Converging On The Edge

DHCP Options

Calix AE ONTs need option 66 as well as option 43 configured on the DHCP server to function correctly.

Option 66

Option 66 is used to the inform the ONTs of a TFTP server. The ONTs will use the TFTP server to download a config as well as the current firmware.

NOTE: There are two options for configuring a tftp server on Cisco equipment, option 150 and option 66. Option 150 is a Cisco properiarty option whereas option 66 is a IETF standard.

Option 43

Option 43 is the "vendor specific information" option. In the case of Calix ONTs, it informs them of the IP address of the CMS server (and optionally a syslog server). In addition to option 43, you will want to configure option 60. The DHCP server - the ASA in this instance - will use option 60 as a "vendor-ID".

The DHCP server will only send option 43 when the vendor ID matches what was configured for option 60 to the vendor ID set in the DHCP discover packet from the ONT.

Caveats and tips

You will also want to make sure the IP addresses that you configure in the DHCP options matches what was configured in CMS. Also, that you have network connectivity from the ONT to the IP adddress configured in the DHCP options.

In my case, I had to configure a secondary TFTP IP address on the CMS server. The IP address I used in the DHCP options was not the primary IP configured for the CMS server TFTP options.

ASA Configuration

Below is the full DHCP configuration for the ASA. It is simple, but notice the options are configured as ascii. At first I tried using ip, because, of course, that seemed the most logical. But after testing, I realized that you must configure the options with the ascii keyword. Also, make sure NOT to put quotes around the IP address, each vendor is different and some want the quotes and others do not.

dhcpd option 66 ascii 172.27.3.11 dhcpd option 43 ascii 172.27.3.11 dhcpd option 60 ascii CalixONT ! dhcpd address 10.118.1.10-10.118.1.41 inside dhcpd enable inside

Also, here is the verision of code I was running on the ASA when this was configured and working.

ASA_5505(config)# sho ver Cisco Adaptive Security Appliance Software Version 8.2(5) Device Manager Version 6.4(5)

Arrogance, what does it looks like?

Maybe you have trouble putting it into words, but most of us can easily spot an arrogant person. 

It's the women in the meeting who's always giving her opinion, as if it is fact. Or the guy you purposely avoid conversation with, because you know it's going to be about his own rightness, or how wrong so and so is.

It's the guy or girl who never listens to what anyone says. Who isn't a team player, and never admits to being wrong. They could be caught red handed and still believe their right.

(At least outwardly)

OK, you get the picture. It is pretty easy to spot an arrogant person.

Confidence, what does it looks like?

I would characterize someone who is confident as a person willing to listen to others. Someone who is able to hear a differing viewpoint and not be threatened by it. This person will know where their knowledge ends about a particular subject. They also can explain their viewpoint clearly, in not so many words.

He or she is not prone to self-promotion and isn't afraid of failure. This person will view failure as an opportunity to learn, not an opportunity for others to see their weakness. They are in a relentless pursuit for truth, and won't stand for anything but truth, regardless if their is a potential for failure.

A call to be better

Bottom line, arrogance will destroy your relationships and your career. There will be a day when what you say - all the crap that you spew - will come crashing down on your head. The proverbial "poopy" (as my kids would say) will hit the fan. Your complete "confidence" and "assurance" of your design, implementation, or whatever it may be is going to fail and fail miserably. And when it does, don't blame others. It's your fault and you will have to deal with it. Your boss and co-workers won't be sympathetic. You will burn bridges, and you will pay for it.

Another thing, don't be fooled and think you are being "confident" because you can out argue someone. Or just because you can put people down, demean them. Sorry, but that isn't confidence. It is arrogance and stupidity. I am going to take a guess and say nine times our of ten your arrogance stems from your insecurity and you're trying to over compensate by making other people look dumb so you look smarter. You're not being confident, you're being foolish.

You see, no one likes an arrogant person. Who wants to work with someone who is ALWAYS right?

So this is my plea. I am urging everyone to strive, no fight to remove all arrogance from your life. It is so important that our workplaces and homes are filled with confident people, not arrogant people.

How to be confident

It's easy to be more confident. Just become a life time student. Whatever it may be, just keep learning. Learning is the best way to be confident and to fight against arrogance. Someone who is confident, is confident because they have studied and they know where their knowledge ends. Being a life time student means in all your conversations you are looking to learn - not to be right.

If you are knowledgable because you actually put in the hard time, you will be less prone to arrogance. You know what you are talking about so you won't feel insecure. You can have an intelligent conversation with whomever is sitting across the table from you, friend or foe.

When you present your ideas, they will be born out of study, so you will be confident they are correct. At the same time, because you are in a relentless pursuit of truth, you are willing to listen to others who challenge your ideas. (After all, no one is perfect and you may be wrong)

Sad truth

If we are all truthful with ourselves, we'd admit that we all have arrogance looming around. At one time or another it comes out. Sometimes in a small way. Other times in a very spectacular way. For me, it rears its ugly head more times than I'd care to admit. It's there, you just need to acknowledge that it is.

The question then is, "how are we doing with it". Are we learning to overcome? Is our life marked by arrogance, or are we increasingly becoming more confident and less arrogant?

If you want to get ahead in your career. If you want to have better relationships with your friends, family, or co-workers. You need to be done with arrogance. You have to stop pushing everyone away because of your insecurities. You need to read more, study more, and realize nothing comes easy. It is the only way to have any rewarding career, or life.

When you put the work in. When you really begin to understand a subject, your boss will take notice (in a good way). He (or she) will gain confidence in your work. Respect your opinion - and who knows maybe you two will start getting along!

If time and time again you come to the table with accurate information that is well thought out, well studied, people will recognize it. When you can have a conversation and really value someone else's viewpoint, they will want to talk with you. They will want to work with you.

I can't stress it enough, arrogance will you get no where in a hurry. Confidence, or truth-seeking, will get you to the right place every time.

What has been your experience? Can you see your own arrogance (come on don't leave me hanging up here all alone)?

CJ

Creating a RAMDisk

Creating a RAMDisk is a different process for each OS.

Linux

Linux - or at least Ubuntu - is the easiest to configure. The RAMDisk is created by default by the OS. When you first install the OS it allocates /run/shm as a RAMDisk for programs to use for storing files.

To determine if your system has it run "df -h" on the CLI.

Ubuntu@Desktop:/opt/gns3$ df -h Filesystem Size Used Avail Use% Mounted on /dev/sda1 20G 8.5G 11G 46% / udev 5.9G 4.0K 5.9G 1% /dev tmpfs 2.4G 1.1M 2.4G 1% /run none 5.0M 0 5.0M 0% /run/lock none 5.9G 7.8M 5.9G 1% /run/shm /dev/sda3 1.8T 260G 1.5T 15% /home

Notice the 5.9G allocated to /run/shm, that is our RAMDisk. It is possible to adjust the default size of the RAMDisk. For more infomoration see here.

Windows

Windows, while not as easy at *nix, isn't really that difficult. To create a RAMDisk you will need to download and install a program called, oddly enough, RAMDisk.

The software is free with the caveat that it is used for personal use and the disks cannot be larger than 4GB in size. If you need something bigger than 4GB then you will need purchase a license.

Once the software is installed, launch it and adjust the size of the disk under the settings tab. After that just start the RAMDisk.

GNS3 Setup

The last step is to configure the dynamips preferences within GNS3.

Launch GNS3 and go to "edit" then "preferences". From there click on "dynamips" and find the "Working directory for Dynamips:" textbox.

In this textbox put the full path to your newly created RAMDisk and hit "Apply" then "OK". You can see from the screenshot above that I am using /run/shm which is my RAMDisk on my Ubuntu machine.

That's is, now fire up a lab and watch your routers fly! You can verify that everything is working by viewing the RAMDisk and checking that dynamips has created the temp files.

[Update]: You may have to reboot GNS3 once you configure the dynamips working directory setting.

Hope that helps. Leave any tips that you might have in the comments.

Happy Lab'ing,

Your typical business or remote site that has a dual-homed connection will look like the following:

Connecting a business or remote site to multiple ISPs requires only a few steps. First you need to get two upstream links and two provider-assigned (PA) IP addresses; the IPs can be static or dynamically assigned.

Next you will configure the interfaces, a floating static route and finally you must configure dual NAT. It's typical to only get one address from your upstream provider and NAT all your workstations, so you must work a little magic to get the failover scenario to work correctly and allow your workstations to continue to have reachability to the outside world.

So to recap, we will need to configure the following:

Configure Interfaces (PA IPs)

Floating Static Route

Configure Dual NAT

Interfaces - PA IPs

Below is the required configuration. We are using SVIs, but you can just as easily use a routed interface. For this setup we are getting a static IP from ISP A and a DHCP address from ISP B.

interface vlan 200 description ISP_A ip address 1.2.3.1 255.255.255.252 ! interface vlan 300 description ISP_B ip address dhcp 20

Floating Static Route

If you are unfamiliar with the idea of a floating static route, check this out first.

ISP A Route

In this example we are going to prefer the route to ISP A. So first we create a static default route towards ISP A. In addition, our static route needs to have a track statement tied to it (think IP SLA in Cisco terms) so if we lose connectivity to the gateway at ISP A we want the route to go away.

(This makes sense because if we can't get to the gateway, we can't get to the outside world and this would blackhole the traffic.)

probe ISP_A icmp-echo destination 1.2.3.2 no shutdown ! track ISP_A test if probe ISP_A no shutdown ! ip route 0.0.0.0 0.0.0.0 1.2.3.2 track ISP_A

The first thing we did was creat the probe which is set to ping the gateway. Next we create our track statement which will be declared down if our probe (ping) fails. Lastly, we create our static route towards ISP A and attach the track to it.

Consequently, if the ping fails towards ISP A's gateway (1.2.3.2), then the router will remove the static default route from the routing table.

ISP B Route

Now that we have our preferred route towards ISP A configured, we need to make sure we have a less preferred route towards ISP B. Fortunately, this is already configured.

Remember our ip address dhcp 20 configuration on ISP B's interface? When you configure an interface for DHCP it automatically installs a default route. The 20 configures the default route to be installed in the routing table with an AD of 20 (static routes default AD is 0).

So now we have a less preferred route that will be installed in the routing table once the route to ISP A is removed.

Configure Dual NAT

Our last step, configuring dual NAT. First, we need to configure a policy class for each interface connected to the ISPs.

ip policy-class ISP_A allow list ADMIN self allow list SNMPAccess self ! ip policy-class ISP_B allow list ADMIN self allow list SNMPAccess self

The policy classes can have an arbitrary number of access lists tied to them. The point is to have an individual one for each interface.

Next we will create our NAT statements in a single policy class for the LAN interface.

ip access-list standard PERMIT_ALL remark ALLOWS_ALL_CONNECTIONS permit any ! ip policy-class Private nat source list PERMIT_ALL interface vlan 300 overload policy ISP_B nat source list PERMIT_ALL interface vlan 200 overload

Here we have created an access list (PERMIT_ALL) that allows all IPs. We then create our NAT statement in the policy class "Private".

Next we configured the NAT statements which reference the acl "PERMIT_ALL" to allow all our workstations to be NAT'd.

The last thing to note is the policy keyword in the first NAT statement. This keyword forces the NAT statement to be permanetly tied to the policy class ISP_B. It also forces the router to do the route lookup first before making its NAT decision.

In other words, when the static default points towards ISP A, workstations that are destined for the outside world will use the NAT statement without the policy keyword. When the static default route points towards ISP B, the traffic from the workstations will use the NAT statement tied to the policy ISP B.

(You can issue the policy keyword for each NAT statement and attach it to each policy for the egress interface, but it is not necessary.)

That last thing to do is attach the policy classes to the proper interfaces. We accomplish this with the access-policy [policy] command.

interface vlan 1 description Workstations (172.16.2.0/24) ip address 172.16.2.1 255.255.255.0 access-policy Private ! interface vlan 200 description ISP_A ip address 1.2.3.1 255.255.255.252 access-policy ISP_A ! interface vlan 300 description ISP_B ip address dhcp 20 access-policy ISP_B

6PE operation

6PE is a solution that allows IPv6 routes to be carried across an IPv4 + MPLS core. The configuration for 6PE is relatively simple. First you enable IPv6 capability in MP-BGP on each PE router. This will allow the PE routers to form an IPv6 adjacency with one another. This adjacency will be used to exchange IPv6 routing information, but carried over the existing IPv4 + MPLS core without any change needed to the core network. With 6PE, you will have a native IPv6 exchange between the PE and CE routers. You can run any IPv6 capable routing protocol between the CE and PE routers.

The magic happens when the send-label option is used in MP-BGP. When the send-label option is specified, the router will begin to advertise its IPv6 + label capability. If the two routers agree to the IPv6 + label capability, they will send all IPv6 routes as labeled routes. So as a packet leaves the PE router ingress into the MPLS network, it will be carrying two labels: the top label, which specifies the IPv4 next hop, and the bottom label, which is the MP-BGP assigned label.

Forwarding Function

For the purposes of demonstration, we will use FEC0:1:7777::/48 as our example.

When the ingress PE router receives an IPv6 packet from the CE, the first thing it does is an IPv6 FIB lookup.

PE1#sho ipv6 cef

FEC0:1:7777::/48

     nexthop ::FFFF:7.7.7.7

    fast tag rewrite with Fa0/1, 10.1.23.2, tags imposed: {19 32}

There are two things we want to focus on from this output: one, the labels imposed (pushed), and two, the next hop address. Looking at the labels (or tags as some routers may refer to them as) we see two labels, 19 and 32. Label 19 refers to the IPv4 Label and 32 refers to the Aggregate IPv6 label. Both of these labels encompass our label stack that will be imposed onto any packet destined for FEC0:1:7777::/48.

The other thing to notice is the next-hop ::FFFF:7.7.7.7, this is the address of  the PE router that we have formed our IPv6 MP-BGP adjacency with. ::FFF:X.X.X.X is a special IPv6 address that allows for IPv4 addresses to be encoded into an IPv6 address. You can easily determine that the IPv4 address encoded in ::FFFF:7.7.7.7.7 is 7.7.7.7. This is the IPv4 address for the PE router to which FEC0:1:777777::/48 is directly connected to. In order to send packets to 7.7.7.7 we must route traffic to 10.1.23.2, which is the next-hop router in the path to 7.7.7.7.

Putting all this information together, first the router will extract the IPv4 address from the IPv6 address (7.7.7.7). Then it will perform an IPv4 lookup on 7.7.7.7 and get 10.1.23.2. Lastly, it will consult the MPLS LFIB (see output below) to get the label for 10.1.23.2. We need this label in order for us to send packets into the MPLS core. You will notice the label is 19. This is where we get label 19 (the IPv4 label) as the top label from the IPv6 FIB output.

PE1#sho mpls forwarding-table

Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop   

tag    tag or VC   or Tunnel Id      switched   interface             

16     Pop tag     3.3.3.3/32        0          Fa0/1      10.1.23.2   

17     17          4.4.4.4/32        0          Fa0/1      10.1.23.2   

18     18          6.6.6.6/32        0          Fa0/1      10.1.23.2   

19     19          7.7.7.7/32        0          Fa0/1      10.1.23.2

Next we need to understand how the IPv6 FIB determined the bottom label was 32. For that we will look at MP-BGP.

PE1#sho bgp ipv6 un ta

   Network          Next Hop      In tag/Out tag

   FEC0:1:7777::/48 ::FFFF:7.7.7.7  notag/32

Notice that MP-BGP has assigned label 32 to prefix FEC0:1:7777::/48. The IPv6 FIB  pulled this information from MP-BGP. Another thing to be aware of is the notag listed as the “In tag”. The router is expecting ingress packets – packets coming in from the CE routers – that are destined for FEC0:1:7777::/48 to be IP packets. This makes sense; the traffic coming in from the CE routers should not have any labels because MPLS is not enabled between the PE and CE routers.

To recap, the IPv6 FIB got label 19 from the MPLS LFIB. Label 19 was assigned to the next hop PE router that is directly connected to FEC0:1:7777::/48.  Then it got label 32 from the MP-BGP label assignment to FEC0:1:7777::/48.

Now that we have all the label information, the packet will be forwarded through the MPLS network using normal MPLS label switching. Once it reaches the penultimate router – assuming ****LINK HERE to MPLS primer****PHP is enabled – it will pop the top label off and forward it to the egress PE router.

The egress PE router will do a lookup in the LFIB for the remaining label (remember the penultimate router has popped the top label (IPv4 label) and forwarded the packet to the egress PE router). So now the egress PE router has a packet with one label, label 32.

PE2#sho mpls forwarding-table

Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop   

tag    tag or VC   or Tunnel Id      switched   interface             

32     Untagged    FEC0:1:7777::/48  0          Se0/0      point2point

According to the output, packets with label 32 need to be forwarded out interface s0/0 untagged, i.e., no label). So the next step is for the egress PE router to do an IPv6 FIB lookup on the prefix associated with label 32 - which you’ll notice is our original prefix, FEC0:1:7777::/48.

R7#sho ipv6 cef

FEC0:1:7777::/48

     nexthop FE80::C009:DFF:FEDC:0 Serial0/0

  tag information

    local tag: 32

The FIB output includes our next hop (CE router). With this information  the egress PE router will forward the packet to the CE router which then will forward the packet towards the final destination, FEC0:1:7777::/48.

Checklist for Configuring 6PE

Next we will discuss the steps necessary to configure 6PE. Each step is listed and will be discussed in more detail later in the document.

1.      Enable IPv6 on PE routers

2.      Assign IPv6 addresses

3.      MP-BGP IPv6 adjacencies between PE routers.

4.      Configure IPv6 Connectivity between CE-PE routers

Enabling IPv6 Connectivity

As mentioned earlier, the first step to configuring 6PE is enabling IPv6 on the PE routers. There are only two commands to enable IPv6:

  PE1(config)#ipv6 unicast-routing

PE1(config)#ipv6 cef

  Next we will assign IPv6 addresses on the interfaces connecting to the CE router.

PE1(config)#interface Serial0/0

PE1(config-if)#description LINK_TO_R9

PE1(config-if)# ipv6 address FEC0:209::2/64    

IPv6 MP-BGP Adjacency

Now we can bring up the PE IPv6 MP-BGP adjacency. This adjacency will be used to carry the IPv6 prefixes + labels across the IPv4 MPLS-enabled backbone. Below is our configuration on the PE routers. The only thing that changes from PE to PE is the IP address used in the neighbor statement.

router bgp 1

 no bgp default ipv4-unicast

 bgp log-neighbor-changes

 neighbor 2.2.2.2 remote-as 1

 neighbor 2.2.2.2 update-source Loopback0

!

 address-family ipv6

  neighbor 2.2.2.2 activate

  neighbor 2.2.2.2 next-hop-self

  neighbor 2.2.2.2 send-label

Now we’ll verify the adjacency is up.

PE1#sho bgp ipv6 un su

BGP router identifier 7.7.7.7, local AS number 1

BGP table version is 7, main routing table version 7

6 network entries using 912 bytes of memory

6 path entries using 456 bytes of memory

8/3 BGP path/bestpath attribute entries using 992 bytes of memory

2 BGP AS-PATH entries using 48 bytes of memory

4 BGP extended community entries using 160 bytes of memory

0 BGP route-map cache entries using 0 bytes of memory

0 BGP filter-list cache entries using 0 bytes of memory

Bitfield cache entries: current 3 (at peak 3) using 96 bytes of memory

BGP using 2664 total bytes of memory

BGP activity 20/8 prefixes, 38/26 paths, scan interval 60 secs

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down 

2.2.2.2         4     1     308     307        7    0    0 02:12:33       

FEC0:710::10    4  1000     154     157        7    0    0 02:28:39       

Don’t forget that BGP needs to have IP reachability to a neighbor for the adjacency to form. We only have IPv4 running in the core, so we need to use the PE routers IPv4 addresses when configuring MP-BGP. You’ll notice that is what we used in our configuration above.

CE-PE Connection

Any routing protocol that supports IPv6 can be used for the connection between the CE and PE routers. What you use depends on the enterprise you are connecting to and their comfort level with each of the routing protocols. It also depends on the Providers policies regarding routing protocols.

MP-BGP CE-PE

The preferred way to exchange routes between the CE and PE router is running MP-BGP. One advantage to using MP-BGP is that the routes will automatically be exchanged with each PE router in the Provider core. This happens because the routes advertised from the CE will be installed in the MP-BGP RIB on the PE router, so you will not need to redistribute the routes into MP-BGP.

Running MP-BGP also protects the Provider from network changes in the customer network affecting the Provider’s network. Imagine if OSPFv3 was running between the CE and PE routers, anytime the customers network had a topology change, those updates would be sent to the PE router. OSPF was meant to be run within one AS, not between ASes.

The basic configuration is simple.

PE1#sho run | b r b

router bgp 1

 no bgp default ipv4-unicast

neighbor FEC0:209::9 remote-as 900

!

address-family ipv6

  neighbor FEC0:209::9 activate

  neighbor FEC0:209::9 default-originate

 exit-address-family

  We have specified the default-originate option. This will cause the PE router to send a default route to the CE router. This is optional and really depends on what the customer is asking for. Most of the time this is all an enterprise would need.  Next, let’s take a look at the CE configuration.

CE#sho run | b r b

router bgp 900

 no synchronization

 bgp router-id 9.9.9.9

 bgp log-neighbor-changes

 neighbor FEC0:209::2 remote-as 1

 no auto-summary

 !

 address-family ipv6

  neighbor FEC0:209::2 activate

  network 9::9/64

  network FEC0:1:2001::/48

  network FEC0:1:3001::/48

  network FEC0:209::9/64

 exit-address-family

Static CE-PE

Another option for exchanging routes between the CE and PE routers is to configure static routing. If customers do not want to run BGP, static routing is the next best option. Our first step is to create a point-to-point connection between the CE and PE router. In IPv4 this is typically done with a /30 between the interfaces, but in IPv6 the current recommendation is to use a /64 everywhere; even on P2P links.

PE1#sho run int s0/0

interface Serial0/0

 description LINK_TO_R9

 ipv6 address FEC0:209::2/64

CE#sho run int s0/0

interface Serial0/0

 description LINK_TO_R9

  ipv6 address FEC0:209::9/64

Next we will define a static route on the PE router so it knows how to get to the prefix assigned to the customer. Then the CE router will need to be configured with a  default route pointing to the PE router as the next hop.

PE1(config)#ipv6 route 9::/64 FEC0:209::9

CE(config)#ipv6 route 0::0/0 FEC0:209::2

The last thing to do is redistribute the static and connected routes into MP-BGP.  To do this it is recommended using the network command. At all cost, avoid using redistribute static and redistributed connected unless you absolutely have to.

PE1#sho run | b r b

router bgp 1

 < -- Code Omitted -- >

 address-family ipv6

  neighbor 7.7.7.7 activate

  neighbor 7.7.7.7 next-hop-self

  neighbor 7.7.7.7 send-label

  network 9::/64

  network FEC0:209::/64

 exit-address-family

Now the prefix that connects the CE and PE routers and also the prefix assigned to the customer is installed into the MP-BGP RIB.

PE1#sho bgp ipv6 un

BGP table version is 12, local router ID is 2.2.2.2

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

*> 9::/64           FEC0:209::9              0         32768 i

*>i7777::/64        ::FFFF:7.7.7.7           0    100      0 1000 i

*>iFEC0:1:7777::/48 ::FFFF:7.7.7.7           0    100      0 1000 i

*> FEC0:209::/64    ::                       0         32768 i

*>iFEC0:710::/64    ::FFFF:7.7.7.7           0    100      0 i

At this point the customer will have full connectivity to the internet and other IPv6 customer networks on the Providers network.

More Information

There is a question that I constantly, almost daily, have to ask myself, “Why do I start with the best intentions and always come up short when it comes to motivations.”

You see, I love teaching, nurturing, and watching people around me grow in their technical ability. I get some kind of natural high when I am able to help someone out. I think it is the greatest thing that there are people on twitter who have never met me, but are willing to help me with some technical problem. It is equally as great that people spend their time writing blogs (or podcasts) that they put out for free for my consumption.

Seriously, think about that for a moment; what an amazing field we have chosen to work in. In fact, I find it so invigorating that I started this blog and try to help people as much as I can. There is something inside of me that wants to give back to the community that has helped me so much as I have grown and continue to grow as an engineer.

Here’s the problem, I find myself equally, if not more excited when I get retweeted, or one of my blog posts hits it “big”. You know, when you find yourself hitting F5 over and over on your Google analytics page to see how many people aren’t reading your blog. Or you’re having a conversation with someone; suddenly a *great* tweet pops in your head; you tweet it and wait anxiously for the retweets to begin. This becomes the validation for your awesomeoness. You know how great you are, but for some reason you need others to validate how great you are.

OK, maybe it’s just me. I am ashamed to admit it but I constantly fall into this trap. I find myself wrapped up in my own mind wanting more and more attention from my virtual peeps. Somehow I feel as though my identity, my self-worth is wrapped up in how *popular* I am online. That my networking skillz (yes, skillz with a Z) can only be validated by how much ataboys and “Wow you’re a genius” comments I get on a daily basis. If I’m not getting it in person, well then heck I have to get it online, after all there is WAY more people to behold my glory online.

Here’s the thing, I don’t think I am alone in this, while it may not be as big of a struggle for some; it is definitely an issue I have seen time and time again in the field of IT.

Where does it come from?

I believe it stems from the fact that we are paid by how much we know. So we must strive and struggle to prove our worth. It’s almost as if the further into our career we go, the more pride and egotistical our behavior must become. If we aren’t the best and brightest around then why would a company want us. We constantly feel the pressure that we must earn our kept day in and day out. And forgot it if we don’t know something, that is just death as we know it.

Is this reality?

Do we really need to think like this? No, I think engineers put this pressure on themselves – while not entirely, but for the most part it is our fault.

What can we do?

Honestly, I wish I had the answer to that. I have tried time and time again to let it go. My family does not judge me based on my OSPF skills or how well I can explain the traffic flow internally inside a Cat 6500. And at the end of the day it doesn’t really matter.

So why am I publicly admitting to my own egotistical behavior? I have no idea – really I don’t. Maybe it is just my narcissism, unabashedly releasing itself into the wild. Or maybe I am just looking for some empathy from some fellow engineers who struggle the same. Or maybe yet, it is a my way of holding me accountable to change. At any rate, I cannot stop trying to help and give back to the community, even if that means my motives aren’t always as pure as I would like them to be.

If one out of every 100 times I strike it rich and my motives are pure, it is worth the 99 times that they aren’t. If I can help in any small way, if I can give back just an ounce what has been given to me, it is worth it no matter what.

So here is my advice, just have fun. We get to work with some really cool technology so let’s just have fun and forgot about being the best and the brightest. If you have fun and just keep learning, I believe it is only natural that you will become a great engineer, one that isn’t so paranoid and annoying.

Let’s just keep putting material out there, let’s keep helping as best as we know how and maybe, just maybe our egos well take a side step and we can get on with it.

Well, I feel better. Thanks for listening.

Multiprotocol Label Switching (MPLS)

MPLS is an open standard (RFC 3031) that was designed to use labels to make forwarding decisions. One of the great features of MPLS is that it can transport many different types of payloads, e.g., Ethernet, ATM, PPP, IPv4, IPv6.  It is an efficient protocol because the routers only need to do one IP lookup (when the packet first enters the MPLS domain) until it reaches the last hop router before the packet is forwarded to the host.

Use Cases:

This list is not exhaustive but includes the major use cases for MPLS.

1.      Transparent tunneling over Service Provider Networks which allows for:

          a. A BGP free core

          b. Layer 2/Layer 3 VPN service to Customers

2.      Traffic Engineering

          a. Distribute load over underutilized links

          b. Give bandwidth guarantees

          c. Detect and repair failures quickly

While MPLS is/was primarily used in Service Provider environments, you can find use cases for the Enterprise. It is worth looking into.

MPLS Devices

MPLS device terminology is pretty straight forward. There are three primary devices that exist within an MPLS network.

·        Customer Edge (CE) Device – the last hop device in the Customer’s network. This device is usually not MPLS aware, i.e., it runs only IP forwarding and not MPLS forwarding.

·        Provider Edge (PE) Device – the last hop device in the Provider’s network, connects to the P devices and is sometimes referred to as the Label Edge Router (LER). This device will run IP and MPLS.

·        Provider (P) Device – the core device at the center of the Providers network. It is sometimes referred to as a Label Switch Router (LSR). This device only runs MPLS, i.e., all switching occurs based on MPLS labels.

Forwarding Equivalency Class (FEC)

A FEC is defined as a group of IP packets which are forwarded over the same path (to the same next-hop), and with the same treatment.

 MPLS Label (Header)

 The MPLS header is 4-bytes in total comprising of:

·        20 bit label = locally significant to router

·        3 bit EXP = Class of Service

·        S bit = defines last label in the label stack

·        8 bit TTL = Time to Live

 The label is used to identify a FEC. The label is imposed (inserted) between the Layer 2 header and the Layer 3 header. The top label appears first in the packet where the bottom label is last.

 Label Operation

 Routers will perform various label operations depending on if the packet is incoming or outgoing.

 ·        Label Push – adds a label to incoming packet; label imposition

·        Label Swap – replaces the label on an incoming packet

·        Label Pop – removes the label on an outgoing packet; label disposition

There is another technique referred to as Penultimate Hop Popping (PHP). Without PHP, the egress PE router must perform two lookups. First it has lookup the destination prefix associated with the label, and then once it has the prefix; the router must look up the next-hop for the destination prefix. With PHP, the next-to-last hop router (the penultimate router) will perform the label pop operation. This means the egress PE router will not have to do the label lookup because it is receiving an IP packet (the penultimate router has popped the label off before forwarding it to the egress router).

MPLS uses the implicit-null label to inform the router to perform PHP. The egress router will advertise the implicit-null label for all directly connected prefixes.

 Label Distribution

There are two protocols used for distributing labels in the network: Tagged Distribution Protocol (TDP) and Label Distribution Protocol (LDP).

        TDP

·        Cisco proprietary protocol that use TCP port 711 to advertise labels.

 LDP

·         Standard protocol

·        Uses UDP multicast 224.0.0.2:646 to discover neighbors

·        Uses TCP port 646 once neighbors are discovered

·        Advertises labels for IGP learned routes

Each router running MPLS will distribute the labels they are using for each prefix to its neighbors; think EIGRP not OSPF. Each router only knows about its neighbor’s labels and does not have a full view of the network.

MPLS switching logic is very straight forward; if traffic comes in interface-1 with label X, then send it out interface-2 with label Y. LDP is preferred and more widely used, so we will focus our efforts on LDP.

               Configuration:

Router(config)#ip cef

Router(config)#mpls label protocol ldp

  MPLS Data Structures

Like all protocols, MPLS has a few data structures to store its information. Before we get into the data structures there is one important fact about MPLS, you need to have CEF running. Without CEF enabled, the router will not enable MPLS forwarding. The MPLS adjacency will still come up, but you will not have MPLS forwarding functioning.

The first data structure is the Label Information Base (LIB). The LIB is a database used by MPLS to store labels learned from other LSRs and also labels assigned by the local router.

The second data structure is the Label Forwarding Information Base (LFIB). The LFIB is used by MPLS for switching labeled packets – think about it like CEFs FIB but for MPLS.

MPLS LIB:

  Router#sho mpls ldp bindings

  tib entry: 10.0.0.0/30, rev 14

        local binding:  tag: 19

        remote binding: tsr: 172.0.0.4:0, tag: 20

        remote binding: tsr: 172.0.0.2:0, tag: imp-null

  tib entry: 10.0.0.4/30, rev 4

        local binding:  tag: imp-null

        remote binding: tsr: 172.0.0.4:0, tag: 19

        remote binding: tsr: 172.0.0.2:0, tag: imp-null

  MPLS LFIB:

     Router#sho mpls forwarding-table

Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop   

tag    tag or VC   or Tunnel Id      switched   interface             

16     Pop tag     172.0.0.2/32      0          Fa0/1      10.0.0.5    

17     Pop tag     172.0.0.4/32      0          Fa0/0      10.0.0.10   

18     16          172.0.0.1/32      0          Fa0/1      10.0.0.5    

19     Pop tag     10.0.0.0/30       0          Fa0/1      10.0.0.5

  “Special” Labels

There are a few labels that have special meanings, one of which is the implicit-null label that we discussed earlier. There is another label – rather a lack of label – that you might see in the LFIB. In the LFIB, you may see no label listed under outgoing label. This indicates that the next hop router and the local router have not formed a MPLS adjacency. So the local router will send pure IP packets to the next hop router.

So where pop label tells the router to pop the top label off, no label instructs the router to remove all labels and send a pure IP packet to the next-hop. Be aware of no label, if you are expecting MPLS to be running between the neighboring routers and you see no label, you have a problem.

Full Example Configuration

The basic configuration for MPLS is very simple. First you have to enable CEF and LDP/TDP. Next, you enable the interfaces that you want to run MPLS on; this would be the interfaces connecting all your routers together. One thing to keep in mind, you don’t need to enable MPLS on interfaces like you would OSPF or EIGRP, i.e. to enable those networks to be distributed within the protocol. You are only enabling MPLS on interfaces to enable hellos to go out and form adjacencies. MPLS will by default, take all known prefixes learned from the configured IGP and append labels to them.

                Configuration Template

      Router(config)#ip cef

Router(config)#mpls label protocol ldp

Router(config)#int f0/0

Router(config-if)#mpls ip

  Here are a few useful commands that I have listed below.

·        show mpls ldp bindings – displays LIB

·        show mpls forwarding-table – displays LFIB

·        show mpls ldp neighbors – displays LDP adjacencies

·        show mpls interfaces – displays all interfaces that MPLS is enabled on

Well that's what we have, I hope you were able to pay attention long enough; it will be well worth it. Stay tuned for MPLS VPNs and 6PE - that's when the magic happens. Now go on, have some fun, get your MPLS on!

Is there anything I missed or needs to be corrected? Let me know. 

More Information

http://www.cisco.com/en/US/docs/ios/12_0st/12_0st21/feature/guide/fs_rtr.html#wp1067202

http://www.cisco.com/en/US/tech/tk436/tk428/technologies_q_and_a_item09186a00800949e5.shtml

http://www.amazon.com/MPLS-VPN-Architectures-Ivan-Pepelnjak/dp/1587050021/ref=sr_1_4?ie=UTF8&qid=1328021275&sr=8-4

Enable IS-IS

We enable the ISIS process the same as we do OSPF, with the global router command. (One thing to note with IS-IS, if you do not specify the process-id it will default to NULL.)

  P1(config)#router isis [process-id]

  NET Address

The Network Entity Title (NET) address, represented in hexadecimal, is used to define various identifiers. IS-IS will read the NET address from right to left, or from the least significant bit to the most significant bit. The first byte is the N-Selector. The N-selector will always be set to 00 when routing IP. The N-selector has no bearing on routing and is used to identify the network layer service. The next 6 bytes are used to identify the system-id (think OSPF router ID (RID)). You are free to choose whatever you want for the system-id. Lastly, all bytes remaining are understood to be the area address (area ID).

  P1(config-router)#net aa.ssss.ssss.ssss.nn 

Areas

There is only one type of area in IS-IS where OSPF can have multiple types of areas. Areas in IS-IS do not determine which routes are allowed to be installed into the area. However, IS-IS areas will determine the type of adjacency that will be formed between a set of routers.

In OSPF you can assign different areas to the same router, ie. ASBR/ABR. In IS-IS the area is defined globally on the router. That means each router running IS-IS is a part of one and only one area. More on that later.

  Adding Networks/Enabling Interfaces

For an interface to run IS-IS you must enable the process under the interface configuration. This will accomplish two things; one, it will enable that interface to form an adjacency, and two, it will add the network that the interface is apart of into the IS-IS database.

Make sure you use the correct IS-IS process-id. Remember if you didn’t define one when you enabled the global process (router isis) then it defaulted to NULL.

Unlike OSPF, you cannot use the network command under the global process to add networks and enable interfaces to run IS-IS. IS-IS configuration is similar to OSPFv3.

  P1(config-if)ip router isis [process-id]

P1(config-if)ip router isis < Command if the process-id was not defined (NULL)

  Levels – Defining the backbone

In OSPF, area 0 defines the backbone. In IS-IS level 2 links define the backbone. IS-IS uses the concept of levels which are defined on a per link basis. In OSPF you would have two routers connect and that connection would form an area. In IS-IS the two routers would connect and the link between them would be defined as either Level 1/Level 2(L1L2), Level 2 (L2), or Level 1 (L1) links.

The router will display different behavior when defining the link depending on if the link exists between two different areas, or one. If two routers are in different areas, the link defaults to running as level 2 (L2) only. If two routers are defined in the same area, the link defaults to running as Level 1/Level2 (L1L2). It is recommended to run a single level on a per router basis because for each level defined on the router, IS-IS will run a separate SPF process. There are times when a router must run as L1L2, i.e. when connecting two different areas, or connecting the L2 backbone to a L1 area.

Below we define the level attributes:

Level 2 (L2)

Behaves like “Area 0” in OSPF

Must be contiguous

Inter or intra area adjacency

Knows all prefixes

Level 1(L1)

Like a NSSA in OSPF

Intra area routes

Default route out

Redistribution allowed

Only knows L1 prefixes

Intra area adjacency only

  “Stub Areas”

IS-IS doesn’t technically have stub areas, but it does have *similar* behavior on L1 links. If a L1 router (all links defined as L1) has an adjacency with a L1L2 router (some links defined as L1, some defined as L2), the L1L2 router will send a default route to the L1 router. The link between the two routers will be a L1 link. You can think of L1L2 routers as OSPF ABRs for IS-IS. Put another way, if a router that only has L1 links has a L1 adjancency to a router connected to the L2 backbone, it will receive a default route from that router with the connection the the L2 backbone.

The L1L2 routers don’t exactly send a default route, rather they set the “attached-bit” on a particular Link-State Packet (LSP). See the show isis database output below:

  P-PE1#sho isis database

  IS-IS Level-1 Link State Database:

LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL

T-PE1.00-00           0x00000002   0xDEA5        415               0/0/0

P1.00-00              0x00000006   0x0DE1        417               0/0/0

P1.01-00              0x00000001   0x66DA        418               0/0/0

P1.02-00              0x00000001   0x87B6        418               0/0/0

P-P1.00-00            0x00000007   0xCBE5        1004              1/0/0

P-P1.01-00            0x00000001   0xA398        998               0/0/0

P-PE1.00-00         * 0x00000002   0xA4D0        997               0/0/0

IS-IS Level-2 Link State Database:

LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL

P-PE1.00-00         * 0x00000002   0x0AB7        1003              0/0/0

  Notice the ATT (attached) bit is set for the P-P1.00-00 LSP and the LSP is under the Level-1 Link State Database. This means that router P-P1 is advertising a LSP with the attached-bit set. This tells the router receiving this LSP to add a default route to P-P1. See output below showing the default route that was installed in the RIB.

P-PE1#sho ip route

Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP

       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

       E1 - OSPF external type 1, E2 - OSPF external type 2

       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2

       ia - IS-IS inter area, * - candidate default, U - per-user static route

       o - ODR, P - periodic downloaded static route

  Gateway of last resort is 10.0.0.9 to network 0.0.0.0

       172.0.0.0/32 is subnetted, 2 subnets

C       172.0.0.4 is directly connected, Loopback0

i L1    172.0.0.3 [115/10] via 10.0.0.9, FastEthernet0/0

     10.0.0.0/30 is subnetted, 1 subnets

C       10.0.0.8 is directly connected, FastEthernet0/0

i*L1 0.0.0.0/0 [115/10] via 10.0.0.9, FastEthernet0/0

  IS-IS Adjacencies

Pretty basic here, the following must be true for the adjacency to come up:

Layer 3 reachability to neighbor

Level of adjacency must match (Don’t forget: the area must match if it is going to be L1 adjacency)

Network type (there is only two types in IS-IS -Broadcast or Point-to-Point)

Metric style – (Adjacency will still form but routes will not be installed into the RIB)

Metrics

1. Narrow (Default)

2. Wide

Needed for MPLS TE (change the metric style for wide)

3. Transition

Supports both at the same time

Used to transition from Narrow to wide

  Path Selection

IS-IS does have a default cost associated with each link. The default cost is 10 - so this basically means each link is a hop count. You can manually modify the cost on a per interface basis. See output below for configuration:

  P-P1(config)#int f0/0

P-P1(config-if)#isis metric 20

    P-P1#sho isis database detail

  IS-IS Level-1 Link State Database:

LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL

P-P1.00-00          * 0x00000015   0xE6A8        1187              1/0/0

  Area Address: 49.0001

  NLPID:        0xCC

  Hostname: P-P1

  IP Address:   172.0.0.3

  Metric: 20         IP 10.0.0.8/30

  Metric: 0          IP 172.0.0.3/32

  Metric: 20         IS-Extended P-P1.01

P-P1.01-00          * 0x0000000F   0x87A6        682               0/0/0

  Metric: 0          IS-Extended P-P1.00

  Metric: 0          IS-Extended P-PE1.00

P-PE1.00-00           0x00000010   0x88DE        726               0/0/0

Notice when changed the metric (cost) to 20 it was reflected in the LSP detail.

Another thing, L1 routes will be preferred over L2 routes. This is similar behavior to OSPF where intra-area routes are preferred over inter-area routes.

Route Leaking

Route leaking in IS-IS is a way to have specifically defined L2 routes “leaked” into the L1 routers. Remember L2 routes by default do not get installed into a L1 router, hence the need for a default route. IS-IS will tag the routes leaked into the L1 router so they are not propagated back into the L2 backbone.

  Sample Configuration

I have included a sample configuration, see below:

  P-P1#sho run | sec router isis

router isis 1

 net 00.0000.0000.0003.00

 metric-style wide

  P-P1#sho run int f0/0

  interface FastEthernet0/0

 description LINK TO P-PE1

 ip address 10.0.0.9 255.255.255.252

 ip router isis 1

 duplex auto

 speed auto

 isis circuit-type level-1

 isis metric 20

end

  More info…

For more information: http://www.cisco.com/en/US/products/ps6599/products_white_paper09186a00800a3e6f.shtml#wp38674 

So there ya have it, so go lab and enjoy a little IS-IS in your life. How many of you use or have used IS-IS? Have you ever seen it in the enterprise? Is there anything I should add or take out?

Happy Protocoling,