONG LAST HOP error code. If the last-hop router contains a path to the source, the path is traced irrespective of the incorrect destination.
PAGE 578
Table 73. Mtrace Scenarios (continued) Scenario Output 0 1.1.1.1 --> Destination -1 * * * * ----------------------------------------------------------------Timed out receiving responses Perhaps no local router has a route for source, the receiver is not a member of the multicast group or the multicast ttl is too low. While traversing the path from source to destination, if the mtrace packet exhausts the maximum buffer size of the packet, then NO SPACE error is displayed in the output.
PAGE 579
Table 73. Mtrace Scenarios (continued) Scenario Output Querying reverse path for source 6.6.6.6 to destination 4.4.4.5 via RPF From source (?) to destination (?) ---------------------------------------------------------------|Hop| OIF IP |Proto| Forwarding Code |Source Network/Mask| ---------------------------------------------------------------0 4.4.4.5 --> Destination -1 4.4.4.4 PIM 6.6.6.0/24 -2 20.20.20.2 PIM 6.6.6.0/24 -3 10.10.10.1 PIM RPF Interface 6.6.6.
PAGE 580
33 Object Tracking IPv4 or IPv6 object tracking is available on Dell EMC Networking OS. Object tracking allows the Dell EMC Networking OS client processes, such as virtual router redundancy protocol (VRRP), to monitor tracked objects (for example, interface or link status) and take appropriate action when the state of an object changes. NOTE: In Dell EMC Networking OS release version 8.4.1.0, object tracking is supported only on VRRP.
PAGE 581
Figure 96. Object Tracking Example When you configure a tracked object, such as an IPv4/IPv6 a route or interface, you specify an object number to identify the object. Optionally, you can also specify: ● UP and DOWN thresholds used to report changes in a route metric. ● A time delay before changes in a tracked object’s state are reported to a client. Track Layer 2 Interfaces You can create an object to track the line-protocol state of a Layer 2 interface.
PAGE 582
Track IPv4 and IPv6 Routes You can create an object that tracks an IPv4 or IPv6 route entry in the routing table. Specify a tracked route by its IPv4 or IPv6 address and prefix-length. Optionally specify a tracked route by a virtual routing and forwarding (VRF) instance name if the route to be tracked is part of a VRF. The next-hop address is not part of the definition of the tracked object.
PAGE 583
Set Tracking Delays You can configure an optional UP and/or DOWN timer for each tracked object to set the time delay before a change in the state of a tracked object is communicated to clients. The configured time delay starts when the state changes from UP to DOWN or the opposite way. If the state of an object changes back to its former UP/DOWN state before the timer expires, the timer is cancelled and the client is not notified.
PAGE 584
OBJECT TRACKING mode delay {[up seconds] [down seconds]} Valid delay times are from 0 to 180 seconds. The default is 0. 3. (Optional) Identify the tracked object with a text description. OBJECT TRACKING mode description text The text string can be up to 80 characters. 4. (Optional) Display the tracking configuration and the tracked object’s status.
PAGE 585
delay {[up seconds] [down seconds]} Valid delay times are from 0 to 180 seconds. The default is 0. 3. (Optional) Identify the tracked object with a text description. OBJECT TRACKING mode description text The text string can be up to 80 characters. 4. (Optional) Display the tracking configuration and the tracked object’s status.
PAGE 586
To provide a common tracking interface for different clients, route metrics are scaled in the range from 0 to 255, where 0 is connected and 255 is inaccessible. The scaled metric value communicated to a client always considers a lower value to have priority over a higher value.
PAGE 587
IP route 10.0.0.0/8 reachability Reachability is Down (route not in route table) 2 changes, last change 00:02:49 Tracked by: DellEMC#configure DellEMC(conf)#track 4 ip route 3.1.1.
PAGE 588
● OSPF routes - 1 to 1592. The efault is 1. 2. Configure object tracking on the metric of an IPv4 or IPv6 route. CONFIGURATION mode track object-id {ip route ip-address/prefix-len | ipv6 route ipv6-address/prefix-len} metric threshold [vrf vrf-name] Valid object IDs are from 1 to 500. Enter an IPv4 address in dotted decimal format. Valid IPv4 prefix lengths are from /0 to /32. Enter an IPv6 address in X:X:X:X::X format. Valid IPv6 prefix lengths are from /0 to /128.
PAGE 589
Displaying Tracked Objects To display the currently configured objects used to track Layer 2 and Layer 3 interfaces, and IPv4 and IPv6 routes, use the following show commands. To display the configuration and status of currently tracked Layer 2 or Layer 3 interfaces, IPv4 or IPv6 routes, or a VRF instance, use the show track command. You can also display the currently configured per-protocol resolution values used to scale route metrics when tracking metric thresholds.
PAGE 590
Example of the show track vrf Command DellEMC#show track vrf red Track 5 IP route 192.168.0.0/24 reachability, Vrf: red Reachability is Up (CONNECTED) 3 changes, last change 00:02:39 First-hop interface is twentyFiveGigE 1/4 Example of Viewing Object Tracking Configuration DellEMC#show running-config track track 1 ip route 23.0.0.
PAGE 591
34 Open Shortest Path First (OSPFv2 and OSPFv3) Open shortest path first (OSPFv2 for IPv4) and OSPF version 3 (OSPF for IPv6) are supported on Dell EMC Networking OS. This chapter provides a general description of OSPFv2 (OSPF for IPv4) and OSPFv3 (OSPF for IPv6) as supported in the Dell EMC Networking Operating System (OS). NOTE: The fundamental mechanisms of OSPF (flooding, DR election, area support, SPF calculations, and so on) are the same between OSPFv2 and OSPFv3.
PAGE 592
Figure 97. Autonomous System Areas Area Types The backbone of the network is Area 0. It is also called Area 0.0.0.0 and is the core of any AS. All other areas must connect to Area 0. An OSPF backbone is responsible for distributing routing information between areas. It consists of all area border routers, networks not wholly contained in any area, and their attached routers. NOTE: If you configure two non-backbone areas, then you must enable the B bit in OSPF.
PAGE 593
Networks and Neighbors As a link-state protocol, OSPF sends routing information to other OSPF routers concerning the state of the links between them. The state (up or down) of those links is important. Routers that share a link become neighbors on that segment. OSPF uses the Hello protocol as a neighbor discovery and keep alive mechanism. After two routers are neighbors, they may proceed to exchange and synchronize their databases, which creates an adjacency.
PAGE 594
Backbone Router (BR) A backbone router (BR) is part of the OSPF Backbone, Area 0. This includes all ABRs. It can also include any routers that connect only to the backbone and another ABR, but are only part of Area 0, such as Router I in the previous example. Area Border Router (ABR) Within an AS, an area border router (ABR) connects one or more areas to the backbone. The ABR keeps a copy of the link-state database for every area it connects to, so it may keep multiple copies of the link state database.
PAGE 595
● Type 3: Summary LSA (OSPFv2), Inter-Area-Prefix LSA (OSPFv3) — An ABR takes information it has learned on one of its attached areas and can summarize it before sending it out on other areas it is connected to. The link-state ID of the Type 3 LSA is the destination network number. ● Type 4: AS Border Router Summary LSA (OSPFv2), Inter-Area-Router LSA (OSPFv3) — In some cases, Type 5 External LSAs are flooded to areas where the detailed next-hop information may not be available.
PAGE 596
Figure 99. Priority and Cost Examples OSPF with Dell EMC Networking OS The Dell EMC Networking OS supports up to 128,000 OSPF routes for OSPFv2. Dell EMC Networking OS version 9.4(0.0) and later support only one OSPFv2 process per VRF. Dell EMC Networking OS version 9.7(0.0) and later support OSPFv3 in VRF. Also, on OSPFv3, Dell EMC Networking OS supports only one OSPFv3 process per VRF. OSPFv2 and OSPFv3 can co-exist but you must configure them individually.
PAGE 597
OSPF graceful restart understands that in a modern router, the control plane and data plane functionality are separate, restarting the control plane functionality (such as the failover of the active RPM to the backup in a redundant configuration), does not necessarily have to interrupt the forwarding of data packets.
PAGE 598
Multi-Process OSPFv2 with VRF Multi-process OSPF with VRF is supported on the Dell EMC Networking OS. Only one OSPFv2 process per VRF is supported. Multi-process OSPF allows multiple OSPFv2 processes on a single router. Multiple OSPFv2 processes allow for isolating routing domains, supporting multiple route policies and priorities in different domains, and creating smaller domains for easier management. Each OSPFv2 process has a unique process ID and must have an associated router ID.
PAGE 599
Configuration Information The interfaces must be in Layer 3 mode (assigned an IP address) and enabled so that they can send and receive traffic. The OSPF process must know about these interfaces. To make the OSPF process aware of these interfaces, they must be assigned to OSPF areas. You must configure OSPF GLOBALLY on the system in CONFIGURATION mode. NOTE: Loop back routes are not installed in the Route Table Manager (RTM) as non-active routes.
PAGE 600
Enabling OSPFv2 To enable Layer 3 routing, assign an IP address to an interface (physical or Loopback). By default, OSPF, similar to all routing protocols, is disabled. You must configure at least one interface for Layer 3 before enabling OSPFv2 globally. If implementing multi-process OSPF, create an equal number of Layer 3 enabled interfaces and OSPF process IDs. For example, if you create four OSPFv2 process IDs, you must have four interfaces with Layer 3 enabled. 1. Assign an IP address to an interface.
PAGE 601
Supports only single TOS (TOS0) routes SPF schedule delay 5 secs, Hold time between two SPFs 10 secs Number of area in this router is 0, normal 0 stub 0 nssa 0 DellEMC# Assigning an OSPFv2 Area After you enable OSPFv2, assign the interface to an OSPF area. Set up OSPF areas and enable OSPFv2 on an interface with the network command. You must have at least one AS area: Area 0. This is the backbone area. If your OSPF network contains more than one area, configure a backbone area (Area ID 0.0.0.0).
PAGE 602
Example of Viewing Active Interfaces and Assigned Areas DellEMC>show ip ospf 1 interface twentyFiveGigE 1/17 is up, line protocol is up Internet Address 10.2.2.1/24, Area 0.0.0.0 Process ID 1, Router ID 11.1.2.1, Network Type BROADCAST, Cost: 1 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 11.1.2.1, Interface address 10.2.2.1 Backup Designated Router (ID) 0.0.0.0, Interface address 0.0.0.
PAGE 603
3. Enter ROUTER OSPF mode. CONFIGURATION mode router ospf process-id [vrf] Process ID is the ID assigned when configuring OSPFv2 globally. 4. Configure the area as a stub area. CONFIG-ROUTER-OSPF-id mode area area-id stub [no-summary] Use the keywords no-summary to prevent transmission into the area of summary ASBR LSAs. Area ID is the number or IP address assigned when creating the area.
PAGE 604
Transmit Delay is 1 sec, State DOWN, Priority 1 Designated Router (ID) 10.1.2.100, Interface address 0.0.0.0 Backup Designated Router (ID) 0.0.0.0, Interface address 0.0.0.0 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 13:39:46 Neighbor Count is 0, Adjacent neighbor count is 0 twentyFiveGigE 1/2 is up, line protocol is down Internet Address 10.1.3.100/24, Area 2.2.2.2 Process ID 34, Router ID 10.1.2.
PAGE 605
SPF schedule delay 5 secs, Hold time between two SPFs 10 secs Convergence Level 0 Min LSA origination 5 secs, Min LSA arrival 1 secs Number of area in this router is 0, normal 0 stub 0 nssa 0 DellEMC# Changing OSPFv2 Parameters on Interfaces In Dell EMC Networking OS, you can modify the OSPF settings on the interfaces. Some interface parameter values must be consistent across all interfaces to avoid routing errors.
PAGE 606
● Change the wait period between link state update packets sent out the interface. CONFIG-INTERFACE mode ip ospf transmit-delay seconds ○ seconds: the range is from 1 to 65535 (the default is 1 second). The transmit delay must be the same on all routers in the OSPF network. To view interface configurations, use the show config command in CONFIGURATION INTERFACE mode. To view interface status in the OSPF process, use the show ip ospf interface command in EXEC mode.
PAGE 607
● grace period — the length of time the graceful restart process can last before OSPF terminates it. ● helper-reject neighbors — the router ID of each restart router that does not receive assistance from the configured router. ● mode — the situation or situations that trigger a graceful restart. ● role — the role or roles the configured router can perform. NOTE: By default, OSPFv2 graceful restart is disabled. To enable and configure OSPFv2 graceful restart, use the following commands. 1.
PAGE 608
Creating Filter Routes To filter routes, use prefix lists. OSPF applies prefix lists to incoming or outgoing routes. Incoming routes must meet the conditions of the prefix lists. If they do not, OSPF does not add the route to the routing table. Configure the prefix list in CONFIGURATION PREFIX LIST mode prior to assigning it to the OSPF process. ● Create a prefix list and assign it a unique name. CONFIGURATION mode ip prefix-list prefix-name You are in PREFIX LIST mode.
PAGE 609
router ospf 34 network 10.1.2.32 0.0.0.255 area 2.2.2.2 network 10.1.3.24 0.0.0.255 area 3.3.3.3 distribute-list dilling in DellEMC(conf-router_ospf)# Troubleshooting OSPFv2 Use the information in this section to troubleshoot OSPFv2 operation on the switch. Be sure to check the following, as these questions represent typical issues that interrupt an OSPFv2 process. NOTE: The following tasks are not a comprehensive; they provide some examples of typical troubleshooting checks.
PAGE 610
○ database-timers rate-limit: view the LSAs currently in the queue. DellEMC#show run ospf ! router ospf 4 router-id 4.4.4.4 network 4.4.4.0/28 area 1 ! ipv6 router ospf 999 default-information originate always router-id 10.10.10.10 DellEMC# Sample Configurations for OSPFv2 The following configurations are examples for enabling OSPFv2. These examples are not comprehensive directions. They are intended to give you some guidance with typical configurations.
PAGE 611
ip address 192.168.10.100/24 no shutdown OSPF Area 0 — Tw 3/1 and 3/2 router ospf 33333 network 192.168.20.0/24 area 0 network 10.1.1.0/24 area 0 network 10.2.13.0/24 area 0 ! interface Loopback 30 ip address 192.168.20.100/24 no shutdown ! interface TwentyfiveGigE 3/1 ip address 10.1.1.2/24 no shutdown ! interface TwentyfiveGigE 3/2 ip address 10.2.13.3/24 no shutdown OSPF Area 0 — Tw 2/1 and 2/2 router ospf 22222 network 192.168.30.0/24 area 0 network 10.1.11.0/24 area 0 network 10.2.13.
PAGE 612
NOTE: IPv6 and OSPFv3 do not support Multi-Process OSPF. You can only enable a single OSPFv3 process. To create multiple OSPF processes you need to have multiple VRFs on a switch. Set the time interval between when the switch receives a topology change and starts a shortest path first (SPF) calculation. timers spf delay holdtime NOTE: To set the interval time between the reception of topology changes and calculation of SPF in milli seconds, use the timers spf delay holdtime msec command.
PAGE 613
○ process-id: the process ID number assigned. ○ area-id: the area ID for this interface. Assigning OSPFv3 Process ID and Router ID Globally To assign, disable, or reset OSPFv3 globally, use the following commands. ● Enable the OSPFv3 process globally and enter OSPFv3 mode. CONFIGURATION mode ipv6 router ospf {process ID} The range is from 0 to 65535. ● Assign the router ID for this OSPFv3 process. CONF-IPV6-ROUTER-OSPF mode router-id {number} ○ number: the IPv4 address. The format is A.B.C.D.
PAGE 614
Configuring Stub Areas To configure IPv6 stub areas, use the following command. ● Configure the area as a stub area. CONF-IPV6-ROUTER-OSPF mode area area-id stub [no-summary] ○ no-summary: use these keywords to prevent transmission in to the area of summary ASBR LSAs. ○ Area ID: a number or IP address assigned when creating the area. You can represent the area ID as a number from 0 to 65536 if you assign a dotted decimal format rather than an IP address.
PAGE 615
Configuring a Default Route To generate a default external route into the OSPFv3 routing domain, configure the following parameters. To specify the information for the default route, use the following command. ● Specify the information for the default route.
PAGE 616
● Enable OSPFv3 graceful restart globally by setting the grace period (in seconds). CONF-IPV6-ROUTER-OSPF mode graceful-restart grace-period seconds The valid values are from 40 to 1800 seconds. ● Configure an OSPFv3 interface to not act on the Grace LSAs that it receives from a restarting OSPFv3 neighbor. INTERFACE mode ipv6 ospf graceful-restart helper-reject ● Specify the operating mode and type of events that trigger a graceful restart.
PAGE 617
Process 1 database summary Type Count/Status Oper Status 1 Admin Status 1 Area Bdr Rtr Status 0 AS Bdr Rtr Status 1 AS Scope LSA Count 0 AS Scope LSA Cksum sum 0 Originate New LSAS 73 Rx New LSAS 114085 Ext LSA Count 0 Rte Max Eq Cost Paths 5 GR grace-period 180 GR mode planned and unplanned Area 0 database summary Type Brd Rtr Count AS Bdr Rtr Count LSA count Summary LSAs Rtr LSA Count Net LSA Count Inter Area Pfx LSA Count Inter Area Rtr LSA Count Group Mem LSA Count Count/Status 2 2 12010 1 4 3 12000 0
PAGE 618
● ESP — encapsulating security payload encapsulates data, enabling the protection of data that follows in the datagram. ESP provides authentication and confidentiality of every packet. The ESP extension header is designed to provide a combination of security services for both IPv4 and IPv6. Insert the ESP header after the IP header and before the next layer protocol header in Transport mode.
PAGE 619
Configuring IPsec Authentication on an Interface To configure, remove, or display IPsec authentication on an interface, use the following commands. Prerequisite: Before you enable IPsec authentication on an OSPFv3 interface, first enable IPv6 unicast routing globally, configure an IPv6 address and enable OSPFv3 on the interface, and assign it to an area (refer to Configuration Task List for OSPFv3 (OSPF for IPv6)).
PAGE 620
○ key-encryption-type: (optional) specifies if the key is encrypted. The valid values are 0 (key is not encrypted) or 7 (key is encrypted). ○ authentication-algorithm: specifies the encryption authentication algorithm to use. The valid values are MD5 or SHA1. ○ key: specifies the text string used in authentication. All neighboring OSPFv3 routers must share key to exchange information. For MD5 authentication, the key must be 32 hex digits (non-encrypted) or 64 hex digits (encrypted).
PAGE 621
The SPI value must be unique to one IPsec security policy (authentication or encryption) on the router. Configure the same encryption policy (the same SPI and keys) on each interface in an OPSFv3 link. NOTE: When you configure encryption using the area encryption command, you enable both IPsec encryption and authentication. However, when you enable authentication on an area using the area authentication command, you do not enable encryption at the same time.
PAGE 622
○ ○ ○ ○ For For For For a a a a 50-Gigabit Ethernet interface, enter the keyword fiftyGigE then the slot/port/subport information. 100-Gigabit Ethernet interface, enter the keyword hundredGigE then the slot/port information. port channel interface, enter the keywords port-channel then a number. VLAN interface, enter the keyword vlan then a number from 1 to 4094. In the first example, the keys are not encrypted (shown in bold). In the second and third examples, the keys are encrypted (shown in bold).
PAGE 623
inbound esp sas outbound esp sas Interface: twentyFiveGigE 2/1 Link Local address: fe80::201:e8ff:fe40:4d11 IPSecv6 policy name: OSPFv3-1-600 inbound ah sas outbound ah sas inbound esp sas spi : 600 (0x258) transform : esp-des esp-sha1-hmac in use settings : {Transport, } replay detection support : N STATUS : ACTIVE outbound esp sas spi : 600 (0x258) transform : esp-des esp-sha1-hmac in use settings : {Transport, } replay detection support : N STATUS : ACTIVE Troubleshooting OSPFv3 The system provides seve
PAGE 624
EXEC Privilege mode show ipv6 ospf [vrf vrf-name] neighbor ● View debug messages for all OSPFv3 interfaces. EXEC Privilege mode debug ipv6 ospf [vrf vrf-name] [event | packet] {type slot/port} ○ ○ ○ ○ ○ ○ ○ For For For For For For For a a a a a a a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port/subport information. 25-Gigabit Ethernet interface, enter the keyword twentyFiveGigE then the slot/port[/subport] information.
PAGE 625
SNMPv2-SMI::mib-2.191.1.1.8.0 = Counter32: 10088 SNMPv2-SMI::mib-2.191.1.1.9.0 = Counter32: 10076 SNMPv2-SMI::mib-2.191.1.1.10.0 = Gauge32: 7 SNMPv2-SMI::mib-2.191.1.1.11.0 = INTEGER: -1 SNMPv2-SMI::mib-2.191.1.1.12.0 = Gauge32: 0 SNMPv2-SMI::mib-2.191.1.1.13.0 = INTEGER: 2 SNMPv2-SMI::mib-2.191.1.1.14.0 = Gauge32: 100000 SNMPv2-SMI::mib-2.191.1.1.15.0 = INTEGER: 1 SNMPv2-SMI::mib-2.191.1.1.16.0 = Gauge32: 0 SNMPv2-SMI::mib-2.191.1.1.18.0 = INTEGER: 1 SNMPv2-SMI::mib-2.191.1.1.19.
PAGE 626
35 Policy-based Routing (PBR) Policy-based routing (PBR) allows a switch to make routing decisions based on policies applied to an interface. Topics: • • • • Overview Implementing PBR Configuration Task List for Policy-based Routing Sample Configuration Overview When a router receives a packet, the router decides where to forward the packet based on the destination address in the packet, which is used to look up an entry in a routing table.
PAGE 627
● ● ● ● Destination IP address and mask Source port Destination port TCP Flags After you apply a redirect-list to an interface, all traffic passing through it is subjected to the rules defined in the redirect-list. Traffic is forwarded based on the following: ● ● ● ● Next-hop addresses are verified. If the specified next hop is reachable, traffic is forwarded to the specified next-hop. If the specified next-hops are not reachable, the normal routing table is used to forward the traffic.
PAGE 628
PBR Exceptions (Permit) To create an exception to a redirect list, use thepermit command. Exceptions are used when a forwarding decision should be based on the routing table rather than a routing policy. The Dell EMC Networking OS assigns the first available sequence number to a rule configured without a sequence number and inserts the rule into the PBR CAM region next to the existing entries. Because the order of rules is important, ensure that you configure any necessary sequence numbers.
PAGE 629
● ● ● ● source ip-address or any or host ip-address is the Source’s IP address FORMAT: A.B.C.D/NN, or ANY or HOST IP address destination ip-address or any or host ip-address is the Destination’s IP address FORMAT: A.B.C.D/NN, or ANY or HOST IP address To delete a rule, use the no redirect command.
PAGE 630
multiple seq redirect commands with the same source and destination address and specify a different next-hop IP address. In this way, the recursive routes are used as different forwarding routes for dynamic failover. If the primary path goes down and the recursive route is removed from the routing table, the seq redirect command is ignored and the next command in the list with a different route is used.
PAGE 631
EXEC mode show ip redirect-list redirect-list-name 2. View the redirect list entries programmed in the CAM. EXEC mode show cam pbr show cam-usage List the redirect list configuration using the show ip redirect-list redirect-list-name command. The noncontiguous mask displays in dotted format (x.x.x.x). The contiguous mask displays in /x format. DellEMC#show ip redirect-list explicit_tunnel IP redirect-list explicit_tunnel: Defined as: seq 5 redirect tunnel 1 track 1 tcp 155.55.2.0/24 222.22.2.
PAGE 632
00002 Fi 1/49/1 N/A 19 0x0 0 0 155.55.0.0/16 222.22.2.0/24 00:00:00:00:00:04 Tf 1/1 00003 Fi 1/49/1 N/A UDP 0x0 0 0 155.55.0.0/16 222.22.2.0/24 00:00:00:00:00:04 Tf 1/1 Sample Configuration You can use the following example configuration to set up a PBR. These are not comprehensive directions but are intended to give you a guidance with typical configurations. You can copy and paste from these examples to your CLI. Make the necessary changes to support your own IP addresses, interfaces, names, and so on.
PAGE 633
seq 10 redirect 10.99.99.254 ip 192.168.2.0/24 any seq 15 permit ip any any Assign Redirect-List GOLD to Interface 2/11 EDGE_ROUTER(conf)#int tw 2/11 EDGE_ROUTER(conf-if-Tf-2/11)#ip add 192.168.3.
PAGE 634
3 4 IP Host reachability IP Host reachability 42.1.1.2/32 43.1.1.2/32 Up Up 00:00:59 00:00:59 Apply the Redirect Rule to an Interface: DellEMC# DellEMC(conf)#int twentyFiveGigE 2/28 DellEMC(conf-if-tf-2/28)#ip redirect-group redirect_list_with_track DellEMC(conf-if-tf-2/28)#end Verify the Applied Redirect Rules: DellEMC#show ip redirect-list redirect_list_with_track IP redirect-list redirect_list_with_track Defined as: seq 5 redirect 42.1.1.2 track 3 tcp 155.55.2.0/24 222.22.2.
PAGE 635
2 Interface ipv6 routing DellEMC# Tunnel 2 Up 00:00:00 Create a Redirect-list with Track Objects pertaining to Tunnel Interfaces: DellEMC#configure terminal DellEMC(conf)#ip redirect-list explicit_tunnel DellEMC(conf-redirect-list)#redirect tunnel 1 track DellEMC(conf-redirect-list)#redirect tunnel 1 track DellEMC(conf-redirect-list)#redirect tunnel 1 track 144.144.144.
PAGE 636
36 PIM Sparse-Mode (PIM-SM) Protocol-independent multicast sparse-mode (PIM-SM) is a multicast protocol that forwards multicast traffic to a subnet only after a request using a PIM Join message; this behavior is the opposite of PIM-Dense mode, which forwards multicast traffic to all subnets until a request to stop.
PAGE 637
2. The last-hop DR sends a PIM Join message to the RP. All routers along the way, including the RP, create an (*,G) entry in their multicast routing table, and the interface on which the message was received becomes the outgoing interface associated with the (*,G) entry. This process constructs an RPT branch to the RP. 3. If a host on the same subnet as another multicast receiver sends an IGMP report for the same multicast group, the gateway takes no action.
PAGE 638
CONFIGURATION mode ip multicast-routing [vrf vrf-name] Related Configuration Tasks The following are related PIM-SM configuration tasks. ● ● ● ● Configuring S,G Expiry Timers Configuring a Static Rendezvous Point Configuring a Designated Router Creating Multicast Boundaries and Domains Enable PIM-SM You must enable PIM-SM on each participating interface. 1. Enable IPv4 multicast routing on the system. CONFIGURATION mode ip multicast-routing [vrf vrf-name] 2. Enable PIM-Sparse mode.
PAGE 639
(*, 192.1.2.1), uptime 00:29:36, expires 00:03:26, RP 10.87.2.6, flags: SCJ Incoming interface: twentyFiveGigE 1/12, RPF neighbor 10.87.3.5 Outgoing interface list: twentyFiveGigE 1/11 twentyFiveGigE 1/13 (10.87.31.5, 192.1.2.1), uptime 00:01:24, expires 00:02:26, flags: FT Incoming interface: twentyFiveGigE 1/10, RPF neighbor 0.0.0.
PAGE 640
To display the assigned RP for a group range (group-to-RP mapping), use the show ip pim rp mapping command in EXEC privilege mode. Following is an example of show ip pim rp mapping command output: DellEMC#show ip pim rp mapping PIM Group-to-RP Mappings Group(s): 224.0.0.0/4, Static RP: 165.87.50.5, v2 Configuring a Designated Router Multiple PIM-SM routers might be connected to a single local area network (LAN) segment. One of these routers is elected to act on behalf of directly connected hosts.
PAGE 641
Data path event summary: 0 no-cache messages received 0 last-hop switchover messages received 0/0 pim-assert messages sent/received 0/0 register messages sent/received DellEMC# Creating Multicast Boundaries and Domains A PIM domain is a contiguous set of routers that all implement PIM and are configured to operate within a common boundary defined by PIM multicast border routers (PMBRs). PMBRs connect each PIM domain to the rest of the Internet.
PAGE 642
2. Enter the following IPv4 or IPv6 command to make a PIM router a RP candidate: CONFIGURATION ip pim rp-candidate ipv6 pim rp-candidate 3. Display IPv4 or IPv6 Bootstrap Router information. EXEC Privilege show ip pim bsr-router Example: DellEMC# show ip pim bsr-router PIMv2 Bootstrap information This system is the Bootstrap Router (v2) BSR address: 7.7.7.7 (?) BSR Priority: 0, Hash mask length: 30 Next bootstrap message in 00:00:08 This system is a candidate BSR Candidate BSR address: 7.7.7.
PAGE 643
37 PIM Source-Specific Mode (PIM-SSM) PIM source-specific mode (PIM-SSM) is a multicast protocol that forwards multicast traffic from a single source to a subnet. In the other versions of protocol independent multicast (PIM), a receiver subscribes to a group only. The receiver receives traffic not just from the source in which it is interested but from all sources sending to that group.
PAGE 644
Related Configuration Tasks ● Use PIM-SSM with IGMP Version 2 Hosts Enabling PIM-SSM To enable PIM-SSM, follow these steps. 1. Create an ACL that uses permit rules to specify what range of addresses should use SSM. CONFIGURATION mode ip access-list standard name 2. Enter the ip pim ssm-range command and specify the ACL you created. CONFIGURATION mode ip pim ssm-range acl-name To display address ranges in the PIM-SSM range, use the show ip pim ssm-range command from EXEC Privilege mode.
PAGE 645
Configuring PIM-SSM with IGMPv2 R1(conf)#do show run pim ! ip pim rp-address 10.11.12.2 group-address 224.0.0.0/4 ip pim ssm-range ssm R1(conf)#do show run acl ! ip access-list standard map seq 5 permit host 239.0.0.2 ! ip access-list standard ssm seq 5 permit host 239.0.0.2 R1(conf)#ip igmp ssm-map map 10.11.5.2 R1(conf)#do show ip igmp groups Total Number of Groups: 2 IGMP Connected Group Membership Group Address Interface Mode Uptime Expires 239.0.0.
PAGE 646
1. C-BSRs flood their candidacy throughout the domain in a BSM. Each message contains a BSR priority value, and the C-BSR with the highest priority value becomes the BSR. 2. Each C-RP unicasts periodic Candidate-RP-Advertisements to the BSR. Each message contains an RP priority value and the group ranges for which it is a C-RP. 3. The BSR collects the most efficient group-to-RP mappings and periodically updates it to all PIM routes in the network. 4.
PAGE 647
Enabling RP to Server Specific Multicast Groups When you configure an RP candidate, its advertisement is sent to the entire multicast address range and the group-to-RP mapping is advertised for the entire range of multicast address. Starting with Dell EMC Networking OS 9.11.0.0, you can configure an RP candidate for a specified range of multicast group address. The Configured multicast group ranges are used by the BSR protocol to advertise the candidate RPs in the bootstrap messages.
PAGE 648
38 Port Monitoring Port monitoring (also referred to as mirroring ) allows you to monitor ingress and/or egress traffic on specified ports. The mirrored traffic can be sent to a port to which a network analyzer is connected to inspect or troubleshoot the traffic. Mirroring is used for monitoring Ingress or Egress or both Ingress and Egress traffic on a specific port(s). This mirrored traffic can be sent to a port where a network sniffer can connect and monitor the traffic.
PAGE 649
Port Monitoring Port monitoring is supported on both physical and logical interfaces, such as VLAN and port-channel interfaces. The source port (MD) with monitored traffic and the destination ports (MG) to which an analyzer can be attached must be on the same switch. You can configure up to 128 source ports in a monitoring session. Only one destination port is supported in a monitoring session. The platform supports multiple source-destination statements in a single monitor session.
PAGE 650
Figure 100. Port Monitoring Configurations Dell EMC Networking OS Behavior: All monitored frames are tagged if the configured monitoring direction is egress (TX), regardless of whether the monitored port (MD) is a Layer 2 or Layer 3 port. If the MD port is a Layer 2 port, the frames are tagged with the VLAN ID of the VLAN to which the MD belongs. If the MD port is a Layer 3 port, the frames are tagged with VLAN ID 4095.
PAGE 651
DellEMC(conf)#monitor session 0 DellEMC(conf-mon-sess-0)#source po 10 dest twentyFiveGigE 1/2 dir rx DellEMC(conf-mon-sess-0)#do show monitor session SessID Source Destination Dir Mode Source IP Dest IP Rate Gre-Protocol FcMonitor ------ ------------------ ---- ----------------------------- --------0 Tf 1/1 Tf 1/2 rx Port 0.0.0.0 0.0.0.0 N/A N/A No 0 Po 10 Tf 1/2 rx Port 0.0.0.0 0.0.0.
PAGE 652
Configuring Monitor Multicast Queue To configure monitor QoS multicast queue ID, use the following commands. 1. Configure monitor QoS multicast queue ID. CONFIGURATION mode monitor multicast-queue queue-id DellEMC(conf)#monitor multicast-queue 7 2. Verify information about monitor configurations.
PAGE 653
EtherType, ICMP, and TCP packets. The ACL rule describes the traffic that you want to monitor, and the ACL in which you are creating the rule is applied to the monitored interface. Flow monitoring is supported for standard and extended IPv4 ACLs, standard and extended IPv6 ACLs, and standard and extended MAC ACLs.
PAGE 654
monitor session session-id 2. Enable flow-based monitoring for a monitoring session. MONITOR SESSION mode flow-based enable 3. Specify the source and destination port and direction of traffic. MONITOR SESSION mode source source—port destination destination-port direction rx 4. Define IP access-list rules that include the monitor keyword. For port monitoring, Dell EMC Networking OS only considers traffic matching rules with the monitor keyword.
PAGE 655
no disable DellEMC#show run acl ! ip access-list extended acl2 seq 10 permit tcp any 2.1.1.0/24 lt 140 count bytes monitor ! ip access-list extended acl3 seq 15 permit udp 4.1.1.0/24 any neq 150 count bytes monitor ! ip access-list extended acl4 seq 20 permit ip any any count bytes monitor DellEMC(conf)#do show ip access-lists in Extended Ingress IP access list acl3 seq 15 permit udp 4.1.1.
PAGE 656
Figure 102. Remote Port Mirroring Configuring Remote Port Mirroring Remote port mirroring requires a source session (monitored ports on different source switches), a reserved tagged VLAN for transporting mirrored traffic (configured on source, intermediate, and destination switches), and a destination session (destination ports connected to analyzers on destination switches).
PAGE 657
● Reserved Vlan cannot have untagged ports In the reserved L2 VLAN used for remote port mirroring: ● MAC address learning in the reserved VLAN is automatically disabled. ● The reserved VLAN for remote port mirroring can be automatically configured in intermediate switches by using GVRP. ● There is no restriction on the VLAN IDs used for the reserved remote-mirroring VLAN. Valid VLAN IDs are from 2 to 4094. The default VLAN ID is not supported.
PAGE 658
Displaying Remote-Port Mirroring Configurations To display the current configuration of remote port mirroring for a specified session, enter the show config command in MONITOR SESSION configuration mode.
PAGE 659
CONFIGURATION mode interface vlan vlan-id 3. Configure the RSPAN VLAN to be used to transport mirrored traffic in RPM. VLAN INTERFACE mode mode remote-port-mirroring 4. Configure a tagged port to carry mirrored traffic in the VLAN. VLAN INTERFACE mode tagged interface You can repeat this command to configure additional tagged ports for the VLAN. Configuring a source session Following are the steps for configuring a source session on a switch.
PAGE 660
Configuration Example of Remote Port Mirroring This example provides a sample configuration of remote port mirroring (RPM) on a source switch, an intermediate switch, and a destination switch based on the following illustration. Figure 103.
PAGE 661
Following is a sample configuration of RPM on an a destination switch.
PAGE 662
Configuration Example of RPM for port-channel This example provides a sample configuration of remote port mirroring for the port-channel source interface. Configuring Remote Port Mirroring on source switch The below configuration example shows that the source is a source port-channel and the destination is the reserved VLAN (for example, remote-vlan 30).
PAGE 663
● You can configure up to four ERPM source sessions on switch. ● Configure the system MTU to accommodate the increased size of the ERPM mirrored packet. ● The maximum number of source ports you can define in a session is 128. ● The system encapsulates the complete ingress or egress data under GRE header, IP header, and outer MAC header and sends it out at the next hop interface as pointed by the routing table.
PAGE 664
SessID Source Destination Dir Protocol FcMonitor Status ------ ---------------- -------------- --------- ------0 Tf 1/9 remote-ip rx 111 No Enabled 0 Po 1 remote-ip tx 111 No Enabled 1 Vl 11 remote-ip rx 139 No Enabled Mode Source IP Dest IP DSCP TTL ---- --------- -------- ---- --- Drop Rate Gre---- ---- Port 1.1.1.1 7.1.1.2 0 255 No 100 Port 1.1.1.1 7.1.1.2 0 255 No 100 Flow 5.1.1.1 3.1.1.
PAGE 665
As seen in the above figure, the packets received/transmitted on Port A will be encapsulated with an IP/GRE header plus a new L2 header and sent to the destination ip address (Port D’s ip address) on the sniffer. The Header that gets attached to the packet is 38 bytes long. If the sniffer does not support IP interface, a destination switch will be needed to receive the encapsulated ERPM packet and locally mirror the whole packet to the Sniffer or a Linux Server.
PAGE 666
NOTE: For more information on port monitoring, see Port Monitoring. The port monitoring or mirroring function when applied to VLT devices works as expected except with some restrictions. You can configure RPM or ERPM monitoring between two VLT peers. As VLT devices are seen as a single device in the network, when a fail over occurs, the source or destination port on one of the VLT peers becomes inactive causing the monitoring session to fail.
PAGE 667
Table 76. RPM over VLT Scenarios (continued) Scenario RPM Restriction Recommended Solution Mirroring VLT LAG to Orphan Port — In No restrictions apply. this scenario, the VLT LAG is mirrored to an orphan port on the same VLT device. The packet analyzer is connected to the VLT device through the orphan port.. If the packet analyzer is directly connected to the VLT device, use local Port mirroring session instead of RPM.
PAGE 668
39 Private VLANs (PVLAN) The private VLAN (PVLAN) feature is supported on Dell EMC Networking OS. For syntax details about the commands described in this chapter, refer to the Private VLANs commands chapter in the Dell EMC Networking OS Command Line Reference Guide. Private VLANs extend the Dell EMC Networking OS security suite by providing Layer 2 isolation between ports within the same virtual local area network (VLAN).
PAGE 669
PVLAN port types include: ● Community port — a port that belongs to a community VLAN and is allowed to communicate with other ports in the same community VLAN and with promiscuous ports. ● Host port — in the context of a private VLAN, is a port in a secondary VLAN: ○ The port must first be assigned that role in INTERFACE mode. ○ A port assigned the host role cannot be added to a regular VLAN. ● Isolated port — a port that, in Layer 2, can only communicate with promiscuous ports that are in the same PVLAN.
PAGE 670
Configuration Task List The following sections contain the procedures that configure a private VLAN. ● ● ● ● Creating Creating Creating Creating PVLAN Ports a Primary VLAN a Community VLAN an Isolated VLAN Creating PVLAN ports PVLAN ports are ports that will be assigned to the PVLAN. 1. Access INTERFACE mode for the port that you want to assign to a PVLAN. CONFIGURATION mode interface interface 2. Enable the port. INTERFACE mode no shutdown 3. Set the port in Layer 2 mode. INTERFACE mode switchport 4.
PAGE 671
CONFIGURATION mode interface vlan vlan-id 2. Enable the VLAN. INTERFACE VLAN mode no shutdown 3. Set the PVLAN mode of the selected VLAN to primary. INTERFACE VLAN mode private-vlan mode primary 4. Map secondary VLANs to the selected primary VLAN. INTERFACE VLAN mode private-vlan mapping secondary-vlan vlan-list The list of secondary VLANs can be: ● Specified in comma-delimited (VLAN-ID,VLAN-ID) or hyphenated-range format (VLAN-ID-VLAN-ID). ● Specified with this command even before they have been created.
PAGE 672
You can enter the interfaces singly or in range format, either comma-delimited (slot/port,port,port) or hyphenated (slot/ port-port). You can only add host (isolated) ports to the VLAN. Creating an Isolated VLAN An isolated VLAN is a secondary VLAN of a primary VLAN. An isolated VLAN port can only talk with the promiscuous ports in that primary VLAN. 1. Access INTERFACE VLAN mode for the VLAN that you want to make an isolated VLAN. CONFIGURATION mode interface vlan vlan-id 2. Enable the VLAN.
PAGE 673
Private VLAN Configuration Example The following example shows a private VLAN topology. Figure 105. Sample Private VLAN Topology The following configuration is based on the example diagram for the Z9500: ● ● ● ● ● Te Te Te Te Te 1/1 and Te 1/23 are configured as promiscuous ports, assigned to the primary VLAN, VLAN 4000. 1/25 is configured as a PVLAN trunk port, also assigned to the primary VLAN 4000. 1/24 and Te 1/47 are configured as host ports and assigned to the isolated VLAN, VLAN 4003.
PAGE 674
● The S4810 ports would have the same intra-switch communication characteristics as described for the Z9500. ● For transmission between switches, tagged packets originating from host PVLAN ports in one secondary VLAN and destined for host PVLAN ports in the other switch travel through the promiscuous ports in the local VLAN 4000 and then through the trunk ports (1/25 in each switch). Inspecting the Private VLAN Configuration The standard methods of inspecting configurations also apply in PVLANs.
PAGE 675
G - GVRP tagged, M - Vlan-stack NUM * 1 100 P 200 I 201 Status Inactive Inactive Inactive Inactive Description Q Ports primary VLAN in PVLAN T Tf 1/19-2 isolated VLAN in VLAN 200 T Tf 1/21 The following example shows viewing a private VLAN configuration.
PAGE 676
40 Per-VLAN Spanning Tree Plus (PVST+) Per-VLAN spanning tree plus (PVST+) is a variation of spanning tree — developed by a third party — that allows you to configure a separate spanning tree instance for each virtual local area network (VLAN).
PAGE 677
Figure 106. Per-VLAN Spanning Tree The Dell EMC Networking OS supports three other variations of spanning tree, as shown in the following table. Table 77. Spanning Tree Variations Dell EMC Networking OS Supports Dell EMC Networking Term IEEE Specification Spanning Tree Protocol (STP) 802 .1d Rapid Spanning Tree Protocol (RSTP) 802 .1w Multiple Spanning Tree Protocol (MSTP) 802 .
PAGE 678
Configure Per-VLAN Spanning Tree Plus Configuring PVST+ is a four-step process. 1. 2. 3. 4. Configure interfaces for Layer 2. Place the interfaces in VLANs. Enable PVST+. Optionally, for load balancing, select a nondefault bridge-priority for a VLAN.
PAGE 679
Influencing PVST+ Root Selection As shown in the previous per-VLAN spanning tree illustration, all VLANs use the same forwarding topology because R2 is elected the root, and all TenGigabitEthernet ports have the same cost. The following per-VLAN spanning tree illustration changes the bridge priority of each bridge so that a different forwarding topology is generated for each VLAN. This behavior demonstrates how you can use PVST+ to achieve load balancing. Figure 107.
PAGE 680
Current root has priority 4096, Address 0001.e80d.b6d6 Number of topology changes 5, last change occurred 00:34:37 ago on Tf 1/32 Port 375 (twentyFiveGigE 1/22) is designated Forwarding Port path cost 20000, Port priority 128, Port Identifier 128.375 Designated root has priority 4096, address 0001.e80d.b6:d6 Designated bridge has priority 4096, address 0001.e80d.b6:d6 Designated port id is 128.
PAGE 681
● Port priority — influences the likelihood that a port is selected to be a forwarding port in case that several ports have the same port cost. The following tables lists the default values for port cost by interface. Table 78.
PAGE 682
CAUTION: Configure EdgePort only on links connecting to an end station. EdgePort can cause loops if you enable it on an interface connected to a network. To enable EdgePort on an interface, use the following command. ● Enable EdgePort on an interface. INTERFACE mode spanning-tree pvst edge-port [bpduguard | shutdown-on-violation] The EdgePort status of each interface is given in the output of the show spanning-tree pvst command, as previously shown.
PAGE 683
Figure 108. PVST+ with Extend System ID ● Augment the bridge ID with the VLAN ID. PROTOCOL PVST mode extend system-id DellEMC(conf-pvst)#do show spanning-tree pvst vlan 5 brief VLAN 5 Executing IEEE compatible Spanning Tree Protocol Root ID Priority 32773, Address 0001.e832.73f7 Root Bridge hello time 2, max age 20, forward delay 15 Bridge ID Priority 32773 (priority 32768 sys-id-ext 5), Address 0001.e832.
PAGE 684
no shutdown ! interface Vlan 300 no ip address tagged twentyFiveGigE 1/22,1/32 no shutdown ! protocol spanning-tree pvst no disable vlan 100 bridge-priority 4096 Example of PVST+ Configuration (R2) interface TwentyfiveGigE 2/12 no ip address switchport no shutdown ! interface TwentyfiveGigE 2/32 no ip address switchport no shutdown ! interface Vlan 100 no ip address tagged TwentyfiveGigE 2/12,2/32 no shutdown ! interface Vlan 200 no ip address tagged TwentyfiveGigE 2/12,2/32 no shutdown ! interface Vlan 300
PAGE 685
41 Quality of Service (QoS) This chapter describes how to use and configure Quality of Service service (QoS) features on the switch. Differentiated service is accomplished by classifying and queuing traffic, and assigning priorities to those queues. Table 79.
PAGE 686
Table 79. Dell EMC Networking Operating System (OS) Support for Port-Based, Policy-Based Features (continued) Feature Direction Create Output Policy Maps Egress Specify an Aggregate QoS Policy Egress Create Output Policy Maps Egress Enabling QoS Rate Adjustment Enabling Strict-Priority Queueing Weighted Random Early Detection Egress Create WRED Profiles Egress Figure 109.
PAGE 687
• • • • • • Configuring Policy-Based Rate Shaping Configuring Weights and ECN for WRED Configuring WRED and ECN Attributes Guidelines for Configuring ECN for Classifying and Color-Marking Packets Applying Layer 2 Match Criteria on a Layer 3 Interface Enabling Buffer Statistics Tracking Implementation Information The Dell EMC Networking QoS implementation complies with IEEE 802.1p User Priority Bits for QoS Indication.
PAGE 688
dot1p-priority DellEMC#configure terminal DellEMC(conf)#interface twentyFiveGigE 1/1 DellEMC(conf-if-tf-1/1)#switchport DellEMC(conf-if-tf-1/1)#dot1p-priority 1 DellEMC(conf-if-tf-1/1)#end Honoring dot1p Priorities on Ingress Traffic By default, Dell EMC Networking OS does not honor dot1p priorities on ingress traffic. You can configure this feature on physical interfaces and port-channels, but you cannot configure it on individual interfaces in a port channel.
PAGE 689
Configuring Port-Based Rate Shaping Rate shaping buffers, rather than drops, traffic exceeding the specified rate until the buffer is exhausted. If any stream exceeds the configured bandwidth on a continuous basis, it can consume all of the buffer space that is allocated to the port. Dell EMC Networking OS Behavior: Rate shaping is effectively rate limiting because of its smaller buffer size.
PAGE 690
Policy-Based QoS Configurations Policy-based QoS configurations consist of the components shown in the following example. Figure 110. Constructing Policy-Based QoS Configurations Classify Traffic Class maps differentiate traffic so that you can apply separate quality of service policies to different types of traffic. For both class maps, Layer 2 and Layer 3, Dell EMC Networking OS matches packets against match criteria in the order that you configure them.
PAGE 691
class-map match-any 2. Create a match-all class map. CONFIGURATION mode class-map match-all 3. Specify your match criteria. CLASS MAP mode [seq sequence number] match {ip | ipv6 | ip-any} After you create a class-map, Dell EMC Networking OS places you in CLASS MAP mode. Match-any class maps allow up to five ACLs. Match-all class-maps allow only one ACL. NOTE: Within a class-map, the match rules are installed in the sequence number order. 4. Link the class-map to a queue.
PAGE 692
3. Specify your match criteria. CLASS MAP mode [seq sequence number] match mac After you create a class-map, Dell EMC Networking OS places you in CLASS MAP mode. Match-any class maps allow up to five access-lists. Match-all class-maps allow only one. You can match against only one VLAN ID. 4. Link the class-map to a queue.
PAGE 693
ip access-list extended AF1-FB1 seq 5 permit ip host 23.64.0.2 any seq 10 deny ip any any ! ip access-list extended AF1-FB2 seq 5 permit ip host 23.64.0.3 any seq 10 deny ip any any ! ip access-list extended AF2 seq 5 permit ip host 23.64.0.5 any seq 10 deny ip any any DellEMC# show cam layer3-qos interface twe 1/4 Cam Port Dscp Proto Tcp Src Dst SrcIp DstIp DSCP Queue Index Flag Port Port Marking ----------------------------------------------------------------------20416 1 18 IP 0x0 0 0 23.64.0.5/32 0.0.
PAGE 694
But ‘Green’ packets matching the specific match criteria for which ‘color-marking’ is configured will be over-written and marked as “Yellow”. Create a QoS Policy There are two types of QoS policies — input and output. Input QoS policies regulate Layer 3 and Layer 2 ingress traffic. The regulation mechanisms for input QoS policies are rate policing and setting priority values. ● Layer 3 — QoS input policies allow you to rate police and set a DSCP or dot1p value.
PAGE 695
Creating an Output QoS Policy To create an output QoS policy, use the following commands. 1. Create an output QoS policy. CONFIGURATION mode qos-policy-output 2. After you configure an output QoS policy, do one or more of the following: Scheduler Strict — Policy-based Strict-priority Queueing configuration is done through scheduler strict. It is applied to Qospolicy-output. When scheduler strict is applied to multiple Queues, high queue number takes precedence.
PAGE 696
Specifying WRED Drop Precedence You can configure the WRED drop precedence in an output QoS policy. ● Specify a WRED profile to yellow and/or green traffic. QOS-POLICY-OUT mode wred For more information, refer to Applying a WRED Profile to Traffic. DSCP Color Maps This section describes how to configure color maps and how to display the color map and color map configuration.
PAGE 697
Create the DSCP color map profile, bat-enclave-map, with a yellow drop precedence , and set the DSCP values to 9,10,11,13,15,16 DellEMC(conf)# qos dscp-color-map bat-enclave-map DellEMC(conf-dscp-color-map)# dscp yellow 9,10,11,13,15,16 DellEMC(conf-dscp-color-map)# exit Assign the color map, bat-enclave-map to the interface. Displaying DSCP Color Maps To display DSCP color maps, use the show qos dscp-color-map command in EXEC mode. Examples for Creating a DSCP Color Map Display all DSCP color maps.
PAGE 698
Create Policy Maps There are two types of policy maps: input and output. Creating Input Policy Maps There are two types of input policy-maps: Layer 3 and Layer 2. 1. Create a Layer 3 input policy map. CONFIGURATION mode policy-map-input Create a Layer 2 input policy map by specifying the keyword layer2 with the policy-map-input command. 2.
PAGE 699
Table 82. Default DSCP to Queue Mapping (continued) DSCP/CP hex range (XXX)xxx DSCP Definition Traditional IP Precedence Internal Queue ID Internal Queue ID DSCP/CP decimal (4– queue) DSCP/CP decimal (8–queue) 100XXX AF4 (Assured Forwarding) Flash Override 2 4 32–47 16–23 011XXX AF3 Flash 1 3 16–31 8–15 010XXX AF2 Immediate 1 2 16–31 8–15 001XXX AF1 Priority 0 1 0–15 0–7 000XXX BE (Best Effort) Best Effort 0 0 0–15 0–7 ● Enable the trust DSCP feature.
PAGE 700
Guaranteeing Bandwidth to dot1p-Based Service Queues To guarantee bandwidth to dot1p-based service queues, use the following command. Apply this command in the same way as the bandwidth-percentage command in an output QoS policy (refer to Allocating Bandwidth to Queue). The bandwidth-percentage command in QOS-POLICY-OUT mode supersedes the service-class bandwidth-percentage command. ● Guarantee a minimum bandwidth to queues globally.
PAGE 701
Applying an Output Policy Map to an Interface To apply an output policy map to an interface, use the following command. ● Apply an input policy map to an interface. INTERFACE mode service-policy output You can apply the same policy map to multiple interfaces, and you can modify a policy map after you apply it. Enabling QoS Rate Adjustment By default while rate limiting, policing, and shaping, Dell EMC Networking OS does not include the Preamble, SFD, or the IFG fields.
PAGE 702
Queue Classification Requirements for PFC Functionality Queue classification requirements for PFC functionality are mentioned below: ● On untagged ports, Queue classification must be based on DSCP. ● On tagged ports, Queue classification must be based on Dot1p. Layer 3 classification configurations should not be present on the port. ● On hybrid ports, Queue classification can be based on either Dot1p (for tagged packets) or DSCP (for untagged packets) but not both.
PAGE 703
DellEMC(conf-qos-policy-in)#set ip-dscp 5 DellEMC(conf-qos-policy-in)# Weighted Random Early Detection Weighted random early detection (WRED) is a congestion avoidance mechanism that drops packets to prevent buffering resources from being consumed. The WRED congestion avoidance mechanism drops packets to prevent buffering resources from being consumed. Traffic is a mixture of various kinds of packets. The rate at which some types of packets arrive might be greater than others.
PAGE 704
Creating WRED Profiles To create WRED profiles, use the following commands. 1. Create a WRED profile. CONFIGURATION mode wred-profile 2. Specify the minimum and maximum threshold values. WRED mode threshold Applying a WRED Profile to Traffic After you create a WRED profile, you must specify to which traffic Dell EMC Networking OS should apply the profile. Dell EMC Networking OS assigns a color (also called drop precedence) — red, yellow, or green — to each packet based on it DSCP value before queuing it.
PAGE 705
Out of Profile 0 DellEMC# Displaying egress–queue Statistics To display the number of transmitted and dropped packets and their rate on the egress queues of an interface, use the following command: ● Display the number of packets and number of bytes on the egress-queue profile.
PAGE 706
● test cam-usage service-policy input policy-map {stack-unit } number port-set number ● test cam-usage service-policy input policy-map {stack-unit } all The output of this command, shown in the following example, displays: ● The estimated number of CAM entries the policy-map will consume. ● Whether or not the policy-map can be applied. ● The number of interfaces in a port-pipe to which the policy-map can be applied.
PAGE 707
size as a measure of pps. Alternatively, you can use the rate shape kbps peak-rate burst-KB committed kbps committed-rate burst-KB command to configure the committed rate and committed burst size as a measure of bytes. If you configure the peak rate in pps, the peak burst size must also be configured as a measure of number of packets. Similarly, if you configure the peak rate in Kbps, the peak burst size must also be configured as a measure of bytes.
PAGE 708
previous time sampling performed. You can specify the weight parameter for front-end and backplane ports separately in the range of 0 through 15. You can enable WRED and ECN capabilities per queue for granularity. You can disable these functionality per queue, and you can also specify the minimum and maximum buffer thresholds for each color-coding of the packets. You can configure maximum drop rate percentage of yellow and green profiles.
PAGE 709
Configuring WRED and ECN Attributes The functionality to configure a weight factor for the WRED and ECN functionality for backplane ports is supported on the platform. WRED drops packets when the average queue length exceeds the configured threshold value to signify congestion. Explicit Congestion Notification (ECN) is a capability that enhances WRED by marking the packets instead of causing WRED to drop them when the threshold value is exceeded.
PAGE 710
● If two rate three color policer is configured along with this feature then, ○ x < CIR – will be marked as “Green” ○ CIR < x< PIR – will be marked as “Yellow” ○ PIR < x – will be marked as “Red” But ‘Green’ packets matching the specific match criteria for which ‘color-marking’ is configured will be over-written and marked as “Yellow”.
PAGE 711
1. Rate Policing 2. Queuing 3. Marking For the L3 Routed packets, the DSCP marking is the only marking action supported in the software. As a part of this feature, the additional marking action to set the “color” of the traffic will be provided. Until Release 9.3(0.0), the software has the capability to qualify only on the 6-bit DSCP part of the ToS field in IPv4 Header. You can now accept and process incoming packets based on the 2-bit ECN part of the ToS field in addition to the DSCP categorization.
PAGE 712
Sample configuration to mark non-ecn packets as “yellow” with single traffic class Consider the use case where the packet with DSCP value “40” need to be enqueued in queue#2 and packets with DSCP value as 50 need to be enqueued in queue#3. And all the packets with ecn value as ‘0’ must be marked as ‘yellow’. The above requirement can be achieved using either of the two approaches. The above requirement can be achieved using either of the two approaches.
PAGE 713
service-queue 2 class-map class_dscp_40 service-queue 3 class-map class_dscp_50 Applying Layer 2 Match Criteria on a Layer 3 Interface To process Layer 3 packets that contain a dot1p (IEEE 802.1p) VLAN Layer 2 header, configure VLAN tags on a Layer 3 port interface which is configured with an IP address but has no VLAN associated with it. You can also configure a VLAN subinterface on the port interface and apply a policy map that classifies packets using the dot1p VLAN ID.
PAGE 714
Enabling Buffer Statistics Tracking You can enable the tracking of statistical values of buffer spaces at a global level. The buffer statistics tracking utility operates in the max use count mode that enables the collection of maximum values of counters. To configure the buffer statistics tracking utility, perform the following step: 1. Enable the buffer statistics tracking utility and enter the Buffer Statistics Snapshot configuration mode.
PAGE 715
42 Routing Information Protocol (RIP) The Routing Information Protocol (RIP) tracks distances or hop counts to nearby routers when establishing network connections and is based on a distance-vector algorithm. RIP is based on a distance-vector algorithm; it tracks distances or hop counts to nearby routers when establishing network connections. RIP protocol standards are listed in the Standards Compliance chapter.
PAGE 716
Table 85. RIP Defaults Feature Default Interfaces running RIP ● Listen to RIPv1 and RIPv2 ● Transmit RIPv1 RIP timers ● ● ● ● Auto summarization Enabled ECMP paths supported 16 update timer = 30 seconds invalid timer = 180 seconds holddown timer = 180 seconds flush timer = 240 seconds Configuration Information By default, RIP is disabled in Dell EMC Networking OS. To configure RIP, you must use commands in two modes: ROUTER RIP and INTERFACE.
PAGE 717
The Dell EMC Networking OS default is to send RIPv1 and to receive RIPv1 and RIPv2. To change the RIP version globally, use the version command in ROUTER RIP mode. To view the global RIP configuration, use the show running-config command in EXEC mode or the show config command in ROUTER RIP mode. DellEMC(conf-router_rip)#show config ! router rip network 10.0.0.0 DellEMC(conf-router_rip)# When the RIP process has learned the RIP routes, use the show ip rip database command in EXEC mode to view those routes.
PAGE 718
29.0.0.0/8 31.0.0.0/8 [120/1] via 31.0.0.0/8 192.162.2.0/24 [120/1] via 192.162.2.0/24 192.161.1.0/24 [120/1] via 192.161.1.0/24 192.162.3.0/24 [120/1] via 192.162.3.0/24 auto-summary 29.10.10.12, 00:00:26, Fa 1/49 auto-summary 29.10.10.12, 00:01:21, Fa 1/49 auto-summary 29.10.10.12, 00:00:27, Fa 1/49 auto-summary 29.10.10.12, 00:01:22, Fa 1/49 auto-summary To disable RIP globally, use the no router rip command in CONFIGURATION mode.
PAGE 719
To view the current RIP configuration, use the show running-config command in EXEC mode or the show config command in ROUTER RIP mode. Adding RIP Routes from Other Instances In addition to filtering routes, you can add routes from other routing instances or protocols to the RIP process. With the redistribute command, you can include open shortest path first (OSPF), static, or directly connected routes in the RIP process. To add routes from other routing instances or protocols, use the following commands.
PAGE 720
To configure an interface to receive or send both versions of RIP, include 1 and 2 in the command syntax. The command syntax for sending both RIPv1 and RIPv2 and receiving only RIPv2 is shown in the following example. DellEMC(conf-if)#ip rip send version 1 2 DellEMC(conf-if)#ip rip receive version 2 The following example of the show ip protocols command confirms that both versions are sent out that interface.
PAGE 721
Controlling Route Metrics As a distance-vector protocol, RIP uses hop counts to determine the best route, but sometimes the shortest hop count is a route over the lowest-speed link. To manipulate RIP routes so that the routing protocol prefers a different route, manipulate the route by using the offset command. Exercise caution when applying an offset command to routers on a broadcast network, as the router using the offset command is modifying RIP advertisements before sending out those advertisements.
PAGE 722
● ● ● ● ● Configuring RIPv2 on Core 2 Core 2 RIP Output RIP Configuration on Core 3 Core 3 RIP Output RIP Configuration Summary Figure 112. RIP Topology Example RIP Configuration on Core2 The following example shows how to configure RIPv2 on a host named Core2. Core2(conf-if-tf-1/1)# Core2(conf-if-tf-1/1)#router rip Core2(conf-router_rip)#ver 2 Core2(conf-router_rip)#network 10.200.10.0 Core2(conf-router_rip)#network 10.300.10.0 Core2(conf-router_rip)#network 10.11.10.0 Core2(conf-router_rip)#network 10.
PAGE 723
192.168.2.0/24 Core2# auto-summary The following example shows the show ip route command to show the RIP setup on Core 2.
PAGE 724
Core3(conf-router_rip)#network 192.168.2.0 Core3(conf-router_rip)#network 10.11.30.0 Core3(conf-router_rip)#network 10.11.20.0 Core3(conf-router_rip)#show config ! router rip network 10.0.0.0 network 192.168.1.0 network 192.168.2.0 version 2 Core3(conf-router_rip)# Core 3 RIP Output The examples in this section show the core 2 RIP output. ● To display Core 3 RIP database, use the show ip rip database command. ● To display Core 3 RIP setup, use the show ip route command.
PAGE 725
Invalid after 180 seconds, hold down 180, flushed after 240 Output delay 8 milliseconds between packets Automatic network summarization is in effect Outgoing filter for all interfaces is Incoming filter for all interfaces is Default redistribution metric is 1 Default version control: receive version 2, send version 2 Interface Recv Send twentyFiveGigE 1/1 2 2 twentyFiveGigE 1/1 2 2 twentyFiveGigE 1/1 2 2 twentyFiveGigE 1/1 2 2 Routing for Networks: 10.11.20.0 10.11.30.0 192.168.2.0 192.168.1.
PAGE 726
! interface TwentyfiveGigE 3/5 ip address 192.168.2.1/24 no shutdown ! router rip version 2 network 10.11.20.0 network 10.11.30.0 network 192.168.1.0 network 192.168.2.
PAGE 727
43 Remote Monitoring (RMON) RMON is an industry-standard implementation that monitors network traffic by sharing network monitoring information. RMON provides both 32-bit and 64-bit monitoring facility and long-term statistics collection on Dell EMC Networking Ethernet interfaces. RMON operates with the simple network management protocol (SNMP) and monitors all nodes on a local area network (LAN) segment. RMON monitors traffic passing through the router and segment traffic not destined for the router.
PAGE 728
[no] rmon alarm number variable interval {delta | absolute} rising-threshold [value event-number] falling-threshold value event-number [owner string] OR [no] rmon hc-alarm number variable interval {delta | absolute} rising-threshold value event-number falling-threshold value event-number [owner string] Configure the alarm using the following optional parameters: ○ number: alarm number, an integer from 1 to 65,535, the value must be unique in the RMON Alarm Table.
PAGE 729
In the following example, the configuration creates RMON event number 1, with the description “High ifOutErrors”, and generates a log entry when an alarm triggers the event. The user nms1 owns the row that is created in the event table by this command. This configuration also generates an SNMP trap when the event is triggered using the SNMP community string “eventtrap”.
PAGE 730
The following command example enables an RMON MIB collection history group of statistics with an ID number of 20 and an owner of john, both the sampling interval and the number of buckets use their respective defaults.
PAGE 731
44 Rapid Spanning Tree Protocol (RSTP) The Rapid Spanning Tree Protocol (RSTP) is a Layer 2 protocol — specified by IEEE 802.1w — that is essentially the same as spanning-tree protocol (STP) but provides faster convergence and interoperability with switches configured with STP and multiple spanning tree protocol (MSTP).
PAGE 732
● ● ● ● ● ● Prevent Network Disruptions with BPDU Guard Influencing RSTP Root Selection Configuring Spanning Trees as Hitless Enabling SNMP Traps for Root Elections and Topology Changes Configuring Fast Hellos for Link State Detection Flush MAC Addresses after a Topology Change Important Points to Remember ● RSTP is disabled by default. ● Dell EMC Networking OS supports only one Rapid Spanning Tree (RST) instance.
PAGE 733
To verify that an interface is in Layer 2 mode and enabled, use the show config command from INTERFACE mode. The bold lines indicate that the interface is in Layer 2 mode. DellEMC(conf-if-tf-1/1)#show config ! interface twentyFiveGigE 1/1 no ip address switchport no shutdown DellEMC(conf-if-tf-1/1)# Enabling Rapid Spanning Tree Protocol Globally Enable RSTP globally on all participating bridges; it is not enabled by default.
PAGE 734
Figure 113. Rapid Spanning Tree Enabled Globally To view the interfaces participating in RSTP, use the show spanning-tree rstp command from EXEC privilege mode. If a physical interface is part of a port channel, only the port channel is listed in the command output. DellEMC#show spanning-tree rstp Root Identifier has priority 32768, Address 0001.e801.cbb4 Root Bridge hello time 2, max age 20, forward delay 15, max hops 0 Bridge Identifier has priority 32768, Address 0001.e801.
PAGE 735
The port is not in the Edge port mode Port 380 (twentyFiveGigE 1/4) is designated Forwarding Port path cost 20000, Port priority 128, Port Identifier 128.380 Designated root has priority 32768, address 0001.e801.cbb4 Designated bridge has priority 32768, address 0001.e801.cbb4 Designated port id is 128.
PAGE 736
Table 87.
PAGE 737
Modifying Interface Parameters On interfaces in Layer 2 mode, you can set the port cost and port priority values. ● Port cost — a value that is based on the interface type. The previous table lists the default values. The greater the port cost, the less likely the port is selected to be a forwarding port. ● Port priority — influences the likelihood that a port is selected to be a forwarding port in case that several ports have the same port cost.
PAGE 738
Configuring an EdgePort The EdgePort feature enables interfaces to begin forwarding traffic approximately 30 seconds sooner. In this mode an interface forwards frames by default until it receives a BPDU that indicates that it should behave otherwise; it does not go through the Learning and Listening states. The bpduguard shutdown-on-violation option causes the interface hardware to be shut down when it receives a BPDU.
PAGE 739
The range is from 50 to 950 milliseconds. DellEMC(conf-rstp)#do show spanning-tree rstp brief Executing IEEE compatible Spanning Tree Protocol Root ID Priority 0, Address 0001.e811.2233 Root Bridge hello time 50 ms, max age 20, forward delay 15 Bridge ID Priority 0, Address 0001.e811.2233 We are the root Configured hello time 50 ms, max age 20, forward delay 15 NOTE: The hello time is encoded in BPDUs in increments of 1/256ths of a second.
PAGE 740
45 Software-Defined Networking (SDN) The Dell EMC Networking OS supports software-defined networking (SDN). For more information, see the SDN Deployment Guide.
PAGE 741
46 Security This chapter describes several ways to provide security to the Dell EMC Networking system. For details about all the commands described in this chapter, refer to the Security chapter in the Dell EMC Networking OS Command Reference Guide.
PAGE 742
● Enable AAA accounting and create a record for monitoring the accounting function. CONFIGURATION mode aaa accounting {commands level | dot1x | exec | rest | suppress | system} {default | name} {start-stop | wait-start | stop-only} {radius | tacacs+} The variables are: ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ ○ system: sends accounting information of any other AAA configuration. exec: sends accounting information when a user has logged in to EXEC mode.
PAGE 743
CONFIG-LINE-VTY mode accounting commands 15 com15 accounting exec execAcct DellEMC(config-line-vty)# accounting commands 15 com15 DellEMC(config-line-vty)# accounting exec execAcct Monitoring AAA Accounting Dell EMC Networking OS does not support periodic interim accounting because the periodic command can cause heavy congestion when many users are logged in to the network. No specific show command exists for TACACS+ accounting.
PAGE 744
Sample dot1x accounting records The following lists the sample EAP and MAB accounting records EAP START accounting record: Fri May 10 12:20:43 2019 NAS-IP-Address = 10.16.133.
PAGE 745
NAS-Port = 1010 NAS-Port-Id = "GigabitEthernet 1/11" Service-Type = Call-Check Acct-Session-Time = 21 Acct-Session-Id = "00-11-22-33-44-55-4" Acct-Multi-Session-Id = "00-11-22-33-44-55-00-11-33-44-77-88-5e-50-d6-5cc" Acct-Link-Count = 1 Acct-Terminate-Cause = Lost-Carrier Acct-Status-Type = Stop Event-Timestamp = "May 10 2019 23:30:42 CDT" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "5a761462ef63b815707de5fa1c5ef348" Timestamp = 1557549042 RADIUS Accounting attributes The following tables describe the va
PAGE 746
Table 89. RADIUS Accounting Stop Record Attributes for CLI user (continued) RADIUS Attribute code RADIUS Attribute Description 46 Acct-Session Time Time the user has received the service. 49 Acct-Terminate-Cause Reason for session termination. 61 NAS-Port-Type ASYNC - for Console session. VIRTUAL - for telnet/SSH session. Table 90.
PAGE 747
Table 92. RADIUS Accounting Stop Record Attributes for dot1x supplicant (continued) RADIUS Attribute code RADIUS Attribute Description 4 NAS-IP-Address IPv4 address of the NAS. 95 NAS-IPv6–Address IPv6 address of the NAS. Session Identification Attributes 1 User-Name User name/ Supplicant MAC Address (for MAB). 5 NAS-Port Port on which session is terminated. 6 Service-Type Framed (2) for EAP /Call check (10) for MAB. 8 Framed-IP-Address IPv4 address of supplicant.
PAGE 748
Table 93. Use cases for dot1x supplicant to trigger RADIUS Accounting Start/Stop records (continued) dot1x event Accounting type Attributes Configure Port control to force unauth Stop Stop record attributes with termination cause as port-reinitialized (21). Interface Host mode change (single/multihost/multiauth) Stop Stop record attributes with termination cause as port-reinitialized (21).
PAGE 749
Configuring AAA Authentication Login Methods To configure an authentication method and method list, use the following commands. Dell EMC Networking OS Behavior: If you use a method list on the console port in which RADIUS or TACACS is the last authentication method, and the server is not reachable, Dell EMC Networking OS allows access even though the username and password credentials cannot be verified.
PAGE 750
Enabling AAA Authentication — RADIUS To enable authentication from the RADIUS server, and use TACACS as a backup, use the following commands. 1. Enable RADIUS and set up TACACS as backup. CONFIGURATION mode aaa authentication enable default radius tacacs 2. Establish a host address and password. CONFIGURATION mode radius-server host x.x.x.x key some-password 3. Establish a host address and password. CONFIGURATION mode tacacs-server host x.x.x.
PAGE 751
2. You are prompted to force the users to re-authenticate while adding or removing a RADIUS/TACACS+ server. CONFIGURATION mode aaa authentication login method-list-name Example: DellEMC(config)#aaa authentication login vty_auth_list radius Force all logged-in users to re-authenticate (y/n)? 3. You are prompted to force the users to re-authenticate whenever there is a change in the RADIUS server list.. CONFIGURATION mode radius-server host IP Address Example: DellEMC(config)#radius-server host 192.100.0.
PAGE 752
Privilege Levels Overview Limiting access to the system is one method of protecting the system and your network. However, at times, you might need to allow others access to the router and you can limit that access to a subset of commands. In Dell EMC Networking OS, you can configure a privilege level for users who need limited access to the system. Every command in Dell EMC Networking OS is assigned a privilege level of 0, 1, or 15. You can configure up to 16 privilege levels in Dell EMC Networking OS.
PAGE 753
○ privilege level The range is from 0 to 15. ○ Secret:Specify the secret for the user To view username, use the show users command in EXEC Privilege mode. Configuring the Enable Password Command To configure Dell EMC Networking OS, use the enable command to enter EXEC Privilege level 15. After entering the command, Dell EMC Networking OS requests that you enter a password. Privilege levels are not assigned to passwords, rather passwords are assigned to a privilege level.
PAGE 754
enable password [level level] [encryption-mode] password Configure the optional and required parameters: ● level level: specify a level from 0 to 15. Level 15 includes all levels. ● encryption-type: enter 0 for plain text or 7 for encrypted text. ● password: enter a string up to 32 characters long. To change only the password for the enable command, configure only the password parameter. 3. Configure level and commands for a mode or reset a command’s level.
PAGE 755
exit Exit from the EXEC no Negate a command show Show running system information terminal Set terminal line parameters traceroute Trace route to destination DellEMC#confi DellEMC(conf)#? end Exit from Configuration mode exit Exit from Configuration mode no Reset a command snmp-server Modify SNMP parameters DellEMC(conf)# Specifying LINE Mode Password and Privilege You can specify a password authentication of all users on different terminal lines.
PAGE 756
RADIUS Remote authentication dial-in user service (RADIUS) is a distributed client/server protocol. This protocol transmits authentication, authorization, and configuration information between a central RADIUS server and a RADIUS client (the Dell EMC Networking system). The system sends user information to the RADIUS server and requests authentication of the user and password. The RADIUS server returns one of the following responses: ● Access-Accept — the RADIUS server authenticates the user.
PAGE 757
Auto-Command You can configure the system through the RADIUS server to automatically execute a command when you connect to a specific line. The auto-command command is executed when the user is authenticated and before the prompt appears to the user. ● Automatically execute a command. auto-command Privilege Levels Through the RADIUS server, you can configure a privilege level for the user to enter into when they connect to a session. This value is configured on the client system. ● Set a privilege level.
PAGE 758
Applying the Method List to Terminal Lines To enable RADIUS AAA login authentication for a method list, apply it to a terminal line. To configure a terminal line for RADIUS authentication and authorization, use the following commands. ● Enter LINE mode. CONFIGURATION mode line {aux 0 | console 0 | vty number [end-number]} ● Enable AAA login authentication for the specified RADIUS method list.
PAGE 759
CONFIGURATION mode radius-server deadtime seconds ○ seconds: the range is from 0 to 2147483647. The default is 0 seconds. ● Configure a key for all RADIUS communications between the system and RADIUS server hosts. CONFIGURATION mode radius-server key [encryption-type] key ○ encryption-type: enter 7 to encrypt the password. Enter 0 to keep the password as plain text. ○ key: enter a string. The key can be up to 42 characters long. You cannot use spaces in the key.
PAGE 760
aaa authentication login default radius local 2. Specify the protocol for authentication. CONFIGURATION mode aaa radius auth-method mschapv2 3. Establish a host address and password. CONFIGURATION mode radius-server host H key K 4. Log in to switch using console or telnet or ssh with a valid user role. When 1-factor authentication is used, the authentication succeeds enabling you to access the switch.
PAGE 761
To view the configuration, use the show config in LINE mode or the show running-config tacacs+ command in EXEC Privilege mode. If authentication fails using the primary method, Dell EMC Networking OS employs the second method (or third method, if necessary) automatically. The fallback to the second method would happen only if the authentication failure is due to a nonreachable server or invalid TACACS server key. The fallback would not occur if the authentication failure is due to invalid credentials.
PAGE 762
When configuring a TACACS+ server host, you can set different communication parameters, such as the key password. Example of Specifying a TACACS+ Server Host DellEMC(conf)# DellEMC(conf)#aaa authentication login tacacsmethod tacacs+ DellEMC(conf)#aaa authentication exec tacacsauthorization tacacs+ DellEMC(conf)#tacacs-server host 25.1.1.
PAGE 763
Protection from TCP Tiny and Overlapping Fragment Attacks Tiny and overlapping fragment attack is a class of attack where configured ACL entries — denying TCP port-specific traffic — is bypassed and traffic is sent to its destination although denied by the ACL. RFC 1858 and 3128 proposes a countermeasure to the problem. This countermeasure is configured into the line cards and enabled by default.
PAGE 764
Using SCP with SSH to Copy a Software Image To use secure copy (SCP) to copy a software image through an SSH connection from one switch to another, use the following commands. 1. On Switch 1, set the SSH port number ( port 22 by default). CONFIGURATION MODE ip ssh server port number 2. On Switch 1, enable SSH. CONFIGURATION MODE copy ssh server enable 3. On Switch 2, invoke SCP. CONFIGURATION MODE copy scp: flash: 4.
PAGE 765
To remove the generated RSA host keys and zeroize the key storage location, use the crypto key zeroize rsa command in CONFIGURATION mode. DellEMC(conf)#crypto key zeroize rsa Configuring When to Re-generate an SSH Key You can configure the time-based or volume-based rekey threshold for an SSH session. If both threshold types are configured, the session rekeys when either one of the thresholds is reached.
PAGE 766
Configuring the HMAC Algorithm for the SSH Server To configure the HMAC algorithm for the SSH server, use the ip ssh server mac hmac-algorithm command in CONFIGURATION mode. hmac-algorithm: Enter a space-delimited list of keyed-hash message authentication code (HMAC) algorithms supported by the SSH server.
PAGE 767
Example of Configuring a HMAC Algorithm The following example shows you how to configure a HMAC algorithm list. DellEMC(conf)# ip ssh mac hmac-sha1-96 Configuring the SSH Server Cipher List To configure the cipher list supported by the SSH server, use the ip ssh server cipher cipher-list command in CONFIGURATION mode. cipher-list-: Enter a space-delimited list of ciphers the SSH server will support. The following ciphers are available.
PAGE 768
Secure Shell Authentication Secure Shell (SSH) is enabled by default using the SSH Password Authentication method. Enabling SSH Authentication by Password Authenticate an SSH client by prompting for a password when attempting to connect to the Dell EMC Networking system. This setup is the simplest method of authentication and uses SSH version 2. To enable SSH password authentication, use the following command. ● Enable SSH password authentication.
PAGE 769
Overwrite (y/n)? y Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /home/admin/.ssh/id_rsa. Your public key has been saved in /home/admin/.ssh/id_rsa.pub. Configuring Host-Based SSH Authentication Authenticate a particular host. This method uses SSH version 2. To configure host-based authentication, use the following commands. 1. Configure RSA Authentication. Refer to Using RSA Authentication of SSH. 2.
PAGE 770
Using Client-Based SSH Authentication To SSH from the chassis to the SSH client, use the following command. If the SSH port is a non-default value, use the ip ssh server port number command to change the default port number. You may only change the port number when SSH is disabled. Then use the -p option with the ssh command. ● SSH from the chassis to the SSH client. ssh ip_address DellEMC#ssh 10.16.127.
PAGE 771
Table 94. VTY Access (continued) Authentication Method VTY access-class support? Username access-class support? Remote authorization support? TACACS+ YES NO YES (with version 5.2.1.0 and later) RADIUS YES NO YES (with version 6.1.1.
PAGE 772
Example of Configuring VTY Authorization Based on Access Class Retrieved from the Line (Per Network Address) DellEMC(conf)#ip access-list standard deny10 DellEMC(conf-ext-nacl)#permit 10.0.0.0/8 DellEMC(conf-ext-nacl)#deny any DellEMC(conf)# DellEMC(conf)#aaa authentication login tacacsmethod tacacs+ DellEMC(conf)#tacacs-server host 256.1.1.
PAGE 773
● Configuring TACACS+ and RADIUS VSA Attributes for RBAC ● Displaying User Roles ● Displaying Accounting for User Roles ● Displaying Information About Roles Logged into the Switch ● Display Role Permissions Assigned to a Command Overview of RBAC With Role-Based Access Control (RBAC), access and authorization is controlled based on a user’s role. Users are granted permissions based on their user roles, not on their individual user ID.
PAGE 774
You must specify at least local authentication. For consistency, the best practice is to define the same authentication method list across all lines, in the same order of comparison; for example VTY and console port. You could also use the default authentication method to apply to all the LINES; for example, console port and VTY. NOTE: The authentication method list must be in the same order as the authorization method list.
PAGE 775
secadmin Exec Config Line sysadmin Exec Config Interface Line Router IP Route-map Protocol MAC User Roles This section describes how to create a new user role and configure command permissions and contains the following topics. ● Creating a New User Role ● Modifying Command Permissions for Roles ● Adding and Deleting Users from a Role Creating a New User Role Instead of using the system defined user roles, you can create a new user role that best matches your organization.
PAGE 776
myrole secadmin Exec Config Line Modifying Command Permissions for Roles You can modify (add or delete) command permissions for newly created user roles and system defined roles using the role mode { { { addrole | deleterole } role-name } | reset } command command in Configuration mode. NOTE: You cannot modify system administrator command permissions. If you add or delete command permissions using the role command, those changes only apply to the specific user role.
PAGE 777
The following example shows that the secadmin role can now access Interface mode (highlighted in bold). Role Inheritance netoperator netadmin secadmin sysadmin Modes Exec Config Interface Router IP RouteMap Protocol MAC Exec Config Interface Line Exec Config Interface Line Router IP RouteMap Protocol MAC Example: Remove Security Administrator Access to Line Mode.
PAGE 778
The following example adds a user, to the secadmin user role. DellEMC(conf)# username john role secadmin password 0 password AAA Authentication and Authorization for Roles This section describes how to configure AAA Authentication and Authorization for Roles.
PAGE 779
Examples of Applying a Method List The following configuration example applies a method list: TACACS+, RADIUS and local: ! radius-server host 10.16.150.203 key ! tacacs-server host 10.16.150.203 key ! aaa authentication login ucraaa tacacs+ radius local aaa authorization exec ucraaa tacacs+ radius local aaa accounting commands role netadmin ucraaa start-stop tacacs+ ! The following configuration example applies a method list other than default to each VTY line.
PAGE 780
Configuring TACACS+ and RADIUS VSA Attributes for RBAC For RBAC and privilege levels, the Dell EMC Networking OS RADIUS and TACACS+ implementation supports two vendorspecific options: privilege level and roles. The Dell EMC Networking vendor-ID is 6027 and the supported option has attribute of type string, which is titled “Force10-avpair”.
PAGE 781
Applying an Accounting Method to a Role To apply an accounting method list to a role executed by a user with that user role, use the accounting command in LINE mode. accounting {exec | commands {level | role role-name}} method-list Example of Applying an Accounting Method to a Role The following example applies the accounting default method to the user role secadmin (security administrator).
PAGE 782
interface line route-map router Interface configuration mode Line Configuration mode Route map configuration mode Router configuration mode DellEMC#show role mode configure username Role access: sysadmin DellEMC##show role mode configure password-attributes Role access: secadmin,sysadmin DellEMC#show role mode configure interface Role access: netadmin, sysadmin DellEMC#show role mode configure line Role access: netadmin,sysadmin Displaying Information About Users Logged into the Switch To display informa
PAGE 783
to the user’s e-mail ID or mobile. If the OTP is valid, the RADIUS server authenticates the 2FA user and sends an AccessAccept response to NAS. ● Access-Reject—NAS validates the OTP and if the OTP is invalid, the RADIUS server does not authenticate the user and sends an Access-Reject response to NAS. Configuring Challenge Response Authentication for SSHv2 To configure challenge response authentication for SSHv2, perform the following steps: 1. Enable challenge response authentication for SSHv2.
PAGE 784
Table 95. Suppressed ICMP message types ICMPv4 message types Echo reply (0) All sub types of destination unreachable (3) Source quench (4) Redirect (5) Router advertisement (9) Router solicitation (10) Time exceeded (11) IP header bad (12) Timestamp request (13) Timestamp reply (14) Information request (15) Information reply (16) Address mask request (17) Address mask reply (18) NOTE: The Dell EMC Networking OS does not suppress the ICMP message type echo request (8). Table 96.
PAGE 785
● ● ● ● ● ● ● ● Router advertisement (134) Neighbor solicitation (135) Neighbor advertisement (136) Redirect (137) Router renumbering (138) MLD v2 listener report (143) Duplicate Address Request (157) Duplicate Address Confirmation (158) SSH Lockout Settings The system has a SSH protection mechanism which, by default, allows 10 login attempts (success or failure) per minute.
PAGE 786
47 Service Provider Bridging Service provider bridging provides the ability to add a second VLAN ID tag in an Ethernet frame and is referred to as VLAN stacking in the Dell EMC Networking OS. Topics: • • • • • VLAN Stacking VLAN Stacking Packet Drop Precedence Dynamic Mode CoS for VLAN Stacking Layer 2 Protocol Tunneling Provider Backbone Bridging VLAN Stacking VLAN stacking, also called Q-in-Q, is defined in IEEE 802.1ad — Provider Bridges, which is an amendment to IEEE 802.
PAGE 787
Figure 114. VLAN Stacking in a Service Provider Network Important Points to Remember ● Interfaces that are members of the Default VLAN and are configured as VLAN-Stack access or trunk ports do not switch untagged traffic. To switch traffic, add these interfaces to a non-default VLAN-Stack-enabled VLAN. ● Dell EMC Networking cautions against using the same MAC address on different customer VLANs, on the same VLAN-Stack VLAN.
PAGE 788
Related Configuration Tasks ● ● ● ● Configuring the Protocol Type Value for the Outer VLAN Tag Configuring Dell EMC Networking OS Options for Trunk Ports Debugging VLAN Stacking VLAN Stacking in Multi-Vendor Networks Creating Access and Trunk Ports To create access and trunk ports, use the following commands. ● Access port — a port on the service provider edge that directly connects to the customer. An access port may belong to only one service provider VLAN.
PAGE 789
2 3 4 5 6 Inactive Inactive Inactive Inactive Active DellEMC# M Po1(Te 1/12-1/21) M Tf 1/33/1 Configuring the Protocol Type Value for the Outer VLAN Tag The tag protocol identifier (TPID) field of the S-Tag is user-configurable. To set the S-Tag TPID, use the following command. ● Select a value for the S-Tag TPID. CONFIGURATION mode vlan-stack protocol-type The default is 9100. To display the S-Tag TPID for a VLAN, use the show running-config command from EXEC privilege mode.
PAGE 790
G - GVRP tagged, M - Vlan-stack NUM * 1 100 101 103 Status Inactive Inactive Inactive Inactive Description Q Ports U Tf 1/1 T Tf 1/1 M Tf 1/1 Debugging VLAN Stacking To debug VLAN stacking, use the following command. ● Debug the internal state and membership of a VLAN and its ports. debug member The port notations are as follows: ● ● ● ● ● MT — stacked trunk MU — stacked access port T — 802.1Q trunk port U — 802.
PAGE 791
system is able to differentiate between 0x8100 and untagged traffic and maps each to the appropriate VLAN, as shown by the packet originating from Building A. Therefore, a mismatched TPID results in the port not differentiating between tagged and untagged traffic. Figure 115.
PAGE 792
Figure 116.
PAGE 793
Figure 117. Single and Double-Tag TPID Mismatch VLAN Stacking Packet Drop Precedence VLAN stacking packet-drop precedence is supported on the switch. The drop eligible indicator (DEI) bit in the S-Tag indicates to a service provider bridge which packets it should prefer to drop when congested. Enabling Drop Eligibility Enable drop eligibility globally before you can honor or mark the DEI value. When you enable drop eligibility, DEI mapping or marking takes place according to the defaults.
PAGE 794
Table 97. Drop Eligibility Behavior (continued) Ingress Egress DEI Disabled DEI Enabled Trunk Port Trunk Port Retain inner tag CFI Retain inner tag CFI. Retain outer tag CFI Set outer tag CFI to 0. Retain inner tag CFI Retain inner tag CFI Set outer tag CFI to 0 Set outer tag CFI to 0 Access Port Trunk Port To enable drop eligibility globally, use the following command. ● Make packets eligible for dropping based on their DEI value.
PAGE 795
To display the DEI-marking configuration, use the show interface dei-mark [interface slot/port[/ subport] ] in EXEC Privilege mode. DellEMC#show interface dei-mark Default CFI/DEI Marking: 0 Interface Drop precedence CFI/DEI -------------------------------Tf 1/1 Green 0 Tf 1/2 Yellow 1 Tf 2/9 Yellow 0 Tf 2/10 Yellow 0 Dynamic Mode CoS for VLAN Stacking One of the ways to ensure quality of service for customer VLAN-tagged frames is to use the 802.
PAGE 796
Examples of QoS Interface Configuration and Rate Policing policy-map-input in layer2 service-queue 3 class-map a qos-policy 3 ! class-map match-any a layer2 match mac access-group a ! mac access-list standard a seq 5 permit any ! qos-policy-input 3 layer2 rate-police 40 Likewise, in the following configuration, packets with dot1p priority 0–3 are marked as dot1p 7 in the outer tag and queued to Queue 3. Rate policing is according to qos-policy-input 3.
PAGE 797
NOTE: Because dot1p-mapping marks and queues packets, the only remaining applicable QoS configuration is rate metering. You may use Rate Shaping or Rate Policing. Layer 2 Protocol Tunneling Spanning tree bridge protocol data units (BPDUs) use a reserved destination MAC address called the bridge group address, which is 01-80-C2-00-00-00. Only spanning-tree bridges on the local area network (LAN) recognize this address and process the BPDU.
PAGE 798
Dell EMC Networking OS Behavior: In Dell EMC Networking OS versions prior to 8.2.1.0, the MAC address that Dell EMC Networking systems use to overwrite the Bridge Group Address on ingress was non-configurable. The value of the L2PT MAC address was the Dell EMC Networking-unique MAC address, 01-01-e8-00-00-00.
PAGE 799
EXEC Privilege mode show cam-profile 2. Enable protocol tunneling globally on the system. CONFIGURATION mode protocol-tunnel enable 3. Tunnel BPDUs the VLAN. INTERFACE VLAN mode protocol-tunnel stp Specifying a Destination MAC Address for BPDUs By default, Dell EMC Networking OS uses a Dell EMC Networking-unique MAC address for tunneling BPDUs. You can configure another value. To specify a destination MAC address for BPDUs, use the following command.
PAGE 800
Provider Backbone Bridging IEEE 802.1ad—Provider Bridges amends 802.1Q—Virtual Bridged Local Area Networks so that service providers can use 802.1Q architecture to offer separate VLANs to customers with no coordination between customers, and minimal coordination between customers and the provider. 802.
PAGE 801
48 sFlow sFlow is a standard-based sampling technology embedded within switches and routers which is used to monitor network traffic. It is designed to provide traffic monitoring for high-speed networks with many switches and routers.
PAGE 802
To avoid the back-off, either increase the global sampling rate or configure all the line card ports with the desired sampling rate even if some ports have no sFlow configured. Important Points to Remember ● The Dell EMC Networking OS implementation of the sFlow MIB supports sFlow configuration via snmpset. ● By default, sFlow collection is supported only on data ports.
PAGE 803
If you did not enable any extended information, the show output displays the following (shown in bold).
PAGE 804
Enabling and Disabling sFlow on an Interface By default, sFlow is disabled on all interfaces. This CLI is supported on physical ports and link aggregation group (LAG) ports. To enable sFlow on a specific interface, use the following command. ● Enable sFlow on an interface. INTERFACE mode [no] sflow ingress-enable To disable sFlow on an interface, use the no version of this command.
PAGE 805
Example of viewing the sflow max-header-size extended on an Interface Mode DellEMC#show sflow interface hundredgigabitethernet 1/29 Hu 1/49 sFlow type :Ingress Configured sampling rate :131072 Actual sampling rate :131072 Counter polling interval :20 Extended max header size :256 Samples rcvd from h/w :0 Example of the show running-config sflow Command DellEMC#show running-config sflow ! sflow collector 100.1.1.1 agent-addr 1.1.1.
PAGE 806
23 UDP packets dropped 0 sFlow samples collected stack-unit 1 Port set 0 Hu 1/49: configured rate 131072, actual rate 131072 Tf 1/1: configured rate 32768, actual rate 32768 Displaying Show sFlow on an Interface To view sFlow information on a specific interface, use the following command. ● Display sFlow configuration information and statistics on a specific interface. EXEC mode show sflow interface interface-name The following example shows the show sflow interface command.
PAGE 807
sflow collector ip-address agent-addr ip-address [number [max-datagram-size number] ] | [max-datagram-size number ] The default UDP port is 6343. The default max-datagram-size is 1400. Changing the Polling Intervals The sflow polling-interval command configures the polling interval for an interface in the maximum number of seconds between successive samples of counters sent to the collector. This command changes the global default counter polling (20 seconds) interval.
PAGE 808
49 Simple Network Management Protocol (SNMP) The Simple Network Management Protocol (SNMP) is designed to manage devices on IP networks by monitoring device operation, which might require administrator intervention. NOTE: On Dell EMC Networking routers, standard and private SNMP management information bases (MIBs) are supported, including all Get and a limited number of Set operations (such as set vlan and copy cmd).
PAGE 809
• Configuring SNMP context name Protocol Overview Network management stations use SNMP to retrieve or alter management data from network elements. A datum of management information is called a managed object; the value of a managed object can be static or variable. Network elements store managed objects in a database called a management information base (MIB).
PAGE 810
SHA authentication needs to be used with the AES-CFB128 privacy algorithm only when FIPS is enabled because SHA is then the only available authentication level. If FIPS is disabled, you can use MD5 authentication in addition to SHA authentication with the AES-CFB128 privacy algorithm You cannot modify the FIPS mode if SNMPv3 users are already configured and present in the system.
PAGE 811
Set up SNMP As previously stated, Dell EMC Networking OS supports SNMP version 1 and version 2 that are community-based security models. The primary difference between the two versions is that version 2 supports two additional protocol operations (informs operation and snmpgetbulk query) and one additional object (counter64 object). SNMP version 3 (SNMPv3) is a user-based security model that provides password authentication for user security and encryption for data security and privacy.
PAGE 812
snmp-server group group-name 3 noauth auth read name write name ● Configure an SNMPv3 view. CONFIGURATION mode snmp-server view view-name oid-tree {included | excluded} NOTE: To give a user read and write view privileges, repeat this step for each privilege type. ● Configure the user with an authorization password (password privileges only). CONFIGURATION mode snmp-server user name group-name 3 noauth auth md5 auth-password ● Configure an SNMP group (password privileges only).
PAGE 813
Reading Managed Object Values You may only retrieve (read) managed object values if your management station is a member of the same community as the SNMP agent. Dell EMC Networking supports RFC 4001, Textual Conventions for Internet Work Addresses that defines values representing a type of internet address. These values display for ipAddressTable objects using the snmpwalk command. There are several UNIX SNMP commands that read data. ● Read the value of a single managed object.
PAGE 814
Configuring Contact and Location Information using SNMP You may configure system contact and location information from the Dell EMC Networking system or from the management station using SNMP. To configure system contact and location information from the Dell EMC Networking system and from the management station using SNMP, use the following commands.
PAGE 815
To send informational messages, enter the keyword informs. To send the SNMP version to use for notification messages, enter the keyword version. To identify the SNMPv1 community string, enter the name of the community-string. 2. Specify which traps the Dell EMC Networking system sends to the trap receiver. CONFIGURATION mode snmp-server enable traps Enable all Dell EMC Networking enterprise-specific and RFC-defined traps using the snmp-server enable traps command from CONFIGURATION mode.
PAGE 816
CONFIGURATION MODE snmp-server enable traps snmp syslog-unreachable To enable an SNMP agent to send a trap when the syslog server resumes connectivity, enter the following command: CONFIGURATION MODE snmp-server enable traps snmp syslog-reachable Table 100. List of Syslog Server MIBS that have read access MIB Object OID Object Values Description dF10SysLogTraps 1.3.6.1.4.1.6027.3.30.1.1 1 = reachable2 = unreachable Specifies whether the syslog server is reachable or unreachable.
PAGE 817
Table 101. MIB Objects for Copying Configuration Files via SNMP (continued) MIB Object OID Object Values Description 2 = running-config ● If copySrcFileType is running-config or startupconfig, the default copySrcFileLocation is flash. ● If copySrcFileType is a binary file, you must also specify copySrcFileLocation and copySrcFileName. 3 = startup-config copySrcFileLocation .1.3.6.1.4.1.6027.3.5.1.1.1.1.3 1 = flash 2 = slot0 3 = tftp 4 = ftp 5 = scp 6 = usbflash copySrcFileName copyDestFileType .
PAGE 818
Table 101. MIB Objects for Copying Configuration Files via SNMP (continued) MIB Object OID Object Values Description copyUserName .1.3.6.1.4.1.6027.3.5.1.1.1.1.9 Username for the server. Username for the FTP, TFTP, or SCP server. ● If you specify copyUserName, you must also specify copyUserPassword. copyUserPassword .1.3.6.1.4.1.6027.3.5.1.1.1.1.10 Password for the server. Password for the FTP, TFTP, or SCP server.
PAGE 819
Copying Configuration Files via SNMP To copy the running-config to the startup-config from the UNIX machine, use the following command. ● Copy the running-config to the startup-config from the UNIX machine. snmpset -v 2c -c public force10system-ip-address copySrcFileType.index i 2 copyDestFileType.index i 3 The following examples show the command syntax using MIB object names and the same command using the object OIDs. In both cases, a unique index number follows the object.
PAGE 820
copyServerAddress.110 a 11.11.11.11 copyUserName.110 s mylogin copyUserPassword.110 s mypass FTOS-COPY-CONFIG-MIB::copySrcFileType.110 = INTEGER: runningConfig(2) FTOS-COPY-CONFIG-MIB::copyDestFileName.110 = STRING: /home/startup-config FTOS-COPY-CONFIG-MIB::copyDestFileLocation.110 = INTEGER: ftp(4) FTOS-COPY-CONFIG-MIB::copyServerAddress.110 = IpAddress: 11.11.11.11 FTOS-COPY-CONFIG-MIB::copyUserName.110 = STRING: mylogin FTOS-COPY-CONFIG-MIB::copyUserPassword.
PAGE 821
Table 102. Additional MIB Objects for Copying Configuration Files via SNMP (continued) MIB Object OID Values Description copyTimeCompleted .1.3.6.1.4.1.6027.3.5.1.1.1.1.13 Time value Specifies the point in the uptime clock that the copy operation completed. copyFailCause .1.3.6.1.4.1.6027.3.5.1.1.1.1.14 1 = bad filename Specifies the reason the copy request failed. 2 = copy in progress 3 = disk full 4 = file exists 5 = file not found 6 = timeout 7 = unknown copyEntryRowStatus .1.3.6.1.4.1.6027.
PAGE 822
MIB Support for Power Monitoring Dell EMC Networking provides MIB objects to display the information for Power Monitoring. The OIDs specific to Power Monitoring are appended to the DellITaMIbs. There are three separate DellITaMIbs available to display the current input power, average input power and average input-power start time. These statistics can also be obtained by using the CLI command: show environment . The following table lists the related MIB objects, OID and description for the same: Table 103.
PAGE 823
Table 104. MIB Objects to Display support for 25G, 40G, 50G, 100G Optical Transceiver or DAC cable IDPROM user info (continued) MIB Object OID Description dellNetIfTransSerialNumber 1.3.6.1.4.1.6027.3.11.1.3.1.1.7 Specifies the Serial Number of the Optic inserted dellNetIfTransTransmitPowerLane1 1.3.6.1.4.1.6027.3.11.1.3.1.1.8 Specifies Lane 1 Tx power value in dBm dellNetIfTransTransmitPowerLane2 1.3.6.1.4.1.6027.3.11.1.3.1.1.
PAGE 824
MIB Support to Display the Available Memory Size on Flash Dell EMC Networking provides more MIB objects to display the available memory size on flash memory. The following table lists the MIB object that contains the available memory size on flash memory. Table 105. MIB Objects for Displaying the Available Memory Size on Flash via SNMP MIB Object OID Description chStackUnitFlashUsageUtil 1.3.6.1.4.1.6027.3.10.1.2.9.1.6 Contains flash memory usage in percentage.
PAGE 825
Viewing the Software Core Files Generated by the System ● To view the software core files generated by the system, use the following command. snmpwalk -v2c -c public 192.168.60.120 .1.3.6.1.4.1.6027.3.10.1.2.10 enterprises.6027.3.10.1.2.10.1.1.1.1 = 1 enterprises.6027.3.10.1.2.10.1.1.1.2 = 2 enterprises.6027.3.10.1.2.10.1.1.1.3 = 3 enterprises.6027.3.10.1.2.10.1.1.2.1 = 1 enterprises.6027.3.10.1.2.10.1.2.1.1 = "/CORE_DUMP_DIR/flashmntr.core.gz" enterprises.6027.3.10.1.2.10.1.2.1.
PAGE 826
Table 107. MIB Objects to Display the Information for PFC Storm Control (continued) MIB Object OID Description dellNetFpPfcStormControlCumulativeDr oppedPacketsEgress 1.3.6.1.4.1.6027.3.27.1.21.1.1.1.6 Cumulative number of packets dropped on egress. dellNetFpPfcStormControlStatistics 1.3.6.1.4.1.6027.3.27.1.21.2 Storm control statistics. dellNetFpPfcStormControlStatisticsTabl e 1.3.6.1.4.1.6027.3.27.1.21.2.1 Table to show counters of PFC stormcontrol on per-port, per-priority basis.
PAGE 827
SNMPv2-SMI::enterprises.6027.3.27.1.21.1.1.1.6.2097925.5 SNMPv2-SMI::enterprises.6027.3.27.1.21.1.1.1.6.2097925.6 SNMPv2-SMI::enterprises.6027.3.27.1.21.2.1.1.1.2097157.5 SNMPv2-SMI::enterprises.6027.3.27.1.21.2.1.1.1.2097157.6 SNMPv2-SMI::enterprises.6027.3.27.1.21.2.1.1.1.2097413.5 SNMPv2-SMI::enterprises.6027.3.27.1.21.2.1.1.1.2097413.6 SNMPv2-SMI::enterprises.6027.3.27.1.21.2.1.1.1.2097669.5 SNMPv2-SMI::enterprises.6027.3.27.1.21.2.1.1.1.2097669.6 SNMPv2-SMI::enterprises.6027.3.27.1.21.2.1.1.1.2097925.
PAGE 828
MIB Support for Monitoring the overall buffer usage for lossy and lossless traffic per XPE Dell EMC Networking provides MIB objects to display the information for Monitoring the overall buffer usage for lossy and lossless traffic per XPE. These statistics can also be obtained by using the CLI command: show hardware buffer service-pool buffer-info . The following table lists the related MIB objects, OID and description for the same: Table 109.
PAGE 829
SNMP Support for WRED Green/Yellow/Red Drop Counters Dell EMC Networking provides MIB objects to display the information for WRED Green (Green Drops)/Yellow (Yellow Drops)/Red (Out of Profile Drops) Drop Counters. These statistics can also be obtained by using the CLI command: show qos statistics wred-profile . The following table lists the related MIB objects, OID and description for the same: Table 110.
PAGE 830
MIB Support to Display the Available Partitions on Flash Dell EMC Networking provides MIB objects to display the information of various partitions such as /flash, /tmp, /usr/ pkg, and /f10/ConfD. The dellNetFlashStorageTable table contains the list of all partitions on disk. The following table lists the related MIB objects: Table 111. MIB Objects to Display the Available Partitions on Flash MIB Object OID Description dellNetFlashPartitionNumber 1.3.6.1.4.1.6027.3.26.1.4.8.1.1 Index for the table.
PAGE 831
.1.3.6.1.4.1.6027.3.26.1.4.8.1.4.1 .1.3.6.1.4.1.6027.3.26.1.4.8.1.4.2 .1.3.6.1.4.1.6027.3.26.1.4.8.1.4.3 .1.3.6.1.4.1.6027.3.26.1.4.8.1.4.4 .1.3.6.1.4.1.6027.3.26.1.4.8.1.4.5 .1.3.6.1.4.1.6027.3.26.1.4.8.1.5.1 .1.3.6.1.4.1.6027.3.26.1.4.8.1.5.2 .1.3.6.1.4.1.6027.3.26.1.4.8.1.5.3 .1.3.6.1.4.1.6027.3.26.1.4.8.1.5.4 .1.3.6.1.4.1.6027.3.26.1.4.8.1.5.5 .1.3.6.1.4.1.6027.3.26.1.4.8.1.6.1 .1.3.6.1.4.1.6027.3.26.1.4.8.1.6.2 .1.3.6.1.4.1.6027.3.26.1.4.8.1.6.3 .1.3.6.1.4.1.6027.3.26.1.4.8.1.6.4 .1.3.6.1.4.1.6027.3.
PAGE 832
MIB Support to ECMP Group Count Dell EMC Networking OS provides MIB objects to display the information of the ECMP group count information. The following table lists the related MIB objects: Table 114. MIB Objects to display ECMP Group Count MIB Object OID Description dellNetInetCidrECMPGrpMax 1.3.6.1.4.1.6027.3.9.1.6 Total CAM for ECMP group. dellNetInetCidrECMPGrpUsed 1.3.6.1.4.1.6027.3.9.1.7 Used CAM for ECMP group. dellNetInetCidrECMPGrpAvl 1.3.6.1.4.1.6027.3.9.1.
PAGE 833
INTEGER: 2097157 SNMPv2SMI::enterprises.6027.3.9.1.5.1.8.1.1.4.100.100.100.0.24.1.4.10.1.1.1.1.4.10.1.1.1 = INTEGER: 2098693 SNMPv2SMI::enterprises.6027.3.9.1.5.1.8.1.1.4.100.100.100.0.24.1.4.20.1.1.1.1.4.20.1.1.1 = INTEGER: 1258296320 SNMPv2SMI::enterprises.6027.3.9.1.5.1.8.1.1.4.100.100.100.0.24.1.4.30.1.1.1.1.4.30.1.1.1 = INTEGER: 1275078656 SNMPv2-SMI::enterprises.6027.3.9.1.5.1.9.1.1.4.10.1.1.0.24.0.0.0.0 = "" SNMPv2-SMI::enterprises.6027.3.9.1.5.1.9.1.1.4.10.1.1.1.32.1.4.10.1.1.1.1.4.10.1.1.
PAGE 834
SNMPv2-SMI::enterprises.6027.3.9.1.5.1.10.1.1.4.70.70.70.0.24.0.0.0.0 = STRING: "CP" SNMPv2SMI::enterprises.6027.3.9.1.5.1.10.1.1.4.70.70.70.1.32.1.4.127.0.0.1.1.4.127.0.0.1 = STRING: "CP" SNMPv2SMI::enterprises.6027.3.9.1.5.1.10.1.1.4.70.70.70.2.32.1.4.70.70.70.2.1.4.70.70.70.2 = STRING: "Fo 1/49/1" SNMPv2SMI::enterprises.6027.3.9.1.5.1.10.1.1.4.80.80.80.0.24.1.4.10.1.1.1.1.4.10.1.1.1 = STRING: "Fo 1/49/1" SNMPv2SMI::enterprises.6027.3.9.1.5.1.10.1.1.4.80.80.80.0.24.1.4.20.1.1.1.1.4.20.1.1.
PAGE 835
SNMPv2SMI::enterprises.6027.3.9.1.5.1.11.1.1.4.100.100.100.0.24.1.4.10.1.1.1.1.4.10.1.1.1 = Gauge32: 0 SNMPv2SMI::enterprises.6027.3.9.1.5.1.11.1.1.4.100.100.100.0.24.1.4.20.1.1.1.1.4.20.1.1.1 = Gauge32: 0 SNMPv2SMI::enterprises.6027.3.9.1.5.1.11.1.1.4.100.100.100.0.24.1.4.30.1.1.1.1.4.30.1.1.1 = Gauge32: 0 SNMPv2-SMI::enterprises.6027.3.9.1.6.0 = Gauge32: 2048 SNMPv2-SMI::enterprises.6027.3.9.1.7.0 = Gauge32: 1 SNMPv2-SMI::enterprises.6027.3.9.1.8.
PAGE 836
Table 115. MIB Objects for Displaying the Details of FEC BER (continued) MIB Object OID Description dellNetFpEgInvalidVLANCounterDrops 1.3.6.1.4.1.6027.3.27.1.3.1.18 Invalid VLAN Counter Drops. dellNetFpEgL2MCDrops 1.3.6.1.4.1.6027.3.27.1.3.1.19 L2 MC Drops. dellNetFpEgPktDropsOfAnyCondition 1.3.6.1.4.1.6027.3.27.1.3.1.20 Packet Drops of ANY Conditions. dellNetFpEgHgMacUnderFlow 1.3.6.1.4.1.6027.3.27.1.3.1.21 Hg MacUnderflow. dellNetFpEgTxErrPktCounter 1.3.6.1.4.1.6027.3.27.1.3.1.
PAGE 837
SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.2109454 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.2109966 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.2110478 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.2110990 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.2111502 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.2112014 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.2112526 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.2113038 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.2113540 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.25.
PAGE 838
SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.2103310 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.2103822 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.2104334 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.2104846 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.2105358 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.2105870 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.2106382 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.2106894 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.2107406 SNMPv2-SMI::enterprises.6027.3.27.1.3.1.27.
PAGE 839
.1.3.6.1.2.1.47.1.3.2.1.2.30.0 = OID: .1.3.6.1.2.1.2.2.1.1.2100356 .1.3.6.1.2.1.47.1.3.2.1.2.31.0 = OID: .1.3.6.1.2.1.2.2.1.1.2100484 MIB Support for LAG Dell EMC Networking provides a method to retrieve the configured LACP information (Actor and Partner). Actor (local interface) is to designate the parameters and flags pertaining to the sending node, while the term Partner (remote interface) is to designate the sending node’s view of its peer parameters and flags.
PAGE 840
Table 117. MIB Objects for LAG (continued) MIB Object OID Description dot3adAggCollectorMaxDelay 1.2.840.10006.300.43.1.1.1.1.10 Contains a 16–bit read–write attribute defining the maximum delay, in tens of microseconds, that may be imposed by the frame collector between receiving a frame from an Aggregator Parser, and either delivering the frame to its MAC Client or discarding the frame. dot3adAggPortListTable 1.2.840.10006.300.43.1.1.
PAGE 841
Table 118. MIB Objects for CAM (continued) MIB Object OID Description camUsageL2In 1.3.6.1.4.1.6027.3.7.1.1.2.1.4.stack-unit.port-pipe.pipegAclUsed line camUsageL2E grAclUsed Contains information about the total CAM size allocated to layer 2 ingress ACL. 1.3.6.1.4.1.6027.3.7.1.1.2.1.10.stack-unit.port-pipe.pipe- Contains information about the total CAM size line allocated to layer 2 egress ACL.
PAGE 842
MIB support for MAC notification traps Dell EMC Networking OS provides MIB support to generate SNMP trap messages on learning or station move of a new or existing MAC address in the system with mac–address, vlan–id, and port details. The following table lists the related MIB objects, OID, and description for the same: Table 119. MIB Objects for MAC notification traps MIB Object OID Description dellNetMacNotifMib 1.3.6.1.4.1.6027.3.28.1 Contains the MAC notification groups.
PAGE 843
MIB support for interface level port security The MIB table dellNetPortSecIfConfigTable is used to achieve port security feature (MAC address learning limit) on an interface. NOTE: Port Security is not supported in VLT port channels. The following table shows the MIB objects of the table dellNetPortSecIfConfigTable. The OID of the MIB table is 1.3.6.1.4.1.6027.3.31.1.2.1. Table 121.
PAGE 844
snmpset –v 2c –c public 10.16.129.26 1.3.6.1.4.1.6027.3.31.1.2.1.1.3. 2101252 i 2147483647 To retrieve dellNetPortSecIfSecureMacLimit configured on an interface whose ifIndex is 2101252, use the following command. snmpwalk -v 2c -c public 10.16.129.26 1.3.6.1.4.1.6027.3.31.1.2.1.1.3. 2101252 SNMPv2-SMI::enterprises.6027.3.31.1.2.1.1.3.
PAGE 845
● MAC Address (Octet string of length 6 and MAC address ( in decimal) as value ● VLAN ID Table 123. MIB Objects for configuring MAC addresses MIB Object OID Access or Permission Description dellNetSecureMacIfIndex 1.3.6.1.4.1.6027.3.31.1.3.1.1.3 read-only Shows in which interface the dellNetSecureMacAddress is configured or learnt. dellNetSecureMacAddrType 1.3.6.1.4.1.6027.3.31.1.3.1.1.4 read-only Indicates if the secure MAC address is configured as a static, dynamic, or sticky.
PAGE 846
Manage VLANs using SNMP The qBridgeMIB managed objects in Q-BRIDGE-MIB, defined in RFC 2674, allows you to use SNMP to manage VLANs. Creating a VLAN To create a VLAN, use the dot1qVlanStaticRowStatus object. The snmpset operation shown in the following example creates VLAN 10 by specifying a value of 4 for instance 10 of the dot1qVlanStaticRowStatus object. > snmpset -v2c -c mycommunity 123.45.6.78 .1.3.6.1.2.1.17.7.1.4.3.1.5.10 i 4 SNMPv2-SMI::mib-2.17.7.1.4.3.1.5.
PAGE 847
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" .1.3.6.1.2.1.17.7.1.4.3.1.4.1107787786 x "40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" SNMPv2-SMI::mib-2.17.7.1.4.3.1.2.
PAGE 848
respectively To set time to wait till bgp session are up set 1.3.6.1.4.1.6027.3.18.1.3 and 1.3.6.1.4.1.6027.3.18.1.6 Enabling and Disabling a Port using SNMP To enable and disable a port using SNMP, use the following commands. 1. Create an SNMP community on the Dell system. CONFIGURATION mode snmp-server community 2. From the Dell EMC Networking system, identify the interface index of the port for which you want to change the admin status.
PAGE 849
example, the decimal equivalent of E8 is 232, and so the instance number for MAC address 00:01:e8:06:95:ac is.0.1.232.6.149.172. The value of dot1dTpFdbPort is the port number of the port off which the system learns the MAC address. In this case, of TwentyfiveGigE 1/21, the manager returns the integer 118.
PAGE 850
MIB Objects for Viewing the System Image on Flash Partitions To view the system image on Flash Partition A, use the chSysSwInPartitionAImgVers object or, to view the system image on Flash Partition B, use the chSysSwInPartitionBImgVers object. Table 125. MIB Objects for Viewing the System Image on Flash Partitions MIB Object OID Description MIB chSysSwInPartitionAImgVers 1.3.6.1.4.1.6027.3.10.1.2.8.1.11 List the version string of the system image in Flash Partition A.
PAGE 851
Example of Viewing Changed Interface State for Monitored Ports SNMPv2-MIB::sysUpTime.0 = Timeticks: (8500842) 23:36:48.42 SNMPv2-MIB::snmpTrapOID.0 = OID: IF-MIB::linkDown IF-MIB::ifIndex.33865785 = INTEGER: 33865785 SNMPv2-SMI::enterprises.6027.3.1.1.4.1.2 = STRING: "OSTATE_DN: Changed interface state to down: Tf 1/1" 2010-02-10 14:22:39 10.16.130.4 [10.16.130.4]: SNMPv2-MIB::sysUpTime.0 = Timeticks: (8500842) 23:36:48.42 SNMPv2-MIB::snmpTrapOID.0 = OID: IF-MIB::linkDown IF-MIB::ifIndex.
PAGE 852
SNMPv2-SMI::enterprises.6027.3.11.1.3.1.1.11.2113540 SNMPv2-SMI::enterprises.6027.3.11.1.3.1.1.12.2113540 SNMPv2-SMI::enterprises.6027.3.11.1.3.1.1.13.2113540 SNMPv2-SMI::enterprises.6027.3.11.1.3.1.1.14.2113540 SNMPv2-SMI::enterprises.6027.3.11.1.3.1.1.15.2113540 SNMPv2-SMI::enterprises.6027.3.11.1.3.1.1.16.2113540 SNMPv2-SMI::enterprises.6027.3.11.1.3.1.1.17.2113540 SNMPv2-SMI::enterprises.6027.3.11.1.3.1.1.18.2113540 SNMPv2-SMI::enterprises.6027.3.11.1.3.1.1.19.2113540 SNMPv2-SMI::enterprises.6027.3.11.
PAGE 853
Sample SNMP context configuration: DellEMC(conf-ipv6-router_ospf)#snmp context ospf1 DellEMC>show runnig-config ospf ! ipv6 router ospf 10 router-id 10.10.10.
PAGE 854
50 Storm Control Storm control allows you to control unknown-unicast, muticast, and broadcast traffic on Layer 2 and Layer 3 physical interfaces. Dell EMC Networking Operating System (OS) Behavior: Dell EMC Networking OS supports unknown-unicast, muticast, and broadcast control for Layer 2 and Layer 3 traffic. To view the storm control broadcast configuration show storm-control broadcast | multicast | unknownunicast | pfc-llfc[interface] command.
PAGE 855
● Configure the packets per second of multicast traffic allowed on C-Series or S-Series interface (ingress only) network only. INTERFACE mode storm-control multicast packets_per_second in ● Shut down the port if it receives the PFC/LLFC packets more than the configured rate. INTERFACE mode storm-control pfc-llfc pps in shutdown NOTE: PFC/LLFC storm control enabled interface disables the interfaces if it receives continuous PFC/LLFC packets.
PAGE 856
Detect PFC Storm The following section explains the procedure to detect the PFC storm. You can detect the PFC storm by polling the lossless queues in a port or priority periodically. When the queue depth is not equal to zero or when the queue has traffic after subsequent number of polling, then the port or priority is detected to have the PFC storm. ● Use the polling—interval {interval in milli-seconds} command to set the polling interval. The queue traffic and egress counters are polled.
PAGE 857
Tf 1/1 Tf 1/2 Tf 1/3 Tf 1/4 Tf 1/5 Tf 1/6 Tf 1/7 3 4 5 6 3 4 5 6 3 4 5 6 3 4 5 6 3 4 5 6 3 4 5 6 3 4 5 6 2 2 2 2 0 0 0 0 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 DellEMC# Storm Control 857
PAGE 858
51 Spanning Tree Protocol (STP) The spanning tree protocol (STP) is supported on Dell EMC Networking OS.
PAGE 859
● ● ● ● ● ● ● Modifying Global Parameters Modifying Interface STP Parameters Enabling PortFast Prevent Network Disruptions with BPDU Guard STP Root Guard Enabling SNMP Traps for Root Elections and Topology Changes Important Points to Remember ● STP is disabled by default. ● The Dell EMC Networking OS supports only one spanning tree instance (0). For multiple instances, enable the multiple spanning tree protocol (MSTP) or per-VLAN spanning tree plus (PVST+).
PAGE 860
Configuring Interfaces for Layer 2 Mode All interfaces on all switches that participate in spanning tree must be in Layer 2 mode and enabled. Figure 121. Example of Configuring Interfaces for Layer 2 Mode To configure and enable the interfaces for Layer 2, use the following command. 1. If the interface has been assigned an IP address, remove it. INTERFACE mode no ip address 2. Place the interface in Layer 2 mode. INTERFACE switchport 3. Enable the interface.
PAGE 861
no shutdown DellEMC(conf-if-tf-1/1)# Enabling Spanning Tree Protocol Globally Enable the spanning tree protocol globally; it is not enabled by default. When you enable STP, all physical, VLAN, and port-channel interfaces that are enabled and in Layer 2 mode are automatically part of the Spanning Tree topology. ● Only one path from any bridge to any other bridge participating in STP is enabled. ● Bridges block a redundant path by disabling one of the link ports. Figure 122.
PAGE 862
To view the spanning tree configuration and the interfaces that are participating in STP, use the show spanning-tree 0 command from EXEC privilege mode. If a physical interface is part of a port channel, only the port channel is listed in the command output. R2#show spanning-tree 0 Executing IEEE compatible Spanning Tree Protocol Bridge Identifier has priority 32768, address 0001.e826.ddb7 Configured hello time 2, max age 20, forward delay 15 Current root has priority 32768, address 0001.e80d.
PAGE 863
Modifying Global Parameters You can modify the spanning tree parameters. The root bridge sets the values for forward-delay, hello-time, and max-age and overwrites the values set on other bridges participating in STP. NOTE: Dell EMC Networking recommends that only experienced network administrators change the spanning tree parameters. Poorly planned modification of the spanning tree parameters can negatively affect network performance. The following table displays the default values for STP. Table 128.
PAGE 864
To view the current values for global parameters, use the show spanning-tree 0 command from EXEC privilege mode. Refer to the second example in Enabling Spanning Tree Protocol Globally. Modifying Interface STP Parameters You can set the port cost and port priority values of interfaces in Layer 2 mode. ● Port cost — a value that is based on the interface type. The greater the port cost, the less likely the port is selected to be a forwarding port.
PAGE 865
Prevent Network Disruptions with BPDU Guard Configure the Portfast (and Edgeport, in the case of RSTP, PVST+, and MSTP) feature on ports that connect to end stations. End stations do not generate BPDUs, so ports configured with Portfast/ Edgport (edgeports) do not expect to receive BDPUs. If an edgeport does receive a BPDU, it likely means that it is connected to another part of the network, which can negatively affect the STP topology.
PAGE 866
Figure 123. Enabling BPDU Guard Dell EMC Networking OS Behavior BPDU guard: ● is used on edgeports and blocks all traffic on edgeport if it receives a BPDU. ● drops the BPDU after it reaches the RP and generates a console message. Example of Blocked BPDUs DellEMC(conf-if-tf-1/7)#do show spanning-tree rstp brief Executing IEEE compatible Spanning Tree Protocol Root ID Priority 32768, Address 0001.e805.fb07 Root Bridge hello time 2, max age 20, forward delay 15 Bridge ID Priority 32768, Address 0001.e85d.
PAGE 867
Selecting STP Root The STP determines the root bridge, but you can assign one bridge a lower priority to increase the likelihood that it becomes the root bridge. You can also specify that a bridge is the root or the secondary root. To change the bridge priority or specify that a bridge is the root or secondary root, use the following command. ● Assign a number as the bridge priority or designate it as the root or secondary root.
PAGE 868
Figure 124. STP Root Guard Prevents Bridging Loops Configuring Root Guard Enable STP root guard on a per-port or per-port-channel basis. Dell EMC Networking OS Behavior: The following conditions apply to a port enabled with STP root guard: ● Root guard is supported on any STP-enabled port or port-channel interface except when used as a stacking port.
PAGE 869
To disable STP root guard on a port or port-channel interface, use the no spanning-tree 0 rootguard command in an interface configuration mode. To verify the STP root guard configuration on a port or port-channel interface, use the show spanning-tree 0 guard [interface interface] command in a global configuration mode. Enabling SNMP Traps for Root Elections and Topology Changes To enable SNMP traps individually or collectively, use the following commands.
PAGE 870
As soon as a BPDU is received on an STP port in a Loop-Inconsistent state, the port returns to a blocking state. If you disable STP loop guard on a port in a Loop-Inconsistent state, the port transitions to an STP blocking state and restarts the max-age timer. Figure 125. STP Loop Guard Prevents Forwarding Loops Configuring Loop Guard Enable STP loop guard on a per-port or per-port channel basis.
PAGE 871
○ If a BPDU is received from a remote device, BPDU guard places the port in an Err-Disabled Blocking state and no traffic is forwarded on the port. ○ If no BPDU is received from a remote device, loop guard places the port in a Loop-Inconsistent Blocking state and no traffic is forwarded on the port. ● When used in a PVST+ network, STP loop guard is performed per-port or per-port channel at a VLAN level.
PAGE 872
52 SupportAssist SupportAssist sends troubleshooting data securely to Dell. SupportAssist in this Dell EMC Networking OS release does not support automated email notification at the time of hardware fault alert, automatic case creation, automatic part dispatch, or reports. SupportAssist requires Dell EMC Networking OS 9.9(0.0) and SmartScripts 9.7 or later to be installed on the Dell EMC Networking device. For more information on SmartScripts, see Dell EMC Networking Open Automation guide. Figure 126.
PAGE 873
Enable the SupportAssist service. CONFIGURATION mode support-assist activate DellEMC(conf)#support-assist activate This command guides you through steps to configure SupportAssist. Configuring SupportAssist Manually To manually configure SupportAssist service, use the following commands. 1. Accept the end-user license agreement (EULA). CONFIGURATION mode eula-consent {support-assist} {accept | reject} NOTE: Once accepted, you do not have to accept the EULA again.
PAGE 874
CONFIGURATION mode support-assist DellEMC(conf)#support-assist DellEMC(conf-supportassist)# 3. (Optional) Configure the contact information for the company. SUPPORTASSIST mode contact-company name {company-name}[company-next-name] ... [company-next-name] DellEMC(conf)#support-assist DellEMC(conf-supportassist)#contact-company name test DellEMC(conf-supportassist-cmpy-test)# 4. (Optional) Configure the contact name for an individual.
PAGE 875
[no] activity {full-transfer|core-transfer|event-transfer} DellEMC(conf-supportassist)#activity full-transfer DellEMC(conf-supportassist-act-full-transfer)# DellEMC(conf-supportassist)#activity core-transfer DellEMC(conf-supportassist-act-core-transfer)# DellEMC(conf-supportassist)#activity event-transfer DellEMC(conf-supportassist-act-event-transfer)# 2. Copy an action-manifest file for an activity to the system.
PAGE 876
SUPPORTASSIST ACTIVITY mode [no] enable DellEMC(conf-supportassist-act-full-transfer)#enable DellEMC(conf-supportassist-act-full-transfer)# DellEMC(conf-supportassist-act-core-transfer)#enable DellEMC(conf-supportassist-act-core-transfer)# DellEMC(conf-supportassist-act-event-transfer)#enable DellEMC(conf-supportassist-act-event-transfer)# Configuring SupportAssist Company SupportAssist Company mode allows you to configure name, address and territory information of the company.
PAGE 877
[no] contact-person [first ] last DellEMC(conf-supportassist)#contact-person first john last doe DellEMC(conf-supportassist-pers-john_doe)# 2. Configure the email addresses to reach the contact person. SUPPORTASSIST PERSON mode [no] email-address primary email-address [alternate email-address] DellEMC(conf-supportassist-pers-john_doe)#email-address primary jdoe@mycompany.com DellEMC(conf-supportassist-pers-john_doe)# 3. Configure phone numbers of the contact person.
PAGE 878
[no] enable DellEMC(conf-supportassist-serv-default)#enable DellEMC(conf-supportassist-serv-default)# 4. Configure the URL to reach the SupportAssist remote server. SUPPORTASSIST SERVER mode [no] url uniform-resource-locator DellEMC(conf-supportassist-serv-default)#url https://192.168.1.1/index.htm DellEMC(conf-supportassist-serv-default)# Viewing SupportAssist Configuration To view the SupportAssist configurations, use the following commands: 1.
PAGE 879
! server Dell enable url http://1.1.1.1:1337 DellEMC# 3. Display the EULA for the feature. EXEC Privilege mode show eula-consent {support-assist | other feature} DellEMC#show eula-consent support-assist SupportAssist EULA has been: Accepted Additional information about the SupportAssist EULA is as follows: By installing SupportAssist, you allow Dell to save your contact information (e.g.
PAGE 880
53 System Time and Date System time and date settings and the network time protocol (NTP) are supported on Dell EMC Networking OS. You can set system times and dates and maintained through the NTP. They are also set through the Dell EMC Networking Operating System (OS) command line interfaces (CLIs) and hardware settings. The Dell EMC Networking OS supports reaching an NTP server through different VRFs. You can configure a maximum of eight logging servers across different VRFs or the same VRF.
PAGE 881
Protocol Overview The NTP messages to one or more servers and processes the replies as received. The server interchanges addresses and ports, fills in or overwrites certain fields in the message, recalculates the checksum, and returns it immediately. Information included in the NTP message allows each client/server peer to determine the timekeeping characteristics of its other peers, including the expected accuracies of their clocks.
PAGE 882
To display the system clock state with respect to NTP, use the show ntp status command from EXEC Privilege mode. DellEMC#show ntp status Clock is synchronized, stratum 4, reference is 10.16.151.117, vrf-id is 0 frequency is -44.862 ppm, stability is 0.050 ppm, precision is -18 reference time deeef7ef.85eeaa10 Tue, Jul 10 2018 9:16:31.523 UTC clock offset is -0.167449 msec, root delay is 149.194 msec root dispersion is 54.557 msec, peer dispersion is 0.
PAGE 883
○ ○ ○ ○ ○ ○ ○ ○ ○ For For For For For For For For For a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port/subport information. a 25-Gigabit Ethernet interface, enter the keyword twentyFiveGigE then the slot/port/subport information. a 40-Gigabit Ethernet interface, enter the keyword fortyGigE then the slot/port/subport information. a 50-Gigabit Ethernet interface, enter the keyword fiftyGigE then the slot/port/subport information.
PAGE 884
○ ○ ○ ○ ○ key keyid : Configure a text string as the key exchanged between the NTP server and the client. prefer: Enter the keyword prefer to set this NTP server as the preferred server. version number : Enter a number as the NTP version. The range is from 1 to 4. minpoll polling-interval: Enter the minpoll value. The range is from 4 to 16. maxpoll polling-interval: Enter the maxpoll value. The range is from 4 to 16. 5. Configure the switch as NTP master.
PAGE 885
● Reference Timestamp (sys.reftime, peer.reftime, pkt.reftime) — This is the local time, in timestamp format, when the local clock was last updated. If the local clock has never been synchronized, the value is zero. ● Originate Timestamp: The departure time on the server of its last NTP message. If the server becomes unreachable, the value is set to zero. ● Receive Timestamp — the arrival time on the client of the last NTP message from the server. If the server becomes unreachable, the value is set to zero.
PAGE 886
CONFIGURATION mode ntp offset-threshold threshold-value The range for threshold-value is from 0 to 999. DellEMC(conf)#ntp offset-threshold 9 Dell EMC Networking OS Time and Date You can set the time and date using the Dell EMC Networking OS CLI. Configuration Task List The following is a configuration task list for configuring the time and date settings.
PAGE 887
○ timezone-name: enter the name of the timezone. Do not use spaces. ○ offset: enter one of the following: ￭￭ a number from 1 to 23 as the number of hours in addition to UTC for the timezone. a minus sign (-) then a number from 1 to 23 as the number of hours.
PAGE 888
● Set the clock to the appropriate timezone and adjust to daylight saving time every year. CONFIGURATION mode clock summer-time time-zone recurring start-week start-day start-month start-time endweek end-day end-month end-time [offset] ○ time-zone: Enter the three-letter name for the time zone. This name displays in the show clock output.
PAGE 889
54 Tunneling Tunnel interfaces create a logical tunnel for IPv4 or IPv6 traffic. Tunneling supports RFC 2003, RFC 2473, and 4213. DSCP, hop-limits, flow label values, open shortest path first (OSPF) v2, and OSPFv3 are supported. Internet control message protocol (ICMP) error relay, PATH MTU transmission, and fragmented packets are not supported.
PAGE 890
tunnel mode ipv6ip no shutdown The following sample configuration shows a tunnel configured in IPIP mode (IPv4 tunnel carries IPv4 and IPv6 traffic): DellEMC(conf)#interface tunnel 3 DellEMC(conf-if-tu-3)#tunnel source 5::5 DellEMC(conf-if-tu-3)#tunnel destination 8::9 DellEMC(conf-if-tu-3)#tunnel mode ipv6 DellEMC(conf-if-tu-3)#ip address 3.1.1.1/24 DellEMC(conf-if-tu-3)#ipv6 address 3::1/64 DellEMC(conf-if-tu-3)#no shutdown DellEMC(conf-if-tu-3)#show config ! interface Tunnel 3 ip address 3.1.1.
PAGE 891
The following sample configuration shows how to use the interface tunnel configuration commands. DellEMC(conf-if-tf-1/1)#show config ! interface twentyFiveGigE 1/1 ip address 20.1.1.1/24 ipv6 address 20:1::1/64 no shutdown DellEMC(conf)#interface tunnel 1 DellEMC(conf-if-tu-1)#ip unnumbered twentyFiveGigE 1/1 DellEMC(conf-if-tu-1)#ipv6 unnumbered twentyFiveGigE 1/1 DellEMC(conf-if-tu-1)#tunnel source 40.1.1.
PAGE 892
DellEMC(conf-if-tu-1)#no shutdown DellEMC(conf-if-tu-1)#show config ! interface Tunnel 1 ip address 1.1.1.1/24 ipv6 address 1abd::1/64 tunnel source anylocal tunnel allow-remote 40.1.1.2 tunnel mode ipip decapsulate-any no shutdown Guidelines for Configuring Multipoint Receive-Only Tunnels ● You can configure up to eight remote end-points for a multipoint receive-only tunnel.
PAGE 893
55 Uplink Failure Detection (UFD) Uplink failure detection (UFD) provides detection of the loss of upstream connectivity and, if used with network interface controller (NIC) teaming, automatic recovery from a failed link.
PAGE 894
Figure 128. Uplink Failure Detection How Uplink Failure Detection Works UFD creates an association between upstream and downstream interfaces. The association of uplink and downlink interfaces is called an uplink-state group. An interface in an uplink-state group can be a physical interface or a port-channel (LAG) aggregation of physical interfaces. An enabled uplink-state group tracks the state of all assigned upstream interfaces.
PAGE 895
Figure 129. Uplink Failure Detection Example If only one of the upstream interfaces in an uplink-state group goes down, a specified number of downstream ports associated with the upstream interface are put into a Link-Down state. You can configure this number and is calculated by the ratio of the upstream port bandwidth to the downstream port bandwidth in the same uplink-state group.
PAGE 896
● If one of the upstream interfaces in an uplink-state group goes down, either a user-configurable set of downstream ports or all the downstream ports in the group are put in an Operationally Down state with an UFD Disabled error. The order in which downstream ports are disabled is from the lowest numbered port to the highest.
PAGE 897
To revert to the default setting, use the no downstream disable links command. 4. (Optional) Enable auto-recovery so that UFD-disabled downstream ports in the uplink-state group come up when a disabled upstream port in the group comes back up. UPLINK-STATE-GROUP mode downstream auto-recover The default is auto-recovery of UFD-disabled downstream ports is enabled. To disable auto-recovery, use the no downstream auto-recover command. 5. (Optional) Enter a text description of the uplink-state group.
PAGE 898
02:36:43: %RPM0-P:CP %IFMGR-5-OSTATE_DN: Changed interface state to down: Hu 1/54 02:37:29: %RPM0-P:CP %IFMGR-5-ASTATE_DN: Changed interface Admin state to down: Tf 1/7 02:37:29: %RPM0-P:CP %IFMGR-5-OSTATE_DN: Changed interface state to down: Tf 1/7 02:37:29 : UFD: Group:3, UplinkState: DOWN 02:37:29: %RPM0-P:CP %IFMGR-5-OSTATE_DN: Changed uplink state group state to down: Group 3 02:37:29: %RPM0-P:CP %IFMGR-5-OSTATE_DN: Downstream interface set to UFD error-disabled: Tf 1/9 02:37:29: %RPM0-P:CP %IFMGR-5-OS
PAGE 899
The following example shows viewing the interface status with UFD information.
PAGE 900
Example of Configuring UFD DellEMC(conf)# uplink-state-group 3 00:08:11: %STKUNIT0-M:CP %IFMGR-5-ASTATE_UP: Changed uplink state group Admin state to up: Group 3 DellEMC(conf-uplink-state-group-3)# downstream twentyFiveGigE 1/1-2,5,9,11-12 DellEMC(conf-uplink-state-group-3)# downstream disable links 2 DellEMC(conf-uplink-state-group-3)# upstream twentyFiveGigE 1/3-4 00:10:00: %STKUNIT0-M:CP %IFMGR-5-OSTATE_DN: Downstream interface set to UFD errordisabled: Tf 1/1 DellEMC# 00:10:00: %STKUNIT0-M:CP %IFMGR-5-O
PAGE 901
56 Upgrade Procedures To find the upgrade procedures, go to the Dell EMC Networking OS Release Notes for your system type to see all the requirements needed to upgrade to the desired Dell EMC Networking OS version. To upgrade your system type, follow the procedures in the Dell EMC Networking OS Release Notes. You can download the release notes of your platform at https://www.force10networks.com. Use your login ID to log in to the website.
PAGE 902
57 Virtual LANs (VLANs) Virtual LANs (VLANs) are a logical broadcast domain or logical grouping of interfaces in a local area network (LAN) in which all data received is kept locally and broadcast to all members of the group. When in Layer 2 mode, VLANs move traffic at wire speed and can span multiple devices. The system supports up to 4093 portbased VLANs and one default VLAN, as specified in IEEE 802.1Q.
PAGE 903
NOTE: You cannot assign an IP address to the Default VLAN. To assign an IP address to a VLAN that is currently the Default VLAN, create another VLAN and assign it to be the Default VLAN. For more information about assigning IP addresses, refer to Assigning an IP Address to a VLAN. ● Untagged interfaces must be part of a VLAN. To remove an untagged interface from the Default VLAN, create another VLAN and place the interface into that VLAN.
PAGE 904
● The VLAN protocol identifier identifies the frame as tagged according to the IEEE 802.1Q specifications (2 bytes). ● Tag control information (TCI) includes the VLAN ID (2 bytes total). The VLAN ID can have 4,096 values, but two are reserved. NOTE: The insertion of the tag header into the Ethernet frame increases the size of the frame to more than the 1,518 bytes as specified in the IEEE 802.3 standard. Some devices that are not compliant with IEEE 802.3 may not support the larger frame size.
PAGE 905
Assigning Interfaces to a VLAN You can only assign interfaces in Layer 2 mode to a VLAN using the tagged and untagged commands. To place an interface in Layer 2 mode, use the switchport command. You can further designate these Layer 2 interfaces as tagged or untagged. For more information, see the Interfaces chapter and Configuring Layer 2 (Data Link) Mode.
PAGE 906
When you remove a tagged interface from a VLAN (using the no tagged interface command), it remains tagged only if it is a tagged interface in another VLAN. If the tagged interface is removed from the only VLAN to which it belongs, the interface is placed in the Default VLAN as an untagged interface. Moving Untagged Interfaces To move untagged interfaces from the Default VLAN to another VLAN, use the following commands. 1. Access INTERFACE VLAN mode of the VLAN to which you want to assign the interface.
PAGE 907
Assigning an IP Address to a VLAN VLANs are a Layer 2 feature. For two physical interfaces on different VLANs to communicate, you must assign an IP address to the VLANs to route traffic between the two interfaces. The shutdown command in INTERFACE mode does not affect Layer 2 traffic on the interface; the shutdown command only prevents Layer 3 traffic from traversing over the interface. NOTE: You cannot assign an IP address to the Default VLAN (VLAN 1).
PAGE 908
Enabling Null VLAN as the Default VLAN In a Carrier Ethernet for Metro Service environment, service providers who perform frequent reconfigurations for customers with changing requirements occasionally enable multiple interfaces, each connected to a different customer, before the interfaces are fully configured. This presents a vulnerability because both interfaces are initially placed in the native VLAN, VLAN 1, and for that period customers are able to access each other's networks.
PAGE 909
58 Virtual Link Trunking (VLT) Virtual link trunking (VLT) is a Dell EMC technology that provides two Dell EMC switches the ability to function as a single switch. VLT allows physical links between two Dell EMC switches to appear as a single virtual link to the network core or other switches such as Edge, Access, or top-of-rack (ToR). As a result, the two physical switches appear as a single switch to the connected devices.
PAGE 910
peers as a single switch, VLT eliminates STP-blocked ports. However, the two VLT devices are independent Layer2/Layer3 (L2/L3) switches for devices in the upstream network. Figure 132. VLT providing multipath VLT reduces the role of spanning tree protocols (STPs) by allowing link aggregation group (LAG) terminations on two separate distribution or core switches and supporting a loop-free topology. To prevent the initial loop that may occur prior to VLT being established, use a spanning tree protocol.
PAGE 911
Figure 133. Example of VLT Deployment VLT offers the following benefits: ● ● ● ● ● ● ● ● ● ● ● ● Allows a single device to use a LAG across two upstream devices. Eliminates STP-blocked ports. Provides a loop-free topology. Uses all available uplink bandwidth. Provides fast convergence if either the link or a device fails. Optimized forwarding with virtual router redundancy protocol (VRRP). Provides link-level resiliency. Assures high availability. Active-Active load sharing with VRRP.
PAGE 912
● VLT backup link — The backup link monitors the connectivity between the VLT peer switches. The backup link sends configurable, periodic keep alive messages between the VLT peer switches. ● VLT interconnect (VLTi) — The link used to synchronize states between the VLT peer switches. Both ends must be on 10G, 25G, 40G, 50G, or 100G interfaces. ● VLT domain — This domain includes both the VLT peer devices, VLT interconnect, and all of the port channels in the VLT connected to the attached devices.
PAGE 913
Viewing the MAC Synchronization Between VLT Peers You can use the following commands to verify the MAC synchronization between VLT peers: VLT-10-PEER-1#show mac-address-table count MAC Entries for all vlans : Dynamic Address Count : 1007 Static Address (User-defined) Count : 1 Sticky Address Count : 0 Total Synced Mac from Peer(N): 503 Total MAC Addresses in Use: 1008 VLT-10-PEER-1#show vlt counter mac Total MAC VLT counters ---------------------L2 Total MAC-Address Count: 1007 VLT-10-PEER-1#show mac-addr
PAGE 914
that all the uplinks from servers to access and access to aggregation are in Active-Active Load Sharing mode. This example provides the highest form of resiliency, scaling, and load balancing in data center switching networks. The following example shows stacking at the access, VLT in aggregation, and Layer 3 at the core. Figure 135. VLT on Core Switches The aggregation layer is mostly in the L2/L3 switching/routing layer.
PAGE 915
Figure 136. Enhanced VLT Configure Virtual Link Trunking VLT requires that you enable the feature and then configure the same VLT domain, backup link, and VLT interconnect on both peer switches. Important Points to Remember WARNING: Do not add any VLANs to the VLT Interconnect. The VLTi interface manages VLAN tagged/untagged traffic automatically between peers. Manually adding any VLAN configuration has been shown to disrupt traffic flow.
PAGE 916
● ● ● ● ● ● ● ● ● ● ● ● channels to or from a VLAN. You can manually add or remove a VLTi port-channel to a VLAN. In case a VLTi port-channel is manually removed from a VLAN, it is added back to the VLAN after reload of the VLTi peers. Use the lacp ungroup member-independent command only if the system connects to nodes using bare metal provisioning (BMP) to upgrade or boot from the network.
PAGE 917
Configuration Notes When you configure VLT, the following conditions apply. ● With VLT, when an L3 interface is created, the local DA of that interface is added as an L2 entry pointing to the ICL interface on the peer chassis. This ensures that the L3 packets reaching the peer, by LAG hashing on ToR, get forwarded to the actual chassis via ICL and then get routed. When this interface is removed, the entry pointing to ICL on the peer chassis is deleted.
PAGE 918
NOTE: If you configure the VLT system MAC address or VLT unit-id on only one of the VLT peer switches, the link between the VLT peer switches is not established. Each VLT peer switch must be correctly configured to establish the link between the peers. ○ If the link between the VLT peer switches is established, changing the VLT system MAC address or the VLT unit-id causes the link between the VLT peer switches to become disabled.
PAGE 919
○ ○ ○ ○ ○ ○ ○ ￭ Ingress and egress QoS policies applied on VLT ports must be the same on both VLT peers. ￭ Apply the same ingress and egress QoS policies on VLTi (ICL) member ports to handle failed links. For detailed information about how to use VRRP in a VLT domain, see the following VLT and VRRP interoperability section. For information about configuring IGMP Snooping in a VLT domain, see VLT and IGMP Snooping.
PAGE 920
can configure another peer as the Primary Peer using the VLT domain domain-id role priority priority-value command. If the VLTi link fails, the status of the remote VLT Primary Peer is checked using the backup link. If the remote VLT Primary Peer is available, the Secondary Peer disables all VLT ports to prevent loops. If all ports in the VLTi link fail or if the communication between VLTi links fails, VLT checks the backup link to determine the cause of the failure.
PAGE 921
VLT and IGMP Snooping When configuring IGMP Snooping with VLT, ensure the configurations on both sides of the VLT trunk are identical to get the same behavior on both sides of the trunk. When you configure IGMP snooping on a VLT node, the dynamically learned groups and multicast router ports are automatically learned on the VLT peer node. VLT IPv6 The following features have been enhanced to support IPv6: ● VLT Sync — Entries learned on the VLT interface are synced on both VLT peers.
PAGE 922
Figure 137. PIM-Sparse Mode Support on VLT On each VLAN where the VLT peer nodes act as the first hop or last hop routers, one of the VLT peer nodes is elected as the PIM designated router. If you configured IGMP snooping along with PIM on the VLT VLANs, you must configure VLTi as the static multicast router port on both VLT peer switches. This ensures that for first hop routers, the packets from the source are redirected to the designated router (DR) if they are incorrectly hashed.
PAGE 923
If the VLT node elected as the designated router fails and you enable VLT Multicast Routing, multicast routes are synced to the other peer for traffic forwarding to ensure minimal traffic loss. If you did not enable VLT Multicast Routing, traffic loss occurs until the other VLT peer is selected as the DR. VLT Routing VLT Routing refers to the ability to run a dynamic routing protocol within a single VLT domain or between VLT domains (mVLT).
PAGE 924
If you enable peer routing, a VLT node acts as a proxy gateway for its connected VLT peer as shown in the image below. Even though the gateway address of the packet is different, Peer-1 routes the packet to its destination on behalf of Peer-2 to avoid sub-optimal routing. Figure 139. Packets with peer routing enabled Benefits of Peer Routing ● ● Avoids sub-optimal routing ● Reduces latency by avoiding another hop in the traffic path.
PAGE 925
Configuring VLT Unicast To enable and configure VLT unicast, follow these steps. 1. Enable VLT on a switch, then configure a VLT domain and enter VLT-domain configuration mode. CONFIGURATION mode vlt domain domain-id 2. Enable peer-routing. VLT DOMAIN mode peer-routing 3. Configure the peer-routing timeout. VLT DOMAIN mode peer-routing—timeout value value: Specify a value (in seconds) from 1 to 65535. The default value is infinity (without configuring the timeout).
PAGE 926
3. Configure the multicast peer-routing timeout. VLT DOMAIN mode multicast peer-routing—timeout value value: Specify a value (in seconds) from 1 to 1200. NOTE: Reduce the multicast peer-routing-timeout value to 10 seconds to clear the (S,G) entry in mroute in primary VLT peer. Also, the MLD leave packet must be sent after the unicast route convergence. 4. Configure a PIM-SM compatible VLT node as a designated router (DR). For more information, refer to Configuring a Designated Router. 5.
PAGE 927
Sample RSTP configuration The following is a sample of an RSTP configuration: Using the example shown in the Overview section as a sample VLT topology, the primary VLT switch sends BPDUs to an access device (switch or server) with its own RSTP bridge ID. BPDUs generated by an RSTP-enabled access device are only processed by the primary VLT switch. The secondary VLT switch tunnels the BPDUs that it receives to the primary VLT switch over the VLT interconnect.
PAGE 928
Configuring a VLT Interconnect To configure a VLT interconnect, follow these steps. 1. Configure the port channel for the VLT interconnect on a VLT switch and enter interface configuration mode. CONFIGURATION mode interface port-channel id-number Enter the same port-channel number configured with the peer-link port-channel command as described in Enabling VLT and Creating a VLT Domain. NOTE: To be included in the VLTi, the port channel must be in Default mode (no switchport or VLAN assigned). 2.
PAGE 929
3. Configure the port channel to be used as the VLT interconnect between VLT peers in the domain. VLT DOMAIN CONFIGURATION mode peer-link port-channel id-number 4. Enable peer routing. VLT DOMAIN CONFIGURATION mode peer-routing If you enable peer routing, a VLT node acts as the proxy gateway for its peer. 5.
PAGE 930
vlt domain domain-id The range of domain IDs from 1 to 1000. 2. Enter an amount of time, in seconds, to delay the restoration of the VLT ports after the system is rebooted. CONFIGURATION mode delay-restore delay-restore-time The range is from 1 to 1200. The default is 90 seconds. Reconfiguring the Default VLT Settings (Optional) To reconfigure the default VLT settings, use the following commands. 1. Enter VLT-domain configuration mode for a specified VLT domain.
PAGE 931
no ip address 3. Place the interface in Layer 2 mode. INTERFACE PORT-CHANNEL mode switchport 4. Add one or more port interfaces to the port channel. INTERFACE PORT-CHANNEL mode channel-member interface interface: specify one of the following interface types: ● ● ● ● ● For For For For For a a a a a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port/subport information.
PAGE 932
Enter the same port-channel number configured with the peer-link port-channel command in the . 2. Add one or more port interfaces to the port channel. INTERFACE PORT-CHANNEL mode channel-member interface interface: specify one of the following interface types: ● ● ● ● ● For For For For For a a a a a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port/subport information.
PAGE 933
11. Ensure that the port channel is active. INTERFACE PORT-CHANNEL mode no shutdown 12. Add links to the eVLT port. Configure a range of interfaces to bulk configure. CONFIGURATION mode interface range {port-channel id} 13. Enable LACP on the LAN port. INTERFACE mode port-channel-protocol lacp 14. Configure the LACP port channel mode. INTERFACE mode port-channel number mode [active] 15. Ensure that the interface is active. MANAGEMENT INTERFACE mode no shutdown 16. Enable peer routing.
PAGE 934
EXEC Privilege mode show running-config entity 10. Configure the VLT peer link port channel id in VLT peer 1 and VLT peer 2. EXEC mode or EXEC Privilege mode show interfaces interface 11. In the top of rack unit, configure LACP in the physical ports. EXEC Privilege mode show running-config entity 12. Verify that VLT is running. EXEC mode show vlt brief or show vlt detail 13. Verify that the VLT LAG is running in both VLT peer units.
PAGE 935
switchport vlt-peer-lag port-channel 2 no shutdown Dell-2#show interfaces port-channel 2 brief Codes: L - LACP Port-channel L LAG 2 Mode L2L3 Status up Uptime 03:33:14 Ports Tf 1/4 (Up) In the ToR unit, configure LACP on the physical ports.
PAGE 936
Verify that the VLT LAG is up in VLT peer unit. Dell-2#show interfaces port-channel 2 brief Codes: L - LACP Port-channel LAG L 2 Mode L2L3 Status up Uptime 03:43:24 Ports Tf 1/4 (Up) Dell-4#show interfaces port-channel 2 brief Codes: L - LACP Port-channel LAG L 2 Mode L2L3 Status up Uptime 03:33:31 Ports Tf 1/18 (Up) PVST+ Configuration PVST+ is supported in a VLT domain. Before you configure VLT on peer switches, configure PVST+ in the network.
PAGE 937
Interface Name ---------Po 1 Po 2 Tf 1/10 Tf 1/10 DellEMC# Role -----Desg Desg Desg Desg PortID -------128.2 128.3 128.230 128.233 Prio ---128 128 128 128 Cost ------188 2000 2000 2000 Sts ----------FWD FWD FWD FWD Cost Link-type Edge ------- --------- ---0 (vltI)P2P No 0 (vlt) P2P No 0 P2P Yes 0 P2P No Peer Routing Configuration Example This section provides a detailed explanation of how to configure peer routing in a VLT domain.
PAGE 938
Dell-1 Switch Configuration In the following output, RSTP is enabled with a bridge priority of 0. This ensures that Dell-1 becomes the root bridge. DellEMC#1#show run | find protocol protocol spanning-tree pvst no disable vlan 1,20,800,900 bridge-priority 0 The following output shows the existing VLANs.
PAGE 939
description To_CR1_fa0/13 no ip address port-channel-protocol LACP port-channel 1 mode active no shutdown Port channel 1 connects the uplink switch R1. DellEMC#1#sh run int po1 interface Port-channel 1 description port-channel_to_R1 no ip address switchport vlt-peer-lag port-channel 1 no shutdown Port channel 2 connects the access switch A1.
PAGE 940
Version: Local System MAC address: Remote System MAC address: Configured System MAC address: Remote system version: Delay-Restore timer: Peer routing : Peer routing-Timeout timer: Multicast peer routing timeout: 6(3) 90:b1:1c:f4:2c:bb 90:b1:1c:f4:29:f1 90:b1:1c:f4:01:01 6(3) 90 seconds Enabled 0 seconds 150 seconds Verify that the heartbeat mechanism is operational DellEMC#1#sh vlt backup-link VLT Backup Link ----------------Destination: Peer HeartBeat status: Destination VRF: HeartBeat Timer Interval: He
PAGE 941
The following output displays the MAC address of all interfaces in the system. All interfaces, physical and virtual, have the same MAC address. This is the address used for peer routing.
PAGE 942
interface TwentyfiveGigE 1/2 description VLTi LINK no ip address no shutdown The following example shows that te 0/0 and te 0/1 are included in port channel 10. Also note that configuration on the VLTi links does not contain the switchport command. Dell-2#sh run int po10 interface Port-channel 10 description VLTi Port-Channel no ip address channel-member TwentyfiveGigE 1/1-1/2 no shutdown Te 1/4 connects to the access switch A1.
PAGE 943
tagged Port-channel 2 no shutdown The following output shows Dell-2 is configured with VLT domain 1. The peer-link port-channel command makes port channel 10 as the VLTi link. The peer-routing command enables peer routing between VLT peers in VLT domain 1. The IP address configured with the backup-destination command is the management IP address of the VLT peer (Dell-1). A priority value of 55000 makes Dell-2 as the secondary VLT peer.
PAGE 944
network 172.16.1.0/24 area 0 network 192.168.20.0/29 area 0 passive-interface default no passive-interface vlan 20 While the passive-interface default command prevents all interfaces from establishing an OSPF neighborship, the no passiveinterface vlan 20 command allows the interface for VLAN 20, the OSPF peering VLAN, to establish OSPF adjacencies. The following output displays that Dell-1 forms neighborship with Dell-2 and R1. Dell-2#show ip ospf neighbor Neighbor ID Pri State Interface Area 172.17.1.
PAGE 945
interface Loopback4 ip address 4.4.4.2 255.255.255.0 R1#show run int port-channel 1 interface Port-channel1 switchport ip address 192.168.20.3 255.255.255.248 R1#show run | find router router ospf 1 router-id 172.15.1.1 passive-interface default no passive-interface Port-channel1 network 2.2.2.0 0.0.0.255 area 0 network 3.3.3.0 0.0.0.255 area 0 network 4.4.4.0 0.0.0.255 area 0 (The above subnets correspond to loopback interfaces lo2, lo3 and lo4.
PAGE 946
It’s in place to ensure that routed test traffic has DellEMC#2’s MAC address as the destination address in the Ethernet frame’s header When A1 sends a packet to R1, the VLT peers act as the default gateway for each other. If the packet reaches Dell-1, irrespective of the default gateway used, Dell-1 routes the packet to R1. Similarly, if the packet reaches Dell-2, irrespective of the default gateway used, Dell-2 routes the packet to R1.
PAGE 947
Domain_1_Peer1(conf-if-range-tf-1/16-1/17)# port-channel 100 mode active Domain_1_Peer1(conf-if-range-tf-1/16-1/17)# no shutdown Next, configure the VLT domain and VLTi on Peer 2.
PAGE 948
Domain_2_Peer4(conf-vlt-domain)# peer-routing Domain_2_Peer4(conf-vlt-domain)# unit-id 1 Configure eVLT on Peer 4. Domain_2_Peer4(conf)#interface port-channel 100 Domain_2_Peer4(conf-if-po-100)# switchport Domain_2_Peer4(conf-if-po-100)# vlt-peer-lag port-channel 100 Domain_2_Peer4(conf-if-po-100)# no shutdown Add links to the eVLT port-channel on Peer 4.
PAGE 949
Verifying a VLT Configuration To monitor the operation or verify the configuration of a VLT domain, use any of the following show commands on the primary and secondary VLT switches. ● Display information on backup link operation. EXEC mode show vlt backup-link ● Display general status information about VLT domains currently configured on the switch.
PAGE 950
VLT Backup Link ----------------Destination: Peer HeartBeat status: HeartBeat Timer Interval: HeartBeat Timeout: UDP Port: HeartBeat Messages Sent: HeartBeat Messages Received: 10.11.200.20 Up 1 3 34998 1030 1014 The following example shows the show vlt brief command.
PAGE 951
The following example shows the show running-config vlt command. Dell_VLTpeer1# show running-config vlt ! vlt domain 30 peer-link port-channel 60 back-up destination 10.11.200.18 Dell_VLTpeer2# show running-config vlt ! vlt domain 30 peer-link port-channel 60 back-up destination 10.11.200.20 The following example shows the show vlt statistics command.
PAGE 952
Po Po Po Po Po Po 3 4 100 110 111 120 128.4 128.5 128.101 128.111 128.112 128.121 128 128 128 128 128 128 200000 200000 800 00 200000 2000 DIS 0 DIS 0 FWD(VLTi)0 FWD(vlt) 0 DIS(vlt) 0 FWD(vlt) 0 0 0 0 0 0 0 0001.e88a.dff8 0001.e88a.dff8 0001.e88a.dff8 0001.e88a.dff8 0001.e88a.dff8 0001.e88a.dff8 128.4 128.5 128.101 128.111 128.112 128.
PAGE 953
Dell_VLTpeer2(conf-vlt-domain)#back-up destination 10.11.206.23 Dell_VLTpeer2(conf-vlt-domain)#exit Configure the backup link. Dell_VLTpeer2(conf)#interface ManagementEthernet 1/1 Dell_VLTpeer2(conf-if-ma-1/1)#ip address 10.11.206.35/ Dell_VLTpeer2(conf-if-ma-1/1)#no shutdown Dell_VLTpeer2(conf-if-ma-1/1)#exit Configure the VLT interconnect (VLTi).
PAGE 954
Table 129. Troubleshooting VLT (continued) Description Behavior at Peer Up Behavior During Run Time Action to Take The VLT peer does not boot up. The VLTi is forced to a down state. Verify the domain ID matches on both VLT peers. threshold and when it drops below 80%. Domain ID mismatch The VLT peer does not boot up. The VLTi is forced to a down state. A syslog error message and an A syslog error message and an SNMP trap are generated. SNMP trap are generated.
PAGE 955
Reconfiguring Stacked Switches as VLT To convert switches that have been stacked to VLT peers, use the following procedure. 1. Remove the current configuration from the switches. You will need to split the configuration up for each switch. 2. Copy the files to the flash memory of the appropriate switch. 3. Copy the files on the flash drive to the startup-config. 4. Reset the stacking ports to user ports for both switches. 5. Reload the stack and confirm the new configurations have been applied. 6.
PAGE 956
Association of VLTi as a Member of a PVLAN If a VLAN is configured as a non-VLT VLAN on both the peers, the VLTi link is made a member of that VLAN if the VLTi link is configured as a PVLAN or normal VLAN on both the peers. If a PVLAN is configured as a VLT VLAN on one peer and a non-VLT VLAN on another peer, the VLTi is added as a member of that VLAN by verifying the PVLAN parity on both the peers.
PAGE 957
● Layer 3 communication between secondary VLANs in a private VLAN is enabled by using the ip local-proxy-arp command in INTERFACE VLAN configuration mode. ● The ARP request is not received on the ICL Under such conditions, the IP stack performs the following operations: ● The ARP reply is sent with the MAC address of the primary VLAN. ● The ARP request packet originates on the primary VLAN for the intended destination IP address.
PAGE 958
Table 130.
PAGE 959
interface: specify one of the following interface types: ● ● ● ● ● For For For For For a a a a a 10-Gigabit Ethernet interface, enter the keyword TenGigabitEthernet then the slot/port/subport information. 25-Gigabit Ethernet interface, enter the keyword twentyFiveGigE then the slot/port/subport information. 40-Gigabit Ethernet interface, enter the keyword fortyGigE then the slot/port/subport information. 50-Gigabit Ethernet interface, enter the keyword fiftyGigE then the slot/port/subport information.
PAGE 960
private-vlan mode primary 8. Map secondary VLANs to the selected primary VLAN. INTERFACE VLAN mode private-vlan mapping secondary-vlan vlan-list The list of secondary VLANs can be: ● Specified in comma-delimited (VLAN-ID,VLAN-ID) or hyphenated-range format (VLAN-ID-VLAN-ID). ● Specified with this command even before they have been created. ● Amended by specifying the new secondary VLAN to be added to the list.
PAGE 961
VLT nodes start performing Proxy ARP when the ICL link goes down. When the VLT peer comes up, proxy ARP stops for the peer VLT IP addresses. When the peer node is rebooted, the IP address synchronized with the peer is not flushed. Peer down events cause the proxy ARP to commence. When a VLT node detects peer up, it does not perform proxy ARP for the peer IP addresses. IP address synchronization occurs again between the VLT peers. Proxy ARP is enabled only if you enable peer routing on both the VLT peers.
PAGE 962
2. Configure VLAN as VLAN-stack compatible on both the peers. INTERFACE VLAN mode vlan-stack compatible 3. Add the VLT LAG as a member to the VLAN-stack on both the peers. INTERFACE VLAN mode member port-channel port—channel ID 4. Verify the VLAN-stack configurations. EXEC Privilege show running-config Sample configuration of VLAN-stack over VLT (Peer 1) Configure the VLT domain DellEMC(conf)#vlt domain 1 DellEMC(conf-vlt-domain)#peer-link port-channel 1 DellEMC(conf-vlt-domain)#back-up destination 10.16.
PAGE 963
Configure the VLAN as a VLAN-Stack VLAN and add the VLT LAG as Members to the VLAN DellEMC(conf)#interface vlan 50 DellEMC(conf-if-vl-50)#vlan-stack compatible DellEMC(conf-if-vl-50-stack)#member port-channel 10 DellEMC(conf-if-vl-50-stack)#member port-channel 20 DellEMC#show running-config interface vlan 50 ! interface Vlan 50 vlan-stack compatible member Port-channel 10,20 shutdown DellEMC# Verify that the Port Channels used in the VLT Domain are Assigned to the VLAN-Stack VLAN DellEMC#show vlan id 50 Cod
PAGE 964
DellEMC(conf)#interface port-channel 20 DellEMC(conf-if-po-20)#switchport DellEMC(conf-if-po-20)#vlt-peer-lag port-channel 20 DellEMC(conf-if-po-20)#vlan-stack trunk DellEMC(conf-if-po-20)#no shutdown DellEMC#show running-config interface port-channel 20 ! interface Port-channel 20 no ip address switchport vlan-stack trunk vlt-peer-lag port-channel 20 no shutdown DellEMC# Configure the VLAN as a VLAN-Stack VLAN and add the VLT LAG as members to the VLAN DellEMC(conf)#interface vlan 50 DellEMC(conf-if-vl-50)
PAGE 965
● Performing routing on behalf of peer VLT nodes for a configured time period when a peer VLT node goes down. When you configure Layer 3 VLT peer routing using the peer-routing command in VLT DOMAIN mode, it applies for both IPv4 and IPv6 traffic in VLT domains. Layer 3 VLT provides a higher resiliency at the Layer 3 forwarding level. Routed VLT allows you to replace VRRP with routed VLT to route the traffic from the Layer 2 access nodes.
PAGE 966
● NA messages are almost always sent in response to an NS message from a node. In this case, the solicited NA has the destination address field set to the unicast MAC address of the initial NS sender. This solicited NA must be tunneled when they reach the wrong peer. ● Sometimes NA messages are sent by a node when its link-layer address changes.
PAGE 967
Figure 143. Sample Configuration of IPv6 Peer Routing in a VLT Domain Neighbor Solicitation from VLT Hosts Consider a case in which NS for VLT node1 IP reaches VLT node1 on the VLT interface and NS for VLT node1 IP reaches VLT node2 due to LAG level hashing in the ToR. When VLT node1 receives NS from VLT VLAN interface, it unicasts the NA packet on the VLT interface. When NS reaches VLT node2, it is flooded on all interfaces including ICL.
PAGE 968
Traffic Destined to VLT Nodes Hosts can send traffic to one of the VLT nodes using a global IP or Link-Local address. When the host communicates with the VLT node using LLA and traffic reaches the wrong peer due to LAG level hashing in the ToR, the wrong peer routes the packet to correct the VLT node though the destination IP is LLA.
PAGE 969
Configure BFD in VLT Domain Dell EMC Networking OS supports Bidirectional Forwarding Detection (BFD) to detect communication failures on an interface that is a part of a VLT link aggregation group (LAG). In VLT domain, BFD provides high availability path when there are communication failures in any one of the VLT LAG links. The VLT nodes and top of rack (ToR) use the VLT LAG links to carry the BFD packets.
PAGE 970
3. Configure the port channel for the VLT interconnect on a ToR. TOR(conf)# interface TOR(conf-if-po-111)# TOR(conf-if-po-111)# TOR(conf-if-po-111)# port-channel 10 no ip address switchport no shutdown 4. Configure a VLAN. TOR(conf)#interface vlan 100 TOR(conf-if-vl-100)#ip address 100.1.1.3/24 TOR(conf-if-vl-100)#tagged port-channel 10 TOR(conf-if-vl-100)#arp timeout 1 TOR(conf-if-vl-100)#no shutdown TOR(conf-if-vl-100)#exit 5. Enable BFD over OSPF.
PAGE 971
VLT_Primary(conf-if-vl-100)#no shutdown VLT_Primary(conf-if-vl-100)#exit 6. Enable BFD over OSPF. VLT_Primary(conf)# router ospf 1 VLT_Primary(conf-router_ospf)# network 100.1.1.0/24 area 0 VLT_Primary(conf-router_ospf)# bfd all-neighbors VLT Secondary 1. Enable BFD globally. VLT_Secondary(conf)# bfd enable 2. Configure port channel which is used as VLTi link.
PAGE 972
● To verify the BFD neighbors in the ToR, use show bfd neighbors command. TOR#show bfd neighbors LocalAddr RemoteAddr * 100.1.1.3 100.1.1.1 * 100.1.1.3 100.1.1.2 Interface Vl 100 Vl 100 State Rx-int Tx-int Mult Clients Up 200 200 3 O Up 200 200 3 O ● To verify the VLTi (ICL) link is up in the VLT primary peer, use show vlt brief command.
PAGE 973
59 VLT Proxy Gateway The virtual link trucking (VLT) proxy gateway feature allows a VLT domain to locally terminate and route L3 packets that are destined to a Layer 3 (L3) end point in another VLT domain. Enable the VLT proxy gateway using the link layer discover protocol (LLDP) method or the static configuration. For more information, see the Command Line Reference Guide.
PAGE 974
Figure 144. Sample Configuration for a VLT Proxy Gateway Guidelines for Enabling the VLT Proxy Gateway Keep the following points in mind when you enable a VLT proxy gateway: ● Proxy gateway is supported only for VLT; for example, across a VLT domain. ● You must enable the VLT peer-routing command for the VLT proxy gateway to function.
PAGE 975
● When a Virtual Machine (VM) moves from one VLT domain to the another VLT domain, the VM host sends the gratuitous ARP (GARP) , which in-turn triggers a mac movement from the previous VLT domain to the newer VLT domain. ● After a station move, if the host sends a TTL1 packet destined to its gateway; for example, a previous VLT node, the packet can be dropped.
PAGE 976
● You must globally enable LLDP. ● You cannot have interface–level LLDP disable commands on the interfaces configured for proxy gateway and you must enable both transmission and reception. ● You must connect both units of the remote VLT domain by the port channel member. ● If you connect more than one port to a unit of the remote VLT domain, the connection must be completed by the time you enable the proxy gateway LLDP.
PAGE 977
● The preceding figure shows a sample square VLT Proxy gateway topology. There are no diagonal links in the square VLT connection between the C and D in VLT domain 1 and C1 and D1 in the VLT domain 2. This causes sub-optimal routing. For VLT Proxy Gateway to work in this scenario you must configure the VLT-peer-mac transmit command under VLT Domain Proxy Gateway LLDP mode, in both C and D (VLT domain 1) and C1 and D1 (VLT domain 2).
PAGE 978
2. Configure peer-domain-link port-channel in VLT Domain Proxy Gateway LLDP mode. The VLT port channel is the one that connects the remote VLT domain. Sample Dynamic Proxy Configuration on C switch or C1 switch Switch_C#conf Switch_C(conf)#vlt domain 1 Switch_C(conf-vlt-domain1)#proxy-gateway lldp Switch_C(conf-vlt-domain1-pxy-gw-lldp)#peer-domain-link port-channel 1....
PAGE 979
The MAC addresses, configured using the remote-mac-address command, belong to Dell-3 and Dell-4.
PAGE 980
remote-mac-address 00:01:e8:8b:ff:4f remote-mac-address 00:01:e8:d8:93:04 The MAC addresses, configured using the remote-mac-address command, belong to Dell-3 and Dell-4. interface Vlan 100 description OSPF peering VLAN to Dell-1 ip address 10.10.100.2/30 ip ospf network point-to-point no shutdown The following is the OSPF configuration on Dell-2. router ospf 1 router-id 2.2.2.2 network 10.10.100.0/30 area 0 The following output shows that Dell-1 forms OSPF neighborship with Dell-2.
PAGE 981
interface Vlan 102 description ospf peering vlan to DELL-4 ip address 10.10.102.1/30 ip ospf network point-to-point no shutdown The following is the OSPF configuration on Dell-3. router ospf 1 router-id 3.3.3.3 network 10.10.101.0/30 area 0 network 10.10.102.0/30 area 0 The following output shows that Dell-4 and VLT domain 120 form OSPF neighborship with Dell-3. Dell-3#sh ip ospf nei ! Neighbor ID Pri State Dead Time Address Interface Area 4.4.4.4 1 FULL/ - 00:00:33 10.10.101.1 Vl 101 0 1.1.1.
PAGE 982
60 Virtual Extensible LAN (VXLAN) Virtual Extensible LAN (VXLAN) is supported on Dell EMC Networking OS. Overview The switch acts as the VXLAN gateway and performs the VXLAN Tunnel End Point (VTEP) functionality. VXLAN is a technology where in the data traffic from the virtualized servers is transparently transported over an existing legacy network. Figure 147. VXLAN Gateway NOTE: In a stack setup, the Dell EMC Networking OS does not support VXLAN.
PAGE 983
Components of VXLAN network VXLAN provides a mechanism to extend an L2 network over an L3 network. In short, VXLAN is an L2 overlay scheme over an L3 network and this overlay is termed as a VXLAN segment.
PAGE 984
Functional Overview of VXLAN Gateway The following section is the functional overview of VXLAN Gateway: 1. Provides connectivity between a Virtual server infrastructure and a Physical server infrastructure. 2. Provides the functions performed by a VTEP in a virtual server infrastructure. The functions of a VTEP are: ● VTEP is responsible for creating one or more logical networks. ● VTEP is responsible for identifying and binding a Port and VLAN to a logical network ● VTEP maintains MAC bindings to a VTEP.
PAGE 985
● Ethertype: It is set to 0×0800 because the payload packet is an IPv4 packet. The initial VXLAN draft does not include an IPv6 implementation, but it is planned for the next draft. Outer IP Header: The Outer IP Header consists of the following components: ● Protocol: It is set to 0×11 to indicate that the frame contains a UDP packet . ● Source IP: It is the IP address of originating VTEP. ● Destination IP: : It is the IP address of target VTEP.
PAGE 986
sSFKBohqu40EWXIBJ0QbKvFWv91rbjkgtsrHVTdohrA== -----END CERTIFICATE----Copy and paste the generated certificate to the NSX. NOTE: Once controller connectivity is established from VLT peers, if you want to generate a new certificate and use it for controller connection, generate the certificate from the node (node that is directly connected to controller). If you do not generate a new certificate from the node, system shows inconsistent behavior. 2. Create a VXLAN Gateway.
PAGE 987
Figure 150. Hardware Devices 3. Add a service node or replicator. Under Home > Networking and Security > Service Definition > Hardware Devices > Replication Cluster, click the Edit button. Select required hosts for replication and click OK. Figure 151. Add Service Node or Replicator NOTE: Ensure L3 reachability between the VTEP and the replicator. 4. Create Logical Switch. You can create a logical network by creating a logical switch.
PAGE 988
Figure 152. Create Logical Switch 5. Create Logical Switch Port. A logical switch port provides a logical connection point for a VM interface (VIF) and a L2 gateway connection to an external network. It binds the virtual access ports in the gateway to logical network (VXLAN) and VLAN. In the Manage Hardware Bindings window, expand a VTEP and click Add. The Manage Hardware Bindings Window opens. Click the Select link and the Specify Hardware Port window opens. Click the hardware port and click OK.
PAGE 989
Figure 154. Create Logical Switch Port 6. (Optional) Enable or disable BFD globally. Go to Hardware Devices tab > BFD Configuration, and click the Edit button. The Edit BFD Configuration windows opens. Check or uncheck the Enable BFD check box. You can also change the probe interval if required. Figure 155. Edit VXLAN BFD Configuration NOTE: For more details about NSX controller configuration, refer to the NSX user guide from VMWare .
PAGE 990
2. Advertising VXLAN access ports to controller Connecting to an NVP Controller To connect to an NVP controller, use the following commands. 1. Enable the VXLAN feature. CONFIGURATION mode feature vxlan You must configure feature VXLAN to configure vxlan-instance. 2. Create a VXLAN instance that connects to the controller. CONFIGURATION mode vxlan-instance instance ID {nsx | Nuage} Use the nsx keyword to connect to an NSX controller. Use the nuage keyword to connect to a Nuage controller.
PAGE 991
Displaying VXLAN Configurations To display the VXLAN configurations, use the following commands. The following example shows the show vxlan vxlan-instance command. DellEMC#show vxlan vxlan-instance 1 Instance : 1 Mode : Controller Admin State : enabled Controller Type : Nsx Management IP : 10.16.140.34 Gateway IP : 4.3.3.3 MAX Backoff : 8000 Controller : 10.16.140.181:6640 ssl Controller Cluster : : 10.16.140.181:6640 ssl (connected) : 10.16.140.182:6640 ssl (connected) : 10.16.140.
PAGE 992
The following example shows the show vxlan vxlan-instance unicast-mac-remote command. DellEMC# show vxlan vxlan-instance <1> unicast-mac-remote Total Local Mac Count: 1 VNI MAC TUNNEL 4656 00:00:01:00:00:01 36.1.1.1 The following example shows the show vxlan vxlan-instance unicast-mac-remote command when the tunnel is down. DellEMC# show vxlan vxlan-instance <1> unicast-mac-remote Total Local Mac Count: 1 VNI MAC TUNNEL 4656 00:00:01:00:00:01 36.1.1.
PAGE 993
no shutdown 8. Enable VXLAN instance on the interface. The interface should not be on layer 2. INTERFACE mode vxlan-instance Instance ID 9. Associate VNID to VLAN. INTERFACE VLAN mode vxlan-vnid VNID Limitations on VXLAN While configuring a VXLAN, the following conditions apply: ● Hybrid ports are not supported in VXLAN (hybrid port means an interface tagged to one VLAN and untagged to another VLAN).
PAGE 994
The following example displays VXLAN statistics for a specific port and VLAN combination. DellEMC# show vxlan statistics interface tf 1/1 vlan 2 Statistics for Port : Tf 1/1 Vlan : 2 Rx Packets : 0 Rx Bytes : 0 Tx Packets : 0 Tx Bytes : 0 The following example displays VXLAN statistics for the specified VXLAN tunnel. DellEMC# show vxlan vxlan-instance 1 statistics remote-vtep-ip 1.1.1.1 Statistics for Remote-vtep-ip : 1.1.1.
PAGE 995
RIOT VXLAN RIOT additional feature descriptions are listed below. ● A new port-channel with LAG id 4097 is created and all the internal ports are added as member to that port-channel. ● Default configuration of these internal ports will be: ○ No keep alive ○ No shut ● Apart from that no user configurations are not allowed on these ports as well as suppressed from show runningconfig. Also these internal interfaces will not be displayed in show running-config.
PAGE 996
61 Virtual Routing and Forwarding (VRF) Virtual Routing and Forwarding (VRF) allows a physical router to partition itself into multiple Virtual Routers (VRs). The control and data plane are isolated in each VR so that traffic does NOT flow across VRs.Virtual Routing and Forwarding (VRF) allows multiple instances of a routing table to co-exist within the same router at the same time.
PAGE 997
Figure 156. VRF Network Example VRF Configuration Notes Although there is no restriction on the number of VLANs that can be assigned to a VRF instance, the total number of routes supported in VRF is limited by the size of the IPv4 CAM. VRF is implemented in a network device by using Forwarding Information Bases (FIBs). A network device may have the ability to configure different virtual routers, where entries in the FIB that belong to one VRF cannot be accessed by another VRF on the same device.
PAGE 998
VRF supports some routing protocols only on the default VRF (default-vrf) instance. Table 1 displays the software features supported in VRF and whether they are supported on all VRF instances or only the default VRF. NOTE: To configure a router ID in a non-default VRF, configure at least one IP address in both the default as well as the non-default VRF. Table 131. Software Features Supported on VRF Feature/Capability Support Status for Default VRF Support Status for Non-default VRF 802.
PAGE 999
DHCP DHCP requests are not forwarded across VRF instances. The DHCP client and server must be on the same VRF instance. VRF Configuration The VRF configuration tasks are: 1. Enabling VRF in Configuration Mode 2. Creating a Non-Default VRF 3. Assign an Interface to a VRF You can also: ● View VRF Instance Information ● Connect an OSPF Process to a VRF Instance ● Configure VRRP on a VRF Loading VRF CAM ● Load CAM memory for the VRF feature.
PAGE 1000
interface twentyFiveGigE 1/1 2. Assign the interface to management VRF. INTERFACE CONFIGURATION ip vrf forwarding management Before assigning a front-end port to a management VRF, ensure that no IP address is configured on the interface. 3. Assign an IPv4 address to the interface. INTERFACE CONFIGURATION ip address 10.1.1.1/24 Before assigning a front-end port to a management VRF, ensure that no IP address is configured on the interface. 4. Assign an IPv6 address to the interface.
PAGE 1001
Table 132. Configuring VRRP on a VRF (continued) Task Command Syntax Assign an IP address to the interface Configure the VRRP group and virtual IP address View VRRP command output for the VRF vrf1 Command Mode ip address 10.1.1.1 /24 no shutdown vrrp-group 10 virtual-address 10.1.1.100 show config ----------------------------! interface twentyFiveGigE 1/13 ip vrf forwarding vrf1 ip address 10.1.1.1/24 ! vrrp-group 10 virtual-address 10.1.1.
PAGE 1002
● ● ● ● ● ● ● ipv6 ipv6 ipv6 ipv6 ipv6 ipv6 ipv6 nd ra-lifetime — Set IPv6 Router Advertisement Lifetime nd reachable-time — Set advertised reachability time nd retrans-timer — Set NS retransmit interval used and advertised in RA nd suppress-ra — Suppress IPv6 Router Advertisements ad — IPv6 Address Detection ad autoconfig — IPv6 stateless auto-configuration address — Configure IPv6 address on an interface NOTE: The command line help still displays relevant details correspon
PAGE 1003
Figure 158. Setup VRF Interfaces The following example relates to the configuration shown in the above illustrations. Router 1 ip vrf blue 1 ! ip vrf orange 2 ! ip vrf green 3 ! interface twentyFiveGigE 3/1 no ip address switchport no shutdown ! interface twentyFiveGigE 1/1/ ip vrf forwarding blue ip address 10.0.0.1/24 no shutdown ! interface twentyFiveGigE 1/2 ip vrf forwarding orange ip address 20.0.0.1/24 no shutdown ! interface twentyFiveGigE 1/3 ip vrf forwarding green ip address 30.0.0.
PAGE 1004
ip vrf forwarding blue ip address 1.0.0.1/24 tagged twentyFiveGigE 3/1 no shutdown ! interface Vlan 192 ip vrf forwarding orange ip address 2.0.0.1/24 tagged twentyFiveGigE 3/1 no shutdown ! interface Vlan 256 ip vrf forwarding green ip address 3.0.0.1/24 tagged twentyFiveGigE 3/1 no shutdown ! router ospf 1 vrf blue router-id 1.0.0.1 network 1.0.0.0/24 area 0 network 10.0.0.0/24 area 0 ! router ospf 2 vrf orange router-id 2.0.0.1 network 2.0.0.0/24 area 0 network 20.0.0.
PAGE 1005
! router ospf 1 vrf blue router-id 1.0.0.2 network 11.0.0.0/24 area 0 network 1.0.0.0/24 area 0 passive-interface TwentyfiveGigE 1/8 ! router ospf 2 vrf orange router-id 2.0.0.2 network 21.0.0.0/24 area 0 network 2.0.0.0/24 area 0 passive-interface TwentyfiveGigE 1/9 ! ip route vrf green30.0.0.0/24 3.0.0.1 ! The following shows the output of the show commands on Router 1.
PAGE 1006
Change --------------------C 2.0.0.0/24 C 20.0.0.0/24 O 21.0.0.0/24 00:10:41 ------Direct, Vl 192 Direct, Tf 1/2 via 2.0.0.
PAGE 1007
You can also leak global routes to be made available to VRFs. As the global RTM usually contains a large pool of routes, when the destination VRF imports global routes, these routes will be duplicated into the VRF's RTM. As a result, it is mandatory to use route-maps to filter out leaked routes while sharing global routes with VRFs. Configuring Route Leaking without Filtering Criteria You can use the ip route-export tag command to export all the IPv4 routes corresponding to a source VRF.
PAGE 1008
ip address ip—address mask A non-default VRF named VRF-blue is created and the interface 1/12 is assigned to it. 7. Configure the import target in VRF-blue. ip route-import 1:1 8. Configure the export target in VRF-blue. ip route-import 3:3 9. Configure VRF-green. ip vrf vrf-green interface-type slot/port[/subport] ip vrf forwarding VRF-green ip address ip—address mask A non-default VRF named VRF-green is created and the interface is assigned to it. 10.
PAGE 1009
Show routing tables of VRFs( after route-export and route-import tags are configured). DellEMC# show ip route vrf VRF-Red O C O C 11.1.1.1/32 111.1.1.0/24 44.4.4.4/32 144.4.4.0/24 via 111.1.1.1 110/0 00:00:10 Direct, Te 1/11 0/0 22:39:59 via VRF-shared:144.4.4.4 0/0 00:32:36 Direct, VRF-shared:Tf 1/4 0/0 00:32:36 DellEMC# show ip route vrf VRF-Blue O 22.2.2.2/32 via 122.2.2.2 00:00:11 C O C 122.2.2.0/24 44.4.4.4/32 144.4.4.0/24 110/0 Direct, Tf 1/12 0/0 22:39:61 via vrf-shared:144.4.4.
PAGE 1010
Consider a scenario where you have created two VRF tables VRF-red and VRF-blue. VRF-red exports routes with the export_ospfbgp_protocol route-map to VRF-blue. VRF-blue imports these routes into its RTM. For leaking these routes from VRF-red to VRF-blue, you can use the ip route-export route-map command on VRF-red (source VRF, that is exporting the routes); you must also specify a match criteria for these routes using the match source-protocol command.
PAGE 1011
ip route-export 2:2 ip route-import 1:1 import_ospf_protocol !this action accepts only OSPF routes from VRF-red even though both OSPF as well as BGP routes are shared The show VRF commands displays the following output: DellEMC# show ip route vrf VRF-Blue C 122.2.2.0/24 Direct, Tf 1/22 0/0 O 22.2.2.2/32 via 122.2.2.2 110/0 00:00:11 O 44.4.4.4/32 22:39:61 via vrf-red:144.4.4.4 0/0 00:32:36 << only OSPF and BGP leaked from VRF-red Important Points to Remember ● Only Active routes are eligible for leaking.
PAGE 1012
62 Virtual Router Redundancy Protocol (VRRP) Virtual router redundancy protocol (VRRP) is designed to eliminate a single point of failure in a statically routed network. Topics: • • • • • VRRP Overview VRRP Benefits VRRP Implementation VRRP Configuration Sample Configurations VRRP Overview VRRP is designed to eliminate a single point of failure in a statically routed network. VRRP specifies a MASTER router that owns the next hop IP and MAC address for end stations on a local area network (LAN).
PAGE 1013
Figure 159. Basic VRRP Configuration VRRP Benefits With VRRP configured on a network, end-station connectivity to the network is not subject to a single point-of-failure. Endstation connections to the network are redundant and are not dependent on internal gateway protocol (IGP) protocols to converge or update routing tables. In conjunction with Virtual Link Trunking (VLT), you can configure optimized forwarding with virtual router redundancy protocol (VRRP).
PAGE 1014
NOTE: In a VLT environment, VRRP configuration acts as active-active and if route is not present in any of the VRRP nodes, the packet to the destination is dropped on that VRRP node. Table 133.
PAGE 1015
The following examples how to configure VRRP. DellEMC(conf)#interface twentyFiveGigE 1/1 DellEMC(conf-if-tf-1/1)#vrrp-group 111 DellEMC(conf-if-tf-1/1-vrid-111)# The following examples how to verify the VRRP configuration. DellEMC(conf-if-1/1)#show conf ! interface TwentyfiveGigE 1/1 ip address 10.10.10.
PAGE 1016
2. Set the master switch to VRRP protocol version 3. Dell_master_switch(conf-if-tf-1/1-vrid-100)#version 3 Dell_master_switch(conf-if-tf-1/1/1-vrid-100)#version 3 3. Set the backup switches to version 3. Dell_backup_switch1(conf-if-tf-1/1-vrid-100)#version 3 Dell_backup_switch2(conf-if-tf-1/2-vrid-100)#version 3 Assign Virtual IP addresses Virtual routers contain virtual IP addresses configured for that VRRP group (VRID).
PAGE 1017
NOTE: In the following example, the primary IP address and the virtual IP addresses are on the same subnet. DellEMC(conf-if-tf-1/1)#show conf ! interface twentyFiveGigE 1/1 ip address 10.10.10.1/24 ! vrrp-group 111 priority 255 virtual-address 10.10.10.1 virtual-address 10.10.10.2 virtual-address 10.10.10.3 ! vrrp-group 222 no shutdown The following example shows the same VRRP group (VRID 111) configured on multiple interfaces on different subnets.
PAGE 1018
To verify the VRRP group priority, use the show vrrp command. Dellshow vrrp -----------------TwentyfiveGigE 1/1, VRID: 111, Net: 10.10.10.1 VRF: 0 default State: Master, Priority: 255, Master: 10.10.10.1 (local) Hold Down: 0 sec, Preempt: TRUE, AdvInt: 1 sec Adv rcvd: 0, Bad pkts rcvd: 0, Adv sent: 2343, Gratuitous ARP sent: 5 Virtual MAC address: 00:00:5e:00:01:6f Virtual IP address: 10.10.10.1 10.10.10.2 10.10.10.3 10.10.10.10 Authentication: (none) -----------------TwentyfiveGigE 1/2, VRID: 111, Net: 10.
PAGE 1019
Disabling Preempt The preempt command is enabled by default. The command forces the system to change the MASTER router if another router with a higher priority comes online. Prevent the BACKUP router with the higher priority from becoming the MASTER router by disabling preempt. NOTE: You must configure all virtual routers in the VRRP group the same: you must configure all with preempt enabled or configure all with preempt disabled.
PAGE 1020
● For VRRPv3, change the advertisement centisecs interval setting. INTERFACE-VRID mode advertise-interval centisecs centisecs The range is from 25 to 4075 centisecs in units of 25 centisecs. The default is 100 centisecs. The following example shows how to change the advertise interval using the advertise-interval command.
PAGE 1021
Tracking an Interface To track an interface, use the following commands. NOTE: The sum of all the costs for all tracked interfaces must be less than the configured priority of the VRRP group. ● Monitor an interface and, optionally, set a value to be subtracted from the interface’s VRRP group priority. INTERFACE-VRID mode track interface [priority-cost cost] The cost range is from 1 to 254. The default is 10.
PAGE 1022
The following example shows verifying the VRRP status.
PAGE 1023
vrrp delay reload seconds This time is the gap between system boot up completion and VRRP enabling. The seconds range is from 0 to 900. The default is 0. Sample Configurations Before you set up VRRP, review the following sample configurations. VRRP for an IPv4 Configuration The following configuration shows how to enable IPv4 VRRP. This example does not contain comprehensive directions and is intended to provide guidance for only a typical VRRP configuration.
PAGE 1024
Examples of Configuring VRRP for IPv4 and IPv6 The following example shows configuring VRRP for IPv4 Router 2. R2(conf)#interface twentyFiveGigE 2/31 R2(conf-if-tf-2/31)#ip address 10.1.1.1/24 R2(conf-if-tf-2/31)#vrrp-group 99 R2(conf-if-tf-2/31-vrid-99)#priority 200 R2(conf-if-tf-2/31-vrid-99)#virtual 10.1.1.3 R2(conf-if-tf-2/31-vrid-99)#no shut R2(conf-if-tf-2/31)#show conf ! interface twentyFiveGigE 2/31 ip address 10.1.1.1/24 ! vrrp-group 99 priority 200 virtual-address 10.1.1.
PAGE 1025
Figure 161. VRRP for an IPv6 Configuration NOTE: In a VRRP or VRRPv3 group, if two routers come up with the same priority and another router already has MASTER status, the router with master status continues to be MASTER even if one of two routers has a higher IP or IPv6 address. The following example shows configuring VRRP for IPv6 Router 2 and Router 3. Configure a virtual link local (fe80) address for each VRRPv3 group created for an interface.
PAGE 1026
vrrp-group 10 priority 100 virtual-address fe80::10 virtual-address 1::10 no shutdown R2(conf-if-tf-1/1)#end R2#show vrrp -----------------twentyFiveGigE 1/1, IPv6 VRID: 10, Version: 3, Net:fe80::201:e8ff:fe6a:c59f VRF: 0 default State: Master, Priority: 100, Master: fe80::201:e8ff:fe6a:c59f (local) Hold Down: 0 centisec, Preempt: TRUE, AdvInt: 100 centisec Accept Mode: FALSE, Master AdvInt: 100 centisec Adv rcvd: 0, Bad pkts rcvd: 0, Adv sent: 135 Virtual MAC address: 00:00:5e:00:02:0a Virtual IP address:
PAGE 1027
groups on each VRF instance in order that there is one MASTER and one backup router for each VRF. In VRF-1 and VRF-2, Switch-2 serves as owner-master of the VRRP group and Switch-1 serves as the backup. On VRF-3, Switch-1 is the ownermaster and Switch-2 is the backup. In VRF-1 and VRF-2 on Switch-2, the virtual IP and node IP address, subnet, and VRRP group are the same.
PAGE 1028
S1(conf-if-tf-1/2)#no shutdown ! S1(conf)#interface twentyFiveGigE 1/3 S1(conf-if-tf-1/3)#ip vrf forwarding VRF-3 S1(conf-if-tf-1/3)#ip address 20.1.1.5/24 S1(conf-if-tf-1/3)#vrrp-group 15 % Info: The VRID used by the VRRP group 15 in VRF 3 will be 243. S1(conf-if-tf-1/3-vrid-105)#priority 255 S1(conf-if-tf-1/3-vrid-105)#virtual-address 20.1.1.5 S1(conf-if-tf-1/3)#no shutdown DellEMC#show vrrp twentyFiveGigE 1/8 -----------------twentyFiveGigE 1/8, IPv4 VRID: 1, Version: 2, Net: 10.1.1.
PAGE 1029
This VLAN scenario often occurs in a service-provider network in which you configure VLAN tags for traffic from multiple customers on customer-premises equipment (CPE), and separate VRF instances associated with each VLAN are configured on the provider edge (PE) router in the point-of-presence (POP).
PAGE 1030
10.1.1.100 Authentication: (none) VRRP in VRF: Switch-2 VLAN Configuration Switch-2 S2(conf)#ip vrf VRF-1 1 ! S2(conf)#ip vrf VRF-2 2 ! S2(conf)#ip vrf VRF-3 3 ! S2(conf)#interface twentyFiveGigE 1/1 S2(conf-if-tf-1/1)#no ip address S2(conf-if-tf-1/1)#switchport S2(conf-if-tf-1/1)#no shutdown ! S2(conf-if-tf-1/1)#interface vlan 100 S2(conf-if-vl-100)#ip vrf forwarding VRF-1 S2(conf-if-vl-100)#ip address 10.10.1.
PAGE 1031
Port-channel 1, IPv4 VRID: 1, Version: 2, Net: 10.1.1.1 VRF: 2 vrf2 State: Master, Priority: 100, Master: 10.1.1.1 (local) Hold Down: 0 sec, Preempt: TRUE, AdvInt: 1 sec Adv rcvd: 0, Bad pkts rcvd: 0, Adv sent: 419, Gratuitous ARP sent: 1 Virtual MAC address: 00:00:5e:00:01:01 Virtual IP address: 10.1.1.100 Authentication: (none) VRRP for IPv6 Configuration This section shows VRRP IPv6 topology with CLI configurations.
PAGE 1032
NOTE: In a VRRP or VRRPv3 group, if two routers come up with the same priority and another router already has MASTER status, the router with master status continues to be master even if one of two routers has a higher IP or IPv6 address. Router 2 R2(conf)#interface twentyFiveGigE 1/1 R2(conf-if-tf-1/1)#no ip address R2(conf-if-tf-1/1)#ipv6 address 1::1/64 R2(conf-if-tf-1/1)#vrrp-group 10 NOTE: You must configure a virtual link local (fe80) address for each VRRPv3 group created for an interface.
PAGE 1033
State: Backup, Priority: 100, Master: fe80::201:e8ff:fe6a:c59f Hold Down: 0 centisec, Preempt: TRUE, AdvInt: 100 centisec Accept Mode: FALSE, Master AdvInt: 100 centisec Adv rcvd: 11, Bad pkts rcvd: 0, Adv sent: 0 Virtual MAC address: 00:00:5e:00:02:0a Virtual IP address: 1::10 fe80::10 DellEMC#show vrrp twentyFiveGigE 1/1 twentyFiveGigE 1/1, IPv6 VRID: 255, Version: 3, Net: fe80::201:e8ff:fe8a:fd76 VRF: 0 default State: Backup, Priority: 90, Master: fe80::201:e8ff:fe8a:e9ed Hold Down: 0 centisec, Preempt:
PAGE 1034
VRF: 2 vrf2 State: Backup, Priority: 90, Master: fe80::201:e8ff:fe8a:e9ed Hold Down: 0 centisec, Preempt: TRUE, AdvInt: 100 centisec Accept Mode: FALSE, Master AdvInt: 100 centisec Adv rcvd: 548, Bad pkts rcvd: 0, Adv sent: 0 Virtual MAC address: 00:00:5e:00:02:ff Virtual IP address: 10:1:1::255 fe80::255 1034 Virtual Router Redundancy Protocol (VRRP)
PAGE 1035
63 Debugging and Diagnostics This chapter describes debugging and diagnostics for the device. Topics: • • • • • • • • • • Offline Diagnostics Trace Logs Auto Save on Crash or Rollover Hardware Watchdog Timer Enabling Environmental Monitoring Buffer Tuning Troubleshooting Packet Loss Enabling Application Core Dumps Mini Core Dumps Enabling TCP Dumps Offline Diagnostics The offline diagnostics test suite is useful for isolating faults and debugging hardware.
PAGE 1036
NOTE: The system reboots when the offline diagnostics complete. This is an automatic process. The following warning message appears when you implement the offline stack-unit command: Warning - Diagnostic execution will cause stack-unit to reboot after completion of diags. Proceed with Offline-Diags [confirm yes/no]:y After the system goes offline, you must reload or run the online stack-unit stack-unit-number command for the normal operation. 2. Confirm the offline status.
PAGE 1037
NOTE: Non-management member units do not support this functionality. Hardware Watchdog Timer The hardware watchdog command automatically reboots a Dell EMC Networking OS switch or router with a single RPM that is unresponsive. This is a last resort mechanism that is intended to prevent a manual power cycle. Enabling Environmental Monitoring The device components use environmental monitoring hardware to detect transmit power readings, receive power readings, and temperature updates.
PAGE 1038
QSFP QSFP QSFP QSFP QSFP QSFP QSFP 52 52 52 52 52 52 52 TX2 TX3 TX4 RX1 RX2 RX3 RX4 Bias Current Bias Current Bias Current Power Power Power Power = = = = = = = 0.000mA 0.000mA 0.000mA 0.000mW 0.000mW 0.000mW 0.
PAGE 1039
Troubleshoot an Over-temperature Condition To troubleshoot an over-temperature condition, use the following information. 1. Use the show environment commands to monitor the temperature levels. 2. Check air flow through the system. Ensure that the air ducts are clean and that all fans are working correctly. 3. After the software has determined that the temperature levels are within normal limits, you can re-power the card safely. To bring back the line card online, use the power-on command in EXEC mode.
PAGE 1040
Table 134. SNMP Traps and OIDs (continued) OID String OID Name Description .1.3.6.1.4.1.6027.3.27.1.6 dellNetFpStatsPerCOSTable View the forwarding plane statistics containing the packet buffer statistics per COS per port. Buffer Tuning Buffer Tuning allows you to modify the way your switch allocates buffers from its available memory and helps prevent packet drops during a temporary burst of traffic.
PAGE 1041
● show hardware buffer-stats-snapshot resource interface interface ● show hardware buffer inteface interface{priority-group { id | all } | queue { id| all} | detail} buffer-info ● show hardware buffer-stats-snapshot resource interface interface{priority-group { id | all } | queue { ucast{id | all}{ mcast {id | all} | all} ● show hardware drops interface interface ● clear hardware stack-unit stack-unit-number counters ● clear hardware stack-unit stack-unit-number unit 0-1 counters ● clear hardware stack-unit
PAGE 1042
IPv4 L3UC Aged & Drops : 0 TTL Threshold Drops : 0 INVALID VLAN CNTR Drops : 0 L2MC Drops : 0 PKT Drops of ANY Conditions : 0 Hg MacUnderflow : 0 TX Err PKT Counter : 0 --- Error counters--Internal Mac Transmit Errors : 0 Unknown Opcodes : 0 Internal Mac Receive Errors : 0 --- FEC Counters --Ingress FEC uncorrected code words: 172 --- Error Ratio Counters --Ingress preFEC Bit Error Ratio: 3.727463E-11 Ingress FCS Drops Error Ratio : 0.
PAGE 1043
txPkt(COS7 ) txPkt(COS8 ) txPkt(COS9 ) txPkt(COS10) txPkt(COS11) txPkt(UNIT0) :0 :0 :0 :0 :0 :0 Example of Viewing Party Bus Statistics DellEMC#sh hardware stack-unit 1 cpu party-bus statistics Input Statistics: 27550 packets, 2559298 bytes 0 dropped, 0 errors Output Statistics: 1649566 packets, 1935316203 bytes 0 errors Display Stack Member Counters You can use the show hardware command to display internal receive and transmit statistics, based on the selected command option.
PAGE 1044
RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX RX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX TX 1044 - Multicast Frame Counter Broadcast Frame Counter Byte Counter Control Frame Counter Pause Control Frame Counter Oversized Frame Counter Jabber Frame Counter VLAN Tag Frame Counter Double VLAN Tag Frame Counter RUNT Frame Counter Fragment Counter VLAN Tagged Packets Ingress Dropped Pa
PAGE 1045
TX - Debug Counter 10 TX - Debug Counter 11 0 0 Enabling Application Core Dumps Application core dumps are disabled by default. A core dump file can be very large. Due to memory requirements the file can only be sent directly to an FTP server; it is not stored on the local flash. To enable full kernel core dumps, use the following command. ● Enable stack unit kernel full core dumps. CONFIGURATION mode logging coredump server To undo this command, use the no logging coredump server command.
PAGE 1046
27 28 -rwx -rwx 1887496 1913790 Sep 23 2015 05:28:14 +00:00 f10lp_sysdlp_150923052924.acore.gz Sep 23 2015 06:33:40 +00:00 f10lp_sysdlp_150923063451.acore.
PAGE 1047
64 Standards Compliance This chapter describes standards compliance for Dell EMC Networking products. NOTE: Unless noted, when a standard cited here is listed as supported by the Dell EMC Networking OS, the system also supports predecessor standards. One way to search for predecessor standards is to use the http://tools.ietf.org/ website. Click “Browse and search IETF documents,” enter an RFC number, and inspect the top of the resulting document for obsolescence citations to related RFCs.
PAGE 1048
RFC and I-D Compliance Dell EMC Networking OS supports the following standards. The standards are grouped by related protocol. The columns showing support by platform indicate which version of Dell EMC Networking OS first supports the standard. General Internet Protocols The following table lists the Dell EMC Networking OS support per platform for general internet protocols. Table 135.
PAGE 1049
Table 135. General Internet Protocols (continued) R F C # Full Name S-Series S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON 6 0 Transfer Protocol 2 4 7 4 Definition of 7.7.1 the Differentiate d Services Field (DS Field) in the IPv4 and IPv6 Headers 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 2 PPP over 61 SONET/SD 5 H 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 2 6 9 8 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.
PAGE 1050
Table 136. General IPv4 Protocols (continued) RF C# Full Name S-Series S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON 103 DOMAIN NAMES 5 IMPLEMENTATION AND SPECIFICATION (client) 7.6.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 104 A Standard for the 2 Transmission of IP Datagrams over IEEE 802 Networks 7.6.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 1191 Path MTU Discovery 7.6.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.
PAGE 1051
Table 137. General IPv6 Protocols (continued) RFC Full Name # S-Series S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON 246 2 (Par tial) IPv6 Stateless Address Autoconfiguration 7.8.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 246 4 Transmission of IPv6 Packets over Ethernet Networks 7.8.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 267 5 IPv6 Jumbograms 7.8.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 2711 IPv6 Router Alert Option 8.3.12.0 9.8(0.
PAGE 1052
Table 138. Border Gateway Protocol (BGP) (continued) RFC# Full Name SSeries/ZSeries S3048–ON S4048–ON Z9100–ON S4048TON S6010–ON 2842 Capabilities Advertisement with BGP-4 7.8.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 2858 Multiprotocol Extensions for BGP-4 7.8.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 2918 Route Refresh Capability for BGP-4 7.8.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 3065 Autonomous System Confederations for BGP 7.8.1 9.
PAGE 1053
Intermediate System to Intermediate System (IS-IS) The following table lists the Dell EMC Networking OS support per platform for IS-IS protocol. Table 140. Intermediate System to Intermediate System (IS-IS) RFC# Full Name S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON 1142 OSI IS-IS Intra-Domain Routing Protocol (ISO DP 10589) 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 1195 Use of OSI IS-IS for Routing in TCP/IP and Dual Environments 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.
PAGE 1054
Routing Information Protocol (RIP) The following table lists the Dell EMC Networking OS support per platform for RIP protocol. Table 141. Routing Information Protocol (RIP) RF C# Full Name S-Series S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON 105 8 Routing Information Protocol 7.8.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 245 RIP Version 3 7.8.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.10(0.1) 9.10(0.1) 4191 Default Router Preferences and More-Specific Routes 8.3.12.0 9.8(0.
PAGE 1055
Table 143. Network Management (continued) RFC# Full Name S4810 S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON 1156 Management Information Base for Network Management of TCP/IP-based internets 7.6.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.0) 1157 A Simple Network Management 7.6.1 Protocol (SNMP) 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.0) 1212 Concise MIB Definitions 7.6.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.
PAGE 1056
Table 143. Network Management (continued) RFC# Full Name 2575 S4810 S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON View-based Access Control 7.6.1 Model (VACM) for the Simple Network Management Protocol (SNMP) 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.0) 2576 Coexistence Between Version 1, 7.6.1 Version 2, and Version 3 of the Internet-standard Network Management Framework 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.0) 2578 Structure of Management Information Version 2 (SMIv2) 7.
PAGE 1057
Table 143. Network Management (continued) RFC# Full Name S4810 S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON Network Management Protocol (SNMP) 3418 Management Information Base (MIB) for the Simple Network Management Protocol (SNMP) 7.6.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.0) 3434 Remote Monitoring MIB Extensions for High Capacity Alarms, High-Capacity Alarm Table (64 bits) 7.6.1 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.0) 3580 IEEE 802.
PAGE 1058
Table 143. Network Management (continued) RFC# Full Name S4810 S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON IEEE Management Information Base 7.7.1 802.1A module for LLDP configuration, B statistics, local system data and remote systems data components. 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.0) IEEE The LLDP Management 802.1A Information Base extension B module for IEEE 802.1 organizationally defined discovery information. (LLDP DOT1 MIB and LLDP DOT3 MIB) 7.7.1 9.8(0.0P2) 9.8(0.
PAGE 1059
Table 143. Network Management (continued) RFC# Full Name FORC E10-IFEXTEN SIONMIB S4810 S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON Force10 Enterprise IF Extension 7.6.1 MIB (extends the Interfaces portion of the MIB-2 (RFC 1213) by providing proprietary SNMP OIDs for other counters displayed in the "show interfaces" output) 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.0) FORC E10LINKA GGMIB Force10 Enterprise Link Aggregation MIB 9.8(0.0P2) 9.8(0.0P5) 9.8(1.0) 9.8(1.0) 9.8(1.
PAGE 1060
Table 143. Network Management (continued) RFC# Full Name S4810 S3048–ON S4048–ON Z9100–ON S4048T-ON S6010–ON ALAR M-MIB MIB Location You can find Force10 MIBs under the Force10 MIBs subhead on the Documentation page of iSupport: https://www.force10networks.com/CSPortal20/KnowledgeBase/Documentation.aspx You also can obtain a list of selected MIBs and their OIDs at the following URL: https://www.force10networks.com/CSPortal20/Main/Login.aspx Some pages of iSupport require a login.
PAGE 1061
65 X.509v3 supports X.509v3 standards. Topics: • • • • • • • • • Introduction to X.509v3 certificates X.509v3 support in Information about installing CA certificates Information about Creating Certificate Signing Requests (CSR) Information about installing trusted certificates Transport layer security (TLS) Online Certificate Status Protocol (OSCP) Verifying certificates Event logging Introduction to X.509v3 certificates X.
PAGE 1062
Advantages of X.509v3 certificates Public key authentication is preferred over password-based authentication, although both may be used in conjunction, for various reasons. Public-key authentication provides the following advantages over normal password-based authentication: ● Public-key authentication avoids the human problems of low-entropy password selection and provides more resistance to brute-force attacks than password-based authentication.
PAGE 1063
The other hosts on the network, such as the SUT switch, syslog server, and OCSP server, generate private keys and create Certificate Signing Requests (CSRs). The hosts then upload the CSRs to the Intermediate CA or make the CSRs available for the Intermediate CA to download. generates a CSR using the crypto cert generate request command. The hosts on the network (SUT, syslog, OCSP…) also download and install the CA certificates from the Root and Intermediate CAs.
PAGE 1064
After the CA certificate is installed, the system can secure communications with TLS servers by verifying certificates that are signed by the CA. Installing CA certificate To install a CA certificate, enter the crypto ca-cert install {path} command in Global Configuration mode. Information about Creating Certificate Signing Requests (CSR) Certificate Signing Request (CSR) enables a device to get a X.509v3 certificate from a CA. In order for a device to get a X.
PAGE 1065
● ● ● ● ● ● Organization Unit Name Common Name Email address Validity Length Alternate Name NOTE: The command contains multiple options with the Common Name being a required field and blanks being filled in for unspecified fields. Information about installing trusted certificates Dell EMC Networking OS also enables you to install a trusted certificate. The system can then present this certificate for authentication to clients such as SSH and HTTPS.
PAGE 1066
When not operating in FIPS mode, the system may support TLS 1.0 up to 1.2, and older ciphers and hashes: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_ECDH_RSA_WITH_AES_256_CBC_SHA TLS_ECDH_RSA_WITH_AES_128_CBC_SHA TLS_DH_RSA_WITH_AES_256_CBC_SHA TLS_DH_RSA_WITH_AES_128_CBC_SHA TLS compression is disabled by default.
PAGE 1067
Configuring OCSP behavior You can configure how the OCSP requests and responses are signed when the CA or the device contacts the OCSP responders. To configure this behavior, follow this step: In CONFIGURATION mode, enter the following command: crypto x509 ocsp {[nonce] [sign-request]} Both the none and sign-request parameters are optional. The default behavior is to not use these two options.
PAGE 1068
Verifying Client Certificates Verifying client certificates is optional in the TLS protocol and is not explicitly required by Common Criteria. However, TLS-protected Syslog and RADIUS protocols mandate that certificate-based mutual authentication be performed. Event logging The system logs the following events: ● ● ● ● ● A CA certificate is installed or deleted. A self-signed certificate and private key are generated. An existing host certificate, a private key, or both are deleted.