Redback magic command

For those of you who are working with Redback equipments, this command can be useful :

[local]Redback# washoutthewash

Then you will have access to all commands the CLI hide you such as : ‘show sub ip’ or ‘show qos meter’ …

[CUSTOMER_1194]Redback# show sub act
CUST_8HL2@isp.vpn
        Session state Up
        Circuit   14/1:1 vpi-vci 1 928
        Internal Circuit   14/1:1:63/1/2/1407
        Interface bound  pppoe
        Current port-limit 1
        ppp mtu 1508 (applied)
        context-name CUSTOMER_1194 (applied)
        ip route 198.18.50.202 255.255.255.255 172.31.64.7  (applied)
        ip route 192.1.48.0 255.255.255.0 172.31.64.7  (applied)
        ip route 172.26.48.0 255.255.255.0 172.31.64.7  (applied)
        ip address 172.31.64.7 (applied)
        port-limit 1 (applied from sub_default)
[CUSTOMER_1194]Redback#show sub ?
  access-line       Show DSL line attributes of active subscribers
  active            Display active subscribers
  address           Display subscriber IP-Addresses
  agent-circuit-id  Show subscriber by agent circuit id
  agent-remote-id   Show subscriber by agent remote id
  all               Display all subscribers
  log               Display AAAd log
  session           Display subscriber by circuit
  summary           Display subscriber summary
  username          Display subscriber by username
  |                 Output Modifiers
  
[CUSTOMER_1194]Redback#washoutthewash
[CUSTOMER_1194]Redback#show sub ?
  access-line       Show DSL line attributes of active subscribers
  active            Display active subscribers
  address           Display subscriber IP-Addresses
  agent-circuit-id  Show subscriber by agent circuit id
  agent-remote-id   Show subscriber by agent remote id
  all               Display all subscribers
  debug             Display debug counters
  handle            Show subscriber by internal circuit handle
  ip-addr           Display subscriber by IP address
  log               Display AAAd log
  profile           Display subscriber profile info
  session           Display subscriber by circuit
  summary           Display subscriber summary
  username          Display subscriber by username
  |                 Output Modifiers
  
[CUSTOMER_1194]Redback#show sub ip 172.31.64.7
TYPE    CIRCUIT                    SUBSCRIBER         CONTEXT   START TIME    
--------------------------------------------------------------------------------
ppp     14/1:1 vpi-vci 1 928       CUST_8HL2@is CUSTOMER Aug 27 14:20:51
--------------------------------------------------------------------------------
Total=1
 
Type            Authenticating          Active          Disconnecting
PPP                          0               1                      0
PPPoE                        0               0                      0
DOT1Q                        0               0                      0
CLIPs                        0               0                      0
ATM-B1483                    0               0                      0
ATM-R1483                    0               0                      0
Mobile-IP                    0               0                      0
[CUSTOMER_1194]Redback#

GETVPN : Group Encrypted Transport VPN

Schema Here it comes. We will use the same topology as the last two blog posts.
This time we will play with GETVPN. GETVPN is a Cisco technology. One of the advantage of GETVPN is that we are able to build somespoke-to-spoke IPSEC tunnel without Tunnel interface and it is highly scalable.

We could say to me : ok, man ! but you could do this by means of static tunnels. Yes you can, BUT with GETVPN you can maintain easily full mesh networks by means of Key Server and the GETVPN technology.

Tunnel is build between GM (Group Member). The Key Server (KS) maintains security policies and is not part of the Forwarding Path. This server is here to provide security policy and make it possible to GM to build a encrypted tunnel between each other. No need to pass through a central node. GETVPN is a answer, DMVPN phase 3 is another 🙂

We have R4 as KS with a loopback address : 4.4.4.4/32
We have R2 and R3 as our spokes. These routers has each other a loopback 99 with a different /24 subnet.

  • R2 : 99.99.99.0/24
  • R3 : 100.100.100.0/24

Let’s go and see how it is configured. Begin with the Key Server :

crypto key generate rsa modulus 1024 label REKEYRSA

crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco address 0.0.0.0
crypto ipsec transform-set SET esp-3des esp-md5-hmac
 mode tunnel
crypto ipsec profile PROFILE
 set transform-set SET
crypto gdoi group GDOI-GROUP1
 identity number 12345
 server local
  rekey algorithm aes 128
  rekey authentication mypubkey rsa REKEYRSA
  rekey transport unicast
  sa ipsec 1
   profile PROFILE
   match address ipv4 getvpn-acl
   replay time window-size 5
   no tag
  address ipv4 4.4.4.4

ip access-list extended getvpn-acl
 permit ip 99.99.99.0 0.0.0.255 100.100.100.0 0.0.0.255
 permit ip 100.100.100.0 0.0.0.255 99.99.99.0 0.0.0.255
 deny   ip any any

Now R2 and R3 :

R2 : 

crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco address 0.0.0.0
crypto ipsec transform-set SET esp-3des esp-md5-hmac
 mode tunnel
crypto ipsec profile PROFILE
 set transform-set SET
crypto gdoi group GDOI-GROUP1
 identity number 12345
 server address ipv4 4.4.4.4
crypto map gdoimap 1 gdoi
 set group GDOI-GROUP1
 crypto map gdoimap

interface Ethernet0/1
 ip address 123.0.0.2 255.255.255.0
 ip router isis
 crypto map gdoimap
R3 : 
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco address 0.0.0.0
crypto ipsec transform-set SET esp-3des esp-md5-hmac
 mode tunnel
crypto ipsec profile PROFILE
 set transform-set SET
crypto gdoi group GDOI-GROUP1
 identity number 12345
 server address ipv4 4.4.4.4
crypto map gdoimap 1 gdoi
 set group GDOI-GROUP1
 crypto map gdoimap

GM use and interact with the KS to build their IPSec SA. Here, the security policy is identified by “identity number 12345”.

To make my topology works I have been obliged to add a static route towards my remote endpoints. I have been obliged to due to a bug on my IOS. It crashes if I add a “reverse-route” command in my crypto map.

Now, we could try to ping each other :

R2#  ping 100.100.100.3 so lo 99
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 100.100.100.3, timeout is 2 seconds:
Packet sent with a source address of 99.99.99.2
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/7 ms
R2#

Good ! it pings. Let’s see if it is encrypted :

https://www.cloudshark.org/captures/a99bd1404eaa or http://www.clucas.fr/downloads/GETVPN.pcap

Great it works 🙂

Now see some troubleshooting commands :

R2#show crypto session
Crypto session current status

Interface: Ethernet0/1
Session status: UP-ACTIVE
Peer: 0.0.0.0 port 500
  Session ID: 0
  IKEv1 SA: local 123.0.0.2/848 remote 4.4.4.4/848 Active
  IPSEC FLOW: deny ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0
        Active SAs: 0, origin: crypto map
  IPSEC FLOW: permit ip 100.100.100.0/255.255.255.0 99.99.99.0/255.255.255.0
        Active SAs: 2, origin: crypto map
  IPSEC FLOW: permit ip 99.99.99.0/255.255.255.0 100.100.100.0/255.255.255.0
        Active SAs: 2, origin: crypto map

R2#
R2#show crypto gdoi gm
Group Member Information For Group GDOI-GROUP1:
    IPSec SA Direction       : Both
    ACL Received From KS     : gdoi_group_GDOI-GROUP1_temp_acl

    Group member             : 123.0.0.2       vrf: None
       Local addr/port       : 123.0.0.2/848
       Remote addr/port      : 4.4.4.4/848
       fvrf/ivrf             : None/None
       Version               : 1.0.8
       Registration status   : Registered
       Registered with       : 4.4.4.4
       Re-registers in       : 2673 sec
       Succeeded registration: 1
       Attempted registration: 1
       Last rekey from       : 4.4.4.4
       Last rekey seq num    : 10
       Unicast rekey received: 2
       Rekey ACKs sent       : 2
       Rekey Rcvd(hh:mm:ss)  : 00:11:50
       DP Error Monitoring   : OFF

R2#
R2# show crypto ipsec sa

interface: Ethernet0/1
    Crypto map tag: gdoimap, local addr 123.0.0.2

   protected vrf: (none)
   local  ident (addr/mask/prot/port): (100.100.100.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (99.99.99.0/255.255.255.0/0/0)
   Group: GDOI-GROUP1
   current_peer 0.0.0.0 port 848
     PERMIT, flags={}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
    #pkts decaps: 25, #pkts decrypt: 25, #pkts verify: 25
[...]
   protected vrf: (none)
   local  ident (addr/mask/prot/port): (99.99.99.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (100.100.100.0/255.255.255.0/0/0)
   Group: GDOI-GROUP1
   current_peer 0.0.0.0 port 848
     PERMIT, flags={}
    #pkts encaps: 25, #pkts encrypt: 25, #pkts digest: 25
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
[...]

Ok each SA encrypt and decrypts the correct number of packets 🙂

KS side :

R4#show crypto gdoi ks
Total group members registered to this box: 2

Key Server Information For Group GDOI-GROUP1:
    Group Name               : GDOI-GROUP1
    Re-auth on new CRL       : Disabled
    Group Identity           : 12345
    Group Members            : 2
    IPSec SA Direction       : Both
    ACL Configured:
	access-list getvpn-acl


R4#show crypto gdoi ks acl
Group Name: GDOI-GROUP1
 Configured ACL:
   access-list getvpn-acl  permit ip 99.99.99.0 0.0.0.255 100.100.100.0 0.0.0.255
   access-list getvpn-acl  permit ip 100.100.100.0 0.0.0.255 99.99.99.0 0.0.0.255
   access-list getvpn-acl  deny ip any any


R4#

For more information : http://www.cisco.com/c/en/us/products/collateral/security/group-encrypted-transport-vpn/deployment_guide_c07_554713.html

Have fun with GETVPN !!

IPSEC VTI

IPSEC VTI stands for IPSEC Virtual Tunnel Interface.

Besides traditionnal IPSEC configuration with cyrpto map, VTI allows to use an interface. It is useful to apply some policies as we can do as other : service-policy, …

For this example, I will use the previous topology with four routers (R1, R2, R3, R4) : see the blog post below for a diagram.

I will implement a IPSEC VTI tunnel between R2 and R4.

VTI is really simple to implement :

 

R4#  show run int tun 11
Building configuration...

Current configuration : 179 bytes
!
interface Tunnel11
 ip address 11.1.1.4 255.255.255.0
 tunnel source Loopback0
 tunnel mode ipsec ipv4
 tunnel destination 2.2.2.2
 tunnel protection ipsec profile PROFILE
end

R4#show run | sec crypto
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco address 0.0.0.0        
crypto ipsec transform-set SET esp-3des esp-md5-hmac 
 mode tunnel
crypto ipsec profile PROFILE
 set transform-set SET 
R4#

And :

R2#show run | sec crypto
crypto isakmp policy 1
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key cisco address 0.0.0.0        
crypto ipsec transform-set SET esp-3des esp-md5-hmac 
 mode tunnel
crypto ipsec profile PROFILE
 set transform-set SET 
R2#show run int tun 11
Building configuration...

Current configuration : 179 bytes
!
interface Tunnel11
 ip address 11.1.1.2 255.255.255.0
 tunnel source Loopback0
 tunnel mode ipsec ipv4
 tunnel destination 4.4.4.4
 tunnel protection ipsec profile PROFILE
end

R2#

When the two tunnels are implemented the two tunnels states to up/up. Previous state is up/down.

We could do this kind of things and others :

 

R4(config)#int tun 11
R4(config-if)#service-policy output pm

R4#ping 11.1.1.2 rep 200
Type escape sequence to abort.
Sending 200, 100-byte ICMP Echos to 11.1.1.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
Success rate is 100 percent (200/200), round-trip min/avg/max = 3/7/25 ms
R4#show policy-map interface tunnel 11
 Tunnel11 

  Service-policy output: pm

    Class-map: class-default (match-any)  
      200 packets, 20000 bytes
      5 minute offered rate 0000 bps, drop rate 0000 bps
      Match: any 
R4#

DMVPN and QOS

How can DMVPN can make some QOS per spoke ?

It is what we will configure today :

Here is the network :

Schema
 

 

 

 

I will not explain how NHRP works in detail here.

R1, R2, R3, R4 use IS-IS (for fun) as IGP.

router isis
net 49.MAC_ADD.00

interface etc x/y
ip router isis

Now, here it comes DMVPN configurations :

R4#show run int tun 0
Building configuration...

Current configuration : 351 bytes
!
interface Tunnel0
 bandwidth 1000
 ip address 77.0.0.4 255.255.255.0
 no ip redirects
 ip nhrp authentication 1111
 ip nhrp map multicast dynamic
 ip nhrp map group toto service-policy output pm
 ip nhrp network-id 1111
 ip nhrp redirect
 load-interval 30
 qos pre-classify
 tunnel source Loopback0
 tunnel mode gre multipoint
 tunnel key 1111
end

R4#

And for R3 :

R3#show run int tun 0
Building configuration...

Current configuration : 340 bytes
!
interface Tunnel0
 ip address 77.0.0.3 255.255.255.0
 no ip redirects
 ip nhrp authentication 1111
 ip nhrp group toto
 ip nhrp map 77.0.0.4 4.4.4.4
 ip nhrp map multicast 4.4.4.4
 ip nhrp network-id 1111
 ip nhrp nhs 77.0.0.4
 ip nhrp shortcut
 qos pre-classify
 tunnel source Loopback0
 tunnel mode gre multipoint
 tunnel key 1111
end

R3#

!!! WARNING !!!  ‘ip nhrp group’ and ‘ip nhrp map group xxx service-policy output yyy’ commands are not displayed with ‘?’. But the correct way is ‘nhrp group xxx’ and ‘nhrp map group xxx service-policy out pm’.

The mapping of the policy-map on the multipoint tunnel is done when the NHRP request is sent (on the spoke we flag it by means of ‘ip nhrp group toto’). Some extra fields in the NHRP packet show that ‘this’ kind of trafic through this IP must be grouped with ‘this’ spoke.

We can see the mapping by :

4#show dmvpn detail
Legend: Attrb --> S - Static, D - Dynamic, I - Incomplete
	N - NATed, L - Local, X - No Socket
	# Ent --> Number of NHRP entries with same NBMA peer
	NHS Status: E --> Expecting Replies, R --> Responding, W --> Waiting
	UpDn Time --> Up or Down Time for a Tunnel
==========================================================================

Interface Tunnel0 is up/up, Addr. is 77.0.0.4, VRF ""
   Tunnel Src./Dest. addr: 4.4.4.4/MGRE, Tunnel VRF ""
   Protocol/Transport: "multi-GRE/IP", Protect ""
   Interface State Control: Disabled
   nhrp event-publisher : Disabled
Type:Hub, Total NBMA Peers (v4/v6): 2

# Ent  Peer NBMA Addr Peer Tunnel Add State  UpDn Tm Attrb    Target Network
----- --------------- --------------- ----- -------- ----- -----------------
    1 2.2.2.2                77.0.0.2    UP 09:21:51    D        77.0.0.2/32
    1 3.3.3.3                77.0.0.3    UP 09:22:34    D        77.0.0.3/32
NHRP group: toto
 Output QoS service-policy applied: pm


Crypto Session Details:
--------------------------------------------------------------------------------

Pending DMVPN Sessions:

R4#

And we can see statistics by this command :

R4#show policy-map multipoint Tunnel 0 3.3.3.3

Interface Tunnel0  3.3.3.3

  Service-policy output: pm

    Class-map: class-default (match-any)
      8 packets, 1061 bytes
      30 second offered rate 0000 bps, drop rate 0000 bps
      Match: any
R4#

Les grandes grandes vacances : enfin un vrai dessin animĂ© pour nos enfants…

Désolé pour les lecteurs anglophones, cela sera un article pour une fois en français et loin des sphères concernant Cisco et la certification CCIE.

Les grandes grandes vacances” est un dessin animĂ© rĂ©alisĂ© par la maison de production “Les armateurs“.

Cette série animée traite de la seconde guerre mondiale et de la résistance française. Le fait que les évènements se passent près de Dieppe en Normandie, rajoute à mon intérêt.

Je suis tombĂ© dessus avec mes enfants. Ils sont encore petits et ne comprennent pas tout ce qu’implique ce dessin animĂ©. Mais ce dernier est vraiment de qualitĂ© et permet je l’espère aux enfants d’aujourd’hui de comprendre l’Ă©poque Ă©voquĂ©, soit la seconde guerre mondiale, la rĂ©sistance, et la libertĂ©.

Cette Ă©poque rĂ©sonne particulièrement en moi et je voulais partager cet extraordinaire travail et j’espère que ce dessin animĂ© sera utilisĂ© afin d’Ă©duquer nos enfants et donc que cette pĂ©riode de notre histoire reste toujours ancrĂ© en nous. Ceci est nĂ©cessaire. Vu l’Ă©poque difficile oĂą la nous vivons, cette piqure de rappel est vraiment importante.

 

Dia and OSX Yosemite

For those of you whom are using this excellent opensource diagram software, since OS X Yosemite it seems it lacks one line to work correctly.
You must edit : ‘/Applications/Dia.app/Contents/Ressources/bin/dia’ and add at line 39 : “export DISPLAY=:O” such as :


[…]

 

fi
fi
export DISPLAY=:0
osascript -e ‘tell app “XQuartz” to launch’
for i in `seq 1 30`; do

[…]


 

Now it must work correctly 🙂

Source : http://navkirats.blogspot.fr/2014/10/dia-diagram-mac-osx-yosemite-fix-i-use.html

OSPF : Outbound filtering

If you read/see videos about OSPF, it will be said that you can only filter on INBOUND or 1/0 on OUTBOUND (via ip ospf database-filter all out / neighbor x.x.x.x database-filter all out).
You will say to me, no problem I can filter by means of “area range xxxxx not-advertise” (LSA Type 3) or “summary-address xxxx no-advertise” (LSA Type 5).
Ok, now let’s say, I want with distribute-list and ACL, you filter out some routes ?

You could do this as :

R1(config-router)#distribute-list 10 out connected
R1(config-router)#do sh run | sec router
router ospf 1
 router-id 1.1.1.1
 no capability transit
 area 14 nssa
 summary-address 10.1.4.4 255.255.255.255 not-advertise
 summary-address 10.22.4.4 255.255.255.255 not-advertise
 network 10.1.1.1 0.0.0.0 area 0
 network 10.1.14.0 0.0.0.255 area 14
 network 11.1.1.0 0.0.0.255 area 0
 neighbor 11.1.1.2 database-filter all out
 distribute-list 10 out connected
 distance 255 9.9.9.9 0.0.0.0 41
R1(config-router)#

And you could do more :

R1(config-router)#distribute-list 10 out ?
  Async              Async interface
  Auto-Template      Auto-Template interface
  BVI                Bridge-Group Virtual Interface
  CDMA-Ix            CDMA Ix interface
  CTunnel            CTunnel interface
  Dialer             Dialer interface
  Ethernet           IEEE 802.3
  GMPLS              MPLS interface
  LongReachEthernet  Long-Reach Ethernet interface
  Loopback           Loopback interface
  Lspvif             LSP virtual interface
  MFR                Multilink Frame Relay bundle interface
  Multilink          Multilink-group interface
  Null               Null interface
  Tunnel             Tunnel interface
  Vif                PGM Multicast Host interface
  Virtual-PPP        Virtual PPP interface
  Virtual-Template   Virtual Template interface
  Virtual-TokenRing  Virtual TokenRing
  bgp                Border Gateway Protocol (BGP)
  connected          Connected
  eigrp              Enhanced Interior Gateway Routing Protocol (EIGRP)
  isis               ISO IS-IS
  lisp               Locator ID Separation Protocol (LISP)
  ospf               Open Shortest Path First (OSPF)
  ospfv3             OSPFv3
  rip                Routing Information Protocol (RIP)
  static             Static routes
  vmi                Virtual Multipoint Interface
  

Have lot of fun to lab all these great OSPF features.

Holidays

During these holidays on this beginning of may has been used for work at home and in our garden. Nevertheless, some work has been done on OSPF during these last two weeks. CCIE studies has been indeed slower than in April. It will be at 100% in beginning of the next week.

Some fun on this off-day.

I have found again this networking game. The first time I play with it was in 2009. It was fun to take some hours to play with it.
It is not hosted by Cisco, so if you want to retrieve the archive you can download it here for those of you that were not in this industry or not know this cisco networking game.