BFD between IOSXE and IOS XR

I don’t really easily documentary to configure BFD (RFC5880 and you could read precedent blog-post : BFD : Bidirectional Forwarding Detection (RFC5880)) between IOSXE and IOSXR boxes.

Here it comes 🙂

 

IOSXE : 

R0# show run | sec bfd 
bfd fast-timers-on-slow-interface
bfd-template single-hop BFD
   interval min-tx 200 min-rx 200 multiplier 3
[...]
R0#show run int port-ch 14
Building configuration...

Current configuration : 373 bytes
!
interface Port-channel14
description *** Vers R1_Be10000 ***
mtu 9202
ip address 172.18.255.29 255.255.255.252
ip ospf authentication message-digest
ip ospf message-digest-key 10 md5 7 XXXXXXXXXXXXXXXXXX
ip ospf network point-to-point
ip ospf bfd
ip ospf cost 20000
no negotiation auto
mpls ip
port-channel bfd destination ipv4 172.18.255.30 BFD
end

R0#

IOS XR : 

RP/0/RSP0/CPU0:R1#show conf run int be10000
Tue Feb 14 14:49:35.026 CET
interface Bundle-Ether10000
description *** Vers R0_Po14 *** 
bfd mode ietf
bfd address-family ipv4 multiplier 3
bfd address-family ipv4 destination 172.18.255.29
bfd address-family ipv4 fast-detect
bfd address-family ipv4 minimum-interval 200
mtu 9216
ipv4 address 172.18.255.30 255.255.255.252
!

RP/0/RSP0/CPU0:R1#

[FR] — Parce qu’on a tjs des bonnes intentions en dĂ©but d’annĂ©e…

J’ai eu de bonnes intentions en dĂ©but d’annĂ©es de produire du contenu en Français sur diffĂ©rents sujets rĂ©seaux et tĂ©lĂ©coms de niveau basiques, mais j’avoue que cela s’est vite arrĂŞtĂ©.

Le but Ă©tait de fournir tout en un :

  • Video explicative ;
  • Une fiche d’Ă©tude rapide au format cheatsheet ;
  • Un guide de travail ;
  • Un accès Ă  un lab guidĂ©

Bon j’avoue cela prend Ă©normĂ©ment de temps et d’autres projets personnels sont venus s’intercalĂ©s.

Bref autant partagĂ© ce qu’il en reste et amusez-vous bien :

Soyez pas trop durs …

L’accès Ă  la partie Lab est bien Ă©videmment depuis pĂ©rimĂ© (on peut donner des durĂ©es d’utilisation avec pnetlab :)).

A plus,

Christophe

xrv9k-full, qemu, AMD Ryzen

If as me you have EVE-NG (2.0.3) and lab some Cisco XRV9K-Full on a virtualized box running AMD Ryzen processor, you have probably encountered problem to start the image. After reading lot of website, it seems the answer is change the command line.

My original command line is :

-enable-kvm -smbios type=1,manufacturer="cisco",product=\"Cisco IOS XRv 9000\",uuid=[...] -cpu host

I correct to :

-enable-kvm -smbios type=1,manufacturer="cisco",product="Cisco IOS XRv 9000",uuid=[...] -cpu qemu64,+ssse3,+sse4.1,+sse4.2

IOS, IOS XE and configure … revert timer X

If you are familiar with IOS XR and JunOS, it lacks a rollback to IOS and IOS XE. You can do it with “archive” such as :

  1. Configure where your archive will be stored.
  2. Say to your OS to “archive” at a point
  3. Configure your router with a “revert timer”
  4. Confirm if it is ok for you

Here we go in details now :

  1. Configure where your archive will be stored.
Router# conf t
Router(conf)# archive
Router(conf-archive)# path bootflash:myconfig
Router(conf-archive)# maximum 10
Router(conf-archive)# end
Router# wr

2. Say to your OS to “archive” at a point

Router# archive config 
Router# 
Router# show archive
The maximum archive configurations allowed is 10.
There are currently 1 archive configurations saved.
The next archive file will be named bootflash:myconfig-<timestamp>-1
 Archive #  Name
   1        bootflash:myconfig-Jan--3-2022-08-34-34.348-CET-0 <- Most Recent
   2         
   3         
   4         
   5         
   6         
   7         
   8         
   9         
   10   
Router#     

3. Configure your router with a “revert timer”

Router# configure terminal revert timer 1
Router(conf)# Rollback Confirmed Change: Backing up current running config to bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1

Enter configuration commands, one per line.  End with CNTL/Z.
Router(config)#Rollback Confirmed Change: Rollback will begin in one minute.
Enter "configure confirm" if you wish to keep what you've configured

*Jan  3 2022 08:35:01.670 CET: %ARCHIVE_DIFF-5-ROLLBK_CNFMD_CHG_BACKUP: Backing up current running config to bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1
*Jan  3 2022 08:35:01.670 CET: %ARCHIVE_DIFF-5-ROLLBK_CNFMD_CHG_START_ABSTIMER: User: console(Priv: 15, View: 0): Scheduled to rollback to config bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1 in 1 minutes
*Jan  3 2022 08:35:01.670 CET: %ARCHIVE_DIFF-5-ROLLBK_CNFMD_CHG_WARNING_ABSTIMER: System will rollback to config bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1 in one minute. Enter "configure confirm" if you wish to keep what you've configured
Router(conf)# hostname BLAH
BLAH(conf)#
[................... WAITING FOR A MINUTE ........................]
Rollback Confirmed Change: rolling to:bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1

!Pass 1
!List of Rollback Commands:
no hostname BLAH
hostname Router
end


Total number of passes: 1
Rollback Done

*Jan  3 2022 08:36:01.669 CET: %ARCHIVE_DIFF-5-ROLLBK_CNFMD_CHG_ROLLBACK_START: Start rolling to: bootflash:myconfig-Jan--3-2022-08-35-01.511-CET-1
*Jan  3 07:36:01.722: Rollback:Acquired Configuration lock.


Router(conf) # end

4. Confirm if it is ok for you

If between your “conf t revert time X” and t0+X, you are ok with the configuration you have made, so you can confirm your changes.

Router# configure confirm

That’s it ! Have fun.

Long long time ago, blog and FreeBSD…

It was a long long timeago I wrote here. ot of things happens to me but I don’t think it is the time and place to explain it.

This post is about a new experience to me : hosting this blog on FreeBSD machine. I am in love with BSD but don’t use it everyday. Networking&Telco is not an professional area where you can use it or your employer allow you to use it. Damn Windows, Teams, … and his egemony.

I will move this blog from Debian to FreeBSD server. I think it will lot of fun. If I have FreeBSD’s tips or remarks I will post it here. By the way I am currently studying for Cisco’s CCNP SPCOR (350-501) exam. Either I will try to give me a kick in the ass to post more technical posts.

Have fun 🙂

Cisco & IP NAT

Hi,

It’s been a while I have posted a blog entry. A simple tip from IOS 12.4(20) to 12.4(24) and above to use OID “.1.3.6.1.4.1.9.10.77.1.2.3.0” to graph your NAT translations :


R(conf)# ip nat service enable-mib
%NAT: Old NAT-MIB support enabled
R(conf)#

HTH
++Christophe

Site to site IKEv2 tunnel

Hello guys,

Here it is a tips / reminder how to implement an site-ot-site IKEv2 tunnel :

crypto ikev2 proposal aes-cbc-256-proposal 
 encryption aes-cbc-256
 integrity sha1
 group 2
crypto ikev2 policy policy1 
 match address local x.x.x.x
 proposal aes-cbc-256-proposal
crypto ikev2 keyring v2-kr1
 peer abc
  address y.y.y.y
  pre-shared-key somesecretpass
 !
crypto ikev2 profile profile1
 description IKEv2 profile
 match address local x.x.x.x
 match identity remote address y.y.y.y 255.255.255.255 
 authentication local pre-share
 authentication remote pre-share
 keyring v2-kr1

crypto ipsec transform-set myset esp-des esp-md5-hmac 

crypto map mymap 20 ipsec-isakmp 
 set peer y.y.y.y
 set security-association lifetime seconds 27000
 set transform-set ESP-AES-SHA 
 set ikev2-profile profile1
 match address 120

With ACL 120 is your flows / SA and your implement your crypto map on your WAN interface.

IPv6 prefix delegation feature

We will dive into IPv6 prefix delegation prefix.

First of all, we will make a real simple topology :

R1 acts as a DHCP server and use the prefix delegation feature. But how it works ? How it is configured ?

R1 :

ipv6 unicast-routing
ipv6 cef
ipv6 dhcp pool POOLv6
 prefix-delegation pool p lifetime 180 120
 domain-name lucas.fr.eu.org

ipv6 local pool p 2001:DB8::/40 48

interface FastEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 duplex half
 ipv6 address 2A02::1/48
 ipv6 enable
 ipv6 dhcp server POOLv6


R1#   show ipv6 dhcp interface 
FastEthernet0/0 is in server mode
  Using pool: POOLv6
  Preference value: 0
  Hint from client: ignored
  Rapid-Commit: disabled
R1#

R2 :

interface FastEthernet0/0
 duplex half
 ipv6 address autoconfig default
 ipv6 enable
 ipv6 dhcp client pd prefix-from-provider

interface FastEthernet1/1
 no ip address
 duplex auto
 speed auto
 ipv6 address prefix-from-provider ::1:0:0:0:1/64
 ipv6 enable

R2#show ipv6 dhcp interface 
FastEthernet0/0 is in client mode
  Prefix State is OPEN
  Renew will be sent in 00:00:04
  Address State is IDLE
  List of known servers:
    Reachable via address: FE80::C805:ADFF:FE80:0
    DUID: 00030001CA05AD800000
    Preference: 0
    Configuration parameters:
      IA PD: IA ID 0x00040001, T1 60, T2 120
        Prefix: 2001:DB8::/48
                preferred lifetime 120, valid lifetime 180
                expires at May 03 2016 10:53 PM (125 seconds)
      Domain name: lucas.fr.eu.org
      Information refresh time: 0
  Prefix name: prefix-from-provider
  Prefix Rapid-Commit: disabled
  Address Rapid-Commit: disabled
R2#

Debug trace on R2 (debug ipv6 dhcp) :

*May  3 22:36:11.859: IPv6 DHCP: Sending RENEW to FF02::1:2 on FastEthernet0/0
*May  3 22:36:11.859: IPv6 DHCP: DHCPv6 changes state from OPEN to RENEW (TIMEOUT) on FastEthernet0/0
*May  3 22:36:11.879: IPv6 DHCP: Received REPLY from FE80::C805:ADFF:FE80:0 on FastEthernet0/0
*May  3 22:36:11.879: IPv6 DHCP: Processing options
*May  3 22:36:11.879: IPv6 DHCP: Adding prefix 2001:DB8::/48 to prefix-from-provider
*May  3 22:36:11.883: IPv6 DHCP: T1 set to expire in 60 seconds
*May  3 22:36:11.883: IPv6 DHCP: T2 set to expire in 120 seconds
*May  3 22:36:11.883: IPv6 DHCP: DHCPv6 changes state from RENEW to OPEN (REPLY_RECEIVED) on FastEthernet0/0

We have acquired the prefix via PD aka Prefix Delegation feature :

R2#show ipv6 general-prefix 
IPv6 Prefix prefix-from-provider, acquired via DHCP PD
  2001:DB8::/48 Valid lifetime 158, preferred lifetime 98
   FastEthernet1/1 (Address command)
R2#

On R3 or R4 :

interface FastEthernet0/0
 no ip address
 duplex half
 ipv6 address autoconfig default
 ipv6 enable
end


2#show ipv6 dhcp interface 
FastEthernet0/0 is in client mode
  Prefix State is OPEN
  Renew will be sent in 00:00:04
  Address State is IDLE
  List of known servers:
    Reachable via address: FE80::C805:ADFF:FE80:0
    DUID: 00030001CA05AD800000
    Preference: 0
    Configuration parameters:
      IA PD: IA ID 0x00040001, T1 60, T2 120
        Prefix: 2001:DB8::/48
                preferred lifetime 120, valid lifetime 180
                expires at May 03 2016 10:53 PM (125 seconds)
      Domain name: lucas.fr.eu.org
      Information refresh time: 0
  Prefix name: prefix-from-provider
  Prefix Rapid-Commit: disabled
  Address Rapid-Commit: disabled
R2#

If we debug we will see (debug ipv6 interface, debug ipv6 dhcp, debug ipv6 nd) :

May  3 22:05:01.335: ICMPv6-ND: Neighbour FE80::C806:ADFF:FE81:1D on FastEthernet0/0 : LLA ca06.ad81.001d
*May  3 22:05:01.335: ICMPv6-ND: INCMP -> STALE: FE80::C806:ADFF:FE81:1D
*May  3 22:05:01.335: IPv6-Address: intfid_algo is notactive on intf 4
*May  3 22:05:01.339: IPv6-Address: intfid_algo is active on intf 4
*May  3 22:05:01.339: IPv6-Address: Generating IntfID rc 0, prefix: 2001:DB8:0:1::/64, address 2001:DB8:0:1:C808:ADFF:FE85:0
*May  3 22:05:01.343: IPv6-Address: Prefix Information change for 2001:DB8:0:1::/64, 0x0 -> 0x1E0
*May  3 22:05:01.343: IPv6-Address: Adding prefix 2001:DB8:0:1::/64 to FastEthernet0/0
*May  3 22:05:01.343: IPv6-Address: Adding operating owner prefix configured on FastEthernet0/0
*May  3 22:05:01.347: IPv6-Address: Adding operating owner address configured on FastEthernet0/0
*May  3 22:05:01.347: IPv6-Address: Address 2001:DB8:0:1:C808:ADFF:FE85:0 configured on FastEthernet0/0
*May  3 22:05:01.347: IPv6-Addrmgr-
R4(config-if)#ND: DAD request for 2001:DB8:0:1:C808:ADFF:FE85:0 on FastEthernet0/0
*May  3 22:05:01.347: ICMPv6-ND: Sending NS for 2001:DB8:0:1:C808:ADFF:FE85:0 on FastEthernet0/0
*May  3 22:05:01.351: ICMPv6-ND: Autoconfiguring 2001:DB8:0:1:C808:ADFF:FE85:0 on FastEthernet0/0
*May  3 22:05:02.351: IPv6-Addrmgr-ND: DAD: 2001:DB8:0:1:C808:ADFF:FE85:0 is unique.
*May  3 22:05:02.351: ICMPv6-ND: Sending NA for 2001:DB8:0:1:C808:ADFF:FE85:0 on FastEthernet0/0
*May  3 22:05:02.355: IPv6-Address: Address 2001:DB8:0:1:C808:ADFF:FE85:0/64 is up on FastEthernet0/0

Finally, we are able to ping the DHCPv6 server :

R4#ping ipv6 2A02::1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2A02::1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 32/45/96 ms
R4#traceroute 2A02::1

Type escape sequence to abort.
Tracing the route to 2A02::1

  1 2001:DB8:0:1::1 12 msec 36 msec 12 msec
  2 2A02::1 8 msec 56 msec 36 msec
R4#