Showing posts with label L2. Show all posts
Showing posts with label L2. Show all posts

Tuesday, July 14, 2015

STP Port-ID.

I found that there are many engineers who don't understand STP Port-ID concept, so I decided to write this blogpost for ease of reference.
STP Tie-breaking sequence is as following:
1. Lowest Root Bridge ID.
2. Lowest Root Path Cost.
3. Lowest Sender Bridge ID.
4. Lowest Sender Port ID.
The key word in the last tie-breaker is "Sender" Port ID, not the local one.
Let's use this simple topology:
I will use RPVST+, but it doesn't really matter, which STP flavor you use.

Firstly, the Root Brdige is being elected (SW1, due to lower MAC-Address).
Then, each non-Root Bridge has to choose one Root Port. SW2 has two equal links connected to SW1.
The tie breaking sequence:
1. SW2 receives BPDUs with the same Root Bridge ID on both links.
2. Since both interfaces are the same, Root Path Cost is the same too.
3. Both links are connected to the same switch, thus Sender Bridge ID in these BPDUs are the same.
4. SW2 receives two BPDUs with different Sender Port ID and chooses the lowest one. It happens to be BPDUs on E0/0.
So, E0/0 is chosen as Root Port, and E0/1 is blocked.
SW2#show spanning-tree detail | begin Port
 Port 1 (Ethernet0/0) of VLAN0001 is root forwarding 
   Port path cost 100, Port priority 128, Port Identifier 128.1.
   Designated root has priority 32769, address aabb.cc00.6400
   Designated bridge has priority 32769, address aabb.cc00.6400
   Designated port id is 128.1, designated path cost 0
   Timers: message age 16, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   Link type is point-to-point
   BPDU: sent 5, received 233

 Port 2 (Ethernet0/1) of VLAN0001 is alternate blocking 
   Port path cost 100, Port priority 128, Port Identifier 128.2.
   Designated root has priority 32769, address aabb.cc00.6400
   Designated bridge has priority 32769, address aabb.cc00.6400
   Designated port id is 128.2, designated path cost 0
   Timers: message age 16, forward delay 0, hold 0
   Number of transitions to forwarding state: 0
   Link type is point-to-point
   BPDU: sent 3, received 233

In the output above take a look at Designated port id. SW2 has no designated ports, so indeed upstream BPDU information is being analyzed.
Just to prove it let's swap ports on SW2:
Even though E0/0 on SW2 has lower Port ID, it is being blocked:
SW2#show spanning-tree detail | begin Port
 Port 1 (Ethernet0/0) of VLAN0001 is alternate blocking 
   Port path cost 100, Port priority 128, Port Identifier 128.1.
   Designated root has priority 32769, address aabb.cc00.6400
   Designated bridge has priority 32769, address aabb.cc00.6400
   Designated port id is 128.2, designated path cost 0
   Timers: message age 16, forward delay 0, hold 0
   Number of transitions to forwarding state: 0
   Link type is point-to-point
   BPDU: sent 2, received 121

 Port 2 (Ethernet0/1) of VLAN0001 is root forwarding 
   Port path cost 100, Port priority 128, Port Identifier 128.2.
   Designated root has priority 32769, address aabb.cc00.6400
   Designated bridge has priority 32769, address aabb.cc00.6400
   Designated port id is 128.1, designated path cost 0
   Timers: message age 16, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   Link type is point-to-point
   BPDU: sent 4, received 121

Dont' forget that Port ID consists of two parts:
- Port Priority - 128 by default, can be configured with values from 0 to 192 in increments of 64.
- Port ID - usually starts with 1 and increments by 1, but with chassis and LAGs this value can be not quite obvious.
Let's change E0/1 Port Priority on SW1, so SW2 will block E0/1 port.
SW1#show running-config interface e0/1
interface Ethernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
 duplex auto
 spanning-tree link-type point-to-point
 spanning-tree port-priority 64
end
SW2#show spanning-tree detail | begin Port
 Port 1 (Ethernet0/0) of VLAN0001 is root forwarding 
   Port path cost 100, Port priority 128, Port Identifier 128.1.
   Designated root has priority 32769, address aabb.cc00.6400
   Designated bridge has priority 32769, address aabb.cc00.6400
   Designated port id is 64.2, designated path cost 0
   Timers: message age 16, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   Link type is point-to-point
   BPDU: sent 5, received 316

 Port 2 (Ethernet0/1) of VLAN0001 is alternate blocking 
   Port path cost 100, Port priority 128, Port Identifier 128.2.
   Designated root has priority 32769, address aabb.cc00.6400
   Designated bridge has priority 32769, address aabb.cc00.6400
   Designated port id is 128.1, designated path cost 0
   Timers: message age 16, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   Link type is point-to-point
   BPDU: sent 4, received 317

As you can see, changing the Port Priority on the upstream switch affects blocking decision on the downstream switch.

The topology used along with the configuration files (IOU) is available here.

Thursday, March 13, 2014

Integrated Routing and Bridging (IRB).

The concept of IRB is very simple and straightforward. And somehow similar to the concept of vlans and inter-vlan routing. I was surprised that CCNP track didn't include this topic.
This feature is very useful when you need to span a vlan between several ports, but your platform doesn't support vlans, and using additional switch is not an option. Or you need to bridge non-IP protocol, and MPLS is not your protocol of love (:
The topology is simple:
Basic configuration of the router:
interface FastEthernet0/0
 no ip address
!
interface FastEthernet0/1
 no ip address
!
interface FastEthernet1/0
 ip address 10.0.1.2 255.255.255.0
As expected, PC1 and PC2 can't reach each other (routers do not forward broadcast packets), and PC3 is able to ping only the R1's fa1/0 interface IP. I am using VPCs to emulate end stations:
VPCS[1]> show
NAME   IP/MASK              GATEWAY           MAC                LPORT  RHOST:PORT
VPCS1  10.0.0.1/24          255.255.255.0     00:50:79:66:68:00  20000  127.0.0.1:30000
VPCS2  10.0.0.2/24          255.255.255.0     00:50:79:66:68:01  20001  127.0.0.1:30001
VPCS3  10.0.1.1/24          10.0.1.2          00:50:79:66:68:02  20002  127.0.0.1:30002
VPCS[1]> ping 10.0.0.2
host (10.0.0.2) not reachable
VPCS[3]> ping 10.0.1.2
10.0.1.2 icmp_seq=1 ttl=255 time=10.004 ms
10.0.1.2 icmp_seq=2 ttl=255 time=44.027 ms
10.0.1.2 icmp_seq=3 ttl=255 time=44.009 ms
10.0.1.2 icmp_seq=4 ttl=255 time=33.022 ms
10.0.1.2 icmp_seq=5 ttl=255 time=42.025 ms
Notice, that PC1 and PC2 have no default gateway set yet. Since they are in the same broadcast domain they should be able to reach one another.
The first task is to configure bridging between R1's fa0/0 anf fa0/1 interfaces. Actual configuration is simple:
R1(config)#bridge irb #Enabling IRB, without this command you can get into the issues with bridging IP and "no ip routing".
R1(config)#bridge 10 protocol ieee #Creating the bridge group with ID of 10 and using IEEE version of STP (I'll check this later).
R1(config)#interface fastEthernet 0/0
R1(config-if)#bridge-group 10 #Assign each interface to the bridge group.
R1(config-if)#interface fastEthernet 0/1
R1(config-if)#bridge-group 10
That's it:
VPCS[1]> ping 10.0.0.2
10.0.0.2 icmp_seq=1 ttl=64 time=21.010 ms
10.0.0.2 icmp_seq=2 ttl=64 time=22.015 ms
10.0.0.2 icmp_seq=3 ttl=64 time=20.012 ms
10.0.0.2 icmp_seq=4 ttl=64 time=19.010 ms
10.0.0.2 icmp_seq=5 ttl=64 time=20.011 ms
But they are not able to reach PC3.
VPCS[1]> ping 10.0.1.2
host (255.255.255.0) not reachable
Mainly because they have no default gateway set, let's fix it:
NAME   IP/MASK              GATEWAY           MAC                LPORT  RHOST:PORT
VPCS1  10.0.0.1/24          10.0.0.3       00:50:79:66:68:00  20000  127.0.0.1:30000
VPCS2  10.0.0.2/24          10.0.0.3       00:50:79:66:68:01  20001  127.0.0.1:30001
VPCS3  10.0.1.1/24          10.0.1.2          00:50:79:66:68:02  20002  127.0.0.1:30002
And of course R1 is bridging frames in this subnet and hasn't it in the routing table at all:
     10.0.0.0/24 is subnetted, 1 subnets
C       10.0.1.0 is directly connected, FastEthernet1/0
Next step is to create the BVI (Bridge Group Virtual Interface) and assign an IP address to it. You may think of it as of vlan interface.
R1(config)#interface bvi 10 #The number of the interface has to match the bridge group id configured earlier.
R1(config-if)#ip add 10.0.0.3 255.255.255.0
R1(config)#bridge 10 route ip #Enabling routing of the IP protocol.
That's it:
VPCS[1]> ping 10.0.1.1
10.0.1.1 icmp_seq=1 ttl=63 time=25.016 ms
10.0.1.1 icmp_seq=2 ttl=63 time=22.015 ms
10.0.1.1 icmp_seq=3 ttl=63 time=22.013 ms
10.0.1.1 icmp_seq=4 ttl=63 time=22.007 ms
10.0.1.1 icmp_seq=5 ttl=63 time=22.012 ms
Some useful commands to check:
R1#show interfaces irb
FastEthernet0/0
 Routed protocols on FastEthernet0/0:
  ip
 Bridged protocols on FastEthernet0/0:
  appletalk  clns       decnet     ip
 Software MAC address filter on FastEthernet0/0
  Hash Len    Address      Matches  Act      Type
  0x00:  0 ffff.ffff.ffff        22 RCV Physical broadcast
  0x15:  0 c200.1568.0000        20 RCV Interface MAC address
  0x15:  1 c200.1568.0000         0 RCV Bridge-group Virtual Interface
  0x2A:  0 0900.2b01.0001         0 RCV DEC spanning tree
  0xC0:  0 0100.0ccc.cccc         0 RCV CDP
  0xC2:  0 0180.c200.0000         0 RCV IEEE spanning tree
  0xC2:  1 0180.c200.0000         0 RCV IBM spanning tree
  0xC2:  2 0100.0ccd.cdce         0 RCV VLAN Bridge STP
FastEthernet0/1
 Routed protocols on FastEthernet0/1:
  ip
 Bridged protocols on FastEthernet0/1:
  appletalk  clns       decnet     ip
 Software MAC address filter on FastEthernet0/1
  Hash Len    Address      Matches  Act      Type
  0x00:  0 ffff.ffff.ffff         3 RCV Physical broadcast
  0x14:  0 c200.1568.0001         0 RCV Interface MAC address
  0x15:  0 c200.1568.0000         0 RCV Bridge-group Virtual Interface
  0x2A:  0 0900.2b01.0001         0 RCV DEC spanning tree
  0xC0:  0 0100.0ccc.cccc         0 RCV CDP
  0xC2:  0 0180.c200.0000         0 RCV IEEE spanning tree
  0xC2:  1 0180.c200.0000         0 RCV IBM spanning tree
  0xC2:  2 0100.0ccd.cdce         0 RCV VLAN Bridge STP
FastEthernet1/0
 Routed protocols on FastEthernet1/0:
  ip
BVI10
 Routed protocols on BVI10:
  ip
R1#show bridge 10 group
Bridge Group 10 is running the IEEE compatible Spanning Tree protocol
   Port 4 (FastEthernet0/0) of bridge group 10 is forwarding
   Port 5 (FastEthernet0/1) of bridge group 10 is forwarding
And last but not least thing to check, since we are bridging now and enabled STP, let's confirm that STP works on the routers. The topology is as following:
Configs of R2 and R3 are identical:
bridge irb
!
interface FastEthernet0/0
 no ip address
 bridge-group 10
!
interface FastEthernet0/1
 bridge-group 10
!
bridge 10 protocol ieee
Effectively I created the bridged loop here, but STP is working just as expected:
R2#show spanning-tree
 Bridge group 10 is executing the ieee compatible Spanning Tree protocol
  Bridge Identifier has priority 32768, address c202.1568.0000
  Configured hello time 2, max age 20, forward delay 15
  We are the root of the spanning tree
  Topology change flag not set, detected flag not set
  Number of topology changes 1 last change occurred 00:13:40 ago
          from FastEthernet0/1
  Times:  hold 1, topology change 35, notification 2
          hello 2, max age 20, forward delay 15
  Timers: hello 0, topology change 0, notification 0, aging 300

 Port 4 (FastEthernet0/0) of Bridge group 10 is forwarding
   Port path cost 19, Port priority 128, Port Identifier 128.4.
   Designated root has priority 32768, address c202.1568.0000
   Designated bridge has priority 32768, address c202.1568.0000
   Designated port id is 128.4, designated path cost 0
   Timers: message age 0, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   BPDU: sent 414, received 0

 Port 5 (FastEthernet0/1) of Bridge group 10 is forwarding
   Port path cost 19, Port priority 128, Port Identifier 128.5.
   Designated root has priority 32768, address c202.1568.0000
   Designated bridge has priority 32768, address c202.1568.0000
   Designated port id is 128.5, designated path cost 0
   Timers: message age 0, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   BPDU: sent 415, received 0

R2#show spanning-tree
 Bridge group 10 is executing the ieee compatible Spanning Tree protocol
  Bridge Identifier has priority 32768, address c203.1e50.0000
  Configured hello time 2, max age 20, forward delay 15
  Current root has priority 32768, address c202.1568.0000
  Root port is 4 (FastEthernet0/0), cost of root path is 19
  Topology change flag not set, detected flag not set
  Number of topology changes 0 last change occurred 00:15:16 ago
  Times:  hold 1, topology change 35, notification 2
          hello 2, max age 20, forward delay 15
  Timers: hello 0, topology change 0, notification 0, aging 300

 Port 4 (FastEthernet0/0) of Bridge group 10 is forwarding
   Port path cost 19, Port priority 128, Port Identifier 128.4.
   Designated root has priority 32768, address c202.1568.0000
   Designated bridge has priority 32768, address c202.1568.0000
   Designated port id is 128.4, designated path cost 0
   Timers: message age 2, forward delay 0, hold 0
   Number of transitions to forwarding state: 1
   BPDU: sent 0, received 420

 Port 5 (FastEthernet0/1) of Bridge group 10 is blocking
   Port path cost 19, Port priority 128, Port Identifier 128.5.
   Designated root has priority 32768, address c202.1568.0000
   Designated bridge has priority 32768, address c202.1568.0000
   Designated port id is 128.5, designated path cost 0
   Timers: message age 2, forward delay 0, hold 0
   Number of transitions to forwarding state: 0
   BPDU: sent 0, received 416
The topology used along with the configuration files is available here.

Wednesday, February 27, 2013

OSPF Network Types.

I think this topic is one of my weakest areas in the CCNP track. So I need to strengthen it. And the better way to do so is practice.
OSPF uses broadcast and DR/BDR elections which means some issues with underlying L2 protocols. So let's consider all L2 options and how OSPF handles them.

Point-to-point.
It is the easiest one:
R1#show running-config interface serial 1/0
interface Serial1/0
 ip address 10.0.0.1 255.255.255.0
 ip ospf 1 area 0
end
R1#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           0   FULL/  -        00:00:31    10.0.0.2        Serial1/0
R1#show ip ospf interface serial 1/0
Serial1/0 is up, line protocol is up
  Internet Address 10.0.0.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_POINT, Cost: 64
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

It is default network type for serial links. This type of media supports broadcast (and, therefore, OSPF multicast) so neighboring routers are automatically discovered.
The main reason for DR/BDR election is reducing of full-mesh LSA flooding between adjacent routers on the media. But serial links by default aren't multiaccess media, so DR/BDR election is not necessary.

Broadcast.
The second easiest one:

R1#show running-config interface FastEthernet 0/0
interface FastEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip ospf 1 area 0
end
R1#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           1   2WAY/DROTHER    00:00:39    10.0.0.2        FastEthernet0/0
3.3.3.3           1   FULL/BDR        00:00:37    10.0.0.3        FastEthernet0/0
4.4.4.4           1   FULL/DR         00:00:36    10.0.0.4        FastEthernet0/0
R1#show ip ospf interface FastEthernet 0/0
FastEthernet0/0 is up, line protocol is up
  Internet Address 10.0.0.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 10
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State DROTHER, Priority 1
  Designated Router (ID) 4.4.4.4, Interface address 10.0.0.4
  Backup Designated router (ID) 3.3.3.3, Interface address 10.0.0.3
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5


Non-Broadcast Multiaccess.
The rest of this post is related to obscure Frame Relay technology which I have never seen in real production networks. Configuration examples can be found here.
With Frame Relay you have several interface configuration options, namely - physical interface, point-to-point subinterfaces, point-to-multipoint subinterfaces. Let's consider all of them.

Connection using physical interfaces.
This is a hub-and-spoke topology with R1 as a hub-router, mening R2 and R3 don't have common DLCI.
R1#show running-config interface s1/0
interface Serial1/0
 ip address 10.0.0.1 255.255.255.0
 encapsulation frame-relay
 ip ospf 1 area 0
 no keepalive
 frame-relay interface-dlci 102
 frame-relay interface-dlci 103
 frame-relay lmi-type ansi
end

Because only R1 has DLCIs to all other routers, it should become DR, on other routers the ospf priority is set to 0:
R2#show running-config interface s1/0
interface Serial1/0
 ip address 10.0.0.2 255.255.255.0
 encapsulation frame-relay
 ip ospf priority 0
 ip ospf 1 area 0
 no keepalive
 frame-relay map ip 10.0.0.3 201
 frame-relay interface-dlci 201
 frame-relay lmi-type ansi
end
R1#show ip ospf interface serial 1/0
Serial1/0 is up, line protocol is up
  Internet Address 10.0.0.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type NON_BROADCAST, Cost: 64
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 1.1.1.1, Interface address 10.0.0.1
  No backup designated router on this network
  Timer intervals configured, Hello 30, Dead 120, Wait 120, Retransmit 5

The network type is non-broadcast which means that no OSPF multicast messages are allowed. So you need to manually specify neighbors, forcing OSPF to use unicast messages:
R1#show running-config | section router ospf
router ospf 1
 neighbor 10.0.0.2
 neighbor 10.0.0.3
R1#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           0   FULL/DROTHER    00:01:41    10.0.0.2        Serial1/0
3.3.3.3           0   FULL/DROTHER    00:01:55    10.0.0.3        Serial1/0


Notice, that with Frame Relay you actually can specify ospf network type as broadcast. But this will require frame-relay mappings with "broadcast" keyword:
R1#show running-config interface serial 1/0
interface Serial1/0
 ip address 10.0.0.1 255.255.255.0
 encapsulation frame-relay
 ip ospf network broadcast
 ip ospf 1 area 0
 no keepalive
 frame-relay map ip 10.0.0.3 103 broadcast
 frame-relay map ip 10.0.0.2 102 broadcast

 frame-relay interface-dlci 102
 frame-relay interface-dlci 103
 frame-relay lmi-type ansi
end
R1#show ip ospf interface serial 1/0
Serial1/0 is up, line protocol is up
  Internet Address 10.0.0.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type BROADCAST, Cost: 64
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 1.1.1.1, Interface address 10.0.0.1
  No backup designated router on this network
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
R1#show running-config | section router ospf 1
router ospf 1
 log-adjacency-changes

Router will send multicast packets as unicast according to configured Frame Relay mappings, which will lead essentially to dynamic neighbor discovery.
R1#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           0   FULL/DROTHER    00:00:36    10.0.0.2        Serial1/0
3.3.3.3           0   FULL/DROTHER    00:00:30    10.0.0.3        Serial1/0


Connection using point-to-point subinterfaces.
The topology is the same:
R1#show running-config interface serial 1/0
interface Serial1/0
 no ip address
 encapsulation frame-relay
 no keepalive
end
R1#show running-config interface serial 1/0.102
interface Serial1/0.102 point-to-point
 ip address 10.0.0.1 255.255.255.128
 ip ospf 1 area 0
 frame-relay interface-dlci 102
end
R1#show running-config interface serial 1/0.103
interface Serial1/0.103 point-to-point
 ip address 10.0.0.129 255.255.255.128
 ip ospf 1 area 0
 frame-relay interface-dlci 103

On other routers the configuration is almost the same.
R1#show ip ospf interface serial 1/0.102
Serial1/0.102 is up, line protocol is up
  Internet Address 10.0.0.1/25, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_POINT, Cost: 64
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_POINT
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

As we can see IOS uses point-to-point network type, which is pretty logical.
R1#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
2.2.2.2           0   FULL/  -        00:00:34    10.0.0.2        Serial1/0.102
3.3.3.3           0   FULL/  -        00:00:38    10.0.0.130      Serial1/0.103

And as long these interfaces are point-to-point we don't need DR/BDR on them.

Connection using point-to-multipoint subinterfaces.
R1#show running-config interface serial 1/0
interface Serial1/0
 no ip address
 encapsulation frame-relay
 no keepalive
end
R1#show running-config interface serial 1/0.1
interface Serial1/0.1 multipoint
 ip address 10.0.0.1 255.255.255.0
 ip ospf network point-to-multipoint
 ip ospf 1 area 0
 snmp trap link-status
 frame-relay map ip 10.0.0.3 103 broadcast
 frame-relay map ip 10.0.0.2 102 broadcast

end
R1#show ip ospf interface serial 1/0.1
Serial1/0.1 is up, line protocol is up
  Internet Address 10.0.0.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_MULTIPOINT, Cost: 64
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_MULTIPOINT
  Timer intervals configured, Hello 30, Dead 120, Wait 120, Retransmit 5

By default OSPF treats these multipoint-subinterfaces as regular non-broadcast interfaces, preventing dynamic neighbor discovery. Therefore "ip ospf network point-to-multipoint" is required. Frame relay mappings with "broadcast" keyword required as well. After this configuration OSPF treats each pair of routers (that have common DLCI) as point-to-point neighbors and DR/BDR therefore aren't needed:
R1#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
3.3.3.3           0   FULL/  -        00:01:43    10.0.0.3        Serial1/0.1
2.2.2.2           0   FULL/  -        00:01:59    10.0.0.2        Serial1/0.1


Alternatively you can use "ip ospf network point-to-multipoint non-broadcast". As with regular non-broadcast interfaces you have to specify neighbors manually, but no DR/BDR elections will occur, because each pair of adjacencies will be treated as point-to-point:
R1#show running-config interface serial 1/0.1
interface Serial1/0.1 multipoint
 ip address 10.0.0.1 255.255.255.0
 ip ospf network point-to-multipoint non-broadcast
 ip ospf 1 area 0
 frame-relay interface-dlci 102
#Notice, that there is no more frame-relay mappings due to lack of multicast requirement.
 frame-relay interface-dlci 103
end
R1#show running-config | section router ospf
router ospf 1
 neighbor 10.0.0.3
 neighbor 10.0.0.2
R1#show ip ospf interface serial 1/0.1
Serial1/0.1 is up, line protocol is up
  Internet Address 10.0.0.1/24, Area 0
  Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_MULTIPOINT, Cost: 64
  Enabled by interface config, including secondary ip addresses
  Transmit Delay is 1 sec, State POINT_TO_MULTIPOINT
  Timer intervals configured, Hello 30, Dead 120, Wait 120, Retransmit 5


To sum up the information above:
Type DR/BDR Dynamic Neighbors Hello/Dead Labels
Broadcast Y Y 10/40 Default for Ethernet links, requires broadcast mappings (for Frame Relay)
Non-Broadcast Y N 30/120 Default for Frame Relay physical and multipoint interfaces
Point-to-Point N Y 10/40 Default for Serial links and Frame Relay point-to-point subinterfaces
Point-to-Multipoint N Y 30/120 Requires static neighbors and broadcast mappings (for Frame Relay)
Point-to-Multipoint Non-Broadcast N N 30/120 Requires static neighbors

And the last important thing - you can mix network types on different ends of the link as long as they can interoprate with each other, in other words when these two types of networks both (not) require DR/BDR, dynamic neighbor discovery and have identical timers values:
OSPF over Frame-Relay – Part 6: Troubleshooting
Understanding OSPF Network Types

Saturday, November 3, 2012

Frame Relay configuration.

Logically it is a hub-and-spoke topology.
By default R2, R3 and R4 are able to ping only R1 and not each other, because frame relay routing is specified on FRSW.
FRSW - Frame Relay Switch configuration:
frame-relay switching
!
interface Serial0/0
 description To R1
 encapsulation frame-relay
#Default encapsulation for frame relay is cisco.
 clock rate 64000
#It is an DCE device (see the next command), therefore we need to specify the speed of the interface.
 frame-relay intf-type dce
 frame-relay route 102 interface Serial0/1 201
#Specify source DLCI and destination interface and the destination DLCI.
 frame-relay route 103 interface Serial0/2 301
#DLCI number has only local significance.
 frame-relay route 104 interface Serial0/3 401
#Thus we set up hub-and-spoke topology.
!
 interface Serial0/1
 description To R2
 no ip address
 encapsulation frame-relay
 clock rate 64000
 frame-relay intf-type dce
 frame-relay route 201 interface Serial0/0 102
#Specify the path from each spoke router to the hub router.
!
interface Serial0/2
 description To R3
 no ip address
 encapsulation frame-relay
 clock rate 64000
 frame-relay intf-type dce
 frame-relay route 301 interface Serial0/0 103
!
interface Serial0/3
 description To R4
 no ip address
 encapsulation frame-relay
 clock rate 64000
 frame-relay intf-type dce
 frame-relay route 401 interface Serial0/0 104

 
Basic Frame Relay configuration.
R1 configuration:
interface Serial0/0
 ip address 10.0.0.1 255.255.255.0
 encapsulation frame-relay
 frame-relay lmi-type cisco
#Actually, we don't need to specify LMI type because "cisco" is default.
On other routers we only change IP addresses according to the first picture.
At this point R1 has L3 connectivity with all other routers:
R1#ping 10.0.0.4
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.4, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/29/64 ms

We don't need to specify DLCI on R1, R2, R3, R4 because the LMI does all the work. And inverse ARP creates L2 to L3 mappings:
R1#sh frame-relay map
Serial0/0 (up): ip 10.0.0.2 dlci 102(0x66,0x1860), dynamic,
              broadcast,, status defined, active
Serial0/0 (up): ip 10.0.0.3 dlci 103(0x67,0x1870), dynamic,
              broadcast,, status defined, active
Serial0/0 (up): ip 10.0.0.4 dlci 104(0x68,0x1880), dynamic,
              broadcast,, status defined, active

As stated above, R2, R3 and R4 can only ping R1:
R3#ping 10.0.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 20/44/80 ms

But not each other:
R4#ping 10.0.0.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

To ping each other they need to be configured with inverse ARP mappings. Example for R2 and R3:
R2:
interface Serial0/1
 ip address 10.0.0.2 255.255.255.0
 encapsulation frame-relay
 frame-relay map ip 10.0.0.3 201 broadcast
R2#ping 10.0.0.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3:
interface Serial0/2
 ip address 10.0.0.3 255.255.255.0
 encapsulation frame-relay
 frame-relay map ip 10.0.0.2 301 broadcast
R3#ping 10.0.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/44/72 ms


You also can configure different interfaces types:
- point to point: each spoke will be put in a different subnet;
- point to multipoint: all routers in the same subnet (Frame Relay is NBMA).
In any of these scenarios R1 will route all traffic.

Configuring point to point interfaces.
R1:
interface Serial0/0
 no ip address
 encapsulation frame-relay
 serial restart-delay 0
 frame-relay lmi-type cisco
!
interface Serial0/0.102 point-to-point
 description To R2
 ip address 10.0.0.1 255.255.255.252
 frame-relay interface-dlci 102

!
interface Serial0/0.103 point-to-point
 description To R3
 ip address 10.0.0.5 255.255.255.252
 frame-relay interface-dlci 103
!
interface Serial0/0.104 point-to-point
 description To R4
 ip address 10.0.0.9 255.255.255.252
 frame-relay interface-dlci 104

Now we don't need LMI to get DLCI numbers. Instead we specify them with frame-relay interface-dlci command. Now we use point to point sub-interfaces, which means that it is no more NBMA and so shows inverse arp mappings:
R1#show frame-relay map
Serial0/0.104 (up): point-to-point dlci, dlci 104(0x68,0x1880), broadcast
          status defined, active
Serial0/0.102 (up): point-to-point dlci, dlci 102(0x66,0x1860), broadcast
          status defined, active
Serial0/0.103 (up): point-to-point dlci, dlci 103(0x67,0x1870), broadcast
          status defined, active

We changed addressing scheme, so we have to do the same on spoke routers. R2 as example:
interface Serial0/1
 ip address 10.0.0.2 255.255.255.252

Notice, that we don't need to configure sub-interfaces on spoke routers.
Now all routers can ping R1. To make them able to ping each other we need to specify default route (routers in different subnets now). R2 as example:
ip route 0.0.0.0 0.0.0.0 10.0.0.1
Notice, that if you specify here interface instead of IP-address, you will not be able to ping hosts in other subnets unless you create manual L2-L3 mapping (e.g. R3(config-if)#frame-relay map ip 10.0.0.10 301 broadcast).
Now routers should have full connectivity:
R3#ping 10.0.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/52/96 ms
R3#ping 10.0.0.10
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.10, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/56/88 ms

The main reason why you should configure point to point sub-interfaces is to avoid the split-horizon issue with routing protocols.

Configuring point to multipoint interfaces.
R1:
interface Serial0/0
 no ip address
 encapsulation frame-relay
!
interface Serial0/0.10 multipoint
 ip address 10.0.0.1 255.255.255.0
 frame-relay map ip 10.0.0.2 102 broadcast
 frame-relay map ip 10.0.0.3 103 broadcast
 frame-relay map ip 10.0.0.4 104 broadcast

On other routers we only change IP-addresses. R2 as example:
interface Serial0/2
 ip address 10.0.0.3 255.255.255.0
 encapsulation frame-relay

Now all router can ping R1. To ping each other they need to be configured with inverse ARP mappings. Example for R2 and R3:
R2:
interface Serial0/1
 ip address 10.0.0.2 255.255.255.0
 encapsulation frame-relay
 frame-relay map ip 10.0.0.3 201 broadcast
R2#ping 10.0.0.3
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
R3:
interface Serial0/2
 ip address 10.0.0.3 255.255.255.0
 encapsulation frame-relay
 frame-relay map ip 10.0.0.2 301 broadcast
R3#ping 10.0.0.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/44/72 ms

Wednesday, October 10, 2012

Static routes with outgoing interface or next-hop IP-address.

For static routes there are two options available:
ip route x.x.x.x x.x.x.x [next-hop-ip-address | outgoing interface]
It is said that when you specify the next-hop address it will cause a router to look in its routing table twice - first time to find the destination network and second time to find the outgoing interface. Therefore it is more advisably to specify the outgoing interface instead of next-hop ip address.
Let's investigate what will happen in this topology:
At the top of the picture there are mac-addresses of interfaces e0/0.
R3 has a static route to network 192.168.0.0/24.
Let's run wireshark on the link between routers and find out what it will send with simple "ping 192.168.0.10".
R3#ping 192.168.0.10

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.10, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

It doesn't matter that ping fails. Let's look into the dump:
R3 sends arp-request out of e0/0 for ip-address 192.168.0.10 even though this address is not in the same subnet as this interface. Furthermore R4 answers to this request with its mac-address. The reason for this is arp proxy. And after receiving this reply R3 starts pinging destination ip-address using this mac-address as destination.
But what will happen if I disable arp proxy?
R4(config)#int e0/0
R4(config-if)#no ip proxy-arp

As you can see R3 continuously sends arp-requests without success. This means that disabling arp proxy on the other side of the outgoing interface will completely destroy your static route with specified outgoing interface.
This is the reason why I prefer using static routes with next-hop address instead of outgoing interface.

Tuesday, September 25, 2012

Unknown unicast: router vs switch.

Unknown unicast - it is a frame with an unknown destination mac-address, which means that the switch/router doesn't have this mac-address in its' CAM. Thus the switch/router has no idea where to forward this frame.
The behavior of switches and routers is different here.
Switches flood this frame over all its' ports. If a frame belongs to some vlan - it is being flooded over the ports in this particular vlan.
Routers operate on layer 3, therefore this frame will be decapsulated in order to get the destination IP address. Before the encapsulation of this packet to L2 a router will send ARP request to match mac-address with destination IP-address. This causes some additional delays, e.g. - .!!!!