No more to say : http://www.gns3.com

To beeing keep updated : this new routers seems really well : IOS XE (IOSd over Linux, virtualization, …).

You can learn more about them on : http://lostintransit.se/2014/10/04/cisco-adds-new-routers-in-the-isr-4000-family/

Have fun to read this great article…

It is been a while that I read some papers about EVC, flexible matching, … But I have not found a good paper explaining EVC and a way to understanding well except to cisco configuration guide.

 

This figure is exactly what I searched for. This example is simple but enough to understand well how it works.

My misunderstanding was about “ingress” and “symmetric” : I didn’t understand, but now with the figure that it is clear that :

1. encapsulation dot1q 10 : match all frames where a dot1Q tag is present with value 10
2. “rewrite ingress tag pop 1 symmetric” : We pop 1 tag on this frame
3. Give this frame to the MPLS xconnect without any tag

When a frame comes from the xconnect :

1. It arrives without any tag
2. With “symmetric”, we push the 10 dot1q tag
3. put in TX the frame through the GigabitEthernet 0/2

You can ask me : “Ok this is really complicated your configuration, why don’t you use xxxx” ?
Where xxx is :

int gi 0/2
switchport trunk encapsulation dot1q
switchport trunk allow vlan 10
switchport mode trunk

int vl 10
xconnect 192.168.1.1 33 encapsulation mpls

I will reply : “Have you declare your vlan 100 on your switch ? What does it involve for the scalability ?”
=> Yes, you understand well : you are limited by the number of vlans.
=> With EVC : the “encapsulation dot1q 10” is local to the port. So no limitation.
=> Yes it is really great !!!!!

I urge you to read these papers :

• https://supportforums.cisco.com/document/85231/understanding-ethernet-virtual-circuits-evc
• http://ccie-in-3-months.blogspot.fr/2009/06/evc-flexible-frame-matching.html
• http://ccie-in-3-months.blogspot.fr/2009/06/evc-flexible-vlan-tag-rewrite.html
• http://ccie-in-3-months.blogspot.fr/2009/09/evc-flexible-service-mapping.html

BFD is a mecanism which give you access to a fast switchover for IGP, EBGP, … It is a RFC protocol : RFC5880.

BFD is a UDP protocol.

• BFD control : UDP / 3784
• BFD echo : UDP / 3785

BFD is in use on a segment, when a protocol needs it (such as : OSPF). It is configured by interface and called in protocol configuration.
When BFD detect a failure it informs upper protocols and helps to make a better / quick convergence.

You can configure BFD like :

Then you enable it on IGP configuration :

router ospf 1
 network 0.0.0.0 255.255.255.255 area 0
 bfd all-interfaces

BFD initialization works with a 4-state’s automate. These states are :

• ADMIN-DOWN
• DOWN
• INIT
• UP

ADMIN-DOWN : as it says the system want to hold the session DOWN by an administrative point of view : “I want to keep this session DOWN, so calm down and shut up as long as I say!”

DOWN : says that the session has just been created, administratively or operationnaly it maintains the state to DOWN until we receive a BFD DOWN control datagram from the other side : “We are agree that the session is DOWN, we can go on and try to initialize it!”

INIT : We come from DOWN state. Both systems are communicating. Until we receive an INIT or UP, we keep in INIT and send BFD INIT datagram.

UP : Ok both sides are agreed on INIT/UP we finalize the session and go together to UP states. We are UP until we detect it fails or ADMIN DOWN state is said to me ! So at TX interval we send Control packet with UP state until we detect a problem or been administratively set to DOWN.

Authentication :

BFD is aware of different authentication methods such as simple passowrd, MD5, SHA1.

Timers negotiation :

Timers are continually negotiated during the session by means of sending BFD Control datagram where :

• Interval : Max rate (minimum interval), we are able to send
• Min_RX : Minimum interval we are able to compute
• Min Echo RX : Minimum interval we are able to compute for the Echo function

• Multiplier : is a normal value which is used to calculate the Dead-Timer (HoldOn, …) : number of BFD datagrams lost in a row before we say that the session is DOWN. Dead Timer is : mult x max(desired TX interval , Required RX received interval)

So each side can adjust their timers and this at any time of the session life.

Demultiplexing :

To identify between multiple sessions between two systems, a discriminator (A unique ID). When we receive a BFD datagram with my discriminator, I know it is for __this session and I can compute it correctly.

Echo function :

This function is a way to detect and transmit packets/test forwarding plane : We send BFD echo packet with :

• IP SRC = Me
• IP DST = Me !
• UDP / 3785
• BFD information to demultiplex the session involved.

We can use Echo function only when BFD Control session is UP. After this, we can slow down sending BFD Control packet and only base failure detection by means of Echo function. We detect failure by using number of failure on a row as BFD Control Packets.

We can use BFD without this function only with BFD Control.

R1 (conf-if)# no bfd echo

Lab test :

You can find a cloudshark pcap trace here : https://www.cloudshark.org/captures/94617b9dc969

It consists of an BFD session initialization (you can find in the pcap by adding the filter : ‘bfd’). Then an outage has been produced by removing vlan on SW1 on the trunk (frame 249 : “Diag : Echo function failed”). And then allow it again on the trunk to reform the BFD session).

Checks :

R1#show bfd neighbors  details 

IPv4 Sessions
NeighAddr                              LD/RD         RH/RS     State     Int
155.1.13.3                              1/1          Up        Up        Et0/1.13
Session state is UP and using echo function with 500 ms interval.
Session Host: Software
OurAddr: 155.1.13.1     
Handle: 1
Local Diag: 0, Demand mode: 0, Poll bit: 0
MinTxInt: 1000000, MinRxInt: 1000000, Multiplier: 3
Received MinRxInt: 1000000, Received Multiplier: 3
Holddown (hits): 0(0), Hello (hits): 1000(30)
Rx Count: 31, Rx Interval (ms) min/max/avg: 1/1000/857 last: 681 ms ago
Tx Count: 32, Tx Interval (ms) min/max/avg: 1/999/840 last: 363 ms ago
Elapsed time watermarks: 0 0 (last: 0)
Registered protocols: OSPF 
Uptime: 00:00:26
Last packet: Version: 1                  - Diagnostic: 0
             State bit: Up               - Demand bit: 0
             Poll bit: 0                 - Final bit: 0
             C bit: 0                                   
             Multiplier: 3               - Length: 24
             My Discr.: 1                - Your Discr.: 1
             Min tx interval: 1000000    - Min rx interval: 1000000
             Min Echo interval: 500000  
R1#

Or on ASR9K or CRS plateform :

show bfd session 

—
Hope this help,

To understand well path through new chassis such as ASR9K, you could see this video (from Cisco Live 2014) and this blog post written by Ivan Pepelnjak, CCIE#1354. You could make a join between VOQ for QOS and LPTS/VOIP for ASR9K.

Have fun 🙂

Sometimes you need to remove SSH so that your customer will be able to access SSH behind NAT.

You can do this by means of :

no crypto key generate rsa

you device will reply you : no no !! You must do this :

crypto key zeroize rsa

such as :

Router(config)#no crypto key generate rsa 
% Use 'crypto key zeroize rsa' to delete signature keys.

Router(config)#crypto key zeroize rsa
% All RSA keys will be removed.
% All router certs issued using these keys will also be removed.
Do you really want to remove these keys? [yes/no]: yes
Router(config)#

For those of you who are planning your CCIE v5 lab, it can be useful to plan it by means of a spreadsheet instead of the PDF you can download on CLN.

You can download a XLS file here : blueprint-ccie-lab-v5.