Dell S50V инструкция обслуживания

FTOS Configuration Guide FTOS 8.4.2.7 E-Series TeraScale, C-Series, S-Series (S50/S25)[...]

Notes, Cautions, and Warnings NOTE: A NOTE indicates important information that helps you make better use of your computer. CAUTION: A CAUTION indicates potential damage to hardware or loss of data if instructions are not followed. WARNING: A WARNING indicates a potential for property damage, personal injury, or death. Information in this publicati[...]

| 3 1 About this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Objectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

4 | www.dell.com | support.dell.com Change System Logging Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63 Display the Logging Buffer and the Logging Configuration . . . . . . . . . . . . . . . . . . . . . . . 64 Configure a UNIX Logging Facility Level . . . . . . . . . . . . . . . . . . . . . . . . . [...]

| 5 6 802.3ah . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Link Layer OAM Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Link Layer OAMPDUs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

6 | www.dell.com | support.dell.com MAC Authentication Bypass . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 MAB in Single-host and Multi-Host Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 MAB in Multi-Supplicant Authentication Mode . . . . . . . . . . . . . . . . . . . . . .[...]

| 7 Configuring BFD for VLANs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 Configuring BFD for Port-Channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 201 Configuring Protocol Liveness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 203 Troubles[...]

8 | www.dell.com | support.dell.com Boot Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286 When to Use CAM Profiling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 287 Important Points to Remember . . . . . . . . . . . . . . . . .[...]

| 9 Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314 Configure the System to be a DHCP Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 314 Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

10 | www.dell.com | support.dell.com Enable Force10 Service Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 Specify an SMTP Server for FTSA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 349 Provide an Administrator E-mail Address . . . . . . . . . . . . . . . . . . . [...]

| 11 Failure and Event Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 392 Hot-lock Behavior . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393 Warm Upgrade . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

12 | www.dell.com | support.dell.com Configure Management Interfaces on the S-Series . . . . . . . . . . . . . . . . . . . . . . . . 424 Displaying Information on a Management Interface . . . . . . . . . . . . . . . . . . . . . . . . 425 VLAN Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

| 13 ARP Learning via ARP Request . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474 Configurable ARP Retries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 475 ICMP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

14 | www.dell.com | support.dell.com Clear IPv6 Routes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 504 23 Intermediate System to Intermediate System . . . . . . . . . . . . . . . . . . . . . . . . . . . 507 Protocol Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

| 15 MAC Learning Limit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 562 mac learning-limit dynamic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563 mac learning-limit station-move . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

16 | www.dell.com | support.dell.com Configuring Transmit and Receive Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 596 Configuring a Time to Live . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597 Debugging LLDP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

| 17 View the Source-active Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623 Limit the Source-active Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623 Clear the Source-active Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623 Enab[...]

18 | www.dell.com | support.dell.com Multicast Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665 IPv4 Multicast Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 665 IPv6 Multicast Policies . . . . . . . . . . . . . . . . . . . [...]

| 19 Enable OSPFv2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705 Enable Multi-Process OSPF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707 Assign an OSPFv2 area . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

20 | www.dell.com | support.dell.com Refusing Multicast Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756 Sending Multicast Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 Important Points to Remember . . . . . . . . . . . . . . . . . . . . . . .[...]

| 21 Create VLANs for an Office VOIP Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . 795 Configure LLDP-MED for an Office VOIP Deployment . . . . . . . . . . . . . . . . . . . . . . 796 Configure Quality of Service for an Office VOIP Deployment . . . . . . . . . . . . . . . . . 797 37 Policy-based Routing. . . . . . . . . . . . .[...]

22 | www.dell.com | support.dell.com Configure Per-VLAN Spanning Tree Plus . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836 Related Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836 Enable PVST+ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

| 23 Implementation Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 878 Configuration Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 878 Configuration Task List for RIP . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

24 | www.dell.com | support.dell.com Protection from TCP Tiny and Overlapping Fragment Attacks . . . . . . . . . . . . . . . . . . . 935 SCP and SSH . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 935 Using SCP with SSH to copy a software image . . . . . . . . . . . . . . . . . . . . .[...]

| 25 Show sFlow Globally . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 976 Show sFlow on an Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 976 Show sFlow on a Line Card . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

26 | www.dell.com | support.dell.com Events that Bring Down a SONET Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1013 SONET Port Recovery Mechanism . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014 SONET MIB . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

| 27 Configuring Spanning Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1049 Related Configuration Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1050 Important Points to Remember . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

28 | www.dell.com | support.dell.com Clearing a UFD-Disabled Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1090 Displaying Uplink Failure Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1092 Sample Configuration: Uplink Failure Detection . . . . . . . . . . . . . . . [...]

| 29 VRRP Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1129 VRRP version 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1130 VRRP Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .[...]

30 | www.dell.com | support.dell.com Save a hardware log to a file on the flash . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1176 Manual reload messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1177 CP software exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

| 31 Trace logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1214 Buffer full condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1214 Manual reload condition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . [...]

32 | www.dell.com | support.dell.com[...]

About this Guide | 33 1 About this Guide Objectives This guide describes the protocols and features supported by the Dell Force10 Operating System (FTOS) and provides configuration instructions and examples for implementing them. It supports the system platforms E-Series, C-Series, and S-Series. The E-Series ExaScale platform is supported with FTOS[...]

34 | About this Guide www.dell.com | support.dell.com Conventions This document uses the following conventions to describe command syntax: Information Symbols Table 1-1 describes symbols contained in this guide. Related Documents For more information about the Dell Force10 E-Series, C-Series, and S-Series refer to the following documents: • FTOS [...]

Configuration Fundamentals | 35 2 Configuration Fundamentals The FTOS Command Line Interface (CLI) is a text-based interface through which you can configure interfaces and protocols. The CLI is largely the same for the E-Series, C-Series, and S-Series with the exception of some commands and command outputs. The CLI is structured in modes for securi[...]

36 | Configuration Fundamentals www.dell.com | support.dell.com CLI Modes Different sets of commands are available in each mode. A command found in one mode cannot be executed from another mode (with the exception of EXEC mode commands preceded by the command do ; see The do Command on page 40 ). You can set user access rights to commands and comma[...]

Configuration Fundamentals | 37 Figure 2-2. CLI Modes in FTOS Navigating CLI Modes The FTOS prompt changes to indicate the CLI mode. Table 2-1 lists the CLI mode, its prompt, and information on how to access and exit this CLI mode. You must move linearly through the command modes, with the exception of the end command which takes you directly to EX[...]

38 | Configuration Fundamentals www.dell.com | support.dell.com Table 2-1. FTOS Command Modes CLI Command Mode Prompt Access Command EXEC FTOS> Access the router through the console or Telnet. EXEC Privilege FTOS# • From EXEC mode, enter the command enable . • From any other mode, use the command end . CONFIGURATION FTOS(conf)# • From EXEC[...]

Configuration Fundamentals | 39 Figure 2-3 illustrates how to change the command mode from CONFIGURATION mode to PROTOCOL SPANNING TREE. Figure 2-3. Changing CLI Modes MAC ACCESS-LIST STANDARD ACCESS- LIST FTOS(config-std-macl)# mac access-list standard EXTENDED ACCESS- LIST FTOS(config-ext-macl)# mac access-list extended MULTIPLE SPANNING TREE FTO[...]

40 | Configuration Fundamentals www.dell.com | support.dell.com The do Command Enter an EXEC mode command from any CONFIGURATION mode (CONFIGURATION, INTERFACE, SPANNING TREE, etc.) without returning to EXEC mode by preceding the EXEC mode command with the command do . Figure 2-4 illustrates the do command. Figure 2-4. Using the do Command Undoing [...]

Configuration Fundamentals | 41 Obtaining Help Obtain a list of keywords and a brief functional description of those keywords at any CLI mode using the ? or help command: • Enter ? at the prompt or after a keyword to list the keywords available in the current mode. • ? after a prompt lists all of the available keywords. The output of this comma[...]

42 | Configuration Fundamentals www.dell.com | support.dell.com • The UP and DOWN arrow keys display previously entered commands (see Command History ). • The BACKSPACE and DELETE keys erase the previous letter. • Key combinations are available to move quickly across the command line, as described in Table 2-2 . Command History FTOS maintains[...]

Configuration Fundamentals | 43 Filtering show Command Outputs Filter the output of a show command to display specific information by adding | [ except | find | grep | no-more | save ] specified_text after the command. The variable specified_text is the text for which you are filtering and it IS case sensitive unless the ignore-case sub-option is i[...]

44 | Configuration Fundamentals www.dell.com | support.dell.com • find displays the output of the show command beginning from the first occurrence of specified text Figure 2-11 shows this command used in combination with the command show linecard all . Figure 2-11. Filtering Command Outputs with the find Command • display displays additional co[...]

Getting Started | 45 3 Getting Started This chapter contains the following major sections: • Default Configuration on page 46 • Configure a Host Name on page 47 • Access the System Remotely on page 47 • Configure the Enable Password on page 50 • Configuration File Management on page 50 • File System Management on page 55 When you power [...]

46 | Getting Started www.dell.com | support.dell.com Figure 3-1. Completed Boot Process Default Configuration A version of FTOS is pre-loaded onto the chassis, however the system is not configured when you power up for the first time (except for the default hostname, which is Force10). You must configure the system using the CLI. .*************. .#[...]

Getting Started | 47 Configure a Host Name The host name appears in the prompt. The default host name is force10 . • Host names must start with a letter and end with a letter or digit. • Characters within the string can be letters, digits, and hyphens. To configure a host name: Figure 3-2 illustrates the hostname command. Figure 3-2. Configurin[...]

48 | Getting Started www.dell.com | support.dell.com Configure the Management Port IP Address Assign IP addresses to the management ports in order to access the system remotely. To configure the management port IP address: Configure a Management Route Define a path from the system to the network from which you are accessing the system remotely. Man[...]

Getting Started | 49 To configure a username and password: Access the S-Series Remotely The S-Series does not have a dedicated management port nor a separate management routing table. Configure any port on the S-Series to be the port through which you manage the system and configure an IP route to that gateway. Configuring the system for Telnet acc[...]

50 | Getting Started www.dell.com | support.dell.com Configure the Enable Password The EXEC Privilege mode is accessed by the enable command. Configure a password as a basic security measure. When using a console connection, EXEC Privilege mode is unrestricted by default; it cannot be reached by a VTY connection if no password is configured. There [...]

Getting Started | 51 Copy Files to and from the System The command syntax for copying files is similar to UNIX. The copy command uses the format copy source-file-url destination-file-url . • To copy a local file to a remote system, combine the file-origin syntax for a local file location with the file-destination syntax for a remote file location[...]

52 | Getting Started www.dell.com | support.dell.com • The usbflash and rpm0usbflash commands are supported on E-Series ExaScale platform only. Refer to the FTOS Release Notes for a list of approved USB vendors. Figure 3-4 shows an example of using the copy command to save a file to an FTP server. Figure 3-4. Saving a file to a Remote System Figu[...]

Getting Started | 53 View Files File information and content can only be viewed on local file systems. Task Command Syntax Command Mode Save the running-configuration to: EXEC Privilege the startup-configuration on the internal flash of the primary RPM copy running-config startup-config the internal flash on an RPM copy running-config rpm { 0|1 } f[...]

54 | Getting Started www.dell.com | support.dell.com To view a list of files on the internal or external Flash: The output of the command dir also shows the read/write privileges, size (in bytes), and date of modification for each file, as shown in Figure 3-6 . Figure 3-6. Viewing a List of Files in the Internal Flash To view the contents of a file[...]

Getting Started | 55 In the running-configuration file, if there is a difference between the timestamp on the “Last configuration change,” and “Startup-config last updated,” then you have made changes that have not been saved and will not be preserved upon a system reboot. Figure 3-7. Tracking Changes with Configuration Comments File System[...]

56 | Getting Started www.dell.com | support.dell.com In Figure 3-9 , the default storage location is changed to the external Flash of the primary RPM. File management commands then apply to the external Flash rather than the internal Flash. Figure 3-9. Alternative Storage Location View command history The command-history trace feature captures all [...]

System Management | 57 4 System Management System Management is supported on platforms: c e s This chapter explains the different protocols or services used to manage the Dell Force10 system including: • Configure Privilege Levels on page 57 • Configure Logging on page 61 • File Transfer Services on page 68 • Terminal Lines on page 69 • L[...]

58 | System Management www.dell.com | support.dell.com A user can access all commands at his privilege level and below. Removing a command from EXEC mode Remove a command from the list of available commands in EXEC mode for a specific privilege level using the command privilege exec from CONFIGURATION mode. In the command, specify a level greater t[...]

System Management | 59 The configuration in Figure 4-1 creates privilege level 3. This level: • removes the resequence command from EXEC mode by requiring a minimum of privilege level 4, • moves the command capture bgp-pdu max-buffer-size from EXEC Privilege to EXEC mode by, requiring a minimum privilege level 3, which is the configured level f[...]

60 | System Management www.dell.com | support.dell.com Figure 4-1. Create a Custom Privilege Level FTOS(conf)#do show run priv ! privilege exec level 3 capture privilege exec level 3 configure privilege exec level 4 resequence privilege exec level 3 capture bgp-pdu privilege exec level 3 capture bgp-pdu max-buffer-size privilege configure level 3 l[...]

System Management | 61 Apply a Privilege Level to a Username To set a privilege level for a user: Apply a Privilege Level to a Terminal Line To set a privilege level for a terminal line: Configure Logging FTOS tracks changes in the system using event and error messages. By default, FTOS logs these messages on: • the internal buffer • console an[...]

62 | System Management www.dell.com | support.dell.com Log Messages in the Logging Buffer All error messages, except those beginning with %BOOTUP ( Message 1 ), are log in the internal buffer. Configuration Task List for System Log Management The following list includes the configuration tasks for system log management: • Disable System Logging o[...]

System Management | 63 Send System Messages to a Syslog Server Send system messages to a syslog server by specifying a server: Configure a Unix System as a Syslog Server Configure a UNIX system as a syslog server by adding the following lines to /etc/syslog.conf on the Unix system and assigning write permissions to the file. • on a 4.1 BSD UNIX s[...]

64 | System Management www.dell.com | support.dell.com Display the logging buffer and configuration using the show logging command from EXEC Privilege mode, as shown in Figure 4-2 . Display the logging configuration using the show running-config logging command from EXEC Privilege mode, as shown in Figure 4-3 . Display the Logging Buffer and the Lo[...]

System Management | 65 Figure 4-2. show logging Command Example FTOS#show logging syslog logging: enabled Console logging: level Debugging Monitor logging: level Debugging Buffer logging: level Debugging, 40 Messages Logged, Size (40960 bytes) Trap logging: level Informational %IRC-6-IRC_COMMUP: Link to peer RPM is up %RAM-6-RAM_TASK: RPM1 is trans[...]

66 | System Management www.dell.com | support.dell.com Configure a UNIX Logging Facility Level Facility is a message tag used to describe the application or process that submitted the log message. You can save system log messages with a UNIX system logging facility: Display non-default settings using the show running-config logging command from EXE[...]

System Management | 67 Synchronize Log Messages You can configure a terminal line to hold all logs until all command inputs and outputs are complete so that log printing does not interfere when you are performing management tasks. Log synchronization also filters system messages for a specific line based on severity level and limits number of messa[...]

68 | System Management www.dell.com | support.dell.com File Transfer Services You can configure the system to transfer files over the network using File Transfer Protocol (FTP). Configuration Task List for File Transfer Services The following list includes the configuration tasks for file transfer services: • Enable FTP server on page 68 • Conf[...]

System Management | 69 Display your FTP configuration using the command show running-config ftp from EXEC Privilege mode, as shown in Figure 4-4 . Configure FTP client parameters When the system will be an FTP client, configure FTP client parameters: Display the FTP configuration using the command show running-config ftp from EXEC Privilege mode, F[...]

70 | System Management www.dell.com | support.dell.com Figure 4-5. Applying an Access List to a VTY Line Configure Login Authentication for Terminal Lines You can use any combination of up to 6 authentication methods to authenticate a user on a terminal line. A combination of authentication methods is called a method list. If the user fails the fir[...]

System Management | 71 In Figure 4-6 VTY lines 0-2 use a single authentication method, line . Figure 4-6. Configuring Login Authentication on a Terminal Line Time out of EXEC Privilege Mode EXEC timeout is a basic security feature that returns FTOS to the EXEC mode after a period of inactivity on terminal lines. To change the timeout period or disa[...]

72 | System Management www.dell.com | support.dell.com Figure 4-7. Configuring EXEC Timeout Telnet to Another Network Device To telnet to another device: Figure 4-8. Telnet to Another Network Device Lock CONFIGURATION mode FTOS allows multiple users to make configurations at the same time. You can lock CONFIGURATION mode so that only one user can b[...]

System Management | 73 A two types of locks can be set: auto and manual. • Set an auto-lock using the command configuration mode exclusive auto from CONFIGURATION mode. When you set an auto-lock, every time a user is in CONFIGURATION mode all other users are denied access. This means that you can exit to EXEC Privilege mode, and re-enter CONFIGUR[...]

74 | System Management www.dell.com | support.dell.com You can then send any user a message using the send command from EXEC Privilege mode. Alternatively you can clear any line using the command clear from EXEC Privilege mode. If you clear a console session, the user is returned to EXEC mode. Recovering from a Forgotten Password If you configure a[...]

System Management | 75 Recovering from a Forgotten Enable Password If you forget the enable password: Figure 4-12. Renaming the startup-config 7 Reload the system. reload BOOT_ADMIN 8 Copy startup-config.bak to the running config. copy flash://startup-config.bak running-config EXEC Privilege 9 Remove all authentication statements you might have for[...]

76 | System Management www.dell.com | support.dell.com Recovering from a Forgotten Password on S-Series If you configure authentication for the console and you exit out of EXEC mode or your console session times out, you are prompted for a password to re-enter. If you forget your password: 9 Save the running-config to the startup-config. The startu[...]

System Management | 77 Recovering from a Failed Start A system that does not start correctly might be attempting to boot from a corrupted FTOS image or from a incorrect location. To resolve the problem, you can restart the system and interrupt the boot process to point the system to another boot location by using the boot change command, as describ[...]

78 | System Management www.dell.com | support.dell.com Very similar to the options of the boot change command, the boot system command is available in CONFIGURATION mode on the C-Series and E-Series to set the boot parameters that, when saved to the startup configuration file, are stored in NVRAM and are then used routinely: Also, because the C-Ser[...]

802.1ag | 79 5 802.1ag 802.1ag is available only on platform: s Ethernet Operations, Administration, and Maintenance (OAM) is a set of tools used to install, monitor, troubleshoot and manage Ethernet infrastructure deployments. Ethernet OAM consists of three main areas: 1. Service Layer OAM: IEEE 802.1ag Connectivity Fault Management (CFM) 2. Link [...]

80 | 802.1ag www.dell.com | support.dell.com There is a need for Layer 2 equivalents to manage and troubleshoot native Layer 2 Ethernet networks. With these tools, you can identify, isolate, and repair faults quickly and easily, which reduces operational cost of running the network. OAM also increases availability and reduces mean time to recovery,[...]

802.1ag | 81 These roles define the relationships between all devices so that each device can monitor the layers under its responsibility. Maintenance points drop all lower-level frames and forward all higher-level frames. Figure 5-2. Maintenance Points Maintenance End Points A Maintenance End Point (MEP) is a logical entity that marks the end-poin[...]

82 | 802.1ag www.dell.com | support.dell.com Implementation Information • Since the S-Series has a single MAC address for all physical/LAG interfaces, only one MEP is allowed per MA (per VLAN or per MD level). Configure CFM Configuring CFM is a five-step process: 1. Configure the ecfmacl CAM region using the cam-acl command. See Configure Ingress[...]

802.1ag | 83 Enable Ethernet CFM Create a Maintenance Domain Connectivity Fault Management (CFM) divides a network into hierarchical maintenance domains, as shown in Figure 5-1 . Task Command Syntax Command Mode Spawn the CFM process. No CFM configuration is allowed until the CFM process is spawned. ethernet cfm CONFIGURATION Disable Ethernet CFM w[...]

84 | 802.1ag www.dell.com | support.dell.com Create a Maintenance Association A Maintenance Association MA is a subdivision of an MD that contains all managed entities corresponding to a single end-to-end service, typically a VLAN. An MA is associated with a VLAN ID. Create Maintenance Points Domains are comprised of logical entities called Mainten[...]

802.1ag | 85 Create a Maintenance Intermediate Point Maintenance Intermediate Point (MIP) is a logical entity configured at a port of a switch that constitutes intermediate points of an Maintenance Entity (ME). An ME is a point-to-point relationship between two MEPs within a single domain. An MIP is not associated with any MA or service instance, a[...]

86 | 802.1ag www.dell.com | support.dell.com • MIP Database (MIP-DB) : Every MIP must maintain a database of all other MEPs in the MA that have announced their presence via CCM MP Database Persistence Task Command Syntax Command Mode Display the MEP Database. show ethernet cfm maintenance-points remote detail [ active | domain { level | name } | [...]

802.1ag | 87 Continuity Check Messages Continuity Check Messages (CCM) are periodic hellos used to: • discover MEPs and MIPs within a maintenance domain • detect loss of connectivity between MEPs • detect misconfiguration, such as VLAN ID mismatch between MEPs • to detect unauthorized MEPs in a maintenance domain Continuity Check Messages ([...]

88 | 802.1ag www.dell.com | support.dell.com Enable CCM Enable Cross-checking Loopback Message and Response Loopback Message and Response (LBM, LBR), also called Layer 2 Ping, is an administrative echo transmitted by MEPs to verify reachability to another MEP or MIP within the maintenance domain. LBM and LBR are unicast frames. Linktrace Message an[...]

802.1ag | 89 Figure 5-4. Linktrace Message and Response Link trace messages carry a unicast target address (the MAC address of an MIP or MEP) inside a multicast frame. The destination group address is based on the MD level of the transmitting MEP (01:80:C2:00:00:3[8 to F]). The MPs on the path to the target MAC address reply to the LTM with an LTR,[...]

90 | 802.1ag www.dell.com | support.dell.com Enable CFM SNMP Traps. A Trap is sent only when one of the five highest priority defects occur, as shown in Table 5-2 . FTOS#show ethernet cfm traceroute-cache Traceroute to 00:01:e8:52:4a:f8 on Domain Customer2, Level 7, MA name Test2 with VLAN 2 ---------------------------------------------------------[...]

802.1ag | 91 Three values are given within the trap messages: MD Index, MA Index, and MPID. You can reference these values against the output of show ethernet cfm domain and show ethernet cfm maintenance-points local mep . FTOS#show ethernet cfm maintenance-points local mep ---------------------------------------------------------------------------[...]

92 | 802.1ag www.dell.com | support.dell.com Display CFM statistics by port. show ethernet cfm port-statistics [ interface ] EXEC Privilege FTOS#show ethernet cfm port-statistics interface gigabitethernet 0/5 Port statistics for port: Gi 0/5 ================================== RX Statistics ============= Total CFM Pkts 75394 CCM Pkts 75394 LBM Pkts [...]

802.3ah | 93 6 802.3ah 802.3ah is available only on platform: s A metropolitan area network (MAN) is a set of LANs, geographically separated but managed by a single entity. If the distance is large—across a city, for example—connectivity between LANs is managed by a service provider. While LANs use Ethernet, service providers networks use an ar[...]

94 | 802.3ah www.dell.com | support.dell.com • Remote Loopback —directs the remote system to reflects back frames that the local system transmits so that an administrator can isolate a fault. • Remote Failure Indication —notifies a peer of a critical link event. Link Layer OAMPDUs Link Layer OAM is conducted using OAMPDUs, shown in Figure 6[...]

802.3ah | 95 Link Layer OAM Operational Modes When participating in EFM OAM, system may operate in active or passive mode. • Active mode —Active mode systems initiate discovery. Once the Discovery process completes, they can send any OAMPDU while connected to a peer in Active mode, and a subset of OAMPDUs if the peer is in Passive mode (see Tab[...]

96 | 802.3ah www.dell.com | support.dell.com Link Layer OAM Events Link Layer OAM defines a set of events that may impact link operation, and monitors the link for those events. If an event occurs, the detecting system notifies its peer. There are two types of events: • Critical Link Events —There are three critical events; each has an associat[...]

802.3ah | 97 Configure Link Layer OAM Configuring Link Layer OAM is a two-step process: 1. Enable Link Layer OAM. See page 97. 2. Enable any or all of the following: a Link Performance Event Monitoring on page 99 b Remote Failure Indication on page 102 c Remote Loopback on page 103 Related Configuration Tasks • Adjust the OAMPDU Transmission Para[...]

98 | 802.3ah www.dell.com | support.dell.com FTOS# show ethernet oam discovery interface <interface-name> Output format: <interface name> Local client __________ Administrative configurations: Mode:active Unidirection:not supported Link monitor:supported (on) Remote loopback:not supported MIB retrieval:not supported Mtu size:1500 Operat[...]

802.3ah | 99 Adjust the OAMPDU Transmission Parameters Link Performance Event Monitoring Link Performance Event Monitoring OAM monitors the receive side of a link for a set of pre-defined errors and executes an action when a threshold is exceeded; it is enabled by default. Both peers on the link must be have link performance event monitoring enable[...]

100 | 802.3ah www.dell.com | support.dell.com Set Threshold Values The available pre-defined errors fall under two categories: • Symbol Errors —a symbol is an (electrical or optical) pulse on the physical medium that represents one or more bits. A symbol error occurs when a symbol degrades in transit so that the receiver is not able to decode i[...]

802.3ah | 101 Frame Errors per Second Frame Errors per Frame Period Error Seconds per Time Period Task Command Syntax Command Mode Specify the high threshold value for frame errors, or disable the high threshold. ethernet oam link-monitor frame threshold high { frames | none } Range: 1-65535 Default: None INTERFACE Specify the low threshold for fra[...]

102 | 802.3ah www.dell.com | support.dell.com Execute an Action upon Exceeding the High Threshold When an error exceeds the low threshold , an event notification is sent to the peer. When an error exceeds the high threshold , a pre-defined action is triggered such as disabling the interface. Remote Failure Indication Remote Failure Indication is th[...]

802.3ah | 103 Remote Loopback An active-mode device can place a passive peer into loopback mode by sending a Loopback Control OAMPDU. When in loopback mode: • the remote peer returns unaltered all non-OAMPDU frames sent by the local peer, and • all outbound data frames are discarded. Note: Control traffic egresses from loopback initiator and fr[...]

104 | 802.3ah www.dell.com | support.dell.com Display Link Layer OAM Configuration and Statistics Task Command Syntax Command Mode Display Link Layer OAM status per interface. show ethernet oam status interface interface EXEC Privilege FTOS# show ethernet oam status interface <interface-name> Output Format : <interface-name> General ___[...]

802.3ah | 105 FTOS# show ethernet oam statistics interface <interface-name> <interface-name> Counters: _________ Information OAMPDU Tx: 3439489 Information OAMPDU Rx: 9489 Unique Event Notification OAMPDU Tx: 0 Unique Event Notification OAMPDU x: 0 Duplicate Event Notification OAMPDU Tx: 0 Duplicate Event Notification OAMPDU Rx: 0 Loopb[...]

106 | 802.3ah www.dell.com | support.dell.com Manage Link Layer OAM Enable MIB Retrieval Support/Function IEEE 802.3ah defines the Link OAM MIB in Sec 30A.20, “OAM entity managed object class”; all of the objects described there are supported. Note that 802.3ah does not include the ability to set/write remote MIB variables. You must enable MIB [...]

802.1X | 107 7 802.1X 802.1X is supported on platforms: c e s This chapter has the following sections: • Protocol Overview on page 107 • Configuring 802.1X on page 111 • Important Points to Remember on page 112 • Enabling 802.1X on page 112 • Configuring Request Identity Re-transmissions on page 114 • Forcibly Authorizing or Unauthorizi[...]

108 | 802.1X www.dell.com | support.dell.com 802.1X employs Extensible Authentication Protocol (EAP)* to transfer a device’s credentials to an authentication server (typically RADIUS) via a mandatory intermediary network access device, in this case, a Dell Force10 switch. The network access device mediates all communication between the end-user d[...]

802.1X | 109 • The authentication-server selects the authentication method, verifies the information provided by the supplicant, and grants it network access privileges. Ports can be in one of two states: • Ports are in an unauthorized state by default. In this state, non-802.1X traffic cannot be forwarded in or out of the port. • The authent[...]

110 | 802.1X www.dell.com | support.dell.com Figure 7-2. 802.1X Authentication Process EAP over RADIUS 802.1X uses RADIUS to shuttle EAP packets between the authenticator and the authentication server, as defined in RFC 3579. EAP messages are encapsulated in RADIUS packets as a type of attribute in Type, Length, Value (TLV) format. The Type value f[...]

802.1X | 111 RADIUS Attributes for 802.1 Support Dell Force10 systems includes the following RADIUS attributes in all 802.1X-triggered Access-Request messages: Configuring 802.1X Configuring 802.1X on a port is a two-step process: 1. Enable 802.1X globally. See page 112. 2. Enable 802.1X on an interface. See page 112. Related Configuration Tasks ?[...]

112 | 802.1X www.dell.com | support.dell.com Important Points to Remember • FTOS supports 802.1X with EAP-MD5, EAP-OTP, EAP-TLS, EAP-TTLS, PEAPv0, PEAPv1, and MS-CHAPv2 with PEAP. • All platforms support only RADIUS as the authentication server. • On E-Series ExaScale, if the primary RADIUS server becomes unresponsive, the authenticator begin[...]

802.1X | 113 To enable 802.1X: Verify that 802.1X is enabled globally and at interface level using the command show running-config | find dot1x from EXEC Privilege mode, as shown in Figure 7-5 . Figure 7-5. Verifying 802.1X Global Configuration View 802.1X configuration information for an interface using the command show dot1x interface , as shown [...]

114 | 802.1X www.dell.com | support.dell.com Configuring Request Identity Re-transmissions If the authenticator sends a Request Identity frame, but the supplicant does not respond, the authenticator waits 30 seconds and then re-transmits the frame. The amount of time that the authenticator waits before re-transmitting and the maximum number of time[...]

802.1X | 115 Figure 7-7 shows configuration information for a port for which the authenticator re-transmits an EAP Request Identity frame: • After 90 seconds and a maximum of 10 times for an unresponsive supplicant • Re-transmits an EAP Request Identity frame Figure 7-7. Configuring a Request Identity Re-transmissions Forcibly Authorizing or Un[...]

116 | 802.1X www.dell.com | support.dell.com To place a port in one of these three states: Figure 7-8 shows configuration information for a port that has been force-authorized. Figure 7-8. Configuring Port-control Re-Authenticating a Port Periodic Re-Authentication After the supplicant has been authenticated and the port has been authorized, the au[...]

802.1X | 117 To configure a maximum number of re-authentications: Figure 7-9. Configuring a Reauthentiction Period Configuring Timeouts If the supplicant or the authentication server is unresponsive, the authenticator terminates the authentication process after 30 seconds by default. The amount of time that the authenticator waits for a response ca[...]

118 | 802.1X www.dell.com | support.dell.com To terminate the authentication process due to an unresponsive authentication server: Figure 7-10 shows configuration information for a port for which the authenticator terminates the authentication process for an unresponsive supplicant or server after 15 seconds. Figure 7-10. Configuring a Timeout Step[...]

802.1X | 119 Dynamic VLAN Assignment with Port Authentication Dynamic VLAN Assignment with Port Authentication is supported on platforms: c s e t FTOS supports dynamic VLAN assignment when using 802.1X. During 802.1x authentication, the existing VLAN configuration of a port assigned to a non-default VLAN is overwritten and the port is assigned to a[...]

120 | 802.1X www.dell.com | support.dell.com Figure 7-11 shows the configuration on a Dell Force10 switch that uses dynamic VLAN assignment with 802.1X before you connect the end-user device (black and blue text), and after you connect the device (red text). The blue text corresponds to the numbered steps on page 119. Note that the GigabitEthernet [...]

802.1X | 121 Guest and Authentication-Fail VLANs Typically, the authenticator (Dell Force10 system) denies the supplicant access to the network until the supplicant is authenticated. If the supplicant is authenticated, the authenticator enables the port and places it in either the VLAN for which the port is configured, or the VLAN that the authenti[...]

122 | 802.1X www.dell.com | support.dell.com Configuring an Authentication-Fail VLAN If the supplicant fails authentication, the authenticator re-attempts to authenticate after a specified amount of time (30 seconds by default, see Configuring a Quiet Period after a Failed Authentication on page 114 ). You can configure the maximum number of times [...]

802.1X | 123 Multi-Host Authentication Multi-Host Authentication is available on platforms: c e t s 802.1x assumes that a single end-user is connected to a single authenticator port, as shown in Figure 7-15 ; this one-to-one mode of authentication is called Single-host mode. If multiple end-users are connected to the same port, a many-to-one config[...]

124 | 802.1X www.dell.com | support.dell.com When the host mode is changed on a port that is already authenticated: • Single-host to Multi-host : all devices attached to the port that were previously blocked may access the network; the supplicant does not re-authenticate. • Multi-host to Single-host : the port restarts the authentication proces[...]

802.1X | 125 Multi-Supplicant Authentication Multi-Supplicant Authentication is available on platforms: c s The 802.1X Multi-supplicant Authentication enables multiple devices on a single authenticator port to access the network by authenticating each device. In addition, Multi-supplicant Authentication uses dynamic MAC-based VLAN assignment to pla[...]

126 | 802.1X www.dell.com | support.dell.com During the authentication process, the Dell Force10 system is able to learn the MAC address of the device though the EAPoL frames, and the VLAN assignment from the RADIUS server. With this information it creates an authorized-MAC to VLAN mapping table per port. Then, the system can tag all incoming untag[...]

802.1X | 127 MAC Authentication Bypass MAC Authentication Bypass is supported on platforms: c s MAC Authentication Bypass (MAB) enables you to provide MAC-based security by allowing only known MAC addresses within the network using a RADIUS server. 802.1X-enabled clients can authenticate themselves using the 802.1X protocol. Other devices that do n[...]

128 | 802.1X www.dell.com | support.dell.com MAB in Single-host and Multi-Host Mode In single-host and multi-host mode, the switch attempts to authenticate a supplicant using 802.1X. If 802.1X times out because the supplicant does not respond to the Request Identity frame and MAB is enabled, the switch attempts to authenticate the first MAC it lear[...]

802.1X | 129 3 (Optional) Use MAB authentication only— do not use 802.1X authentication first. If MAB fails the port or the MAC address is blocked, the port is placed in the guest VLAN (if configured). 802.1x authentication is not even attempted. Re-authentication is performed using 802.1X timers. dot1x auth-type mab-only INTERFACE 4 Display the [...]

130 | 802.1X www.dell.com | support.dell.com Dynamic CoS with 802.1X Dynamic CoS with 802.1X is supported on platforms: c s Class of Service (CoS) is a method of traffic management that groups similar types of traffic so that they are serviced differently. One way of classifying traffic is 802.1p, which uses the 3-bit Priority field in the VLAN tag[...]

802.1X | 131 FTOS Behavior: The following conditions are applied to the use of dynamic CoS with 802.1X authentication on C-Series and S-Series platforms: • In accordance with port-based QoS, incoming dot1p values can be mapped to only four priority values: 0, 2, 4, and 6. If the RADIUS server returns any other dot1p value (1, 3, 5, or 7), the val[...]

132 | 802.1X www.dell.com | support.dell.com[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 133 8 IP Access Control Lists (ACL), Prefix Lists, and Route-maps IP Access Control Lists, Prefix Lists, and Route-maps are supported on platforms: c e s Ingress IP ACLs are supported on platforms: c e s Egress IP ACLs are supported on platform: e Overview At their simplest, Access Contr[...]

134 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com • Assign an IP ACL to an Interface on page 147 • Configuring Ingress ACLs on page 149 • Configuring Egress ACLs on page 149 • Configuring ACLs to Loopback on page 151 • Applying an ACL on Loopback Interfaces on page 151 • IP Prefix Lists on[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 135 CAM optimization is supported on platforms c s CAM Profiling CAM optimization is supported on platforms e t CAM profiling for ACLs is supported on E-Series TeraScale only. For complete information regarding E-Series TeraScale CAM profiles and configuration, refer to Chapter 11, Conte[...]

136 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com Allocate space for IPV6 ACLs on the C-Series by using the cam-acl command in CONFIGURATION mode. The CAM space is allotted in FP blocks. The total space allocated must equal 13 FP blocks. Note that there are 16 FP blocks, but the System Flow requires 3[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 137 Figure 8-1. Command Example: test cam-usage (C-Series) Implementing ACLs on FTOS One IP ACL can be assigned per interface with FTOS. If an IP ACL is not assigned to an interface, it is not used by the software in any other capacity. The number of entries allowed per ACL is hardware-d[...]

138 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com Standard and Extended ACLs take up the same amount of CAM space. A single ACL rule uses 2 CAM entries whether it is identified as a Standard or Extended ACL. Determine the order in which ACLs are used to classify traffic When you link class-maps to que[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 139 • Second and subsequent fragments are allowed because a Layer 4 rule cannot be applied to these fragments. If the packet is to be denied eventually, the first fragment would be denied and hence the packet as a whole cannot be reassembled. • Implementing the required rules will us[...]

140 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com In the following, TCP packets that are first fragments or non-fragmented from host 10.1.1.1 with TCP destination port equal to 24 are permitted. Additionally, all TCP non-first fragments from host 10.1.1.1 are permitted. All other IP packets that are n[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 141 A standard IP ACL uses the source IP address as its match criterion. To configure a standard IP ACL, use these commands in the following sequence: When you use the log keyword, CP processor logs details about the packets that match. Depending on how many packets match the log entry a[...]

142 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com Figure 8-4. Command example: seq To delete a filter, use the no seq sequence-number command in the IP ACCESS LIST mode. If you are creating a standard ACL with only one or two filters, you can let FTOS assign a sequence number based on the order in whi[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 143 Figure 8-6. Command Example: show ip accounting access-list To delete a filter, enter the show config command in the IP ACCESS LIST mode and locate the sequence number of the filter you want to delete. Then use the no seq sequence-number command in the IP ACCESS LIST mode. Configure [...]

144 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com When you use the log keyword, CP processor logs details about the packets that match. Depending on how many packets match the log entry and at what rate, the CP may become busy as it has to log these packets’ details. TCP packets : To create a filter[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 145 When you create the filters with a specific sequence number, you can create the filters in any order and the filters are placed in the correct order. Figure 8-7 illustrates how the seq command orders the filters according to the sequence number assigned. In the example, filter 15 was[...]

146 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com Figure 8-8 illustrates an extended IP ACL in which the sequence numbers were assigned by the software. The filters were assigned sequence numbers based on the order in which they were configured (for example, the first filter was given the lowest seque[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 147 If a rule is simply appended, existing counters are not affected. For information on MAC ACLs, refer to the Access Control Lists (ACLs) chapter in the FTOS Command Line Reference Guide . Assign an IP ACL to an Interface Ingress IP ACLs are supported on platforms: c and s Ingress and [...]

148 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com To apply an IP ACL (standard or extended) to a physical or port channel interface, use these commands in the following sequence in the INTERFACE mode: To view which IP ACL is applied to an interface, use the show config command (Figure 232) in the INTE[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 149 Configuring Ingress ACLs Ingress ACLs are applied to interfaces and to traffic entering the system.These system-wide ACLs eliminate the need to apply ACLs onto each interface and achieves the same results. By localizing target traffic, it is a simpler implementation. To create an ing[...]

150 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com An egress ACL is used when users would like to restrict egress traffic. For example, when a DOS attack traffic is isolated to one particular interface, you can apply an egress ACL to block that particular flow from exiting the box, thereby protecting d[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 151 Configuring ACLs to Loopback ACLs can be supplied on Loopback interfaces supported on platform e Configuring ACLs onto the CPU in a loopback interface protects the system infrastructure from attack— malicious and incidental—by explicate allowing only authorized traffic. The ACLs [...]

152 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com To apply ACLs on loopback, use the ip access-group command (Figure 235) in the INTERFACE mode. This example also shows the interface configuration status, adding rules to the access group, and displaying the list of rules in the ACL: Figure 8-12. Apply[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 153 IP Prefix Lists Prefix Lists are supported on platforms: c e s IP prefix lists control routing policy. An IP prefix list is a series of sequential filters that contain a matching criterion (examine IP route prefix) and an action (permit or deny) to process routes. The filters are pro[...]

154 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com The following list includes the configuration tasks for prefix lists: • Configure a prefix list on page 154 • Use a prefix list for route redistribution on page 156 For a complete listing of all commands related to prefix lists, refer to the FTOS C[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 155 If you are creating a standard prefix list with only one or two filters, you can let FTOS assign a sequence number based on the order in which the filters are configured. The FTOS assigns filters in multiples of five. To configure a filter without a specified sequence number, use the[...]

156 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com Figure 8-15. Command example: show ip prefix-list detail Figure 8-16. Command Example: show ip prefix-list summary Use a prefix list for route redistribution To pass traffic through a configured prefix list, you must use the prefix list in a route redi[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 157 Figure 8-17. Command Example: show config in the ROUTER RIP Mode To apply a filter to routes in OSPF, use either of the following commands in the ROUTER OSPF mode: To view the configuration, use the show config command in the ROUTER OSPF mode (Figure 241) or the show running-config o[...]

158 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com IPv4 and IPv6 ACLs and prefixes and MAC ACLs can be resequenced. No CAM writes happen as a result of resequencing, so there is no packet loss; the behavior is like Hot-lock ACLs. Resequencing an ACL or Prefix List Resequencing is available for IPv4 and[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 159 Figure 8-19. Resequencing ACLs Remarks and rules that originally have the same sequence number have the same sequence number after the resequence command is applied. Remarks that do not have a corresponding rule will be incremented as as a rule. These two mechanisms allow remarks to [...]

160 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com Figure 8-20. Resequencing Remarks Route Maps Route-maps are supported on platforms: c e s Like ACLs and prefix lists, route maps are composed of a series of commands that contain a matching criterion and an action, yet route maps can change the packets[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 161 Important Points to Remember • For route-maps with more than one match clause: • Two or more match clauses within the same route-map sequence have the same match commands (though the values are different), matching a packet against these clauses is a logical OR operation. • Two[...]

162 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com To view the configuration, use the show config command in the ROUTE-MAP mode (Figure 8-21) . Figure 8-21. Command Example: show config in the ROUTE-MAP Mode You can create multiple instances of this route map by using the sequence number option to plac[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 163 Figure 8-24. Command Example: show route-map To delete a route map, use the no route-map map-name command in the CONFIGURATION mode. Configure route map filters Within the ROUTE-MAP mode, there are match and set commands. Basically, match commands search for a certain criterion in th[...]

164 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com Also, if there are different instances of the same route-map, then it’s sufficient if a permit match happens in any instance of that route-map. As an example: In the above route-map, instance 10 permits the route having a tag value of 1000 and instan[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 165 To configure a set condition, use any or all of the following commands in the ROUTE-MAP mode: match ip address prefix-list-name CONFIG-ROUTE-MAP Match destination routes specified in a prefix list (IPv4). match ipv6 address prefix-list-name CONFIG-ROUTE-MAP Match destination routes s[...]

166 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com Use these commands to create route map instances. There is no limit to the number of set and match commands per route map, but the convention is to keep the number of match and set filters in a route map low. Set commands do not require a corresponding[...]

IP Access Control Lists (ACL), Prefix Lists, and Route-maps | 167 Configure a route map for route tagging One method for identifying routes from different routing protocols is to assign a tag to routes from that protocol. As the route enters a different routing domain, it is tagged and that tag is passed along with the route as it passes through di[...]

168 | IP Access Control Lists (ACL), Prefix Lists, and Route-maps www.dell.com | support.dell.com Figure 8-27. Command Example: continue ! route-map test permit 10 match commu comm-list1 set community 1:1 1:2 1:3 set as-path prepend 1 2 3 4 5 continue 30![...]

Bidirectional Forwarding Detection | 169 9 Bidirectional Forwarding Detection Bidirectional Forwarding Detection is supported only on platforms: c e BFD is supported on E-Series ExaScale e x with FTOS 8.2.1.0 and later. Protocol Overview Bidirectional Forwarding Detection (BFD) is a protocol that is used to rapidly detect communication failures bet[...]

170 | Bidirectional Forwarding Detection www.dell.com | support.dell.com How BFD Works Two neighboring systems running BFD establish a session using a three-way handshake. After the session has been established, the systems exchange control packets at agreed upon intervals. In addition, systems send a control packet anytime there is a state change [...]

Bidirectional Forwarding Detection | 171 Figure 9-1. BFD in IPv4 Packet Format Version (4) IHL TOS T otal Length Flags Frag Offset Source Port Destination Port Length BFD Control Packet Header Checksum Src IP Addr TTL (255) Protocol Dest IP Addr Options Padding Preamble Start Frame Delimiter Destination MAC Source MAC Ethernet Type (0x8800) IP Pack[...]

172 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Two important parameters are calculated using the values contained in the control packet. • Transmit interval — Transmit interval is the agreed-upon rate at which a system sends control packets. Each system has its own transmit interval, which is the greater of the last re[...]

Bidirectional Forwarding Detection | 173 BFD sessions BFD must be enabled on both sides of a link in order to establish a session. The two participating systems can assume either of two roles: • Active —The active system initiates the BFD session. Both systems can be active for the same session. • Passive —The passive system does not initia[...]

174 | Bidirectional Forwarding Detection www.dell.com | support.dell.com handshake. At this point, the discriminator values have been exchanged, and the transmit intervals have been negotiated. 4. The passive system receives the control packet, changes its state to Up. Both systems agree that a session has been established. However, since both memb[...]

Bidirectional Forwarding Detection | 175 Figure 9-3. BFD State Machine Important Points to Remember • BFD for line card ports is hitless, but is not hitless for VLANs since they are instantiated on the RPM. • BFD is supported on C-Series and E-Series only. • FTOS supports a maximum of 100 sessions per BFD agent. Each linecard processor has a [...]

176 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Configuring BFD for Physical Ports BFD on physical ports is useful when no routing protocol is enabled. Without BFD, if the remote system fails, the local system does not remove the connected route until the first failed attempt to send a packet. When BFD is enabled, the local[...]

Bidirectional Forwarding Detection | 177 Figure 9-5. Establishing a BFD Session for Physical Ports To establish a session: Verify that the session is established using the command show bfd neighbors , as shown in Figure 9-6 . Figure 9-6. Viewing Established Sessions for Physical Ports The command show bfd neighbors detail shows more specific inform[...]

178 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Figure 9-7. Viewing Session Details When both interfaces are configured for BFD, log messages are displayed indicating state changes, as shown in Message 1 . Changing physical port session parameters BFD sessions are configured with default intervals and a default role (active[...]

Bidirectional Forwarding Detection | 179 Figure 9-8. Changing Session Parameters for Physical Ports Disabling and re-enabling BFD BFD is enabled on all interfaces by default, though sessions are not created unless explicitly configured. If BFD is disabled, all of the sessions on that interface are placed in an Administratively Down state ( Message [...]

180 | Bidirectional Forwarding Detection www.dell.com | support.dell.com To re-enable BFD on an interface: Configuring BFD for Static Routes BFD gives systems a link state detection mechanism for static routes. With BFD, systems are notified to remove static routes from the routing table as soon as the link state change occurs, rather than having t[...]

Bidirectional Forwarding Detection | 181 To establish a BFD session: Verify that sessions have been created for static routes using the command show bfd neighbors , as shown in Figure 9-10 . View detailed session information using the command show bfd neighbors detail , as shown in Figure 9-8 . Figure 9-10. Viewing Established Sessions for Static R[...]

182 | Bidirectional Forwarding Detection www.dell.com | support.dell.com To disable BFD for static routes: Configuring BFD for OSPF When using BFD with OSPF, the OSPF protocol registers with the BFD manager on the RPM. BFD sessions are established with all neighboring interfaces participating in OSPF. If a neighboring interface fails, the BFD agent[...]

Bidirectional Forwarding Detection | 183 Figure 9-11. Establishing Sessions with OSPF Neighbors To establish BFD with all OSPF neighbors: To establish BFD for all OSPF neighbors on a single interface: View the established sessions using the command show bfd neighbors , as shown in Figure 9-12 . Figure 9-12. Viewing Established Sessions for OSPF Nei[...]

184 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Changing OSPF session parameters BFD sessions are configured with default intervals and a default role. The parameters that can be configured are: Desired TX Interval, Required Min RX Interval, Detection Multiplier, and system role. These parameters are configured for all OSPF[...]

Bidirectional Forwarding Detection | 185 Configuring BFD for BGP BFD for BGP is only supported on platforms: e c In a BGP core network, BFD provides rapid detection of communication failures in BGP fast-forwarding paths between internal BGP (iBGP) and external BGP (eBGP) peers for faster network reconvergence. BFD for BGP is supported on 1GE, 10GE,[...]

186 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Note that the sample configuration shows alternative ways to establish a BFD session with a BGP neighbor: • By establishing BFD sessions with all neighbors discovered by BGP ( bfd all-neighbors command) • By establishing a BFD session with a specified BGP neighbor ( neighb[...]

Bidirectional Forwarding Detection | 187 Disabling BFD for BGP To disable a BFD for BGP session with a specified neighbor, enter the neighbor { ip-address | peer-group-name } bfd disable command in ROUTER BGP configuration mode . To remove the disabled state of a BFD for BGP session with a specified neighbor, enter the no neighbor { ip-address | pe[...]

188 | Bidirectional Forwarding Detection www.dell.com | support.dell.com • The neighbor inherits only the global timer values that are configured with the bfd all-neighbors command (interval, min_rx, and multiplier). If you explicitly enable (or disable) a peer group for BFD that has no BFD parameters configured (e.g. advertisement interval) usin[...]

Bidirectional Forwarding Detection | 189 The following examples show the BFD for BGP output displayed for these show commands. Figure 9-14. Verifying a BFD for BGP Configuration: show running-config bgp Command Figure 9-15. Verifying BFD Sessions with BGP Neighbors: show bfd neighbors Command R2# show running-config bgp ! router bgp 2 neighbor 1.1.[...]

190 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Figure 9-16. Verifying BFD Sessions with BGP Neighbors: show bfd neighbors detail Command R2# show bfd neighbors detail Session Discriminator: 9 Neighbor Discriminator: 10 Local Addr: 1.1.1.3 Local MAC Addr: 00:01:e8:66:da:33 Remote Addr: 1.1.1.2 Remote MAC Addr: 00:01:e8:8a:d[...]

Bidirectional Forwarding Detection | 191 Figure 9-17. Displaying BFD Packet Counters: show bfd counters bgp Command Figure 9-18. Displaying BFD for BGP Status: show ip bgp summary Command R2# show bfd counters bgp Interface TenGigabitEthernet 6/0 Protocol BGP Messages: Registration : 5 De-registration : 4 Init : 0 Up : 6 Down : 0 Admin Down : 2 Int[...]

192 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Figure 9-19. Displaying Routing Sessions with BGP Neighbors: show ip bgp neighbors Command R2# show ip bgp neighbors 2.2.2.2 BGP neighbor is 2.2.2.2, remote AS 1, external link BGP version 4, remote router ID 12.0.0.4 BGP state ESTABLISHED, in this state for 00:05:33 Last read[...]

Bidirectional Forwarding Detection | 193 Configuring BFD for IS-IS BFD for IS-IS is supported on platform: e When using BFD with IS-IS, the IS-IS protocol registers with the BFD manager on the RPM. BFD sessions are then established with all neighboring interfaces participating in IS-IS. If a neighboring interface fails, the BFD agent on the line ca[...]

194 | Bidirectional Forwarding Detection www.dell.com | support.dell.com To establish BFD with all IS-IS neighbors out of a single interface: View the established sessions using the command show bfd neighbors , as shown in Figure 9-21 . Figure 9-21. Viewing Established Sessions for IS-IS Neighbors Changing IS-IS session parameters BFD sessions are [...]

Bidirectional Forwarding Detection | 195 Disabling BFD for IS-IS If BFD is disabled globally, all sessions are torn down, and sessions on the remote system are placed in a Down state. If BFD is disabled on an interface, sessions on the interface are torn down, and sessions on the remote system are placed in a Down state ( Message 3 on page 179 ). D[...]

196 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Figure 9-22. Establishing Sessions with VRRP Neighbors To establish sessions with all VRRP neighbors: Establishing VRRP sessions on VRRP neighbors The master router does not care about the state of the backup router, so it does not participate in any VRRP BFD sessions. Therefo[...]

Bidirectional Forwarding Detection | 197 Figure 9-23. Viewing Established Sessions for VRRP Neighbors Session state information is also shown in the show vrrp command output, as shown in Figure 9-24 . Figure 9-24. Viewing Established Sessions for VRRP Neighbors Changing VRRP session parameters BFD sessions are configured with default intervals and [...]

198 | Bidirectional Forwarding Detection www.dell.com | support.dell.com To change parameters for a particular VRRP session: View session parameters using the command show bfd neighbors detail , as shown in Figure 9-8 on page 179 . Disabling BFD for VRRP If any or all VRRP sessions are disabled, the sessions are torn down. A final Admin Down contro[...]

Bidirectional Forwarding Detection | 199 There is one BFD Agent for VLANs and port-channels, which resides on RP2 as opposed to the other agents which are on the line card. Therefore, the 100 total possible sessions that this agent can maintain is shared for VLANs and port-channels. Configuring BFD for VLANs is a two-step process: 1. Enable BFD glo[...]

200 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Figure 9-26. Viewing Established Sessions for VLAN Neighbors Changing session parameters BFD sessions are configured with default intervals and a default role. The parameters that can be configured are: Desired TX Interval, Required Min RX Interval, Detection Multiplier, and s[...]

Bidirectional Forwarding Detection | 201 Configuring BFD for Port-Channels BFD on port-channels is analogous to BFD on physical ports. If no routing protocol is enabled, and a remote system fails, the local system does not remove the connected route until the first failed attempt to send a packet. If BFD is enabled, the local system removes the rou[...]

202 | Bidirectional Forwarding Detection www.dell.com | support.dell.com To establish a session on a port-channel: View the established sessions using the command show bfd neighbors , as shown in Figure 9-21 . Figure 9-28. Viewing Established Sessions for VLAN Neighbors Changing port-channel session parameters BFD sessions are configured with defau[...]

Bidirectional Forwarding Detection | 203 To disable BFD for a port-channel: Configuring Protocol Liveness Protocol Liveness is a feature that notifies the BFD Manager when a client protocol is disabled. When a client is disabled, all BFD sessions for that protocol are torn down. Neighbors on the remote system receive an Admin Down control packet an[...]

204 | Bidirectional Forwarding Detection www.dell.com | support.dell.com Figure 9-30. debug bfd packet Command Output The output for the command debug bfd event is the same as the log messages that appear on the console by default. RX packet dump: 20 c0 03 18 00 00 00 05 00 00 00 04 00 01 86 a0 00 01 86 a0 00 00 00 00 00:34:13 : Sent packet for ses[...]

Border Gateway Protocol IPv4 (BGPv4) | 205 10 Border Gateway Protocol IPv4 (BGPv4) Border Gateway Protocol IPv4 (BGPv4) version 4 (BGPv4) is supported on platforms: c e s Platforms support BGP according to the following table: This chapter is intended to provide a general description of Border Gateway Protocol version 4 (BGPv4) as it is supported i[...]

206 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com • Implementing BGP with FTOS • Advertise IGP cost as MED for redistributed routes • Ignore Router-ID for some best-path calculations • 4-Byte AS Numbers • AS4 Number Representation • AS Number Migration • BGP4 Management Information Base (MIB) • Important Poi[...]

Border Gateway Protocol IPv4 (BGPv4) | 207 A stub AS is one that is connected to only one other AS. A transit AS is one that provides connections through itself to separate networks. For example as seen in Figure 10-1 , Router 1 can use Router 2 (the transit AS) to connect to Router 4. ISPs are always transit ASs, because they provide connections f[...]

208 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-2. Full Mesh Examples The number of BGP speakers each BGP peer must maintain increases exponentially. Network management quickly becomes impossible. Sessions and Peers When two routers communicate using the BGP protocol, a BGP session is started. The two end-points[...]

Border Gateway Protocol IPv4 (BGPv4) | 209 In order to make decisions in its operations with other BGP peers, a BGP peer uses a simple finite state machine that consists of six states: Idle, Connect, Active, OpenSent, OpenConfirm, and Established. For each peer-to-peer session, a BGP implementation tracks which of these six states the session is in[...]

210 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com To illustrate how these rules affect routing, see Figure 10-3 and the following steps.Routers B, C, D, E, and G are members of the same AS - AS100. These routers are also in the same Route Reflection Cluster, where Router D is the Route Reflector. Router E and H are client p[...]

Border Gateway Protocol IPv4 (BGPv4) | 211 BGP Attributes Routes learned via BGP have associated properties that are used to determine the best route to a destination when multiple paths exist to a particular destination. These properties are referred to as BGP attributes, and an understanding of how BGP attributes influence route selection is requ[...]

212 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-4. BGP Best Path Selection Best Path selection details 1. Prefer the path with the largest WEIGHT attribute. 2. Prefer the path with the largest LOCAL_PREF attribute. 3. Prefer the path that was locally Originated via a network command, redistribute command or aggr[...]

Border Gateway Protocol IPv4 (BGPv4) | 213 • AS_CONFED_SEQUENCE has a path length of 1, no matter how many ASs are in the AS_CONFED_SEQUENCE. 5. Prefer the path with the lowest ORIGIN type (IGP is lower than EGP, and EGP is lower than INCOMPLETE). 6. Prefer the path with the lowest Multi-Exit Discriminator (MED) attribute. The following criteria [...]

214 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Weight The Weight attribute is local to the router and is not advertised to neighboring routers. If the router learns about more than one route to the same destination, the route with the highest weight will be preferred. The route with the highest weight is installed in the[...]

Border Gateway Protocol IPv4 (BGPv4) | 215 One AS assigns the MED a value and the other AS uses that value to decide the preferred path. For this example, assume the MED is the only attribute applied. In Figure 10-6 , AS100 and AS200 connect in two places. Each connection is a BGP session. AS200 sets the MED for its T1 exit point to 100 and the MED[...]

216 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Generally, an IGP indicator means that the route was derived inside the originating AS. EGP generally means that a route was learned from an external gateway protocol. An INCOMPLETE origin code generally results from aggregation, redistribution or other indirect ways of inst[...]

Border Gateway Protocol IPv4 (BGPv4) | 217 Next Hop The Next Hop is the IP address used to reach the advertising router. For EBGP neighbors, the Next-Hop address is the IP address of the connection between the neighbors. For IBGP, the EBGP Next-Hop address is carried into the local AS. A Next Hop attribute is set when a BGP speaker advertises itsel[...]

218 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com • If the redistribute command does not have any metric configured and BGP Peer out-bound route-map does have metric-type internal configured, BGP advertises the IGP cost as MED. • If the redistribute command has metric configured ( route-map set metric or redistribute ro[...]

Border Gateway Protocol IPv4 (BGPv4) | 219 Where the 2-Byte format is 1-65535, the 4-Byte format is 1- 4294967295 . Enter AS Numbers using the traditional format. If the ASN is greater than 65535, the dot format is shown when using the show ip bgp commands. For example, an ASN entered as 3183856184 will appear in the show commands as 48581.51768; a[...]

220 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com ASDOT representation combines the ASPLAIN and ASDOT+ representations. AS Numbers less than 65536 appear in integer format (asplain); AS Numbers equal to or greater than 65536 appear using the decimal method (asdot+). For example, the AS Number 65526 appears as 65526, and the[...]

Border Gateway Protocol IPv4 (BGPv4) | 221 Figure 10-10. Dynamic changes when bgp asnotation command is disabled in the show running config AS Number Migration When migrating one AS to another, perhaps combining ASs, an eBGP network may lose its routing to an iBGP if the ASN changes. Migration can be difficult as all the iBGP and eBGP peers of the [...]

222 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-11. Local-AS Scenario When you complete your migration, and you have reconfigured your network with the new information you must disable this feature. If the “no prepend” option is used, the local-as will not be prepended to the updates received from the eBGP p[...]

Border Gateway Protocol IPv4 (BGPv4) | 223 Local-as is prepended before the route-map to give an impression that update passed thru a router in AS 200 before it reached Router B. BGP4 Management Information Base (MIB) The FORCE10-BGP4-V2-MIB enhances FTOS BGP Management Information Base (MIB) support with many new SNMP objects and notifications (tr[...]

224 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com • The AFI/SAFI is not used as an index to the f10BgpM2PeerCountersEntry table. The BGP peer's AFI/ SAFI (IPv4 Unicast or IPv6 Multicast) is used for various outbound counters. Counters corresponding to IPv4 Multicast cannot be queried. • The f10BgpM2[Cfg]PeerReflect[...]

Border Gateway Protocol IPv4 (BGPv4) | 225 BGP Configuration To enable the BGP process and begin exchanging information, you must assign an AS number and use commands in the ROUTER BGP mode to configure a BGP neighbor. Defaults By default, BGP is disabled. By default, FTOS compares the MED attribute on different paths from within the same AS (the b[...]

226 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com • Configure passive peering • Maintain existing AS numbers during an AS migration • Allow an AS number to appear in its own AS path • Enable graceful restart • Filter on an AS-Path attribute • Configure IP community lists • Manipulate the COMMUNITY attribute ?[...]

Border Gateway Protocol IPv4 (BGPv4) | 227 Use these commands in the following sequence, starting in the CONFIGURATION mode to establish BGP sessions on the router. Step Command Syntax Command Mode Purpose 1 router bgp as-number CONFIGURATION Assign an AS number and enter the ROUTER BGP mode. AS Number: 0-65535 (2-Byte) or 1-4294967295 (4-Byte) or [...]

228 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Enter show config in CONFIGURATION ROUTER BGP mode to view the BGP configuration. Use the show ip bgp summary command in EXEC Privilege mode to view the BGP status. Figure 10-12 shows the summary with a 2-Byte AS Number displayed; Figure 10-13 shows the summary with a 4-Byte[...]

Border Gateway Protocol IPv4 (BGPv4) | 229 Figure 10-14 displays two neighbors, one is an external and the second one is an internal BGP neighbor. The first line of the output for each neighbor displays the AS number and states whether the link is an external or internal. The third line of the show ip bgp neighbors output contains the BGP State. If[...]

230 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-15. Command example: show running-config bgp Configure AS4 Number Representations Enable one type of AS Number Representation: ASPLAIN, ASDOT+, or ASDOT. • ASPLAIN is the method FTOS has used for all previous FTOS versions. It remains the default method with FTOS[...]

Border Gateway Protocol IPv4 (BGPv4) | 231 Figure 10-16. Command example and output: bgp asnotation asplain Figure 10-17. Command example and output: bgp asnotation asdot Figure 10-18. Command example and output: bgp asnotation asdot+ Enable ASDOT AS Number representation. Figure 10-17 bgp asnotation asdot CONFIG-ROUTER-BGP Enable ASDOT+ AS Number [...]

232 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Configure Peer Groups To configure multiple BGP neighbors at one time, create and populate a BGP peer group. Another advantage of peer groups is that members of a peer groups inherit the configuration properties of the group and share same update policy. A maximum of 256 Pee[...]

Border Gateway Protocol IPv4 (BGPv4) | 233 When you add a peer to a peer group, it inherits all the peer group’s configured parameters. A neighbor cannot become part of a peer group if it has any of the following commands are configured: • neighbor advertisement-interval • neighbor distribute-list out • neighbor filter-list out • neighbor[...]

234 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-20. Command example: show config (peer-group enabled To disable a peer group, use the neighbor peer-group-name shutdown command in the CONFIGURATION ROUTER BGP mode. The configuration of the peer group is maintained, but it is not applied to the peer group members.[...]

Border Gateway Protocol IPv4 (BGPv4) | 235 Figure 10-21. Command example: show ip bgp peer-group BGP fast fall-over By default, a BGP session is governed by the hold time. BGP routers typically carry large routing tables, so frequent session resets are not desirable. The BGP fast fall-over feature reduces the convergence time while maintaining stab[...]

236 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com The BGP fast fall-over feature is configured on a per-neighbor or peer-group basis and is disabled by default. To disable Fast Fall-Over, use the [no] neighbor [neighbor | peer-group] fall-over command in CONFIGURATION ROUTER BGP mode Use the show ip bgp neighbors command as[...]

Border Gateway Protocol IPv4 (BGPv4) | 237 Figure 10-22. Command example: show ip bgp neighbors Use the show ip bgp peer-group command to verify that fast fall-over is enabled on a peer-group. FTOS#sh ip bgp neighbors BGP neighbor is 100.100.100.100, remote AS 65517, internal link Member of peer-group test for session parameters BGP version 4, remo[...]

238 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-23. Command example: show ip bgp peer-group Configure passive peering When you enable a peer-group, the software sends an OPEN message to initiate a TCP connection. If you enable passive peering for the peer group, the software does not send an OPEN message, but it[...]

Border Gateway Protocol IPv4 (BGPv4) | 239 Only after the peer group responds to an OPEN message sent on the subnet does its BGP state change to ESTABLISHED. Once the peer group is ESTABLISHED, the peer group is the same as any other peer group. For more information on peer groups, refer to Configure Peer Groups on page 232 . Maintain existing AS n[...]

240 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-24. Local-as information shown Allow an AS number to appear in its own AS path This command allows you to set the number of times a particular AS number can occur in the AS path. The allow-as feature permits a BGP speaker to allow the ASN to be present for specifie[...]

Border Gateway Protocol IPv4 (BGPv4) | 241 Figure 10-25. Allowas-in information shown Enable graceful restart Use this feature to lessen the negative effects of a BGP restart. FTOS advertises support for this feature to BGP neighbors through a capability advertisement. You can enable graceful restart by router and/or by peer or peer group. The defa[...]

242 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com • Advertise to all BGP neighbors and peer-groups that the forwarding state of all routes has been saved. This prompts all peers to continue saving the routes they receive from your E-Series and to continue forwarding traffic. • Bring the secondary RPM online as the prima[...]

Border Gateway Protocol IPv4 (BGPv4) | 243 Filter on an AS-Path attribute The BGP attribute, AS_PATH, can be used to manipulate routing policies. The AS_PATH attribute contains a sequence of AS numbers representing the route’s path. As the route traverses an Autonomous System, the AS number is prepended to the route. You can manipulate routes bas[...]

244 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Regular Expressions as filters Regular expressions are used to filter AS paths or community lists. A regular expression is a special character used to define a pattern that is then compared with an input string. For an AS-path access list as shown in the commands above, if t[...]

Border Gateway Protocol IPv4 (BGPv4) | 245 Figure 10-27. Filtering with Regular Expression Table 10-4 lists the Regular Expressions accepted in FTOS. Table 10-4. Regular Expressions Regular Expression Definition ^ (carrot) Matches the beginning of the input string. Alternatively, when used as the first character within brackets [^ ] matches any num[...]

246 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com As seen in Figure 10-27 , the expressions are displayed when using the show commands. Use the show config command in the CONFIGURATION AS-PATH ACL mode and the show ip as-path-access-list command in EXEC Privilege mode to view the AS-PATH ACL configuration. For more informat[...]

Border Gateway Protocol IPv4 (BGPv4) | 247 Configure IP community lists Within FTOS, you have multiple methods of manipulating routing attributes. One attribute you can manipulate is the COMMUNITY attribute. This attribute is an optional attribute that is defined for a group of destinations. In FTOS, you can assign a COMMUNITY attribute to BGP rout[...]

248 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Use these commands in the following sequence, starting in the CONFIGURATION mode to configure an IP community list. Use these commands in the following sequence, starting in the CONFIGURATION mode to configure an IP extended community list. To set or modify an extended commu[...]

Border Gateway Protocol IPv4 (BGPv4) | 249 Figure 10-28. Command example: show ip community-lists Use these commands in the following sequence, starting in the CONFIGURATION mode, To use an IP Community list or Extended Community List to filter routes, you must apply a match community filter to a route map and then apply that route map to a BGP nei[...]

250 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Manipulate the COMMUNITY attribute In addition to permitting or denying routes based on the values of the COMMUNITY attributes, you can manipulate the COMMUNITY attribute value and send the COMMUNITY attribute with the route information. By default, FTOS does not send the CO[...]

Border Gateway Protocol IPv4 (BGPv4) | 251 To view the BGP configuration, use the show config command in CONFIGURATION ROUTER BGP mode. To view a route map configuration, use the show route-map command in EXEC Privilege mode. Use the show ip bgp community command in EXEC Privilege mode (Figure 10-29) to view BGP routes matching a certain community [...]

252 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Use any or all of the following commands in the CONFIGURATION ROUTER BGP mode to change how the MED attribute is used. Use the show config command in the CONFIGURATION ROUTER BGP mode to view the nondefault values. Change LOCAL_PREFERENCE attribute In FTOS, you can change th[...]

Border Gateway Protocol IPv4 (BGPv4) | 253 To view the BGP configuration, use the show config command in the CONFIGURATION ROUTER BGP mode. To view a route map configuration, use the show route-map command in EXEC Privilege mode. Change NEXT_HOP attribute You can change how the NEXT_HOP attribute is used. Use the following command in the CONFIGURAT[...]

254 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com You can also use route maps to change this and other BGP attributes. For example, you can include the following command in a route map to specify the next hop address: Enable multipath By default, the software allows one path to a destination. You can enable multipath to all[...]

Border Gateway Protocol IPv4 (BGPv4) | 255 Refer to Chapter 8, “IP Access Control Lists (ACL), Prefix Lists, and Route-maps,” on page 133 for configuration information on prefix lists, AS-PATH ACLs, and route maps. Use these commands in the following sequence, starting in the CONFIGURATION mode to filter routes using prefix lists. As a reminder[...]

256 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Use these commands in the following sequence, starting in the CONFIGURATION mode to filter routes using a route map. Use the show config command in CONFIGURATION ROUTER BGP mode to view the BGP configuration. Use the show route-map command in EXEC Privilege mode to view a ro[...]

Border Gateway Protocol IPv4 (BGPv4) | 257 Use the show config command in CONFIGURATION ROUTER BGP mode and show ip as-path-access-list command in EXEC Privilege mode to view which commands are configured. Include this filter permit .* in your AS-PATH ACL to forward all routes not meeting the AS-PATH ACL criteria. Configure BGP route reflectors BGP[...]

258 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Aggregate routes FTOS provides multiple ways to aggregate routes in the BGP routing table. At least one specific route of the aggregate must be in the routing table for the configured aggregate to become active. Use the following command in the CONFIGURATION ROUTER BGP mode [...]

Border Gateway Protocol IPv4 (BGPv4) | 259 Use the following commands in the CONFIGURATION ROUTER BGP mode to configure BGP confederations. Use the show config command in the CONFIGURATION ROUTER BGP mode to view the configuration. Enable route flap dampening When EBGP routes become unavailable, they “flap” and the router issues both WITHDRAWN [...]

260 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-31. Setting Reuse and Restart Route Values Use the following command in the CONFIGURATION ROUTER BGP mode to configure route flap dampening parameters. To view the BGP configuration, use show config in the CONFIGURATION ROUTER BGP mode or show running-config bgp in[...]

Border Gateway Protocol IPv4 (BGPv4) | 261 To set dampening parameters via a route map, use the following command in CONFIGURATION ROUTE-MAP mode: To view a count of dampened routes, history routes and penalized routes when route dampening is enabled, look at the seventh line of the show ip bgp summary command output (Figure 10-32) . Figure 10-32. [...]

262 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Use the following command in EXEC Privilege mode to clear information on route dampening and return suppressed routes to active state. Use the following command in EXEC and EXEC Privilege mode to view statistics on route flapping. By default, the path selection in FTOS is de[...]

Border Gateway Protocol IPv4 (BGPv4) | 263 Change BGP timers Use either or both of the following commands in the CONFIGURATION ROUTER BGP mode to configure BGP timers. Use the show config command in CONFIGURATION ROUTER BGP mode or the show running-config bgp command in EXEC Privilege mode to view non-default values. Timer values configured with th[...]

264 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Use the clear ip bgp command in EXEC Privilege mode to reset a BGP connection using BGP soft reconfiguration. When inbound soft reconfiguration is enabled on a neighbor and you enter the clear ip bgp soft in command, the update database stored in the router is replayed and u[...]

Border Gateway Protocol IPv4 (BGPv4) | 265 Route map continue The BGP route map continue feature (in ROUTE-MAP mode) allows movement from one route-map entry to a specific route-map entry (the sequence number ). If the sequence number is not specified, the continue feature moves to the next sequence number (also known as an implied continue). If a [...]

266 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com MBGP Configuration MBGP for IPv6 unicast is supported on platforms e t c MBGP for IPv4 Multicast is supported on platform c e t s MBGP is not supported on the E-Series ExaScale e x platform. Multiprotocol BGP (MBGP) is an enhanced BGP that carries IP multicast routes. BGP ca[...]

Border Gateway Protocol IPv4 (BGPv4) | 267 BGP Regular Expression Optimization BGP policies that contain regular expressions to match against as-paths and communities might take a lot of CPU processing time, thus affect BGP routing convergence. Also, show bgp commands that get filtered through regular expressions can to take a lot of CPU cycles, es[...]

268 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com FTOS displays debug messages on the console. To view which debugging commands are enabled, use the show debugging command in EXEC Privilege mode. Use the keyword no followed by the debug command To disable a specific debug command. For example, to disable debugging of BGP up[...]

Border Gateway Protocol IPv4 (BGPv4) | 269 Figure 10-34. Viewing the Last Bad PDU from BGP Peers Capturing PDUs Capture incoming and outgoing PDUs on a per-peer basis using the command capture bgp-pdu neighbor direction. Disable capturing using the no form of this command. FTOS(conf-router_bgp)#do show ip bgp neighbors 1.1.1.2 BGP neighbor is 1.1.1[...]

270 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com The buffer size supports a maximum value between 40 MB (the default) and 100 MB. The capture buffers are cyclic and reaching the limit prompts the system to overwrite the oldest PDUs when new ones are received for a given neighbor or direction. Setting the buffer size to a v[...]

Border Gateway Protocol IPv4 (BGPv4) | 271 With full internet feed (205K) captured, approximately 11.8MB is required to store all of the PDUs, as shown in Figure 10-36 . Figure 10-36. Required Memory for Captured PDUs PDU Counters FTOS version 7.5.1.0 introduces additional counters for various types of PDUs sent and received from neighbors. These a[...]

272 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-37. Sample Configuration Illustration GigE 1/31 10.0.3.31 /24 Loopback 1 192.168.128.1 /24 GigE 2/31 10.0.2.2 /24 Loopback 1 192.168.128.2 /24 Physical Links Vir tual Links GigE 1/21 10.0.1.21 /24 ck 1 /24 GigE 2/11 10.0.1.22 /24 Lo 19 GigE 3/11 10.0.3.33 /24 Loopb[...]

Border Gateway Protocol IPv4 (BGPv4) | 273 Figure 10-38. Enable BGP - Router 1 R1# conf R1(conf)#int loop 0 R1(conf-if-lo-0)#ip address 192.168.128.1/24 R1(conf-if-lo-0)#no shutdown R1(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.1/24 no shutdown R1(conf-if-lo-0)#int gig 1/21 R1(conf-if-gi-1/21)#ip address 10.0.1.21/24 R1[...]

274 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-39. Enable BGP - Router 2 R2# conf R2(conf)#int loop 0 R2(conf-if-lo-0)#ip address 192.168.128.2/24 R2(conf-if-lo-0)#no shutdown R2(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.2/24 no shutdown R2(conf-if-lo-0)#int gig 2/11 R2(conf-if-gi-[...]

Border Gateway Protocol IPv4 (BGPv4) | 275 Figure 10-40. Enable BGP - Router 3 R3# conf R3(conf)# R3(conf)#int loop 0 R3(conf-if-lo-0)#ip address 192.168.128.3/24 R3(conf-if-lo-0)#no shutdown R3(conf-if-lo-0)#show config ! interface Loopback 0 ip address 192.168.128.3/24 no shutdown R3(conf-if-lo-0)#int gig 3/11 R3(conf-if-gi-3/11)#ip address 10.0.[...]

276 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-41. Enable Peer Group - Router 1 R1#conf R1(conf)#router bgp 99 R1(conf-router_bgp)# network 192.168.128.0/24 R1(conf-router_bgp)# neighbor AAA peer-group R1(conf-router_bgp)# neighbor AAA no shutdown R1(conf-router_bgp)# neighbor BBB peer-group R1(conf-router_bgp)[...]

Border Gateway Protocol IPv4 (BGPv4) | 277 Figure 10-42. Enable Peer Groups - Router 1 continued Capabilities received from neighbor for IPv4 Unicast : MULTIPROTO_EXT(1) ROUTE_REFRESH(2) CISCO_ROUTE_REFRESH(128) Capabilities advertised to neighbor for IPv4 Unicast : MULTIPROTO_EXT(1) ROUTE_REFRESH(2) CISCO_ROUTE_REFRESH(128) Update source set to Lo[...]

278 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-43. Enable Peer Groups - Router 2 R2#conf R2(conf)#router bgp 99 R2(conf-router_bgp)# neighbor CCC peer-group R2(conf-router_bgp)# neighbor CC no shutdown R2(conf-router_bgp)# neighbor BBB peer-group R2(conf-router_bgp)# neighbor BBB no shutdown R2(conf-router_bgp)[...]

Border Gateway Protocol IPv4 (BGPv4) | 279 Figure 10-44. Enable Peer Group - Router 3 R3#conf R3(conf)#router bgp 100 R3(conf-router_bgp)# neighbor AAA peer-group R3(conf-router_bgp)# neighbor AAA no shutdown R3(conf-router_bgp)# neighbor CCC peer-group R3(conf-router_bgp)# neighbor CCC no shutdown R3(conf-router_bgp)# neighbor 192.168.128.2 peer-g[...]

280 | Border Gateway Protocol IPv4 (BGPv4) www.dell.com | support.dell.com Figure 10-45. Enable Peer Groups - Router 3 continued Capabilities received from neighbor for IPv4 Unicast : MULTIPROTO_EXT(1) ROUTE_REFRESH(2) CISCO_ROUTE_REFRESH(128) Capabilities advertised to neighbor for IPv4 Unicast : MULTIPROTO_EXT(1) ROUTE_REFRESH(2) CISCO_ROUTE_REFR[...]

Content Addressable Memory | 281 11 Content Addressable Memory Content Addressable Memory is supported on platforms c e t s • Content Addressable Memory on page 281 • CAM Profiles on page 282 • Microcode on page 284 • CAM Profiling for ACLs on page 285 • When to Use CAM Profiling on page 287 • Differences Between EtherScale and TeraScal[...]

282 | Content Addressable Memory www.dell.com | support.dell.com • The ExaScale EH and EJ series line cards are single-CAM line cards that support 10M and 40M CAM for storing the lookup information. • The TeraScale EG-series line cards are dual-CAM and use two 18 Megabit CAM modules with a dedicated 512 IPv4 Forwarding Information Base (FIB), a[...]

Content Addressable Memory | 283 The size of CAM partitions is measured in entries. Table 11-1 shows the number of entries available in each partition for all CAM profiles. The total CAM space is finite, therefor adding entries to one region necessarily decreases the number available to other regions. Table 11-1. CAM Profile Descriptions CAM Profil[...]

284 | Content Addressable Memory www.dell.com | support.dell.com Microcode Microcode is a compiled set of instructions for a CPU. On Dell Force10 systems, the microcode controls how packets are handled. There is a default microcode, and several other microcodes are available, so that you can adjust packet handling according to your application. Spe[...]

Content Addressable Memory | 285 CAM Profiling for ACLs CAM Profiling for ACLs is supported on platform e t only. Refer to Content Addressable Memory for ExaScale for E-Series ExaScale e x CAM descriptions. The default CAM profile has 1K Layer 2 ingress ACL entries. If you need more memory for Layer 2 ingress ACLs, select the profile l2-ipv4-inacl [...]

286 | Content Addressable Memory www.dell.com | support.dell.com You can re-configure the amount of space, in percentage, allocated to each sub-partition . As with the IPv4Flow partition, you can configure the Layer 2 ACL partition from EXEC Privilege mode or CONFIGURATION mode. The amount of space that you can distribute to the sub-partitions is e[...]

Content Addressable Memory | 287 Figure 11-1. EF Line Card with EG Chassis Profile—Card Problem Figure 11-2. EH Line Card with EG Chassis Profile—Card Problem When to Use CAM Profiling The CAM profiling feature enables you to partition the CAM to best suit your application. For example: • Configure more Layer 2 FIB entries when the system is [...]

288 | Content Addressable Memory www.dell.com | support.dell.com • Optimize the VLAN ACL Group feature, which permits group VLANs for IP egress ACLs. See CAM profile for the VLAN ACL group feature on page 299 . Important Points to Remember • CAM Profiling is available on the E-Series TeraScale with FTOS versions 6.3.1.1 and later. • All line [...]

Content Addressable Memory | 289 To change the CAM profile on the entire system: CAM Allocation User Configurable CAM Allocations is available on platforms: c s Allocate space for IPV4 ACLs and QoS regions, and IPv6 6 ACLs and QoS regions on the C-Series and S-Series by using the cam-acl command in CONFIGURATION mode. The CAM space is allotted in F[...]

290 | Content Addressable Memory www.dell.com | support.dell.com The ipv6acl and vman-dual-qos allocations must be entered as a factor of 2 (2, 4, 6, 8, 10). All other profile allocations can use either even or odd numbered ranges. You must save the new CAM settings to the startup-config ( write-mem or copy run start ) then reload the system for th[...]

Content Addressable Memory | 291 View CAM Profiles View the current CAM profile for the chassis and each component using the command show cam-profile , as shown in Figure 11-4 . This command also shows the profile that will be loaded upon the next chassis or component reload. Figure 11-4. Viewing CAM Profiles on E-Series TeraScale View a brief outp[...]

292 | Content Addressable Memory www.dell.com | support.dell.com Figure 11-6. View CAM-ACl settings on C-Series and S-Series View CAM Usage View the amount of CAM space available, used, and remaining in each partition (including IPv4Flow and Layer 2 ACL sub-partitions) using the command show cam-usage from EXEC Privilege mode, as shown in Figure 11[...]

Content Addressable Memory | 293 Figure 11-7. Viewing CAM Usage Information Configure IPv4Flow Sub-partitions IPv4Flow sub-partitions are supported on platform e The IPv4Flow CAM partition has sub-partitions for several types of information. Table 11-5 lists the types of information stored in this partition and the number of entries that FTOS alloc[...]

294 | Content Addressable Memory www.dell.com | support.dell.com • The IPv4Flow configuration is applied to entire system when you enter the command cam-ipv4flow from CONFIGURATION mode, however, you must save the running-configuration to affect the change. The amount of space that is allocated among the sub-partitions must be equal to the amount[...]

Content Addressable Memory | 295 Figure 11-8. Configuring IPv4Flow on the Entire System Configure Ingress Layer 2 ACL Sub-partitions IPv4Flow sub-partitions are supported on platform e The Ingress Layer 2 ACL CAM partition has sub-partitions for several types of information. Table 11-6 lists the sub-partition and the percentage of the Ingress Layer[...]

296 | Content Addressable Memory www.dell.com | support.dell.com You can re-configure the amount of space, in percentage, allocated to each sub-partition . • Apply the Ingress Layer 2 ACL configuration to entire system by entering the command cam-l2acl from CONFIGURATION mode, however, you must save the running-configuration to affect the change.[...]

Content Addressable Memory | 297 Figure 11-9. Configuring Ingress Layer 2 ACL on the Entire System Return to the Default CAM Configuration Return to the default CAM Profile, microcode, IPv4Flow, or Layer 2 ACL configuration using the keyword default from EXEC Privilege mode or from CONFIGURATION mode, as shown in Figure 11-10 . FTOS(conf)#do show c[...]

298 | Content Addressable Memory www.dell.com | support.dell.com Figure 11-10. Returning to the default Configuration CAM Optimization CAM optimization is supported on platforms c s When this command is enabled, if a Policy Map containing classification rules (ACL and/or dscp/ ip-precedence rules) is applied to more than one physical interface on t[...]

Content Addressable Memory | 299 • If the packet has more than 5 MPLS labels, hashing is based on the source and destination MAC address. To enable this type of hashing, use the default CAM profile with the microcode lag-hash-mpls . LAG Hashing based on Bidirectional Flow To hash LAG packets such that both directions of a bidirectional flow (for [...]

300 | Content Addressable Memory www.dell.com | support.dell.com QoS CAM Region Limitation The default CAM profile allocates a partition within the IPv4Flow region to store QoS service policies. If the QoS CAM space is exceeded, messages similar to the ones in Message 5 are displayed. If you exceed the QoS CAM space: FTOS version 7.4.1 introduced t[...]

Configuration Replace and Rollback | 301 12“ Configuration Replace and Rollback Configuration Replace and Rollback is supported on platforms c e The E-Series ExaScale platform is supported with FTOS 8.1.1.0 and later. Configuration Replace and Rollback enables you to replace the current running-configuration with different configuration without r[...]

302 | Configuration Replace and Rollback www.dell.com | support.dell.com Configuring Configuration Replace and Rollback Configuring Configuration Replace and Rollback is a three-step process: 1. Enable the archive service. See page 302. 2. Archive a running-configuration. See page 303. 3. Replace the running-configuration with an archived configura[...]

Configuration Replace and Rollback | 303 You do not have to enable the archive service again if you save the running configuration after completing task. If you reload the system or upgrade your FTOS version without saving the running configuration you must enable the archive service again. Archiving a Configuration File Archive the current running[...]

304 | Configuration Replace and Rollback www.dell.com | support.dell.com 1. The hostname of the Dell Force10 system is changed from “R1” to “FTOS.” 2. The running configuration is replaced with archive_0, in which the hostname is “R1.” Figure 12-3. Replacing the Running-configuration with and Archived Configuration Use the keyword force[...]

Configuration Replace and Rollback | 305 Figure 12-5. Configuring FTOS to Rollback to a Previous Configuration Figure 12-6. Committing to an Archived Configuration Configuring an Archive File Maximum The maximum number of archive files is configurable between 2 and 15. Default maximum is 10. Use the command maximum from ARCHIVE mode to configure th[...]

306 | Configuration Replace and Rollback www.dell.com | support.dell.com Figure 12-8. Configuring the Maximum Number of Archive Files (continued) Configuring Auto-archive You can configure the system to archive the running-configuration periodically so that you do not have to archive manually. Configure auto-archiving using the command time-period [...]

Configuration Replace and Rollback | 307 Figure 12-9. Configuring an Archive Time-period Copying and Deleting an Archive File Copy an archive file to another location using the command archive backup , as shown in Figure 12-10 . Delete an archive file using the command archive delete from CONFIG ARCHIVE mode. Viewing and Editing the Contents of an [...]

308 | Configuration Replace and Rollback www.dell.com | support.dell.com Figure 12-10. Viewing an Archive File Viewing the Difference between Configuration Files View the difference between the running-configuration and an archived configuration using the command show run diff . In Figure 12-11 , the running-configuration is archived as archive_3, [...]

Configuration Replace and Rollback | 309 Figure 12-11. Viewing the Difference between Configuration Files R1#archive config configuration archived as archive_3 R1(conf)#hostname FTOS FTOS(conf)#do show run diff archive_3 running-config ------- < hostname FTOS flash:/CFGARCH_DIR/archive_3 ------- > hostname R1 FTOS(conf)#[...]

310 | Configuration Replace and Rollback www.dell.com | support.dell.com[...]

Dynamic Host Configuration Protocol | 311 13 Dynamic Host Configuration Protocol Dynamic Host Configuration Protocol is available on platforms: c e s This chapter contains the following sections: • Protocol Overview on page 311 • Implementation Information on page 314 • Configuration Tasks on page 314 • Configure the System to be a DHCP Ser[...]

312 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com DHCP Packet Format and Options DHCP uses UDP as its transport protocol. The server listens on port 67 and transmits to port 68; the client listens on port 68 and transmits to port 67. The configuration parameters are carried as options in the DHCP packet in Type, Length, Valu[...]

Dynamic Host Configuration Protocol | 313 Assigning an IP Address using DHCP When a client joins a network: 1. The client initially broadcasts a DHCPDISCOVER message on the subnet to discover available DHCP servers. This message includes the parameters that the client requires and might include suggested values for those parameters. 2. Servers unic[...]

314 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com Implementation Information • The Dell Force10 implementation of DHCP is based on RFC 2131 and RFC 3046. • DHCP is available on VLANs and Private VLANs. • IP Source Address Validation is a sub-feature of DHCP Snooping; FTOS uses ACLs internally to implement this feature [...]

Dynamic Host Configuration Protocol | 315 2. Configuration Parameter Storage and Management : DHCP servers also store and maintain other parameters that are sent to clients when requested. These parameters specify in detail how a client is to operate. 3. Lease Management : DHCP servers use leases to allocate addresses to clients for a limited time.[...]

316 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com To create an address pool: Once an IP address is leased to a client, only that client may release the address. FTOS performs a IP + MAC source address validation to ensure that no client can release another clients address. This is a default behavior, and is separate from IP+[...]

Dynamic Host Configuration Protocol | 317 Enable DHCP Server DHCP server is disabled by default. In Figure 13-3 , an IP phone is powered by PoE and has acquired an IP address from the Dell Force10 system, which is advertising LLDP-MED. The leased IP address is displayed using show ip dhcp binding, and confirmed with show lldp neighbors . Figure 13-[...]

318 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com Address Resolution using NetBIOS WINS Windows Internet Naming Service (WINS) is a name resolution service that Microsoft DHCP clients use to correlate host names to IP addresses within a group of networks. Microsoft DHCP clients can be one of four types of NetBIOS nodes: broa[...]

Dynamic Host Configuration Protocol | 319 To create a manual binding: Check for Address Conflicts By default, the DHCP server pings an address from the pool twice before assigning the address to a client to attempt to verify that it is not in use. If the ping is unanswered, the DHCP server assumes that the address is not in use and assigns the addr[...]

320 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com DHCP Clear Commands Configure the System to be a Relay Agent DHCP clients and servers request and offer configuration information via broadcast DHCP messages. Routers do not forward broadcasts, so if there are no DHCP servers on the subnet, the client does not receive a respo[...]

Dynamic Host Configuration Protocol | 321 Figure 13-4. Configuring Dell Force10 Systems as a DHCP Relay Device To view the ip helper-address configuration for an interface, use the command show ip interface from EXEC privilege mode, Figure 250 . Figure 13-5. Displaying the Helper Address Configuration Configure Secure DHCP DHCP as defined by RFC 21[...]

322 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com • DHCP Snooping on page 322 • Dynamic ARP Inspection on page 325 • Source Address Validation on page 327 Option 82 RFC 3046 (Relay Agent Information option, or Option 82) is used for class-based IP address assignment. The code for the Relay Agent Information option is 8[...]

Dynamic Host Configuration Protocol | 323 When DHCP Snooping is enabled, the relay agent builds a binding table—using DHCPACK messages— containing the client MAC address, IP addresses, IP address lease time, port, VLAN ID, and binding type. Every time the relay agent receives a DHCPACK on an trusted port, it adds an entry to the table. The rela[...]

324 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com Add a static entry in the binding table Clear the binding table Display the contents of the binding table View the DHACP Snooping statistics with the show ip dhcp snooping command. Figure 13-6. Command example: show ip dhcp snooping Task Command Syntax Command Mode Add a stat[...]

Dynamic Host Configuration Protocol | 325 Drop DHCP packets on snooped VLANs only Binding table entries are deleted when a lease expires, or the relay agent encounters a DHCPRELEASE. Starting with FTOS Release 8.2.1.1, line cards maintain a list of snooped VLANs. When the binding table fills, DHCP packets are dropped only on snooped-VLANs, while su[...]

326 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com packets to it. Likewise, the attacker sends the gateway an ARP message containing the attacker’s MAC address and the client’s IP address. The gateway then thinks that the attacker is the client, and forwards all packets addressed to the client to it. As a result, the atta[...]

Dynamic Host Configuration Protocol | 327 View the number of entries in the ARP database with the show arp inspection database command. Figure 13-8. Command example: show arp inspection database Use show arp inspection statistics command to see how many valid and invalid ARP packets have been processed. Figure 13-9. Command example: show arp inspec[...]

328 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com • DHCP MAC Source Address Validation on page 328 verifies a DHCP packet’s source hardware address matches the client hardware address field (CHADDR) in the payload. • IP+MAC Source Address Validation on page 328 verifies that the IP source address and MAC source address[...]

Dynamic Host Configuration Protocol | 329 IP Source Address Validation validates the IP source address of an incoming packet against the DHCP Snooping binding table. IP+MAC Source Address Validation ensures that the IP source address and MAC source address are a legitimate pair, rather validating each attribute individually. IP+MAC Source Address V[...]

330 | Dynamic Host Configuration Protocol www.dell.com | support.dell.com[...]

Equal Cost Multi-Path | 331 14 Equal Cost Multi-Path This chapter describes how to configure: • ECMP for Flow-based Affinity (E-Series) , including the configurable hash algorithm • Configurable ECMP Hash Algorithm (C- and S-Series) ECMP for Flow-based Affinity (E-Series) ECMP for Flow-based Affinity (E-Series) is available on platform: e The h[...]

332 | Equal Cost Multi-Path www.dell.com | support.dell.com For information on the load-balancing criteria used by the hash algorithm to distribute traffic among ECMP paths and LAG members on an E-Series system, see E-Series load-balancing on page 436 . Deterministic ECMP Next Hop Deterministic ECMP Next Hop arranges all ECMPs in order before writi[...]

Equal Cost Multi-Path | 333 In Figure 14-1 , Core Router 1 is an E-Series TeraScale and Core Router 2 is an E-Series ExaScale. They have similar configurations and have routes for prefix P with two possible next-hops. When Deterministic ECMP is enabled and the hash algorithm and seed are configured the same, each flow is consistently sent to the sa[...]

334 | Equal Cost Multi-Path www.dell.com | support.dell.com Configurable ECMP Hash Algorithm (C- and S-Series) Configurable ECMP Hash Algorithm (C- and S-Series) is available on platforms: c s On C-Series and S-Series, the hash-algorithm command is specific to ECMP groups and has a different default from the E-Series (see Configurable Hash Algorith[...]

Force10 Resilient Ring Protocol | 335 15 Force10 Resilient Ring Protocol Force10 Resilient Ring Protocol is supported on platforms c e s The E-Series ExaScale platform is supported with FTOS 8.1.1.0 and later. Force10 Resilient Ring Protocol (FRRP) provides fast network convergence to Layer 2 switches interconnected in a ring topology, such as a Me[...]

336 | Force10 Resilient Ring Protocol www.dell.com | support.dell.com Each Transit node is also configured with a Primary port and a Secondary port on the ring, but the port distinction is ignored as long as the node is configured as a Transit node. If the ring is complete, the Master node logically blocks all data traffic in the transmit and recei[...]

Force10 Resilient Ring Protocol | 337 If the Master node does not receive the Ring Health Frame (RHF) before the fail-period timer expires (a configurable timer), the Master node moves from the Normal state to the Ring-Fault state and unblocks its Secondary port. The Master node also clears its forwarding table and sends a control frame to all othe[...]

338 | Force10 Resilient Ring Protocol www.dell.com | support.dell.com In the example shown in Figure 15-2 , FRRP 101 is a ring with its own Control VLAN, and FRRP 202 has its own Control VLAN running on another ring. A Member VLAN that spans both rings is added as a Member VLAN to both FRRP groups. Switch R3 has two instances of FRRP running on it:[...]

Force10 Resilient Ring Protocol | 339 • Ring Status Check Frames are transmitted by the Master Node at specified intervals. • Multiple physical rings can be run on the same switch. • One Master node is supported per ring. All other nodes are Transit nodes. • Each node has 2 member interfaces: Primary and Secondary. • There is no limit to [...]

340 | Force10 Resilient Ring Protocol www.dell.com | support.dell.com Implementing FRRP • FRRP is media and speed independent. • FRRP is a Dell Force10 proprietary protocol that does not interoperate with any other vendor. • Spanning Tree must be disabled on both Primary and Secondary interfaces before FRRP is enabled. • All ring ports must[...]

Force10 Resilient Ring Protocol | 341 • The Control VLAN is used to carry any data traffic; it carries only RHFs. • The Control VLAN cannot have members that are not ring ports. • If multiple rings share one or more member VLANs, they cannot share any links between them. • Member VLANs across multiple rings are not supported in Master nodes[...]

342 | Force10 Resilient Ring Protocol www.dell.com | support.dell.com • All VLANS must be in Layer 2 mode. • Only ring nodes can be added to the VLAN. • A Control VLAN can belong to one FRRP group only. • Control VLAN ports must be tagged. • All ports on the ring must use the same VLAN ID for the Control VLAN. • A VLAN cannot be configu[...]

Force10 Resilient Ring Protocol | 343 Configure and add the Member VLANs Control and Member VLANS are configured normally for Layer 2. Their status as Control or Member is determined at the FRRP group commands. For complete information about configuring VLANS in Layer 2 mode, see Chapter 25, Layer 2 . Be sure to follow these guidelines: • All VLA[...]

344 | Force10 Resilient Ring Protocol www.dell.com | support.dell.com Set FRRP Timers Clear FRRP counters Use one of the following commands to clear the FRRP counters. 3 interface primary int slot/port secondary int slot/port control-vlan vlan id CONFIG-FRRP Assign the Primary and Secondary ports, and the Control VLAN for the ports on the ring. Int[...]

Force10 Resilient Ring Protocol | 345 Show FRRP configuration Use the following command to view the configuration for the FRRP group. Show FRRP information Use one of the following commands show general FRRP information. Troubleshooting FRRP Configuration Checks • Each Control Ring must use a unique VLAN ID. • Only two interfaces on a switch ca[...]

346 | Force10 Resilient Ring Protocol www.dell.com | support.dell.com Figure 15-3 is an example of a basic FRRP topology. Below the figure are the associated CLI commands. Figure 15-3. Basic Topology and CLI commands R1 MASTER interface GigabitEthernet 1/24 no ip address switchport no shutdown ! interface GigabitEthernet 1/34 no ip address switchpo[...]

Force10 Service Agent | 347 16 Force10 Service Agent Force10 Service Agent is supported on platforms: c e FTSA is supported on the E-Series ExaScale platform with FTOS 8.2.1.0 and later. Accurate and timely resolution of problems in your system or network requires gathering relevant data at the time a condition manifests, and getting that informati[...]

348 | Force10 Service Agent www.dell.com | support.dell.com Configure Force10 Service Agent The minimal FTSA configuration is four steps: 1. Enable FTSA. See page 348. 2. Specify the SMTP server to which FTSA will send E-mails upon a trigger event. See page 349. 3. Specify the source E-mail address that FTSA should use when generating E-mails. See [...]

Force10 Service Agent | 349 Figure 16-1. Displaying the Default FTSA Configuration Specify an SMTP Server for FTSA To specify the SMTP server that will receive and forward the E-mail messages generated by FTSA: Provide an Administrator E-mail Address FTSA is designed to send E-mail notification when a test condition is met, Type 4 messaging is enab[...]

350 | Force10 Service Agent www.dell.com | support.dell.com FTSA Messaging Service The purpose of FTSA is to automatically send information about the switch to the network administrators or Dell Force10 TAC, so that when there is a network problem, the relevant information is collected at the time the problem manifests. • Enable the FTSA Messagin[...]

Force10 Service Agent | 351 You must still explicitly enable messaging for each recipient, including the default recipient. Each recipient has a (user-configurable) mnemonic label. FTOS creates a CLI context based on this label from which you can enable messaging and modify the E-mail parameters for the recipient. You can enter the context for a re[...]

352 | Force10 Service Agent www.dell.com | support.dell.com To add a recipient, you first create a mnemonic label for it. FTOS uses this label to create an FTOS context in which you can configure the E-mail parameters for the recipient. For example, the default recipient is Dell Force10 TAC and the label for this recipient is Force10 . FTOS creates[...]

Force10 Service Agent | 353 Per-recipient, you have a choice of sending FTSA E-mails in clear text or with PGP5 encryption. Messages to the default recipient are configured for encryption using a public encryption key, as shown in Figure 16-2 . Create a PGP5 encryption key Provide Administrator Contact Information Dell Force10 recommends that you p[...]

354 | Force10 Service Agent www.dell.com | support.dell.com Set the Frequency of FTSA Type 3 Messages When messaging is enabled, FTSA sends an E-mail every 24 hours containing inventory information to all recipients. There is no facility for setting the frequency for individual recipients. Generate FTSA Type 4 Messages FTSA can collect and E-mail a[...]

Force10 Service Agent | 355 FTSA Message Types FTOS displays Message 2 every time FTSA sends a message. FTSA generates Type 0 messages when you enable a recipient. Figure 16-3. FTSA Type 0 Message FTSA generates Type 1 messages when messaging is disabled. Messaging is disabled when: • you no-enable a recipient or no enable-all • messaging is en[...]

356 | Force10 Service Agent www.dell.com | support.dell.com Figure 16-5. FTSA Type 2 Message FTSA periodically generates Type 3 messages, which contain the output of the command show inventory . Figure 16-6. FTSA Type 3 Message FTSA periodically generates Type 4 messages, only when Type 4 messaging is enabled, which contains system log messages. &l[...]

Force10 Service Agent | 357 Figure 16-7. FTSA Type 4 Messages For FTSA Type 5 Messages, see FTSA Policy Sample Configurations on page 364 . FTSA Policies FTSA policies are a list of user-defined problematic conditions for which the FTSA periodically searches. If any of the conditions exist, FTSA executes a user-defined set of actions. FTOS allows u[...]

358 | Force10 Service Agent www.dell.com | support.dell.com 2. Create the list of actions that FTSA should take if any of the conditions exist. See Create a Policy Action List on page 361 . 3. Create a policy and assign a test list and action list. See Create a Policy and Assign a Test and Action List on page 363 . 4. Set optional policy parameters[...]

Force10 Service Agent | 359 To add a pre-defined list of conditions to your policy test list: Table 16-2 shows the test conditions that are available to add to a custom policy test list. See the Dell Force10 MIB for further description of the given Object Identifiers (OID). You may only specify one test condition within a policy. Hardware Hardware [...]

360 | Force10 Service Agent www.dell.com | support.dell.com To add a custom test condition to a policy test list: The boolean comparison operators behave as follows: • decrease —If the difference between samples, calculated by subtracting the first value from the last, is or less than or equal to the specified value, then the action list is exe[...]

Force10 Service Agent | 361 • increase —If the difference between successive samples, calculated by subtracting the first value from the last, is greater than or equal to the previously sampled value, then the action list is executed. • less-than —If the value of the probed system variable is less than the specified value, then the action l[...]

362 | Force10 Service Agent www.dell.com | support.dell.com Add actions to a policy action list Once you create a policy action list, FTOS enters the CALLHOME ACTIONLIST context. The list you created is initially empty. You may choose one of three pre-defined action lists and add an unlimited number of custom actions. Table 16-3. Pre-defined Action[...]

Force10 Service Agent | 363 To add a pre-defined list of actions to your policy action list: You may add an unlimited number of three types of custom actions: Create a Policy and Assign a Test and Action List An FTSA minimally must have a policy test list and policy action list assigned to it. Task Command Command Mode Add a pre-defined list of act[...]

364 | Force10 Service Agent www.dell.com | support.dell.com Additional Policy Configurations FTSA Policy Sample Configurations Line card state-change policy configuration The following FTSA policy configuration uses the default test list hardware , which contains a line-card-state-change condition, and the default action list hardware plus the cust[...]

Force10 Service Agent | 365 Figure 16-9. Configuring an FTSA Policy for a Linecard Down Figure 16-10. System Log Messages during an a Linecard Down with FTSA call-home admin-email pubsadmin@training10.com smtp server-address 192.168.1.1 no enable-all server Force10 recipient pubslab@training10.com keyadd Force10DefaultPublicKey no encrypt enable lo[...]

366 | Force10 Service Agent www.dell.com | support.dell.com Figure 16-11. FTSA Type 5 Message for a Linecard Down Policy ---------------------------------Message Body------------------------------------------ <AgentInfo> <messagetype>Type - 5</messagetype> <time>23:19:37.209 UTC Wed Feb 25 2009</time> <serialnum>[...]

Force10 Service Agent | 367 Figure 16-12. FTSA Type 5 Message for a Linecard Down Policy (continued) </item> <item> <item_name>show logging driverlog linecard 1</item_name> <item_time>23:19:46.191 UTC Wed Feb 25 2009</item_time> <item_output> show logging driverlog linecard 1 [output omitted] </item_outp[...]

368 | Force10 Service Agent www.dell.com | support.dell.com Figure 16-13. FTSA Type 5 Message for a Linecard Down Policy (continued) </item> <item> <item_name>remote-exec cp dhsTestCp</item_name> <item_time>23:19:54.597 UTC Wed Feb 25 2009</item_time> <item_output> remote-exec cp dhsTestCp [output omitted] [...]

Force10 Service Agent | 369 Figure 16-14. FTSA Type 5 Message for a BGP Peer Down Policy Excessive CRC-error policy configuration The following FTSA policy configuration uses the interface-crc match condition to monitor GigabitEthernet 1/2 for greater than 500 CRC errors. When this condition exists, FTSA triggers the action list, which captures a p[...]

370 | Force10 Service Agent www.dell.com | support.dell.com Figure 16-15. Configuring an FTSA Policy for an Excessive CRC-error Condition Figure 16-16. System Syslog Messages during an Excessive CRC-error Condition call-home admin-email pubsadmin@training10.com smtp server-address 192.168.1.1 no enable-all server Force10 recipient pubslab@training1[...]

Force10 Service Agent | 371 Figure 16-17. FTSA Type 5 Message for an Excessive CRC-error Condition Debugging FTSA Display FTSA messages using the debug call-home command from EXEC Privilege mode. ---------------------------------Message Body------------------------------------------ <AgentInfo> <messagetype>Type - 5</messagetype> [...]

372 | Force10 Service Agent www.dell.com | support.dell.com Figure 16-18. Call-home Debug All during Type 5 Message Generation #02:13:49 : CALL-HOME: Sending the following email 02:13:49 : From: pubsadmin@training10.com To: pubslab@training10.com Subject: <messagetype>Type - 5</messagetype> Attachment: ramdisk:/crcerror-21_10_04.685.txt[...]

GARP VLAN Registration Protocol | 373 17 GARP VLAN Registration Protocol GARP VLAN Registration Protocol is supported on platform c e s GVRP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Typical VLAN implementation involves manually configuring each Layer 2 switch that participates in a given VLAN. GA[...]

374 | GARP VLAN Registration Protocol www.dell.com | support.dell.com Figure 17-1. GVRP Compatibility Error Message Configuring GVRP Globally, enable GVRP on each switch to facilitate GVRP communications. Then, GVRP configuration is per interface on a switch-by-switch basis. Enable GVRP on each port that connects to a switch where you want GVRP inf[...]

GARP VLAN Registration Protocol | 375 Figure 17-2. GVRP Configuration Overview Basic GVRP configuration is a 2-step process: 1. Enable GVRP globally. See page 376. 2. Enable GVRP on an interface. See page 376. Related Configuration Tasks • Configuring GVRP Registration on page 376 • Configuring a GARP Timer on page 377 Enabling GVRP Globally En[...]

376 | GARP VLAN Registration Protocol www.dell.com | support.dell.com Figure 17-3. Enabling GVRP Globally Enabling GVRP on a Layer 2 Interface Enable GVRP on a Layer 2 interface using the command gvrp enable in INTERFACE mode, as shown in Figure 17-4 . Use show config from the INTERFACE mode to inspect the interface configuration, as shown in Figur[...]

GARP VLAN Registration Protocol | 377 Based on the configuration in the example shown in Figure 17-5 , the interface 1/21 will not be removed from VLAN 34 or VLAN 35 despite receiving a GVRP Leave message. Additionally, the interface will not be dynamically added to VLAN 45 or VLAN 46, even if a GVRP Join message is received. Figure 17-5. Configuri[...]

378 | GARP VLAN Registration Protocol www.dell.com | support.dell.com FTOS displays Message 1 if an attempt is made to configure an invalid GARP timer. Message 1 GARP Timer Error FTOS(conf)#garp timers join 300 % Error: Leave timer should be >= 3*Join timer.[...]

High Availability | 379 18 High Availability High Availability is supported on platforms: c e s High availability is a collection of features that preserves system continuity by maximizing uptime and minimizing packet loss during system disruptions. To support all the features within the HA collection, you should have the latest boot code. The foll[...]

380 | High Availability www.dell.com | support.dell.com Component Redundancy Dell Force10 systems eliminates single points of failure by providing dedicated or load-balanced redundancy for each component. RPM Redundancy The current version of FTOS supports 1+1 hitless Route Processor Module (RPM) redundancy. The primary RPM performs all routing, sw[...]

High Availability | 381 Boot the chassis with dual RPMs When you boot the system with two RPMs installed, the RPM in slot R0 is the primary RPM by default. Both RPMs should be running the same version of FTOS. You can configure either RPM to be the primary upon the next chassis reboot using the command redundancy primary from CONFIGURATION mode. Ve[...]

382 | High Availability www.dell.com | support.dell.com Automatic and manual RPM failover RPM failover is the process of the standby RPM becoming the primary RPM. FTOS fails over to the standby RPM when: 1. communication is lost between the standby and primary RPMs 2. you request a failover via the CLI 3. you remove the primary RPM Use the command [...]

High Availability | 383 Communication between RPMs E-Series RPMs have three CPUs: Control Processor (CP), Routing Processor 1 (RP1), and Routing Processor 2 (RP2). The CPUs use Fast Ethernet connections to communicate to each other and to the line card CPUs (LP) using Inter-Processor Communication (IPC). The CP monitors the health status of the oth[...]

384 | High Availability www.dell.com | support.dell.com After a failover, the new primary RPM prompts you for a username and password if authentication methods was configured and that data was synchronized. The standby RPM does not use authentication methods involving client/server protocols, such as RADIUS and TACACS+. FTOS logs information about [...]

High Availability | 385 RPM synchronization Data between the two RPMs is synchronized immediately after bootup. Once the two RPMs have done an initial full synchronization (block sync), thereafter FTOS only updates changed data (incremental sync). The data that is synchronized consists of configuration data, operational data, state and status, and [...]

386 | High Availability www.dell.com | support.dell.com Figure 18-3. Using the redundancy force-failover rpm Command to Copy Software between RPMs Specify an Auto-failover Limit When a non-recoverable fatal error is detected, an automatic failover occurs. However, FTOS is configured to auto-failover only three times within any 60 minute period. You[...]

High Availability | 387 Online Insertion and Removal You can add, replace, or remove chassis components while the chassis is operating. This section contains the following sub-sections: • RPM Online Insertion and Removal on page 387 • Line Card Online Insertion and Removal on page 387 RPM Online Insertion and Removal Dell Force10 systems are fu[...]

388 | High Availability www.dell.com | support.dell.com Figure 18-5. Inserting and Removing a Line Card Pre-configure a line card slot You may also pre-configure an empty line card slot with a logical line card using the command linecard from CONFIGURATION mode. After creating the logical line card, you can configure the interfaces on the line card[...]

High Availability | 389 Replace a line card If you are replacing a line card with a line card of the same type, you may replace the card without any additional configuration. If you are replacing a line card with a line card of a different type, remove the card and then remove the existing line card configuration using the command no linecard . If [...]

390 | High Availability www.dell.com | support.dell.com Hitless behavior is defined in the context of an RPM failover only and does not include line card, SFM, and power module failures. • On the E-Series: Failovers triggered by software exception, hardware exception, forced failover via the CLI, and manual removal of the primary RPM are all hitl[...]

High Availability | 391 Runtime System Health Check Runtime System Health Check is supported on platform: e FTOS runs a system health check to detect data transfer errors within the system. FTOS performs the check during normal operation by interspersing among, test frames among the data frames that carry user and system data. One such check is a d[...]

392 | High Availability www.dell.com | support.dell.com Software Component Health Monitoring On each of the line cards and the RPM, there are a number of software components. FTOS performs a periodic health check on each of these components by querying the status of a flag, which the corresponding component resets within a specified time. If any he[...]

High Availability | 393 • The kernel is the central component of an operating system that manages system processors and memory allocation and makes these facilities available to applications. A kernel core dump is the contents of the memory in use by the kernel at the time of an exception. • An application core dump is the contents of the memor[...]

394 | High Availability www.dell.com | support.dell.com Table 18-4 show the warm upgrade and downtime impact, if any, which each step. Configure Cache Boot Cache Boot is supported on platforms: c e Cache Boot is supported on E-Series ExaScale e x with FTOS 8.2.1.0. and later. The Dell Force10 system has the ability to boot the chassis using a cache[...]

High Availability | 395 Figure 18-8. Determining your System Pre-requisites for Cache Boot 2. The cache boot feature requires at least the boot code versions in Table 18-5 . Use show rpm and show linecard commands to verify that you have the proper version ( Figure 18-8 ). If you do not have the proper boot code version, the system displays a messa[...]

396 | High Availability www.dell.com | support.dell.com Select the Cache Boot Image Select the FTOS image that you want to cache using the command upgrade system-image , as shown in Figure 18-9 . Dell Force10 recommends using the keyword all with this command to avoid any mis-matched configurations. Figure 18-9. Selecting a Cache Boot Image View yo[...]

High Availability | 397 Figure 18-10. Viewing the Cache Boot Configuration If you attempt to cache a system image that does not support the cache boot feature, Message 8 appears. Verify that the system is configured to boot with the selected cache boot image using the command show bootvar as shown in Figure 18-11 . Figure 18-11. Viewing the Selecte[...]

398 | High Availability www.dell.com | support.dell.com In-Service Modular Hot-Fixes In-Service Modular Hot-Fixes are supported on platforms: e In-Service Modular Hot-Fixes provides a tool whereby you can install a patch while the system is on-line and running. This feature allows a patch to be added to a running FTOS process to obtain debugging in[...]

High Availability | 399 Process Restartability Process Restartability is supported on platforms: c e s Process Restartability is an extension to the FTOS High Availability system component that enables application processes and system protocol tasks to be restarted. This extension increases system reliability and uptime by first attempting to resta[...]

400 | High Availability www.dell.com | support.dell.com You can select which process may attempt to restart, and the number of consecutive restart attempts before failover, but by default, every process causes a system reload or RPM failover. When a process restarts, FTOS displays Message 9 . You can specify the timestamp in hours so that if the nu[...]

High Availability | 401 FTOS Behavior: When debug tacacs or debug radius is enabled, and the respective process restarts, FTOS does not continue to print debug messages after the restart; you must execute debug tacacs or debug radius again. This is because debugging is not saved to the running configuration, rather, FTOS marks the process for debug[...]

402 | High Availability www.dell.com | support.dell.com[...]

Internet Group Management Protocol | 403 19 Internet Group Management Protocol Multicast is premised on identifying many hosts by a single destination IP address; hosts represented by the same IP address are a multicast group . Internet Group Management Protocol (IGMP) is a Layer 3 multicast protocol that hosts use to join or leave a multicast grou[...]

404 | Internet Group Management Protocol www.dell.com | support.dell.com IGMP version 2 IGMP version 2 improves upon version 1 by specifying IGMP Leave messages, which allows hosts to notify routers that they no longer care about traffic for a particular group. Leave messages reduce the amount of time that the router takes to stop forwarding traffi[...]

Internet Group Management Protocol | 405 Sending an Unsolicited IGMP Report A host does not have to wait for a general query to join a group. It may send an unsolicited IGMP Membership Report, also called an IGMP Join message, to the querier. Leaving a Multicast Group 1. A host sends a membership report of type 0x17 (IGMP Leave message) to the all [...]

406 | Internet Group Management Protocol www.dell.com | support.dell.com Figure 19-3. IGMP version 3 Membership Report Packet Format Joining and Filtering Groups and Sources Figure 19-4 shows how multicast routers maintain the group and source information from unsolicited reports. 1. The first unsolicited report from the host indicates that it want[...]

Internet Group Management Protocol | 407 Figure 19-4. IGMP Membership Reports: Joining and Filtering Leaving and Staying in Groups Figure 19-5 shows how multicast routers track and refresh state changes in response to group-and-specific and general queries. 1. Host 1 sends a message indicating it is leaving group 224.1.1.1 and that the include filt[...]

408 | Internet Group Management Protocol www.dell.com | support.dell.com Figure 19-5. IGMP Membership Queries: Leaving and Staying in Groups Configuring IGMP Configuring IGMP is a two-step process: 1. Enable multicast routing using the command ip multicast-routing . 2. Enable a multicast routing protocol. Related Configuration Tasks • Viewing IGM[...]

Internet Group Management Protocol | 409 Figure 19-6. Viewing IGMP-enabled Interfaces Selecting an IGMP Version FTOS enables IGMP version 2 by default, which supports version 1 and 2 hosts, but is not compatible with version 3 on the same subnet. If hosts require IGMP version 3, you can switch to IGMP version 3 using the command ip igmp version fro[...]

410 | Internet Group Management Protocol www.dell.com | support.dell.com Figure 19-8. Viewing Static and Learned IGMP Groups Adjusting Timers View the current value of all IGMP timers using the command show ip igmp interface from EXEC Privilege mode, as shown in Figure 19-6 . Adjusting Query and Response Timers The querier periodically sends a gene[...]

Internet Group Management Protocol | 411 2. When a router receives a query it compares the IP address of the interface on which it was received with the source IP address given in the query. If the receiving router IP address is greater than the source address given in the query, the router stops sending queries. By this method, the router with the[...]

412 | Internet Group Management Protocol www.dell.com | support.dell.com IGMP Snooping Multicast packets are addressed with multicast MAC addresses, which represent a group of devices, rather than one unique device. Switches forward multicast frames out of all ports in a VLAN by default, even though there may be only some interested hosts, which is[...]

Internet Group Management Protocol | 413 Figure 19-10. Enabling IGMP Snooping Disabling Multicast Flooding If the switch receives a multicast packet that has an IP address of a group it has not learned (unregistered frame), the switch floods that packet out of all ports on the VLAN. On the E-Series, you can configure the switch to only forward unre[...]

414 | Internet Group Management Protocol www.dell.com | support.dell.com • When enabled, IGMP snooping Querier starts after one query interval in case no IGMP general query (with IP SA lower than its VLAN IP address) is received on any of its VLAN members. Adjusting the Last Member Query Interval When the querier receives a leave message from a r[...]

Interfaces | 415 20 Interfaces This chapter describes interface types, both physical and logical, and how to configure them with FTOS. 10/100/1000 Mbps Ethernet, Gigabit Ethernet, and 10 Gigabit Ethernet interfaces are supported on platforms c e s SONET interfaces are only supported on platform e and are covered in the SONET/SDH chapter. Basic Inte[...]

416 | Interfaces www.dell.com | support.dell.com Interface Types View Basic Interface Information The user has several options for viewing interface status and configuration parameters. The show interfaces command in EXEC mode will list all configurable interfaces on the chassis and has options to display the interface status, IP and MAC addresses,[...]

Interfaces | 417 Figure 20-1. show interfaces Command Example Use the show ip interfaces brief command in the EXEC Privilege mode to view which interfaces are enabled for Layer 3 data transmission. In Figure 20-2 , GigabitEthernet interface 1/5 is in Layer 3 mode since an IP address has been assigned to it and the interface’s status is operationa[...]

418 | Interfaces www.dell.com | support.dell.com Figure 20-3. Interfaces listed in the show running-config Command (Partial) Enable a Physical Interface After determining the type of physical interfaces available, the user may enter the INTERFACE mode by entering the command interface interface slot/port to enable and configure the interfaces. To e[...]

Interfaces | 419 To confirm that the interface is enabled, use the show config command in the INTERFACE mode. To leave the INTERFACE mode, use the exit command or end command. The user can not delete a physical interface. Physical Interfaces The Management Ethernet interface , is a single RJ-45 Fast Ethernet port on the Route Processor Module (RPM)[...]

420 | Interfaces www.dell.com | support.dell.com Overview of Layer Modes On all systems running FTOS, you can place physical interfaces, port channels, and VLANs in Layer 2 mode or Layer 3 mode. By default, VLANs are in Layer 2 mode. Configure Layer 2 (Data Link) Mode Use the switchport command in INTERFACE mode to enable Layer 2 data transmissions[...]

Interfaces | 421 For information on enabling and configuring Spanning Tree Protocol, see Chapter 10, Layer 2, on page 47 . To view the interfaces in Layer 2 mode, use the command show interfaces switchport in the EXEC mode. Configure Layer 3 (Network) Mode When you assign an IP address to a physical interface, you place it in Layer 3 mode. Use the [...]

422 | Interfaces www.dell.com | support.dell.com You can only configure one (1) primary IP address per interface. You can configure up to 255 secondary IP addresses on a single interface. To view all interfaces to see with an IP address assigned, use the show ip interfaces brief command in the EXEC mode (Figure 176) . To view IP information on an i[...]

Interfaces | 423 Management Interfaces Configure Management Interfaces on the E-Series and C-Series On the E-Series and C-Series, the dedicated Management interface is located on the RPM and provides management access to the system. You can configure this interface with FTOS, but the configuration options on this interface are limited. Gateway addr[...]

424 | Interfaces www.dell.com | support.dell.com Important Things to Remember — virtual-ip • virtual-ip is a CONFIGURATION mode command. You may enter an IPv4 or IPv6 address. • When applied, the management port on the primary RPM assumes the virtual IP address. Entering the show interfaces and show ip interface brief commands on the primary [...]

Interfaces | 425 Displaying Information on a Management Interface To view information about the primary RPM management port, use the show interface Managementethernet command in EXEC or EXEC Privilege mode. If there are two RPMs on the system, you cannot view information on the interface. Figure 20-9. Command Example: show interface ManagementEther[...]

426 | Interfaces www.dell.com | support.dell.com VLAN Interfaces VLANs are logical interfaces and are, by default, in Layer 2 mode. Physical interfaces and port channels can be members of VLANs. For more information on VLANs and Layer 2, refer to Chapter 10, Layer 2, on page 47 . See also Chapter 18, VLAN Stacking, on page 367 . FTOS supports Inter[...]

Interfaces | 427 Loopback Interfaces A Loopback interface is a virtual interface in which the software emulates an interface. Packets routed to it are processed locally. Since this interface is not a physical interface, you can configure routing protocols on this interface to provide protocol stability. You can place Loopback interfaces in default [...]

428 | Interfaces www.dell.com | support.dell.com Port Channel Interfaces Port channel interfaces support link aggregation, as described in IEEE Standard 802.3ad. This section covers the following topics: • Port channel definition and standards on page 428 • Port channel benefits on page 428 • Port channel implementation on page 428 • Config[...]

Interfaces | 429 • Dynamic —Port channels that are dynamically configured using Link Aggregation Control Protocol (LACP). For details, see Chapter 24, Link Aggregation Control Protocol . Table 20-4. As soon as a port channel is configured, FTOS treats it like a physical interface. For example, IEEE 802.1Q tagging is maintained while the physica[...]

430 | Interfaces www.dell.com | support.dell.com The common speed is determined when the port channel is first enabled. At that time, the software checks the first interface listed in the port channel configuration. If that interface is enabled, its speed configuration becomes the common speed of the port channel. If the other interfaces configured[...]

Interfaces | 431 The port channel is now enabled and you can place the port channel in Layer 2 or Layer 3 mode. Use the switchport command to place the port channel in Layer 2 mode or configure an IP address to place the port channel in Layer 3 mode. You can configure a port channel as you would a physical interface by enabling or configuring proto[...]

432 | Interfaces www.dell.com | support.dell.com Figure 20-13. show interfaces port-channel brief Command Example Figure 20-14 displays the port channel’s mode (L2 for Layer 2 and L3 for Layer 3 and L2L3 for a Layer 2 port channel assigned to a routed VLAN), the status, and the number of interfaces belonging to the port channel. Figure 20-14. sho[...]

Interfaces | 433 Figure 20-15. Error Message Reassign an interface to a new port channel An interface can be a member of only one port channel. If the interface is a member of a port channel, you must remove it from the first port channel and then add it to the second port channel. Each time you add or remove a channel member from a port channel, F[...]

434 | Interfaces www.dell.com | support.dell.com Figure 20-16. Command Example from Reassigning an Interface to a Different Port Channel Configure the minimum oper up links in a port channel (LAG) You can configure the minimum links in a port channel (LAG) that must be in “oper up” status for the port channel to be considered to be in “oper u[...]

Interfaces | 435 To add a port channel to a VLAN, use either of the following commands: To remove a port channel from a VLAN, use either of the following commands: To see which port channels are members of VLANs, enter the show vlan command in the EXEC Privilege mode. Assign an IP address to a port channel You can assign an IP address to a port cha[...]

436 | Interfaces www.dell.com | support.dell.com Load balancing through port channels FTOS uses hash algorithms for distributing traffic evenly over channel members in a port channel (LAG). The hash algorithm distributes traffic among ECMP paths and LAG members. The distribution is based on a flow, except for packet-based hashing. A flow is identif[...]

Interfaces | 437 On the E-Series, to change the 5-tuple default to 3-tuple, MAC, or packet-based, use the following command in CONFIGURATION mode: For details on the load-balance command, see the IP Routing chapter of the FTOS Command Reference . To distribute IP traffic over an E-Series port channel member, FTOS uses the 5-tuple IP default. The 5-[...]

438 | Interfaces www.dell.com | support.dell.com IPv4, IPv6, and non-IP traffic handling on the E-Series The table below presents the combinations of the load-balance command and their effect on traffic types. C-Series and S-Series load-balancing For LAG hashing on C-Series and S-Series, the source IP, destination IP, source TCP/UDP port, and desti[...]

Interfaces | 439 Hash algorithm The load-balance command discussed above selects the hash criteria applied to port channels. If even distribution is not obtained with the load-balance command, the hash-algorithm command can be used to select the hash scheme for LAG, ECMP and NH-ECMP. The 12 bit Lag Hash can be rotated or shifted till the desired ha[...]

440 | Interfaces www.dell.com | support.dell.com • dest-ip — uses destination IP address as part of the hash key • lsb — always uses the least significant bit of the hash key to compute the egress port To change to another method, use the following command in the CONFIGURATION mode: For more on load-balancing, see “Equal Cost Multipath an[...]

Interfaces | 441 The show configuration command is also available under the interface range mode. This command allows you to display the running configuration only for interfaces that are part of interface range. Bulk Configuration Examples The following are examples of using the interface range command for bulk configuration: • Create a single-r[...]

442 | Interfaces www.dell.com | support.dell.com Figure 20-23. Interface Range Prompt Excluding a Smaller Port Range Overlap port ranges If overlapping port ranges are specified, the port range is extended to the smallest start port number and largest end port number: Figure 20-24. Interface Range Prompt Including Overlapping Port Ranges Commas The[...]

Interfaces | 443 Interface Range Macros The user can define an interface-range macro to automatically select a range of interfaces for configuration. Before you can use the macro keyword in the interface-range macro command string, you must define the macro. To define an interface-range macro, enter this command: Define the Interface Range This exa[...]

444 | Interfaces www.dell.com | support.dell.com Choose an Interface-range Macro To use an interface-range macro in the interface range command, enter this command: The example below shows how to change to the interface-range configuration mode using the interface-range macro named “test”. Monitor and Maintain Interfaces Monitor interface stati[...]

Interfaces | 445 Figure 20-27. Command Example: monitor interface Maintenance using TDR The Time Domain Reflectometer (TDR) is supported on all Dell Force10 switch/routers. TDR is an assistance tool to resolve link issues that helps detect obvious open or short conditions within any of the four copper pairs. TDR sends a signal onto the physical cab[...]

446 | Interfaces www.dell.com | support.dell.com To test the condition of cables on 10/100/1000 BASE-T modules, use the tdr-cable-test command: Link Debounce Timer Link Debounce Timer is supported on platform e This feature is supported on E-Series ExaScale e x with FTOS 8.2.0.1 and later The Link Debounce Timer feature isolates upper layer protoco[...]

Interfaces | 447 • Changes made do not affect any ongoing debounces. The timer changes take affect from the next debounce onward. Assign a debounce time to an interface Figure 20-28. Setting Debounce Time Show debounce times in an interface Figure 20-29. Showing Debounce Time Disable ports when one only SFM is available (E300 only) Selected ports[...]

448 | Interfaces www.dell.com | support.dell.com When an E300 system boots up and a single SFM is active this configuration, any ports configured with this feature will be shut down. All other ports are booted up. Similarly, if an SFM fails (or is removed) in an E300 system with two SFM, ports configured with this feature will be shut down. All oth[...]

Interfaces | 449 Enable Link Dampening Enable link dampening using the command dampening from INTERFACE mode, as shown in Figure 20-30 . Figure 20-30. Configuring Link Dampening View the link dampening configuration on an interface using the command show config , or view dampening information on all or specific dampened interfaces using the command[...]

450 | Interfaces www.dell.com | support.dell.com Figure 20-33. Clearing Dampening Counters Link Dampening Support for XML View the output of the following show commands in XML by adding | display xml to the end of the command: • show interfaces dampening • show interfaces dampening summary • show interfaces interface x/y Configure MTU size on[...]

Interfaces | 451 The globally assigned 48-bit Multicast address 01-80-C2-00-00-01 is used to send and receive pause frames. To allow full duplex flow control, stations implementing the pause operation instruct the MAC to enable reception of frames with destination address equal to this multicast address. The PAUSE frame is defined by IEEE 802.3x an[...]

452 | Interfaces www.dell.com | support.dell.com Enable Pause Frames Ethernet Pause Frames flow control must be enabled on all ports on a chassis or a line card. If not, the system may exhibit unpredictable behavior. On the C-Series and S-Series systems, the flow-control sender and receiver must be on the same port-pipe. Flow control is not support[...]

Interfaces | 453 Configure MTU Size on an Interface If a packet includes a Layer 2 header, the difference in bytes between the link MTU and IP MTU must be large enough to include the Layer 2 header. For example, for VLAN packets, if the IP MTU is 1400 bytes, the Link MTU must 1422 bytes or greater to accommodate the 22-byte VLAN header: 1400-byte I[...]

454 | Interfaces www.dell.com | support.dell.com Port-pipes A port pipe is a Dell Force10 specific term for the hardware path that packets follow through a system. Port pipes travel through a collection of circuits (ASICs) built into line cards and RPMs on which various processing events for the packets occur. One or two port pipes process traffic [...]

Interfaces | 455 Auto-Negotiation on Ethernet Interfaces Setting speed and duplex mode of Ethernet Interfaces By default, auto-negotiation of speed and duplex mode is enabled on 10/100/1000 Base-T Ethernet interfaces. Only 10GE interfaces do not support auto-negotiation. When using 10GE interfaces, verify that the settings on the connecting devices[...]

456 | Interfaces www.dell.com | support.dell.com Figure 20-34. show interfaces status Command Example In the example, above, several ports display “Auto” in the Speed field, including port 0/1. In Figure 20-35 , the speed of port 0/1 is set to 100Mb and then its auto-negotiation is disabled. Figure 20-35. Setting Port Speed Example Setting Auto[...]

Interfaces | 457 Figure 20-36. Setting Auto-Negotiation Options For details on the speed , duplex , and negotiation auto commands, see the Interfaces chapter of the FTOS Command Reference . Adjust the keepalive timer Use the keepalive command to change the time interval between keepalive messages on the interfaces. The interface sends keepalive mes[...]

458 | Interfaces www.dell.com | support.dell.com Figure 20-37. show Commands with configured Keyword Examples In EXEC mode, the show interfaces switchport command displays only interfaces in Layer 2 mode and their relevant configuration information. The show interfaces switchport command ( Figure 20-38 ) displays the interface, whether the interfac[...]

Interfaces | 459 Figure 20-39. Configuring Rate Interval Example FTOS#show interfaces TenGigabitEthernet 10/0 is down, line protocol is down Hardware is Force10Eth, address is 00:01:e8:01:9e:d9 Internet address is not set MTU 1554 bytes, IP MTU 1500 bytes LineSpeed 10000 Mbit ARP type: ARPA, ARP Timeout 04:00:00 Last clearing of "show interfac[...]

460 | Interfaces www.dell.com | support.dell.com Dynamic Counters By default, counting for the following four applications is enabled: • IPFLOW • IPACL • L2ACL • L2FIB For remaining applications, FTOS automatically turns on counting when the application is enabled, and is turned off when the application is disabled. Please note that if more[...]

Interfaces | 461 Clear interface counters The counters in the show interfaces command are reset by the clear counters command. This command does not clear the counters captured by any SNMP program. To clear the counters, use the following command in the EXEC Privilege mode: When you enter this command, you must confirm that you want FTOS to clear t[...]

462 | Interfaces www.dell.com | support.dell.com[...]

IPv4 Addressing | 463 21 IPv4 Addressing IPv4 Addressing is supported on platforms c e s IPv4 addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. FTOS supports various IP addressing features. This chapter explains the basics of Domain Name Service (DNS), Address Resolution Protocol (ARP), and routing principles an[...]

464 | IPv4 Addressing www.dell.com | support.dell.com At its most basic level, an IP address is 32-bits composed of network and host portions and represented in dotted decimal format. For example, 00001010110101100101011110000011 is represented as 10.214.87.131 For more information on IP addressing, refer to RFC 791 , Internet Protoco l. Implementa[...]

IPv4 Addressing | 465 To assign an IP address to an interface, use these commands in the following sequence, starting in the CONFIGURATION mode: To view the configuration, use the show config command (Figure 246) in the INTERFACE mode or show ip interface in the EXEC privilege mode (Figure 247) . Figure 21-1. show config Command Example in the INTE[...]

466 | IPv4 Addressing www.dell.com | support.dell.com Configure static routes A static route is an IP address that is manually configured and not learned by a routing protocol, such as OSPF. Often static routes are used as backup routes in case other dynamically learned routes are unreachable. To configure a static route, use the following command [...]

IPv4 Addressing | 467 Figure 21-3. show ip route static Command Example (partial) FTOS installs a next hop that is on the directly connected subnet of current IP address on the interface (for example, if interface gig 0/0 is on 172.31.5.0 subnet, FTOS installs the static route). FTOS also installs a next hop that is not on the directly connected su[...]

468 | IPv4 Addressing www.dell.com | support.dell.com To view the configured static routes for the management port, use the show ip management-route command in the EXEC privilege mode. Figure 21-4. show ip management-route Command Example Directed Broadcast By default, FTOS drops directed broadcast packets destined for an interface. This default se[...]

IPv4 Addressing | 469 To view current bindings, use the show hosts command. Figure 21-5. show hosts Command Example To view the current configuration, use the show running-config resolve command. Specify local system domain and a list of domains If you enter a partial domain, FTOS can search different domains to finish or fully qualify that partial[...]

470 | IPv4 Addressing www.dell.com | support.dell.com DNS with traceroute To configure your switch to perform DNS with traceroute, follow the steps below in the CONFIGURATION mode. Figure 21-6 is an example output of DNS using the traceroute command. Figure 21-6. Traceroute command example Command Syntax Command Mode Purpose ip domain-list name CON[...]

IPv4 Addressing | 471 ARP FTOS uses two forms of address resolution: ARP and Proxy ARP. Address Resolution Protocol (ARP) runs over Ethernet and enables endstations to learn the MAC addresses of neighbors on an IP network. Over time, FTOS creates a forwarding table mapping the MAC addresses to their corresponding IP address. This table is called th[...]

472 | IPv4 Addressing www.dell.com | support.dell.com These entries do not age and can only be removed manually. To remove a static ARP entry, use the no arp ip-address command syntax. To view the static entries in the ARP cache, use the show arp static command (Figure 253) in the EXEC privilege mode. Figure 21-7. show arp static Command Example En[...]

IPv4 Addressing | 473 ARP Learning via Gratuitous ARP Gratuitous ARP can mean an ARP request or reply. In the context of ARP Learning via Gratuitous ARP on FTOS, the gratuitous ARP is a request. A Gratuitous ARP Request is an ARP request that is not needed according to the ARP specification, but one that hosts may send to: • detect IP address con[...]

474 | IPv4 Addressing www.dell.com | support.dell.com Beginning with version 8.3.1.0, when a Gratuitous ARP is received, FTOS installs an ARP entry on all 3 CPUs. ARP Learning via ARP Request In FTOS versions prior to 8.3.1.0, FTOS learns via ARP Requests only if the Target IP specified in the packet matches the IP address of the receiving router i[...]

IPv4 Addressing | 475 Configurable ARP Retries In FTOS versions prior to 8.3.1.0 the number of ARP retries is set to 5 and is not configurable. After 5 retries, FTOS backs off for 20 seconds before it sends a new request. Beginning with FTOS version 8.3.1.0, the number of ARP retries is configurable. The backoff interval remains at 20 seconds. ICMP[...]

476 | IPv4 Addressing www.dell.com | support.dell.com Enable ICMP unreachable messages By default, ICMP unreachable messages are disabled. When enabled ICMP unreachable messages are created and sent out all interfaces. To disable ICMP unreachable messages, use the no ip unreachable command. To reenable the creation of ICMP unreachable messages on t[...]

IPv4 Addressing | 477 Configuring UDP Helper Configuring FTOS to direct UDP broadcast is a two-step process: 1. Enable UDP helper and specify the UDP ports for which traffic is forwarded. See Enabling UDP Helper on page 477 . 2. Configure a broadcast address on interfaces that will receive UDP broadcast traffic. See Configuring a Broadcast Address [...]

478 | IPv4 Addressing www.dell.com | support.dell.com Configuring a Broadcast Address Configure a broadcast address on an interface using the command ip udp-broadcast-address , as shown in Figure 21-12 . Figure 21-12. Configuring a Broadcast Address View the configured broadcast address for an interface using the command show interfaces , as shown [...]

IPv4 Addressing | 479 UDP Helper with Broadcast-all Addresses When the destination IP address of an incoming packet is the IP broadcast address, FTOS rewrites the address to match the configured broadcast address. In Figure 21-14 : 1. Packet 1 is dropped at ingress if no UDP helper address is configured. 2. If UDP helper (using the command ip udp-h[...]

480 | IPv4 Addressing www.dell.com | support.dell.com In Figure 21-15 , Packet 1 has the destination IP address 1.1.1.255, which matches the subnet broadcast address of VLAN 101. If UDP helper is configured and the packet matches the specified UDP port, then the system changes the address to the configured IP broadcast address and floods the packet[...]

IPv4 Addressing | 481 UDP Helper with No Configured Broadcast Addresses • If the incoming packet has a broadcast destination IP address, then the unaltered packet is routed to all Layer 3 interfaces. • If the Incoming packet has a destination IP address that matches the subnet broadcast address of any interface, then the unaltered packet is rou[...]

482 | IPv4 Addressing www.dell.com | support.dell.com[...]

IPv6 Addressing | 483 22 IPv6 Addressing IPv6 Addressing is supported on platforms: c e s IPv6 (Internet Protocol Version 6) is the successor to IPv4. Due to the extremely rapid growth in internet users, and IP addresses, IPv4 is reaching its maximum usage. IPv6 will eventually replace IPv4 usage to allow for the constant expansion. This chapter pr[...]

484 | IPv6 Addressing www.dell.com | support.dell.com Some key changes in IPv6 are: • Extended Address Space • Stateless Autoconfiguration • Header Format Simplification • Improved Support for Options and Extensions Extended Address Space The address format is extended from 32 bits to 128 bits. This not only provides room for all anticipate[...]

IPv6 Addressing | 485 IPv6 Headers The IPv6 header has a fixed length of 40 bytes. This provides 16 bytes each for Source and Destination information, and 8 bytes for general header information. The IPv6 header includes the following fields: • Version (4 bits) • Traffic Class (8 bits) • Flow Label (20 bits) • Payload Length (16 bits) • Ne[...]

486 | IPv6 Addressing www.dell.com | support.dell.com Traffic Class (8 bits) The Traffic Class field deals with any data that needs special handling. These bits define the packet priority and are defined by the packet Source. Sending and forwarding routers use this field to identify different IPv6 classes and priorities. Routers understand the prio[...]

IPv6 Addressing | 487 Hop Limit (8 bits) The Hop Limit field shows the number of hops remaining for packet processing. In IPv4, this is known as the Time to Live (TTL) field and uses seconds rather than hops. Each time the packet moves through a forwarding router, this field decrements by 1. If a router receives a packet with a Hop Limit of 1, it d[...]

488 | IPv6 Addressing www.dell.com | support.dell.com Hop-by-Hop Options header The Hop-by-Hop options header contains information that is examined by every router along the packet’s path. It follows the IPv6 header and is designated by the Next Header value 0 (zero) ( Table 22-1 ). When a Hop-by-Hop Options header is not included, the router kno[...]

IPv6 Addressing | 489 • 2001:0db8:0000:0000:0000:0000:1428:57ab • 2001:0db8:0000:0000:0000::1428:57ab • 2001:0db8:0:0:0:0:1428:57ab • 2001:0db8:0:0::1428:57ab • 2001:0db8::1428:57ab • 2001:db8::1428:57ab IPv6 networks are written using Classless Inter-Domain Routing (CIDR) notation. An IPv6 network (or subnet) is a contiguous group of I[...]

490 | IPv6 Addressing www.dell.com | support.dell.com Implementing IPv6 with FTOS FTOS supports both IPv4 and IPv6, and both may be used simultaneously in your system. Table 22-2 lists the FTOS Version in which an IPv6 feature became available for each platform. The sections following the table give some greater detail about the feature. Specific p[...]

IPv6 Addressing | 491 IS-IS for IPv6 7.5.1 8.2.1 8.4.2 8.4.2 Chapter 23, “Intermediate System to Intermediate System,” on page 507 in the FTOS Configuration Guide IPv6 IS-IS in the FTOS Command Line Reference Guide IS-IS for IPv6 support for redistribution 7.6.1 8.2.1 8.4.2 8.4.2 Chapter 23, “Intermediate System to Intermediate System,” on [...]

492 | IPv6 Addressing www.dell.com | support.dell.com ICMPv6 ICMPv6 is supported on platforms c e s ICMP for IPv6 combines the roles of ICMP, IGMP and ARP in IPv4. Like IPv4, it provides functions for reporting delivery and forwarding errors, and provides a simple echo service for troubleshooting. The FTOS implementation of ICMPv6 is based on RFC 2[...]

IPv6 Addressing | 493 Path MTU (Maximum Transmission Unit) defines the largest packet size that can traverse a transmission path without suffering fragmentation. Path MTU for IPv6 uses ICMPv6 Type-2 messages to discover the largest MTU along the path from source to destination and avoid the need to fragment the packet. The recommended MTU for IPv6 [...]

494 | IPv6 Addressing www.dell.com | support.dell.com Figure 22-3. NDP Router Redistribution IPv6 Neighbor Discovery of MTU packets With FTOS 8.3.1.0, you can set the MTU advertised through the RA packets to incoming routers, without altering the actual MTU setting on the interface. The ip nd mtu command sets the value advertised to routers. It doe[...]

IPv6 Addressing | 495 FTOS IPv6 supports quality of service based on DSCP field. You can configure FTOS to honor the DSCP value on incoming routed traffic and forward the packets with the same value. Refer to Chapter 41, Quality of Service for details. Refer also to the Honor DSCP values on ingress packets in the QoS chapter for information relatin[...]

496 | IPv6 Addressing www.dell.com | support.dell.com Configuration Task List for IPv6 This section contains information regarding the following: • Change your CAM-Profile on an E-Series system (mandatory) • Adjust your CAM-Profile on an C-Series or S-Series • Assign an IPv6 Address to an Interface • Assign a Static IPv6 Route • Telnet wi[...]

IPv6 Addressing | 497 Figure 22-5. Command Example: show cam profile (E-Series ) Adjust your CAM-Profile on an C-Series or S-Series The cam-acl command is supported on platforms c s If you plan to implement IPv6 ACLs, you must adjust your CAM settings. The CAM space is allotted in FP blocks. The total space allocated must equal 13 FP blocks. Note t[...]

498 | IPv6 Addressing www.dell.com | support.dell.com Save the new CAM settings to the startup-config ( write-mem or copy run start ) then reload the system for the new settings to take effect. Assign an IPv6 Address to an Interface IPv6 Addresses are supported on platforms c e s Essentially IPv6 is enabled in FTOS simply by assigning IPv6 addresse[...]

IPv6 Addressing | 499 Assign a Static IPv6 Route IPv6 Static Routes are supported on platforms c e s Use the ipv6 route command to configure IPv6 static routes. Telnet with IPv6 IPv6 Telnet is supported on platforms c e s The Telnet client and server in FTOS support IPv6 connections. You can establish a Telnet session directly to the router using a[...]

500 | IPv6 Addressing www.dell.com | support.dell.com SNMP over IPv6 SNMP is supported on platforms c e s Simple Network Management Protocol (SNMP) can be configured over IPv6 transport so that an IPv6 host can perform SNMP queries and receive SNMP notifications from a device running FTOS IPv6. The FTOS SNMP-server commands for IPv6 have been exten[...]

IPv6 Addressing | 501 Show an IPv6 Interface View the IPv6 configuration for a specific interface with the following command. Figure 22-6 illustrates the show ipv6 interface command output. FTOS#show ipv6 ? accounting IPv6 accounting information cam linecard IPv6 CAM Entries for Line Card fib linecard IPv6 FIB Entries for Line Card interface IPv6 i[...]

502 | IPv6 Addressing www.dell.com | support.dell.com Figure 22-6. Command Example: show ipv6 interface Show IPv6 Routes View the global IPv6 routing information with the following command. Command Syntax Command Mode Purpose show ipv6 route type EXEC Show IPv6 routing information for the specified route type. Enter the keyword: • To display info[...]

IPv6 Addressing | 503 Figure 22-7 illustrates the show ipv6 route command output. Figure 22-7. Command Example: show ipv6 route Figure 22-8 illustrates the show ipv6 route summary command output. Figure 22-8. Command Example: show ipv6 route summary Figure 22-9 illustrates the show ipv6 route static command output. Figure 22-9. Command Example: sho[...]

504 | IPv6 Addressing www.dell.com | support.dell.com Show the Running-Configuration for an Interface View the configuration for any interface with the following command. Figure 22-10 illustrates the show running-config command output. Note the IPv6 address listed. Figure 22-10. Command Example: show running-config interface Clear IPv6 Routes Use t[...]

IPv6 Addressing | 505 IPv6 addresses are normally written as eight groups of four hexadecimal digits, where each group is separated by a colon (:). Omitting zeros is accepted as described in Addressing earlier in this chapter. Command Syntax Command Mode Purpose[...]

506 | IPv6 Addressing www.dell.com | support.dell.com[...]

Intermediate System to Intermediate System | 507 23 Intermediate System to Intermediate System Intermediate System to Intermediate System is supported on platform: e Intermediate System to Intermediate System (IS-IS) protocol is an interior gateway protocol (IGP) that uses a shortest-path-first algorithm. Dell Force10 supports both IPv4 and IPv6 ve[...]

508 | Intermediate System to Intermediate System www.dell.com | support.dell.com routing information directly with external routers located outside of the routing domains. Level 1-2 systems manage both inter-area and intra-area traffic by maintaining two separate link databases; one for Level 1 routes and one for Level 2 routes. A Level 1-2 router [...]

Intermediate System to Intermediate System | 509 Multi-Topology IS-IS FTOS 7.8.1.0 and later support Multi-Topology Routing IS-IS. E-Series ExaScale platform e x supports Multi-Topology IS-IS with FTOS 8.2.1.0 and later. Multi-Topology IS-IS (MT IS-IS) allows you to create multiple IS-IS topologies on a single router with separate databases. This f[...]

510 | Intermediate System to Intermediate System www.dell.com | support.dell.com Adjacencies Adjacencies on point-to-point interfaces are formed as usual, where IS-IS routers do not implement Multi-Topology (MT) extensions. If a local router does not participate in certain MTs, it will not advertise those MT IDs in its IIHs and so will not include [...]

Intermediate System to Intermediate System | 511 • The T3 timer sets the overall wait time after which the router determines that it has failed to achieve database synchronization (by setting the overload bit in its own LSP). This timer can be based on adjacency settings with the value derived from adjacent routers that are engaged in graceful re[...]

512 | Intermediate System to Intermediate System www.dell.com | support.dell.com Table 23-1 displays the default values for IS-IS. Configuration Information To use IS-IS, you must configure and enable IS-IS in two or three modes: CONFIGURATION ROUTER ISIS, CONFIGURATION INTERFACE, and ( when configuring for IPv6) ADDRESS-FAMILY mode. Commands in RO[...]

Intermediate System to Intermediate System | 513 Configuration Task List for IS-IS The following list includes the configuration tasks for IS-IS: • Enable IS-IS on page 513 • Configure Multi-Topology IS-IS (MT IS-IS) on page 516 • Configure IS-IS Graceful Restart on page 517 • Change LSP attributes on page 520 • Configure IS-IS metric sty[...]

514 | Intermediate System to Intermediate System www.dell.com | support.dell.com The default IS type is level-1-2. To change the IS type to Level 1 only or Level 2 only, use the is-type command in ROUTER ISIS mode. Enter the show isis protocol command in EXEC Privilege mode or the show config command in ROUTER ISIS mode to view the IS-IS configurat[...]

Intermediate System to Intermediate System | 515 Figure 23-2. Command Example: show isis protocol Use the show isis traffic command in EXEC Privilege mode to view IS-IS protocol statistics. Figure 23-3. Command Example: show isis traffic You can assign additional NET addresses, but the System ID portion of the NET address must remain the same. FTOS[...]

516 | Intermediate System to Intermediate System www.dell.com | support.dell.com Configure Multi-Topology IS-IS (MT IS-IS) Step Task Command Syntax Command Mode 1 Enable Multi-Topology IS-IS for IPv6. Enter the transition keyword to allow an IS-IS IPv6 user to continue to use single-topology mode while upgrading to multi-topology mode.After every r[...]

Intermediate System to Intermediate System | 517 Configure Multi-Topology IS-IS (MT IS-IS) Configure IS-IS Graceful Restart To enable IS-IS Graceful Restart globally, use the following command in ROUTER-ISIS mode. Additional, optional commands can be implemented to enable the Graceful Restart settings. Step Task Command Syntax Command Mode 1 Enable[...]

518 | Intermediate System to Intermediate System www.dell.com | support.dell.com graceful-restart restart- wait seconds ROUTER-ISIS Enable the Graceful Restart maximum wait time before a restarting peer comes up. Be sure to set the t3 timer to adjacency on the restarting router when implementing this command. Range: 5-120 seconds Default: 30 second[...]

Intermediate System to Intermediate System | 519 Use the show isis graceful-restart detail command in EXEC Privilege mode to view all Graceful Restart related configuration. Figure 23-4. Command Example: show isis graceful-restart detail Use the show isis interface command in EXEC Privilege mode to view all interfaces configured with IS-IS routing [...]

520 | Intermediate System to Intermediate System www.dell.com | support.dell.com Figure 23-5. Command Example: show isis interface Change LSP attributes IS-IS routers flood Link state PDUs (LSPs) to exchange routing information. LSP attributes include the generation interval, maximum transmission unit (MTU) or size, and the refresh interval. You ca[...]

Intermediate System to Intermediate System | 521 Figure 23-6. Command Example: show running-config isis Configure IS-IS metric style and cost All IS-IS links or interfaces are associated with a cost that is used in the SPF calculations. The possible cost varies depending on the metric style supported. If you configure narrow, transition or narrow t[...]

522 | Intermediate System to Intermediate System www.dell.com | support.dell.com Figure 23-7. Command Example: show isis protocol When you change from one IS-IS metric style to another, the IS-IS metric value could be affected. For each interface with IS-IS enabled, you can assign a cost or metric that is used in the link state calculation. Use the[...]

Intermediate System to Intermediate System | 523 Configuring the distance of a route Configure the distance for a route using the distance command from ROUTER ISIS mode. Change the IS-type You can configure the system to act as one of the following: • Level 1 router • Level 1-2 router • Level 2 router Use the following command in ROUTER ISIS [...]

524 | Intermediate System to Intermediate System www.dell.com | support.dell.com Figure 23-8. Command Example: show isis database Control routing updates Use the following commands in ROUTER ISIS mode to control the source of IS-IS route information. Command Syntax Command Mode Purpose passive-interface interface ROUTER ISIS Disable a specific inte[...]

Intermediate System to Intermediate System | 525 Distribute Routes Another method of controlling routing information is to filter the information through a prefix list. Prefix lists are applied to incoming or outgoing routes and routes must meet the conditions of the prefix lists or FTOS does not install the route in the routing table. The prefix l[...]

526 | Intermediate System to Intermediate System www.dell.com | support.dell.com IPv6 routes Use these commands in ADDRESS-FAMILY IPV6 mode to apply prefix lists to incoming or outgoing IPv6 routes. = distribute-list prefix-list-name out [ bgp as-number | connected | ospf process-id | rip | static ] ROUTER ISIS Apply a configured prefix list to all[...]

Intermediate System to Intermediate System | 527 Redistribute routes In addition to filtering routes, you can add routes from other routing instances or protocols to the IS-IS process. With the redistribute command syntax, you can include BGP, OSPF, RIP, static, or directly connected routes in the IS-IS process. IPv4 routes Use any of the following[...]

528 | Intermediate System to Intermediate System www.dell.com | support.dell.com IPv6 routes Use any of the these commands in ROUTER ISIS ADDRESS-FAMILY IPV6 mode to add routes from other routing instances or protocols. redistribute ospf process-id [ level-1 | level-1-2 | level-2 ] [ metric value ] [ match external { 1 | 2 } | match internal ] [ me[...]

Intermediate System to Intermediate System | 529 Use the show running-config isis command in EXEC Privilege mode to view IS-IS configuration globally (including both IPv4 and IPv6 settings), or the show config command in ROUTER ISIS mode to view the current IPv4 IS-IS configuration, or the show config command in ROUTER ISIS-ADDRESS FAMILY IPV6 mode[...]

530 | Intermediate System to Intermediate System www.dell.com | support.dell.com When the bit is set, a 1 is placed in the OL column in the show isis database command output. In Figure 23-9 , the overload bit is set in both the Level-1 and Level-2 database because the IS type for the router is Level-1-2 Figure 23-9. Command Example: show isis datab[...]

Intermediate System to Intermediate System | 531 FTOS displays debug messages on the console. Use the show debugging command in EXEC Privilege mode to view which debugging commands are enabled. Enter the keyword no followed by the debug command to disable a specific debug command. For example, to disable debugging of IS-IS updates, enter no debug i[...]

532 | Intermediate System to Intermediate System www.dell.com | support.dell.com Configure Metric Values The following topics are covered in this section: • Maximum Values in the Routing Table on page 532 • Changing the IS-IS Metric Style in One Level Only on page 532 • Leaking from One Level to Another on page 534 For any level (Level-1, Lev[...]

Intermediate System to Intermediate System | 533 Moving to transition and then to another metric style produces different results ( Table 23-6 ). wide narrow transition default value (10) if the original value is greater than 63. A message is sent to the console. wide wide transition original value narrow wide original value narrow transition origi[...]

534 | Intermediate System to Intermediate System www.dell.com | support.dell.com Leaking from One Level to Another In the following scenarios, each IS-IS level is configured with a different metric style. wide transition truncated value narrow default value (10) A message is sent to the logging buffer wide transition transition truncated value narr[...]

Intermediate System to Intermediate System | 535 Sample Configuration The following configurations are examples for enabling IPv6 IS-IS. These are not comprehensive directions. They are intended to give you a some guidance with typical configurations. You can copy and paste from these examples to your CLI. Be sure you make the necessary changes to [...]

536 | Intermediate System to Intermediate System www.dell.com | support.dell.com Figure 23-10. IS-IS Sample Configuration Router 1 R1(conf)#interface Loopback 0 R1(conf-if-lo-0)#ip address 192.168.1.1/24 R1(conf-if-lo-0)#ipv6 address 2001:db8:9999:1::/48 R1(conf-if-lo-0)#ip router isis 9999 R1(conf-if-lo-0)#no shutdown R1(conf-if-lo-0)#router isis [...]

Intermediate System to Intermediate System | 537 Figure 23-11. IS-IS Sample Configuration continued Router 2 R2(conf)#interface Loopback 0 R2(conf-if-lo-0)#ip address 192.168.1.1/24 R2(conf-if-lo-0)#ipv6 address 2001:db8:9999:1::/48 R2(conf-if-lo-0)#ip router isis 9999 R2(conf-if-lo-0)#no shutdown R2(conf-if-lo-0)#router isis 9999 R2(conf-router_is[...]

538 | Intermediate System to Intermediate System www.dell.com | support.dell.com Figure 23-12. IS-IS Sample Configuration continued Router 3 R3(conf)#interface Loopback 0 R3(conf-if-lo-0)#ip address 192.168.1.3/24 R3(conf-if-lo-0)#ipv6 address 2001:db8:9999:3::/48 R3(conf-if-lo-0)#ip router isis 9999 R3(conf-if-lo-0)#no shutdown R3(conf-if-lo-0)#ro[...]

Intermediate System to Intermediate System | 539 Figure 23-13. IPv6 IS-IS Sample Topography AREA A Full Mesh R1 R2 R3 GigE 1/21 2001:0db8:1021:1:: /48 (10.0.12.1 /24) GigE 1/34 2001:0db8:1022:1:: /48 (10.0.13.1 /24) GigE 2/31 2001:0db8:1023:2:: /48 (10.0.23.2 /24) GigE 2/1 1 2001:0db8:1021:2:: /48 (10.0.12.2 /24) GigE 3/21 2001:0db8:1023:3:: /48 (1[...]

540 | Intermediate System to Intermediate System www.dell.com | support.dell.com[...]

Link Aggregation Control Protocol | 541 24 Link Aggregation Control Protocol Link Aggregation Control Protocol is supported on platforms c e s LACP addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. The major sections in the chapter are: • Introduction to Dynamic LAGs and LACP on page 541 • LACP Configuration[...]

542 | Link Aggregation Control Protocol www.dell.com | support.dell.com LACP functions by constantly exchanging custom MAC PDUs across LAN Ethernet links. The protocol packets are only exchanged between ports that are configured as LACP capable. Important Points to Remember • On ExaScale, LACP is supported on 200 physical ports. Use static LAGs f[...]

Link Aggregation Control Protocol | 543 LACP modes FTOS provides the following three modes for configuration of LACP: • Off —In this state, an interface is not capable of being part of a dynamic LAG. LACP does not run on any port that is configured to be in this state. • Active —In this state, the interface is said to be in the “active ne[...]

544 | Link Aggregation Control Protocol www.dell.com | support.dell.com LACP Configuration Tasks The tasks covered in this section are: • Create a LAG • Configure the LAG interfaces as dynamic on page 544 • Set the LACP long timeout on page 545 • Monitor and Debugging LACP on page 546 • Configure Shared LAG State Tracking on page 547 Crea[...]

Link Aggregation Control Protocol | 545 Figure 24-3. Creating a Dynamic LAG Example The port-channel 32 mode active command shown above may be successfully issued as long as there is no existing static channel-member configuration in LAG 32. Set the LACP long timeout PDUs are exchanged between port channel (LAG) interfaces to maintain LACP sessions[...]

546 | Link Aggregation Control Protocol www.dell.com | support.dell.com Figure 24-4. Invoking the LACP Long Timeout Monitor and Debugging LACP The system log (syslog) records faulty LACP actions. To debug LACP, use the following command: Shared LAG State Tracking Shared LAG State Tracking provides the flexibility to bring down a port channel (LAG) [...]

Link Aggregation Control Protocol | 547 Figure 24-5. LAGs using ECMP without Shared LAG State Tracking To avoid packet loss, traffic must be re-directed through the next lowest-cost link (R3 to R4). FTOS has the ability to bring LAG 2 down in the event that LAG 1 fails, so that traffic can be re-directed, as described. This is what is meant by Shar[...]

548 | Link Aggregation Control Protocol www.dell.com | support.dell.com In Figure 24-8 , LAGs 1 and 2 are members of a failover group. LAG 1 fails and LAG 2 is brought down upon the failure. This effect is logged by Message 2 , in which a console message declares both LAGs down at the same time. Figure 24-8. Shared LAG State Tracking View the statu[...]

Link Aggregation Control Protocol | 549 • Only a LAG can be a member of a failover group. • Shared LAG State Tracking can be configured on one side of a link or on both sides. • If a LAG that is part of a failover group is deleted, the failover group is deleted. • If a LAG moves to the down state due to this feature, its members may still b[...]

550 | Link Aggregation Control Protocol www.dell.com | support.dell.com Figure 24-11. LACP Sample Topology Configuring a LAG on ALPHA Figure 24-12. Creating a LAG on ALPHA Gig 2/31 Gig 3/21 Gig 2/32 Gig 3/22 Gig 2/33 Gig 3/23 P or t Channel 10 ALPHA BRA VO Alpha(conf)#interface port-channel 10 Alpha(conf-if-po-10)#no ip address Alpha(conf-if-po-10)[...]

Link Aggregation Control Protocol | 551 Figure 24-13. Inspecting a LAG Port Configuration on ALPHA Alpha#sh int gig 2/31 GigabitEthernet 2/31 is up, line protocol is up Port is part of Port-channel 10 Hardware is F orce10Eth, address is 00:01:e8:06:95:c0 Current address is 00:01:e8:06:95:c0 Interface index is 109101113 Port will not be disabled on [...]

552 | Link Aggregation Control Protocol www.dell.com | support.dell.com Figure 24-14. Inspecting Configuration of LAG 10 on ALPHA Indicates the MAC address assigned t o the LAG. This does NO T match any of the physical interface MAC addresses. Confirms the number of links to bring up the LAG and that this is a switch port instead of a router port. [...]

Link Aggregation Control Protocol | 553 Figure 24-15. Using the show lacp Command to Verify LAG 10 Status on ALPHA Shows LAG status Interfaces par ticipating in the LAG are included here. Alpha#sho lacp 10 Port-channel 10 admin up , oper up, mode lacp Actor System ID: Priority 32768, Address 0001.e806.953e Partner System ID: Priority 32768, Address[...]

554 | Link Aggregation Control Protocol www.dell.com | support.dell.com Summary of the configuration on ALPHA Figure 24-16. Summary of the configuration on ALPHA Alpha(conf-if-po-10)#int gig 2/31 Alpha(conf-if-gi-2/31)#no ip address Alpha(conf-if-gi-2/31)#no switchport Alpha(conf-if-gi-2/31)#shutdown Alpha(conf-if-gi-2/31)#port-channel-protocol lac[...]

Link Aggregation Control Protocol | 555 Summary of the configuration on BRAVO Figure 24-17. Summary of the configuration on BRAVO Bravo(conf-if-gi-3/21)#int port-channel 10 Bravo(conf-if-po-10)#no ip add Bravo(conf-if-po-10)#switch Bravo(conf-if-po-10)#no shut Bravo(conf-if-po-10)#show config ! interface Port-channel 10 no ip address switchport no [...]

556 | Link Aggregation Control Protocol www.dell.com | support.dell.com Figure 24-18. Using the show interface Command to Inspect a LAG Port on BRAVO Shows the status of this nterface. Also shows it is part of LAG 10. Shows the speed of this physical interface. Also shows it is the Master of the GigE link. Brav o#show int gig 3/21 GigabitEthernet 3[...]

Link Aggregation Control Protocol | 557 Figure 24-19. Using the show interfaces port-channel Command to Inspect LAG 10 This does NOT match any of the physical interface MAC addresses. Confirms the number of links to bring up the LAG and that this is a switch port instead of a router port. Confirms the total bandwidth f or this LAG and which interfa[...]

558 | Link Aggregation Control Protocol www.dell.com | support.dell.com Figure 24-20. Using the show lacp Command to Inspect LAG Status PPP is a connection-oriented protocol that enables layer two links over a variety of different physical layer connections. It is supported on both synchronous and asynchronous lines, and can operate in half-duplex [...]

Layer 2 | 559 25 Layer 2 Layer 2 features are supported on platforms c e s The E-Series ExaScale platform is supported with FTOS 8.1.1.0 and later. This chapter describes the following Layer 2 features: • Managing the MAC Address Table on page 559 • MAC Learning Limit on page 562 • NIC Teaming on page 569 • Microsoft Clustering on page 570 [...]

560 | Layer 2 www.dell.com | support.dell.com Clear the MAC Address Table You may clear the MAC address table of dynamic entries: Set the Aging Time for Dynamic Entries Learned MAC addresses are entered in the table as dynamic entries, which means that they are subject to aging. For any dynamic entry, if no packet arrives on the switch with the MAC[...]

Layer 2 | 561 Configure a Static MAC Address A static entry is one that is not subject to aging. Static entries must be entered manually: Display the MAC Address Table To display the contents of the MAC address table: Task Command Syntax Command Mode Create a static MAC address entry in the MAC address table. mac-address-table static CONFIGURATION [...]

562 | Layer 2 www.dell.com | support.dell.com MAC Learning Limit This section has the following sub-sections: • mac learning-limit dynamic on page 563 • mac learning-limit station-move on page 563 • mac learning-limit no-station-move on page 564 • mac learning-limit sticky on page 564 • Displaying MAC Learning-Limited Interfaces on page 5[...]

Layer 2 | 563 mac learning-limit dynamic After you enable a MAC learning limit, MAC addresses learned on the port and entered in the MAC address table are static by default. If you configure the MAC learning dynamic option, learned MAC addresses are stored in the dynamic region of the table and are subject to aging. Entries created before this opti[...]

564 | Layer 2 www.dell.com | support.dell.com mac learning-limit no-station-move The no-station-move option, also known as “sticky MAC,” provides additional port security by preventing a station move. When this option is configured, the first entry in the table is maintained instead of creating a new entry on the new interface. no-station-move [...]

Layer 2 | 565 To enable and display sticky MAC address learning on a Layer 2 physical port or port-channel interface, enter the following commands: FTOS Behavior: The following conditions apply when you enable the sticky-MAC address option for MAC learning on an interface: • When you enable the sticky MAC learning option, all dynamically-learned [...]

566 | Layer 2 www.dell.com | support.dell.com Displaying MAC Learning-Limited Interfaces To display a list of all interfaces with a MAC learning limit: Learning Limit Violation Actions Learning Limit Violation Actions are supported only on platform: e You can configure the system to take an action when the MAC learning limit is reached on an interf[...]

Layer 2 | 567 To display a list of interfaces configured with MAC learning limit or station move violation actions: Recovering from Learning Limit and Station Move Violations After a learning-limit or station-move violation shuts down an interface, you must manually reset it: Per-VLAN MAC Learning Limit Per-VLAN MAC Learning Limit is available only[...]

568 | Layer 2 www.dell.com | support.dell.com Figure 25-1. Per-VLAN MAC Learning Limit Task Command Syntax Command Mode Configure a MAC learning limit on a VLAN. mac learning-limit limit vlan vlan-id INTERFACE Display the MAC learning limit counters for a VLAN. show mac learning-limit [ interface slot/port [ vlan vlan-id ]] EXEC Privilege FTOS#show[...]

Layer 2 | 569 NIC Teaming NIC teaming is a feature that allows multiple network interface cards in a server to be represented by one MAC address and one IP address in order to provide transparent redundancy, balancing, and to fully utilize network adapter resources. Figure 25-2 shows a topology where two NICs have been teamed together. In this case[...]

570 | Layer 2 www.dell.com | support.dell.com Figure 25-3. Configuring mac-address-table station-move refresh-arp Command MAC Move Optimization MAC Move Optimization is supported only on platform: e Station-move detection takes 5000ms because this is the interval at which the detection algorithm runs. On the E-Series, you can reduce detection time [...]

Layer 2 | 571 Since the virtual MAC address is never learned, traffic is forwarded to only one server rather than the entire cluster, and failover and balancing are not preserved ( Figure 25-5 ). Figure 25-4. Server Clustering: Multiple ARP Replies Figure 25-5. Server Clustering: Failover and Balancing Not Preserved Configuring the Switch for Micro[...]

572 | Layer 2 www.dell.com | support.dell.com Figure 25-6. Server Cluster: Failover and Balancing Preserved with the vlan-flooding Command Enable and Disable VLAN Flooding • ARP entries already resolved through the VLAN are deleted when the feature is enabled. This ensures that ARP entries across the VLAN are consistent. • All ARP entries learn[...]

Layer 2 | 573 Configuring Redundant Pairs Configuring Redundant Pairs is supported: • On physical interfaces on platforms c e s • On static and dynamic port-channel interfaces on platforms c e s The Redundant Pairs feature allows you to provide redundancy for Layer 2 links without using Spanning Tree (STP). You create redundant links by configu[...]

574 | Layer 2 www.dell.com | support.dell.com To ensure that existing network applications see no difference when a primary interface in a redundant pair transitions to the backup interface, be sure to apply identical configurations of other traffic parameters to each interface. If you remove an interface in a redundant link (remove the line card o[...]

Layer 2 | 575 In Figure 25-8 , interface 3/41 is a backup interface for 3/42, and 3/42 is DOWN as shown in message Message 1 . If 3/41 fails, 3/42 transitions to the UP state, which makes the backup link active. A message similar to Message 1 appears whenever you configure a backup port. Figure 25-8. CLI for Configuring Redundant Layer 2 Pairs with[...]

576 | Layer 2 www.dell.com | support.dell.com Restricting Layer 2 Flooding Restricting Layer 2 Flooding is supported only on platform: e t When Layer 2 multicast traffic must be forwarded on a VLAN that has multiple ports with different speeds on the same port-pipe, forwarding is limited to the speed of the slowest port. Restricted Layer 2 Flooding[...]

Layer 2 | 577 Far-end Failure Detection Far-end Failure Detection is supported only on platform: e Far-end Failure Detection (FEFD) is a protocol that senses remote data link errors in a network. It responds by sending a unidirectional report that triggers an echoed response after a specified time interval. Figure 25-10. Configuring Far-end Failure[...]

578 | Layer 2 www.dell.com | support.dell.com 5. If the FEFD system has been set to Aggressive mode and neighboring echoes are not received after three intervals, the state changes to Err-disabled. All interfaces in the Err-disabled state must be manually reset using the fefd reset [ interface ] command in EXEC privilege mode (it can be done global[...]

Layer 2 | 579 Entering the show fefd command in EXEC privilege mode displays information about the state of each interface. Figure 25-11. Show FEFD global outputs Enable FEFD on an Interface Entering the command fefd in INTERFACE mode enables FEFD on a per interface basis. To change the FEFD mode, supplement the fefd command in INTERFACE mode by en[...]

580 | Layer 2 www.dell.com | support.dell.com Figure 25-12. FEFD enabled interface configuration Debugging FEFD By entering the command debug fefd events in EXEC privilege mode, output is displayed whenever events occur that initiate or disrupt an FEFD enabled connection. Figure 25-13. Debug FEFD events display Entering the command debug fefd packe[...]

Layer 2 | 581 During an RPM Failover In the event that an RPM failover occurs, FEFD will become operationally down on all enabled ports for approximately 8-10 seconds before automatically becoming operational again. Figure 25-15. FEFD state change during an RPM failover 02-05-2009 12:40:38 Local7.Debug 10.16.151.12 Feb 5 07:06:09: %RPM1-S:CP %RAM-6[...]

582 | Layer 2 www.dell.com | support.dell.com[...]

Link Layer Discovery Protocol | 583 26 Link Layer Discovery Protocol Link Layer Discovery Protocol is supported only on platforms: c e s LLDP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. This chapter contains the following sections: • 802.1AB (LLDP) Overview on page 583 • TIA-1057 (LLDP-MED) Overview on page 586 ?[...]

584 | Link Layer Discovery Protocol www.dell.com | support.dell.com Figure 26-1. Type, Length, Value (TLV) Segment TLVs are encapsulated in a frame called an LLDP Data Unit (LLDPDU) ( Figure 26-2 ), which is transmitted from one LLDP-enabled device to its LLDP-enabled neighbors. LLDP is a one-way protocol. LLDP-enabled devices (LLDP agents) can tra[...]

Link Layer Discovery Protocol | 585 Optional TLVs FTOS supports the following optional TLVs: • Management TLVs • IEEE 802.1 and 802.3 Organizationally Specific TLVs • TIA-1057 Organizationally Specific TLVs Management TLVs A Management TLV is an Optional TLVs sub-type. This kind of TLV contains essential management information about the sende[...]

586 | Link Layer Discovery Protocol www.dell.com | support.dell.com TIA-1057 (LLDP-MED) Overview Link Layer Discovery Protocol—Media Endpoint Discovery (LLDP-MED)—as defined by ANSI/ TIA-1057— provides additional organizationally specific TLVs so that endpoint devices and network connectivity devices can advertise their characteristics and co[...]

Link Layer Discovery Protocol | 587 With regard to connected endpoint devices, LLDP-MED provides network connectivity devices with the ability to: • manage inventory • manage Power over Ethernet (PoE) • identify physical location • identify network policy LLDP-MED is designed for, but not limited to, VoIP endpoints. TIA Organizationally Spe[...]

588 | Link Layer Discovery Protocol www.dell.com | support.dell.com LLDP-MED Capabilities TLV The LLDP-MED Capabilities TLV communicates the types of TLVs that the endpoint device and the network connectivity device support. LLDP-MED network connectivity devices must transmit the Network Policies TLV. • The value of the LLDP-MED Capabilities fiel[...]

Link Layer Discovery Protocol | 589 LLDP-MED Network Policies TLV A network policy in the context of LLDP-MED is a device’s VLAN configuration and associated Layer 2 and Layer 3 configurations, specifically: • VLAN ID • VLAN tagged or untagged status • Layer 2 priority • DSCP value The application type is a represented by an integer (the [...]

590 | Link Layer Discovery Protocol www.dell.com | support.dell.com Figure 26-5. LLDP-MED Policies TLV Extended Power via MDI TLV The Extended Power via MDI TLV enables advanced PoE management between LLDP-MED endpoints and network connectivity devices. Advertise the Extended Power via MDI on all ports that are connected to an 802.3af powered, LLDP[...]

Link Layer Discovery Protocol | 591 Configuring LLDP Configuring LLDP is a two-step process: 1. Enable LLDP globally. See page 592. 2. Advertise TLVs out of an interface. See page 592. Related Configuration Tasks • Viewing the LLDP Configuration on page 594 • Viewing Information Advertised by Adjacent LLDP Agents on page 594 • Configuring LLD[...]

592 | Link Layer Discovery Protocol www.dell.com | support.dell.com Figure 26-7. Configuration and Interface mode LLDP Commands Enabling LLDP LLDP is disabled by default. LLDP can be enabled and disabled globally or per interface. If LLDP is enabled globally, all up interfaces send periodic LLDPDUs. To enable LLDP: Disabling and Undoing LLDP • Di[...]

Link Layer Discovery Protocol | 593 • If you configure an interface, only the interface will send LLDPDUs with the specified TLVs. If LLDP is configured both globally and at interface level, the interface level configuration overrides the global configuration. To advertise TLVs: In Figure 26-8 , LLDP is enabled globally. R1 and R2 are transmittin[...]

594 | Link Layer Discovery Protocol www.dell.com | support.dell.com Viewing the LLDP Configuration Display the LLDP configuration using the command show config in either CONFIGURATION or INTERFACE mode, as shown in Figure 26-9 and Figure 26-10 , respectively Figure 26-9. Viewing LLDP Global Configurations Figure 26-10. Viewing LLDP Interface Config[...]

Link Layer Discovery Protocol | 595 Figure 26-12. Viewing All Information Advertised by Adjacent LLDP Agent Configuring LLDPDU Intervals LLDPDUs are transmitted periodically; the default interval is 30 seconds. You can configure a non-default transmit interval—at CONFIGURATION level or INTERFACE level—using the command hello ( Figure 26-13 ). R[...]

596 | Link Layer Discovery Protocol www.dell.com | support.dell.com Figure 26-13. Configuring LLDPDU Transmit and Receive Mode Configuring Transmit and Receive Mode Once LLDP is enabled, Dell Force10 systems transmit and receive LLDPDUs by default. You can configure the system—at CONFIGURATION level or INTERFACE level—to transmit only by execut[...]

Link Layer Discovery Protocol | 597 Figure 26-14. Configuring LLDPDU Transmit and Receive Mode Configuring a Time to Live The information received from a neighbor expires after a specific amount of time (measured in seconds) called a Time to Live (TTL). The TTL is the product of the LLDPDU transmit interval (hello) and an integer called a multiplie[...]

598 | Link Layer Discovery Protocol www.dell.com | support.dell.com Figure 26-15. Configuring LLDPDU Time to Live Debugging LLDP The command debug lldp enables you to view the TLVs that your system is sending and receiving. • Use the debug lldp brief command to view a readable version of the TLVs. • Use the debug lldp detail command to view a r[...]

Link Layer Discovery Protocol | 599 Figure 26-16. debug lldp detail—LLDPDU Packet Dissection Relevant Management Objects FTOS supports all IEEE 802.1AB MIB objects. • Table lists the objects associated with received and transmitted TLVs. • Table 26-8 lists the objects associated with the LLDP configuration on the local agent. • Table 26-9 l[...]

600 | Link Layer Discovery Protocol www.dell.com | support.dell.com Table 26-7. LLDP Configuration MIB Objects MIB Object Category LLDP Variable LLDP MIB Object Description LLDP Configuration adminStatus lldpPortConfigAdminStatus Whether the local LLDP agent is enabled for transmit, receive, or both msgTxHold lldpMessageTxHoldMultiplier Multiplier [...]

Link Layer Discovery Protocol | 601 Table 26-8. LLDP System MIB Objects TLV Type TLV Name TLV Variable System LLDP MIB Object 1 Chassis ID chassis ID subtype Local lldpLocChassisIdSubtype Remote lldpRemChassisIdSubtype chassid ID Local lldpLocChassisId Remote lldpRemChassisId 2 Port ID port subtype Local lldpLocPortIdSubtype Remote lldpRemPortIdSub[...]

602 | Link Layer Discovery Protocol www.dell.com | support.dell.com Table 26-9. LLDP 802.1 Organizationally Specific TLV MIB Objects TLV Type TLV Name TLV Variable System LLDP MIB Object 127 Port-VLAN ID PVID Local lldpXdot1LocPortVlanId Remote lldpXdot1RemPortVlanId 127 Port and Protocol VLAN ID port and protocol VLAN supported Local lldpXdot1LocP[...]

Link Layer Discovery Protocol | 603 Table 26-10. LLDP-MED System MIB Objects TLV Sub-Type TLV Name TLV Variable System LLDP-MED MIB Object 1 LLDP-MED Capabilities LLDP-MED Capabilities Local lldpXMedPortCapSupported lldpXMedPortConfigTLVsTx Enable Remote lldpXMedRemCapSupported, lldpXMedRemConfigTLVsTx Enable LLDP-MED Class Type Local lldpXMedLocDe[...]

604 | Link Layer Discovery Protocol www.dell.com | support.dell.com 4 Extended Power via MDI Power Device Type Local lldpXMedLocXPoEDeviceTyp e Remote lldpXMedRemXPoEDeviceTy pe Power Source Local lldpXMedLocXPoEPSEPower Source, lldpXMedLocXPoEPDPowerS ource Remote lldpXMedRemXPoEPSEPowe rSource, lldpXMedRemXPoEPDPower Source Power Priority Local l[...]

Multicast Listener Discovery | 605 27 Multicast Listener Discovery Multicast Listener Discovery is supported only on platform: e MLD Snooping is supported only on platform: e Multicast Listener Discovery (MLD) is a Layer 3 protocol that IPv6 routers use to learn of the multicast receivers that are directly connected to them and the groups in which [...]

606 | Multicast Listener Discovery www.dell.com | support.dell.com • Maximum Response Delay —the maximum amount of time that the Querier waits to receive a response to a General or Multicast-Address-Specific Query. The value is zero in reports and Done messages. • Multicast Address — set to zero in General Queries, and set to the relevant m[...]

Multicast Listener Discovery | 607 Leaving a Multicast Group A receiver that is no longer interested in traffic for a particular group should leave the group by sending a Done message to the link-scope all-routers multicast address, FF02::02. When a Querier receives a Done message, it sends a Multicast-Address-Specific Query addressed to the releva[...]

608 | Multicast Listener Discovery www.dell.com | support.dell.com Figure 27-3. MLDv2 Multicast Listener Report Implementation Information • In FTOS versions prior to 8.3.1.0: when a switch on which MLD snooping is enabled acts as Querier, queries sent to a specific port (in the event of a port enable, MLD leave, or MLD join), were sent with an a[...]

Multicast Listener Discovery | 609 • Debug MLD on page 611 • MLD Snooping on page 611 Change MLD Timer Values All non-queriers have a timer that is refreshed when it hears a General Query. If the timer expires, then the router can assume that the Querier is not present, and so it assumes the role of Querier. The Other Querier Present Interval, [...]

610 | Multicast Listener Discovery www.dell.com | support.dell.com Last Member Query Interval The Querier sends a Multicast-Address-Specific Query upon receiving a Done message to ascertain whether there are any remain receivers for a group. The Last Listener Query Interval is the Maximum Response Delay for a Multicast-Address-Specific Query, and a[...]

Multicast Listener Discovery | 611 Display the MLD Group Table Clear MLD Groups Clear a specific group or all groups on an interface from the multicast routing table using the command clear ipv6 mld groups from EXEC Privilege mode. Change the MLD Version Debug MLD MLD Snooping Multicast packets are addressed with multicast MAC addresses, which repr[...]

612 | Multicast Listener Discovery www.dell.com | support.dell.com Enable MLD Snooping MLD is automatically enabled when you enable IPv6 PIM, but MLD Snooping must be explicitly enabled. Disable MLD Snooping on a VLAN When MLD is enabled globally, it is by default enabled on all VLANs. Disable snooping on a VLAN, using the command no ipv6 mld snoop[...]

Multicast Listener Discovery | 613 View the ports that are connected to multicast routers using the command show ipv6 mld snooping mrouter from EXEC Privilege mode. Enable Snooping Explicit Tracking The switch can be a querier, and therefore also has the option of updating the group table through explicit-tracking (see Explicit Tracking on page 610[...]

614 | Multicast Listener Discovery www.dell.com | support.dell.com Figure 27-4. Port Inheritance on Mixed-mode VLANs In Figure 27-4 , the host on Port 1 sends an exclude—that is, exclude nothing—report to join group G and receive traffic from all transmitting sources for the group. FTOS creates a (*,G) entry and lists Port 1 in the outgoing int[...]

Multicast Source Discovery Protocol | 615 28 Multicast Source Discovery Protocol Multicast Source Discovery Protocol is supported only on platform e MSDP addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Multicast Source Discovery Protocol (MSDP) is a Layer 3 protocol that connects IPv4 PIM-SM [...]

616 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Figure 28-1. Multicast Source Discovery Protocol RPs advertise each (S,G) in its domain in Type, Length, Value (TLV) format. The total number of TLVs contained in the SA is indicated in the “Entry Count” field. SA messages are transmitted every 60 seconds, and immediately[...]

Multicast Source Discovery Protocol | 617 Configuring Multicast Source Discovery Protocol Configuring MSDP is a three-step process: 1. Enable an exterior gateway protocol (EGP) with at least two routing domains. Figure 28-5 and MSDP Sample Configurations on page 638 show the OSPF-BGP configuration used in this chapter for MSDP. Otherwise, see Chapt[...]

618 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Figure 28-3. Configuring Interfaces for MSDP R1 R2 R3 R4 1/1 1/21 2/11 2/31 3/21 3/41 4/31 4/1 1/2 PC 1 PC 2 PC 3 2/1 interface GigabitEthernet 1/1 ip pim sparse-mode ip address 10.11.3.1/24 no shutdown ! interface GigabitEthernet 1/2 ip address 10.11.2.1/24 no shutdown ! int[...]

Multicast Source Discovery Protocol | 619 Figure 28-4. Configuring OSPF and BGP for MSDP B G P AS 100 AS 200 R1 R2 R3 R4 1/1 1/21 2/11 2/31 3/21 3/41 4/31 4/1 1/2 PC 1 PC 2 PC 3 2/1 router ospf 1 network 10.11.2.0/24 area 0 network 10.11.1.0/24 area 0 network 192.168.0.1/32 area 0 network 10.11.3.0/24 area 0 O S P F router ospf 1 network 192.168.0.[...]

620 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Figure 28-5. Configuring PIM in Multiple Routing Domains AS 100 AS 200 RP1 RP2 R1 R2 R3 R4 1/1 1/21 2/11 2/31 3/21 3/41 4/31 4/1 1/2 PC 2 Source: 239.0.0.1 PC 3 Receiver: 239.0.0.1 2/1 PC 2 Receiver: 239.0.0.1 ip multicast-routing ! ip pim rp-address 192.168.0.1 group-address[...]

Multicast Source Discovery Protocol | 621 Figure 28-6. Configuring MSDP AS 100 AS 200 + B G P + B G P RP1 RP2 R1 R2 R3 R4 1/1 1/21 2/11 2/31 3/21 3/41 4/31 4/1 1/2 PC 1 Receiver: 239.0.0.1 PC 2 Source: 239.0.0..1 PC 3 Receiver: 239.0.0.1 2/1 O S P F Area 0 O S P F Area 0 + P I M + I G M P + P I M + I G M P R1_E600(conf)#do show run msdp ! ip multic[...]

622 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Enable MSDP Enable MSDP by peering RPs in different administrative domains. Figure 28-7. Configuring an MSDP Peer Figure 28-8. Displaying Details about a Peer Multicast sources in remote domains are stored on the RP in the Source-active cache (SA cache). The system does not c[...]

Multicast Source Discovery Protocol | 623 • RPs can transmit SA messages periodically to prevent SA storms, and • only sources that are in the cache are advertised in the SA to prevent transmitting multiple copies of the same source information. View the Source-active Cache Figure 28-9. Displaying the MSDP Source-active Cache Limit the Source-a[...]

624 | Multicast Source Discovery Protocol www.dell.com | support.dell.com • the peer RP is unreachable, • or because of an SA message format error. Accept Source-active Messages that fail the RFP Check A default peer is a peer from which active sources are accepted even though they fail the RFP check. • In Scenario 1 of Figure 28-10 , all MSP[...]

Multicast Source Discovery Protocol | 625 Figure 28-10. MSDP Default Peer P e e r s h i p F a i l M S D P P e e r s h i p RP1 RP2 RP3 RP4 RP5 (S4, G4) (S5, G5) (S2, G2) (S3, G3) Group Source RP Peer G2 S2 RP2 R3 RPF-Fail G3 S3 RP3 R3 G4 S4 RP4 R3 G5 S5 RP5 R3 ip msdp default-peer Router 3 access-list list123 ip access-list list123 permit RP4 Deny R[...]

626 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Figure 28-11. Accepting Source-active Messages with Limit the Source-active Messages from a Peer If the total number of sources received from the peer is already larger than the limit when this configuration is applied, those sources are not discarded. To enforce the limit in[...]

Multicast Source Discovery Protocol | 627 Prevent MSDP from Caching a Local Source You can prevent MSDP from caching an active source based on source and/or group. Since the source is not cached, it is not advertised to remote RPs. When you apply this filter, the SA cache is not affected immediately. When sources which are denied by the ACL time ou[...]

628 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Prevent MSDP from Caching a Remote Source In Figure 28-14 , R1 is advertising source 10.11.4.2. It is already in the SA cache of R3 when an ingress SA filter is applied to R3. The entry remains in the SA cache until it expires; it is not stored in the rejected SA cache. Figur[...]

Multicast Source Discovery Protocol | 629 Prevent MSDP from Advertising a Local Source In Figure 28-14 , R1 stops advertising source 10.11.4.2. Since it is already in the SA cache of R3, the entry remains there until it expires. Figure 28-14. Preventing MSDP from Advertising a Local Source Display the configured SA filters for a peer using the comm[...]

630 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Log Changes in Peership States Terminate a Peership MSDP uses TCP as its transport protocol. In a peering relationship, the peer with the lower IP address initiates the TCP session, while the peer with the higher IP address listens on port 639. Once the relationship is termin[...]

Multicast Source Discovery Protocol | 631 Clear Peer Statistics Figure 28-16. Clearing Peer Statistics Task Command Syntax Command Mode Reset the TCP connection to the peer and clear all peer statistics. clear ip msdp peer peer-address CONFIGURATION R3_E600(conf)#do show ip msdp peer Peer Addr: 192.168.0.1 Local Addr: 192.168.0.3(639) Connect Sourc[...]

632 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Debug MSDP Figure 28-17. Debugging MSDP MSDP with Anycast RP Anycast RP use MSDP with PIM-SM to allow more than one active group to RP mapping. PIM-SM allows only active group to RP mapping, which has several implications: • traffic concentration : PIM-SM allows only one ac[...]

Multicast Source Discovery Protocol | 633 Figure 28-18. MSDP with Anycast RP To configure Anycast RP: Step Task Command Syntax Command Mode 1 In each routing domain that will have multiple RPs serving a group, create a loopback interface on each RP serving the group with the same IP address. interface loopback CONFIGURATION 2 Make this address the [...]

634 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Reducing Source-active Message Flooding RPs flood source-active messages to all of their peers away from the RP. When multiple RPs exist within a domain, the RPs forward received active source information back to the originating RP, which violates the RFP rule. You can preven[...]

Multicast Source Discovery Protocol | 635 Figure 28-19. R1 Configuration for MSDP with Anycast RP ip multicast-routing ! interface GigabitEthernet 1/1 ip pim sparse-mode ip address 10.11.3.1/24 no shutdown ! interface GigabitEthernet 1/2 ip address 10.11.2.1/24 no shutdown ! interface GigabitEthernet 1/21 ip pim sparse-mode ip address 10.11.1.12/24[...]

636 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Figure 28-20. R2 Configuration for MSDP with Anycast RP ip multicast-routing ! interface GigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.4.1/24 no shutdown ! interface GigabitEthernet 2/11 ip pim sparse-mode ip address 10.11.1.21/24 no shutdown ! interface GigabitEthe[...]

Multicast Source Discovery Protocol | 637 Figure 28-21. R3 Configuration for MSDP with Anycast RP ip multicast-routing ! interface GigabitEthernet 3/21 ip pim sparse-mode ip address 10.11.0.32/24 no shutdown interface GigabitEthernet 3/41 ip pim sparse-mode ip address 10.11.6.34/24 no shutdown ! interface Loopback 0 ip pim sparse-mode ip address 19[...]

638 | Multicast Source Discovery Protocol www.dell.com | support.dell.com MSDP Sample Configurations The following figures show the running-configurations for the routers shown in figures Figure 28-5 , Figure 28-4 , Figure 28-5 , Figure 28-6 . Figure 28-22. MSDP Sample Configuration: R1 Running-config ip multicast-routing ! interface GigabitEtherne[...]

Multicast Source Discovery Protocol | 639 Figure 28-23. MSDP Sample Configuration: R2 Running-config ip multicast-routing ! interface GigabitEthernet 2/1 ip pim sparse-mode ip address 10.11.4.1/24 no shutdown ! interface GigabitEthernet 2/11 ip pim sparse-mode ip address 10.11.1.21/24 no shutdown ! interface GigabitEthernet 2/31 ip pim sparse-mode [...]

640 | Multicast Source Discovery Protocol www.dell.com | support.dell.com Figure 28-24. MSDP Sample Configuration: R3 Running-config ip multicast-routing ! interface GigabitEthernet 3/21 ip pim sparse-mode ip address 10.11.0.32/24 no shutdown ! interface GigabitEthernet 3/41 ip pim sparse-mode ip address 10.11.6.34/24 no shutdown ! interface Manage[...]

Multicast Source Discovery Protocol | 641 Figure 28-25. MSDP Sample Configuration: R4 Running-config ip multicast-routing ! interface GigabitEthernet 4/1 ip pim sparse-mode ip address 10.11.5.1/24 no shutdown ! interface GigabitEthernet 4/22 ip address 10.10.42.1/24 no shutdown ! interface GigabitEthernet 4/31 ip pim sparse-mode ip address 10.11.6.[...]

642 | Multicast Source Discovery Protocol www.dell.com | support.dell.com[...]

Multiple Spanning Tree Protocol | 643 29 Multiple Spanning Tree Protocol Multiple Spanning Tree Protocol is supported on platforms: c e s MSTP addressing is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Multiple Spanning Tree Protocol (MSTP)—specified in IEEE 802.1Q-2003—is an RSTP-based spanning tre[...]

644 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com FTOS supports three other variations of Spanning Tree, as shown in Table 44 . Implementation Information • The FTOS MSTP implementation is based on IEEE 802.1Q-2003, and interoperates only with bridges that also use this standard implementation. • MSTP is compatible with STP [...]

Multiple Spanning Tree Protocol | 645 Enable Multiple Spanning Tree Globally MSTP is not enabled by default. To enable MSTP: Verify that MSTP is enabled using the show config command from PROTOCOL MSTP mode, as shown in Figure 29-2 . Figure 29-2. Verifying MSTP is Enabled When you enable MSTP, all physical, VLAN, and port-channel interfaces that ar[...]

646 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com Figure 29-3. Mapping VLANs to MSTI Instances All bridges in the MSTP region must have the same VLAN-to-instance mapping. View to which instance a VLAN is mapped using the command show spanning-tree mst vlan from EXEC Privilege mode, as shown in Figure 29-6 . View the forwarding/d[...]

Multiple Spanning Tree Protocol | 647 Influence MSTP Root Selection MSTP determines the root bridge, but you can assign one bridge a lower priority to increase the probability that it will become the root bridge. To change the bridge priority: The simple configuration Figure 29-1 by default yields the same forwarding path for both MSTIs. Figure 29-[...]

648 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com To change the region name or revision: View the current region name and revision using the command show spanning-tree mst configuration from EXEC Privilege mode, as shown in Figure 29-6 . Figure 29-6. Viewing the MSTP Region Name and Revision Modify Global Parameters The root bri[...]

Multiple Spanning Tree Protocol | 649 View the current values for MSTP parameters using the show running-config spanning-tree mstp command from EXEC privilege mode. Figure 29-7. Viewing the Current Values for MSTP Parameters Change the hello-time parameter. Note: With large configurations (especially those with more ports) Dell Force10 recommends t[...]

650 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com Modify Interface Parameters You can adjust two interface parameters to increase or decrease the probability that a port becomes a forwarding port: • Port cost is a value that is based on the interface type. The greater the port cost, the less likely the port will be selected to[...]

Multiple Spanning Tree Protocol | 651 Configure an EdgePort The EdgePort feature enables interfaces to begin forwarding traffic approximately 30 seconds sooner. In this mode an interface forwards frames by default until it receives a BPDU that indicates that it should behave otherwise; it does not go through the Learning and Listening states. The b[...]

652 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com Configure a Root Guard Use the Root Guard feature in a Layer 2 MSTP network to avoid bridging loops. You enable root guard on a per-port or per-port-channel basis. To enable a root guard on an MSTP-enabled port or port-channel interface, enter the spanning-tree mstp rootguard com[...]

Multiple Spanning Tree Protocol | 653 Configure a Loop Guard The Loop Guard feature provides protection against Layer 2 forwarding loops (STP loops) caused by a hardware failure, such as a cable failure or an interface fault. When a cable or interface fails, a participating STP link may become unidirectional (STP requires links to be bidirectional)[...]

654 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com Flush MAC Addresses after a Topology Change FTOS has an optimized MAC address flush mechanism for RSTP, MSTP, and PVST+ that flushes addresses only when necessary, which allows for faster convergence during topology changes. However, you may activate the flushing mechanism define[...]

Multiple Spanning Tree Protocol | 655 MSTP Sample Configurations The running-configurations in Figure 29-11 , Figure 29-12 , and Figure 29-12 support the topology shown in Figure 29-10 . The configurations are from FTOS systems. An S50 system using SFTOS, configured as shown Figure 29-14 , could be substituted for an FTOS router in this sample foll[...]

656 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com Figure 29-11. Router 1 Running-configuration protocol spanning-tree mstp no disable name Tahiti revision 123 MSTI 1 VLAN 100 MSTI 2 VLAN 200,300 ! interface GigabitEthernet 1/21 no ip address switchport no shutdown ! interface GigabitEthernet 1/31 no ip address switchport no shut[...]

Multiple Spanning Tree Protocol | 657 Figure 29-12. Router 2 Running-configuration protocol spanning-tree mstp no disable name Tahiti revision 123 MSTI 1 VLAN 100 MSTI 2 VLAN 200,300 ! interface GigabitEthernet 2/11 no ip address switchport no shutdown ! interface GigabitEthernet 2/31 no ip address switchport no shutdown ! interface Vlan 100 no ip [...]

658 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com Figure 29-13. Router 3 Running-configuration protocol spanning-tree mstp no disable name Tahiti revision 123 MSTI 1 VLAN 100 MSTI 2 VLAN 200,300 ! interface GigabitEthernet 3/11 no ip address switchport no shutdown ! interface GigabitEthernet 3/21 no ip address switchport no shut[...]

Multiple Spanning Tree Protocol | 659 Figure 29-14. SFTOS Example Running-Configuration spanning-tree spanning-tree configuration name Tahiti spanning-tree configuration revision 123 spanning-tree MSTi instance 1 spanning-tree MSTi vlan 1 100 spanning-tree MSTi instance 2 spanning-tree MSTi vlan 2 200 spanning-tree MSTi vlan 2 300 interface 1/0/31 [...]

660 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com Debugging and Verifying MSTP Configuration Display BPDUs using the command debug spanning-tree mstp bpdu from EXEC Privilege mode. Display MSTP-triggered topology change messages debug spanning-tree mstp events . Figure 29-15. Displaying BPDUs and Events Examine your individual r[...]

Multiple Spanning Tree Protocol | 661 Figure 29-16. Sample Output for show running-configuration spanning-tree mstp command Figure 29-17. Displaying BPDUs and Events - Debug Log of Successful MSTP Configuration Figure 29-18. Displaying BPDUs and Events - Debug Log of Unsuccessful MSTP Configuration FTOS# show run spanning-tree mstp ! protocol spann[...]

662 | Multiple Spanning Tree Protocol www.dell.com | support.dell.com[...]

Multicast Features | 663 30 Multicast Features Multicast Features are supported on platforms: c e s Multicast is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. This chapter contains the following sections: • Enable IP Multicast on page 663 • Multicast with ECMP on page 664 • Implementation Information on page 665 •[...]

664 | Multicast Features www.dell.com | support.dell.com Prior to enabling any multicast protocols, you must enable multicast routing. Multicast with ECMP Dell Force10 multicast uses Equal-cost Multi-path (ECMP) routing to load-balance multiple streams across equal cost links. When creating the shared-tree Protocol Independent Multicast (PIM) uses [...]

Multicast Features | 665 Implementation Information • Because protocol control traffic in FTOS is redirected using the MAC address, and multicast control traffic and multicast data traffic might map to the same MAC address, FTOS might forward data traffic with certain MAC addresses to the CPU in addition to control traffic. As the upper five bits[...]

666 | Multicast Features www.dell.com | support.dell.com Limit the Number of Multicast Routes When the limit is reached, FTOS does not process any IGMP or MLD joins to PIM—though it still processes leave messages—until the number of entries decreases below 95% of the limit. When the limit falls below 95% after hitting the maximum, the system be[...]

Multicast Features | 667 Prevent a Host from Joining a Group You can prevent a host from joining a particular group by blocking specific IGMP reports. Create an extended access list containing the permissible source-group pairs. Use the command ip igmp access-group access-list-name from INTERFACE mode to apply the access li st. In Figure 30-2 , VLA[...]

668 | Multicast Features www.dell.com | support.dell.com Figure 30-2. Preventing a Host from Joining a Group R1 R2 R3 Source 2 10.11.1.2 Source 1 10.11.5.2 Receiver 2 10.11.4.2 Receiver 1 10.11.3.2 Group: 239.0.0.1, 239.0.0.2 1/31 3/11 2/11 2/31 3/21 interface Vlan 300 ip pim sparse-mode ip address 10.11.3.1/24 untagged GigabitEthernet 1/1 no shutd[...]

Multicast Features | 669 Rate Limit IGMP Join Requests If you expect a burst of IGMP Joins, protect the IGMP process from overload by limiting that rate at which new groups can be joined using the command ip igmp group-join-limit from INTERFACE mode. Hosts whose IGMP requests are denied will use the retry mechanism built-in to IGMP so that they’r[...]

670 | Multicast Features www.dell.com | support.dell.com Figure 30-3. Preventing a Source from Transmitting to a Group Prevent a PIM Router from Processing a Join Permit or deny PIM Join/Prune messages on an interface using an extended IP access list. Use the command ip pim join-filter to prevent the PIM SM router from creating state based on multi[...]

Multicast Features | 671 Using a Static Multicast MAC Address Using a Static Multicast MAC Address is supported on platform c When a multicast source and multicast receivers are in the same VLAN, you can configure a router so that multicast traffic is switched only to the ports assigned to a VLAN that is associated with a static multicast MAC addre[...]

672 | Multicast Features www.dell.com | support.dell.com To display the current configuration of Layer 2 multicast switching on a router, enter the show mac-address-table static multicast [ vlan vlan-id | multicast-mac-address [ vlan vlan-id ]] command in EXEC mode. Static MAC addresses configured for Layer 2 multicast forwarding with an associated[...]

Multicast Features | 673 IPv6 Multicast Policies IPv6 Multicast Policies is available only on platform: e • Limit the Number of IPv6 Multicast Routes on page 673 • Prevent an IPv6 Neighbor from Forming an Adjacency on page 673 • Prevent an IPv6 Source from Registering with the RP on page 674 • Prevent an IPv6 PIM Router from Processing an I[...]

674 | Multicast Features www.dell.com | support.dell.com Prevent an IPv6 Source from Registering with the RP Prevent an IPv6 PIM Router from Processing an IPv6 Join Multicast Traceroute Multicast Traceroute is supported only on platform: e MTRACE is an IGMP-based tool that prints that network path that a multicast packet takes from a source to a de[...]

Multicast Features | 675 • MTRACE Transit —when a Dell Force10 system is an intermediate router between the source and destination in an MTRACE query, FTOS computes the RPF neighbor for the source, fills in the request, and forwards the request to the RPF neighbor. While computing the RPF neighbor, static mroutes and mBGP routes are preferred o[...]

676 | Multicast Features www.dell.com | support.dell.com • Allocate More Buffer Memory for Multicast WRED • Allocate More Bandwidth to Multicast using Egress WFQ Allocate More Buffer Memory for Multicast WRED Allocate more buffer memory to multicast WRED (Weighted Random Early Detection) for bursty multicast traffic that might temporarily becom[...]

Object Tracking | 677 31 Object Tracking IPv4/IPv6 Object Tracking is available on platforms: c e s This chapter covers the following information: • Object Tracking Overview • Object Tracking Configuration • Displaying Tracked Objects Object tracking allows FTOS client processes, such as VRRP, to monitor tracked objects (for example, interfac[...]

678 | Object Tracking www.dell.com | support.dell.com You can create a tracked object to monitor the metric of the default route 0.0.0.0/0. After you configure the default route as a tracked object, you can configure the VRRP group to track the state of the route. In this way, the VRRP priority of the router with the better metric as determined by [...]

Object Tracking | 679 Tracking Layer 3 Interfaces You can create an object that tracks the Layer 3 state (IPv4 or IPv6 routing status) of an interface. • The Layer 3 status of an interface is UP only if the Layer 2 status of the interface is UP and the interface has a valid IP address. • The Layer 3 status of an interface goes DOWN when its Lay[...]

680 | Object Tracking www.dell.com | support.dell.com • If the scaled metric for a route is greater than or equal to the DOWN threshold or the route is not entered in the routing table, the state of a route is DOWN. The UP and DOWN thresholds are user-configurable for each tracked route. The default UP threshold is 254; the default DOWN threshold[...]

Object Tracking | 681 You can assign a unique priority-cost value from 1 to 254 to each tracked VRRP object or group interface. The priority cost is subtracted from the VRRP group priority if a tracked VRRP object is in a DOWN state. If a VRRP group router acts as owner-master, the run-time VRRP group priority remains fixed at 255 and changes in th[...]

682 | Object Tracking www.dell.com | support.dell.com To configure object tracking on the status of a Layer 2 interface, use the following commands. To remove object tracking on a Layer 2 interface, enter the no track object-id command. Figure 31-2. Command Example: track interface line-protocol Tracking a Layer 3 Interface You can create an object[...]

Object Tracking | 683 For an IPv4 interface, a routing object only tracks the UP/DOWN status of the specified IPv4 interface ( track interface ip-routing command). • The status of an IPv4 interface is UP only if the Layer 2 status of the interface is UP and the interface has a valid IP address. • The Layer 3 status of an IPv4 interface goes DOW[...]

684 | Object Tracking www.dell.com | support.dell.com Figure 31-4. Command Example: track interface ipv6 routing Tracking an IPv4/IPv6 Route You can create an object that tracks the reachability or metric of an IPv4 or IPv6 route. You specify the route to be tracked by its address and prefix-length values. Optionally, for an IPv4 route you can ente[...]

Object Tracking | 685 The tracking process uses a protocol-specific resolution value to convert the actual metric in the rout- ing table to a scaled metric in the range 0 to 255. The resolution value is user-configurable and calcu- lates the scaled metric by dividing a route's cost by the resolution value set for the route type: • For ISIS, [...]

686 | Object Tracking www.dell.com | support.dell.com Figure 31-5. Command Example: track ip route reachability Figure 31-6. Command Example: track ipv6 route reachability Tracking a Metric Threshold To configure object tracking on the metric threshold of an IPv4 or IPv6 route, use the following commands. To remove object tracking, enter the no tra[...]

Object Tracking | 687 Figure 31-7. Command Example: track ip route metric threshold Figure 31-8. Command Example: track ipv6 route metric threshold 3 (Optional) Configure the time delay used before communicating a change in the UP and/or DOWN status of a tracked route. delay {[ up seconds ] [ down seconds ]} Valid delay times are from 0 to 180 seco[...]

688 | Object Tracking www.dell.com | support.dell.com Displaying Tracked Objects You can display the currently configured objects used to track Layer 2 and Layer 3 interfaces, and IPv4 and IPv6 routes, by entering the following show commands: • show track [ object-id [ brief ] | interface [ brief ] [ vrf vrf-name ] | ip route [ brief ] [ vrf vrf-[...]

Object Tracking | 689 Figure 31-11. Command Example: show track resolution Figure 31-12. Command Example: show track vrf • show running-config track [ object-id ] Use the show running-config track command to display the tracking configuration of a specified object or all objects that are currently configured on the router. Figure 31-13. Command E[...]

690 | Object Tracking www.dell.com | support.dell.com[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 691 32 Open Shortest Path First (OSPFv2 and OSPFv3) Open Shortest Path First version 2 (OSPF for IPv4) is supported on platforms c e s Open Shortest Path First version 3 (OSPF for IPv6) is supported on platforms c e OSPF for IPv4 is supported on the E-Series ExaScale platform with FTOS 8.1.1.0; OSPF fo[...]

692 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Protocol Overview Open Shortest Path First (OSPF) routing is a link-state routing protocol that calls for the sending of Link-State Advertisements (LSAs) to all other routers within the same Autonomous System (AS) Areas . Information on attached interfaces, metrics u[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 693 Figure 32-1. Autonomous System Areas Area Types The Backbone of the network is Area 0. It is also called Area 0.0.0.0 and is the core of any Autonomous System (AS). All other areas must connect to Area 0. Areas can be defined in such a way that the backbone is not contiguous. In this case, backbone[...]

694 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com A Stub Area (SA) does not receive external route information, except for the default route. These areas do receive information from inter-area (IA) routes. Note that all routers within an assigned Stub area must be configured as stubby, and no generate LSAs that do n[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 695 Figure 32-2. OSPF Routing Examples Backbone Router (BR) A Backbone Router (BR) is part of the OSPF Backbone, Area 0. This includes all Area Border Routers (ABRs). It can also include any routers that connect only to the Backbone and another ABR, but are only part of Area 0, such as Router I in Figu[...]

696 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Area Border Router (ABR) Within an AS, an Area Border (ABR) connects one or more areas to the Backbone. The ABR keeps a copy of the link-state database for every area it connects to, so it may keep multiple copies of the link state database. An Area Border Router (AB[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 697 Link-State Advertisements (LSAs) A Link-State Advertisement (LSA) communicates the router's local routing topology to all other local routers in the same area. • OSPFv3 can treat LSAs as having link-local flooding scope, or store and flood them as if they are understood, while ignoring them [...]

698 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com For all LSA types, there are 20-byte LSA headers. One of the fields of the LSA header is the Link-State ID. Each router link is defined as one of four types: type 1, 2, 3, or 4. The LSA includes a link ID field that identifies, by the network number and mask, the obj[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 699 Figure 32-3. Priority and Costs Example Implementing OSPF with FTOS FTOS supports up to 10,000 OSPF routes. Within that 10,000 up to 8,000 routes can be designated as external and up to 2,000 designated as inter/intra area routes. FTOS version 7.8.1.0 and later support multiple OSPF processes (OSPF[...]

700 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com • NSSA External (type 7) • Opaque Link-local (type 9) Graceful Restart Graceful Restart for OSPFv2 is supported on c e and s platforms in Helper and Restart modes. Graceful Restart for OSPFv3 is supported only on e t platforms in Helper and Restart modes. When a [...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 701 period. You reconfigure OSPFv3 graceful restart to a “restarting-only” role when you enable the helper-reject role on an interface. OSPFv3 supports the helper-reject role on a per-interface basis. Configuring helper-reject role on an OSPFv2 router or OSPFv3 interface enables the restarting-only[...]

702 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Each OSPFv2 process has a unique process ID and must have an associated Router ID. There must be an equal number of interfaces must be in Layer-3 mode for the number of processes created. For example, if 5 OSPFv2 processes are created on a system, there must be at le[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 703 Figure 32-4. Enabling RFC-2328 Compliant OSPF Flooding In FTOS Version, 7.5.1.0 use show ip ospf to confirm that RFC-2328 compliant OSPF flooding is enabled, as shown below. Figure 32-5. Enabling RFC-2328 Compliant OSPF Flooding OSPF ACK Packing The OSPF ACK Packing feature bundles multiple LS ackn[...]

704 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com To ensure equal intervals between the routers, manually set the dead interval of the Dell Force10 router to match the Cisco configuration. Use the command “ ip ospf dead-interval <x> ” in interface mode: Figure 32-6. Command Example: ip ospf intervals Figur[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 705 2. Enable OSPF globally. Assign network area and neighbors. 3. Add interfaces or configure other attributes. The following configuration steps include two mandatory steps and several optional ones: • Enable OSPFv2 (mandatory) • Enable Multi-Process OSPF • Assign an OSPFv2 area (mandatory) •[...]

706 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Return to CONFIGURATION mode to enable the OSPF process. The OSPF Process ID is the identifying number assigned to the OSPF process, and the Router ID is the IP address associated with the OSPF process. . Once the OSPF process and the VRF are tied together, the OSPF [...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 707 Enable Multi-Process OSPF Multi-Process OSPF allows multiple OSPFv2 processes on a single router. The following list shows the number of processes supported on each platform type. • The E-Series supports up to 30 OSPFv2 processes. • The C-Series supports up to 6 OSPFv2 processes. • The S-Seri[...]

708 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com In CONFIGURATION ROUTER OSPF mode, assign the Router ID. The Router ID is not required to be the router’s IP address. Dell Force10 recommends using the IP address as the Router ID for easier management and troubleshooting. Use the no router ospf process-id command [...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 709 Enable OSPFv2 on interfaces Each interface must have OSPFv2 enabled on it. It must be configured for Layer 3 protocol, and not be shutdown. OSPFv2 can also be assigned to a loopback interface as a virtual interface. OSPF functions and features, such as MD5 Authentication, Grace Period, Authenticati[...]

710 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Figure 32-10. Command Example: show ip ospf process-id interface Loopback interfaces also assist in the OSPF process. OSPF will pick the highest interface address as the router-id and a loopback interface address has a higher precedence than other interface addresses[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 711 Configure stub areas OSPF supports different types of LSAs to help reduce the amount of router processing within the areas. Type 5 LSAs are not flooded into stub areas; the Area Border Router (ABR) advertises a default route into the stub area to which it is attached. Stub area routers use the defa[...]

712 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Configure OSPF Stub-Router Advertisement Configure OSPF Stub-Router Advertisement is supported on platforms: c e When you bring a new router onto an OSPF network, you can configure the router to function as a stub area by globally reconfiguring the OSPF link cost so [...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 713 Enable passive interfaces A passive interface is one that does not send or receive routing information. Enabling passive interface suppresses routing updates on an interface. Although the passive interface will neither send nor receive routing updates, the network on that interface will still be in[...]

714 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Figure 32-13. Command Example: show ip ospf process-id interface Enable fast-convergence The fast-convergence CLI sets the minimum origination and arrival LSA parameters to zero (0), allowing rapid route calculation. When fast-convergence is disabled, origination and[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 715 Figure 32-14 shows the convergence settings when fast-convergence is enabled and Figure 32-15 shows settings when fast-convergence is disabled. These displays appear with the show ip ospf command. Figure 32-14. Command Example: show ip ospf process-id (fast-convergence enabled ) Figure 32-15. Comma[...]

716 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Use any or all of the following commands in CONFIGURATION INTERFACE mode to change OSPFv2 parameters on the interfaces: Use the show config command in CONFIGURATION INTERFACE mode ( Figure 32-16 ) to view interface configurations. Use the show ip ospf interface comma[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 717 Figure 32-16. Changing the OSPF Cost Value on an Interface Enable OSPFv2 authentication Use the following commands in CONFIGURATION INTERFACE mode to enable or change various OSPF authentication parameters: Enable OSPFv2 graceful restart Graceful Restart is enabled for the global OSPF process. Use [...]

718 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com • helper-reject neighbors —the router ID of each restart router that does not receive assistance from the configured router. • mode —the situation or situations that trigger a graceful restart. • role —the role or roles the configured router can perform. [...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 719 Figure 32-17. Command Example: show run ospf Use the following command to disable OSPFv2 graceful-restart after you have enabled it. For more information on OSPF graceful restart, refer to the FTOS Command Line Interface Reference . Configure virtual links Areas within OSPF must be connected to the[...]

720 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Use the following command in CONFIGURATION ROUTER OSPF mode to configure virtual links. Use the show ip ospf process-id virtual-links command (Figure 32-18) in the EXEC mode to view the virtual link. Figure 32-18. Command Example: show ip ospf process-id virtual-link[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 721 For configuration information on prefix lists, refer to IP Access Control Lists, Prefix Lists, and Route-maps chapter in the FTOS Configuration Guide . Use the following commands in CONFIGURATION-ROUTER OSPF mode to apply prefix lists to incoming or outgoing OSPF routes Redistribute routes You can [...]

722 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com To view the current OSPF configuration, use the show running-config ospf command in the EXEC mode or the show config command in the ROUTER OSPF mode Figure 32-19. Command Example: show config Troubleshooting OSPFv2 FTOS has several tools to make troubleshooting easie[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 723 Use the show running-config ospf command to see the state of all the enabled OSPFv2 processes. Figure 32-20. Command Example: show running-config ospf Use the following commands in EXEC Privilege mode to get general route and links status information. Use the following command in EXEC Privilege mod[...]

724 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Use the following command in EXEC Privilege mode to configure the debugging options of an OSPFv2 process: To display a summary of the information stored in the OSPFv2 database of the router, enter the show ip ospf database database-summary command. Note that the numb[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 725 Sample Configurations for OSPFv2 The following configurations are examples for enabling OSPFv2. These are not comprehensive directions. They are intended to give you a some guidance with typical configurations. You can copy and paste from these examples to your CLI. Be sure you make the necessary c[...]

726 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Configuration Task List for OSPFv3 (OSPF for IPv6) Open Shortest Path First version 3 (OSPF for IPv6) is supported on platforms c e The configuration options of OSPFv3 are the same as those for OSPFv2, but may be configured with differently labeled commands. Process [...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 727 Enable IPv6 Unicast Routing Assign IPv6 addresses on an interface Assign Area ID on interface The ipv6 ospf area command enables OSPFv3 on an interface and places the interface in the specified area. Additionally, it creates the OSPFv3 process with ID on the router. OSPFv2 required two commands are[...]

728 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Assign OSPFv3 Process ID and Router ID Globally Configure stub areas Command Syntax Command Mode Usage ipv6 router ospf { process ID} CONFIGURATION Enable the OSPFv3 process globally and enter OSPFv3 mode. Range: 0-65535 router-id {number} CONF-IPV6-ROUTER-OSPF Assig[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 729 Configure Passive-Interface Use the following command to suppress the interface’s participation on an OSPFv3 interface. This command stops the router from sending updates on that interface. To enable both receiving and sending routing updates, enter the no passive-interface interface command. Whe[...]

730 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Redistribute routes You can add routes from other routing instances or protocols to the OSPFv3 process. With the redistribute command syntax, you can include RIP, static, or directly connected routes in the OSPF process. Configure a default route Configure FTOS to ge[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 731 Enable OSPFv3 graceful restart Graceful Restart for OSPFv3 is supported only on platform e t . Refer to Graceful Restart on page 700 for more information on the feature. By default, OSPFv3 graceful restart is disabled and functions only in a helper role to help restarting neighbor routers in their [...]

732 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com To display information on the use and configuration of OSPFv3 graceful restart, enter any of the following commands: Figure 32-23. Command Example: show run ospf Command Syntax Command Mode Usage show run ospf EXEC Privilege Display the graceful-restart configuration[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 733 Figure 32-24. Command Example: show ipv6 ospf database database-summary Figure 32-25. Command Example: show ipv6 ospf database grace-lsa FTOS#show ipv6 ospf database database-summary ! OSPFv3 Router with ID (200.1.1.1) (Process ID 1) Process 1 database summary Type Count/Status Oper Status 1 Admin [...]

734 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com OSPFv3 Authentication Using IPsec OSPFv3 Authentication Using IPsec is supported only on platform: e t Starting in release 8.4.2.0, OSPFv3 uses the IP Security (IPsec) to provide authentication for OSPFv3 packets. IPsec authentication ensures security in the transmis[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 735 OSPFv3 Authentication using IPsec: Configuration Notes OSPFv3 authentication using IPsec is implemented according to the specifications in RFC 4552, including: • To use IPsec, you configure an authentication (using AH) or encryption (using ESP) security policy on an interface or in an OSPFv3 area[...]

736 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com • Configuring IPsec Authentication for an OSPFv3 Area • Configuring IPsec Encryption for an OSPFv3 Area • Displaying OSPFv3 IPsec Security Policies Configuring IPsec Authentication on an Interface Prerequisite : Before you enable IPsec authentication on an OSPF[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 737 Configuring IPsec Encryption on an Interface Prerequisite : Before you enable IPsec encryption on an OSPFv3 interface, you must first enable IPv6 unicast routing globally, configure an IPv6 address and enable OSPFv3 on the interface, and assign it to an area (see Configuration Task List for OSPFv3 [...]

738 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com To remove an IPsec encryption policy from an interface, enter the no ipv6 ospf encryption ipsec spi number command. To remove null encryption on an interface to allow the interface to inherit the encryption policy configured for the OSPFv3 area, enter the no ipv6 osp[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 739 To display the configuration of IPsec authentication policies on the router, enter the show crypto ipsec policy command. Configuring IPsec Encryption for an OSPFv3 Area Prerequisite : Before you enable IPsec encryption in an OSPFv3 area, you must first enable OSPFv3 globally on the router (see Conf[...]

740 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Note that when you configure encryption with the area encryption command, you enable both IPsec encryption and authentication. However, when you enable authentication on an area with the area authentication command, you do not enable encryption at the same time. If y[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 741 Figure 32-26. Command Example: show crypto ipsec policy FTOS#show crypto ipsec policy Crypto IPSec client security policy data Policy name : OSPFv3-1-502 Policy refcount : 1 Inbound ESP SPI : 502 (0x1F6) Outbound ESP SPI : 502 (0x1F6) Inbound ESP Auth Key : 123456789a123456789b123456789c12 Outbound[...]

742 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com To display the IPsec security associations (SAs) used on OSPFv3 interfaces, enter the following command: Command Syntax Command Mode Usage show crypto ipsec sa ipv6 [ interface interface ] EXEC Privilege Displays security associations set up for OSPFv3 links in IPsec[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 743 Figure 32-27. Command Example: show crypto ipsec sa ipv6 FTOS#show crypto ipsec sa ipv6 Interface: TenGigabitEthernet 0/0 Link Local address: fe80::201:e8ff:fe40:4d10 IPSecv6 policy name: OSPFv3-1-500 inbound ah sas spi : 500 (0x1f4) transform : ah-md5-hmac in use settings : {Transport, } replay de[...]

744 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com Troubleshooting OSPFv3 FTOS has several tools to make troubleshooting easier. Be sure to check the following, as these are typical issues that interrupt the OSPFv3 process. Note that this is not a comprehensive list, just some examples of typical troubleshooting chec[...]

Open Shortest Path First (OSPFv2 and OSPFv3) | 745 Use the following command in EXEC Privilege mode to configure the debugging options of an OSPFv3 process: Command Syntax Command Mode Usage debug ipv6 ospf [ event | packet ] {type slot/port} EXEC Privilege View debug messages for all OSPFv3 interfaces. • event : View OSPF event messages. • pac[...]

746 | Open Shortest Path First (OSPFv2 and OSPFv3) www.dell.com | support.dell.com[...]

PIM Dense-Mode | 747 33 PIM Dense-Mode PIM Dense-Mode is supported on platforms: c e s PIM-Dense Mode (PIM-DM) is a multicast protocol that directs routers to forward multicast traffic to all subnets until the router receives a request to stop; this behavior is the opposite of PIM-Sparse Mode, which does not forward multicast traffic to a subnet un[...]

748 | PIM Dense-Mode www.dell.com | support.dell.com Figure 33-1. Multicast Flooding in a PIM-DM Network Refusing Multicast Traffic If a PIM-DM router has no receivers for a group, it refuses multicast traffic by sending a PIM Prune message to address 224.0.0.13 out of the source interface. The upstream neighbor receives the prune message and deter[...]

PIM Dense-Mode | 749 When a router receives a prune message, it flags the relevant (S,G) entry and sets a timer. If the timer expires, it begins flooding traffic out of the interface, and downstream routers must again evaluate whether to prune itself from the tree. To prevent the timer from expiring, while the source is sending traffic for the (S,G[...]

750 | PIM Dense-Mode www.dell.com | support.dell.com Configure PIM-DM Configuring PIM-DM is a two-step process: 1. Enable multicast routing using the command ip multicast-routing from CONFIGURATION mode. 2. Enable PIM-DM on an interface. See page 750. Related Configuration Tasks • Clear the PIM TIB using the command clear ip pim tib from EXEC Pri[...]

PIM Dense-Mode | 751 Figure 33-4. Enabling PIM-DM Display which interfaces are enabled with PIM-DM using the command show ip pim interface from EXEC Privilege mode, as shown in Figure 33-5 . Figure 33-5. Viewing PIM-SM Enabled Interfaces Display PIM neighbors for each interface using the command show ip pim neighbor from EXEC Privilege mode, as sho[...]

752 | PIM Dense-Mode www.dell.com | support.dell.com Figure 33-6. Viewing PIM Neighbors Command Example Display the PIM routing table using the command show ip pim tib from EXEC privilege mode, as shown in Figure 33-7 . R1_E600(conf)#do show ip pim neighbor Neighbor Interface Uptime/Expires Ver DR Prio/Mode GR Address 2.1.1.2 Gi 1/12 01:43:51/00:01[...]

PIM Dense-Mode | 753 Figure 33-7. Viewing the PIM Multicast Routing Table ------------------------------------- Router 1 ---------------------------------------------- R1_E600(conf)#do show ip pim tib PIM Multicast Routing Table Flags: D - Dense, S - Sparse, C - Connected, L - Local, P - Pruned, R - RP-bit set, F - Register flag, T - SPT-bit set, J[...]

754 | PIM Dense-Mode www.dell.com | support.dell.com[...]

PIM Sparse-Mode | 755 34 PIM Sparse-Mode PIM Sparse-Mode is supported on platforms: c e s PIM-SM is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. PIM-Sparse Mode (PIM-SM) is a multicast protocol that forwards multicast traffic to a subnet only upon request using a PIM Join message; this behavior is the opposite of PIM-Den[...]

756 | PIM Sparse-Mode www.dell.com | support.dell.com Protocol Overview To distribute the same traffic to multiple receivers, PIM-SM creates a tree extending from a root, called the Rendezvous Point (RP), down branches that extend to the nodes which have requested the traffic. Nodes requesting the same traffic belong to the same multicast group . I[...]

PIM Sparse-Mode | 757 Sending Multicast Traffic With PIM-SM, all multicast traffic must initially originate from the RP. A source must unicast traffic to the RP so that the RP can learn about the source and create an SPT to it. Then the last-hop DR may create an SPT directly to the source. 1. The source gateway router (first-hop DR) receives the mu[...]

758 | PIM Sparse-Mode www.dell.com | support.dell.com 3. Enable PIM-SM on an interface. See page 758. Related Configuration Tasks • Configurable S,G Expiry Timers on page 759 • Configure a Static Rendezvous Point on page 760 • Elect an RP using the BSR Mechanism on page 762 • Configure a Designated Router on page 763 • Create Multicast Bo[...]

PIM Sparse-Mode | 759 Figure 34-2. Viewing PIM Neighbors Command Example Display the PIM routing table using the command show [ ip | ipv6 ] pim tib from EXEC privilege mode, as shown in Figure 34-3 . Figure 34-3. Viewing the PIM Multicast Routing Table Configurable S,G Expiry Timers By default S, G entries expire in 210 seconds. You can configure a[...]

760 | PIM Sparse-Mode www.dell.com | support.dell.com Configure the expiry time for a particular (S,G) entry: Figure 34-4. Configuring an (S,G) Expiry Time Display the expiry time configuration using the show running-configuration [ acl | pim ] command from EXEC Privilege mode. Configure a Static Rendezvous Point The rendezvous point is a PIM-enabl[...]

PIM Sparse-Mode | 761 Figure 34-5. Electing a Rendezvous Point Override Bootstrap Router Updates PIM-SM routers need to know the address of the RP for each group for which they have (*,G) entry. This address is obtained automatically through the bootstrap router (BSR) mechanism or a static RP configuration. If you have configured a static RP for a [...]

762 | PIM Sparse-Mode www.dell.com | support.dell.com Elect an RP using the BSR Mechanism Every PIM router within a domain must map a particular multicast group address to the same RP. The group-to-RP mapping may be statically or dynamically configured. RFC 5059 specifies a dynamic, self-configuring method called the Bootstrap Router (BSR) mechanis[...]

PIM Sparse-Mode | 763 Configure a Designated Router Multiple PIM-SM routers might be connected to a single LAN segment. One of these routers is elected to act on behalf of directly connected hosts. This router is the Designated Router (DR). The DR is elected using hello messages. Each PIM router learns about its neighbors by periodically sending a [...]

764 | PIM Sparse-Mode www.dell.com | support.dell.com Set a Threshold for Switching to the SPT Set a Threshold for Switching to the SPT is available only on platform: e Initially, a single PIM-SM tree called a shared tree to distribute traffic. It is called shared because all traffic for the group, regardless of the source, or the location of the s[...]

PIM Sparse-Mode | 765 FTOS supports PIM-SM graceful restart based on the GenID. Per RFC 4601, hello messages should contain a Generation_Identifier option, which contains a randomly generated value (GenID) that is regenerated each time PIM forwarding is started or restarted on the interface, including when the router restarts. When a router receive[...]

766 | PIM Sparse-Mode www.dell.com | support.dell.com To prevent these delivery errors you must statically map the potential incoming interfaces for the (*,G) entries via the CLI. When you create this mapping, (*,G) entries are programmed in hardware. Packets are then fast forwarded starting with the first packet, and the potential for these delive[...]

PIM Sparse-Mode | 767 • It is recommended that you do not enable IGMP snooping on a PIM-SM snooping-enabled VLAN interface unless until it is necessary for VLAN operation. For information on how to enable PIM-SM snooping and disable PIM DR flooding, refer to PIM-SM Snooping on page 767 . PIM-SM Snooping PIM-SM Snooping is supported on VLAN interf[...]

768 | PIM Sparse-Mode www.dell.com | support.dell.com Feature Overview PIM-SM snooping functions in a Layer 2 network in which multiple routers are interconnected by a switch, such as an IXP where Internet service providers (ISPs) exchange Internet traffic between their networks. By default, the switch floods multicast traffic to all VLAN member po[...]

PIM Sparse-Mode | 769 • In the downstream PIM TIB, states and timers are maintained for each VLAN and member port. The downstream outgoing-interface timers for each valid (*,G) and (S,G) entry are started for each VLAN/ port and upstream neighbor combination: ( port ,*,G, neighbor ) or ( port ,S,G, neighbor ), where port is a downstream port and [...]

770 | PIM Sparse-Mode www.dell.com | support.dell.com PIM-SM Snooping Example Figure 34-8 shows an example with PIM-SM snooping enabled. When Router A sends a join message to Router B, the switches forward the join message only to Router B without flooding the message to other connected routers, such as Routers C and D. Figure 34-8. PIM-SM Snooping[...]

PIM Sparse-Mode | 771 Similarly, in Figure 34-8 , when PIM-SM snooping is enabled and multicast data is sent to VLAN members of group G, the switches forward the data traffic from the server attached to Router B only to the router (Router A) in the multicast group that should receive it. Without PIM-SM snooping, the switches would flood the data to[...]

772 | PIM Sparse-Mode www.dell.com | support.dell.com PIM-SM Snooping Configuration You can enable PIM-SM snooping globally on a switch or on individual VLANs. PIM-SM snooping is not enabled by default and does not require an IP address, PIM-DM, or PIM-SM. PIM-SM snooping and PIM multicast routing are mutually exclusive: PIM-SM snooping cannot be e[...]

PIM Sparse-Mode | 773 Verify PIM-SM Snooping To display information about PIM-SM snooping operation, enter one of the following show commands: To clear tree information learned through PIM-SM snooping from the PIM TIB, enter the clear ip pim snooping tib command. To clear information on the multicast routes learned through PIM-SM snooping from the [...]

774 | PIM Sparse-Mode www.dell.com | support.dell.com Figure 34-11. PIM-SM snooping: show ip pim snooping tib Figure 34-12. PIM-SM snooping: show ip pim snooping interface FTOS# show ip pim snooping tib PIM Multicast Snooping Table Flags: J/P - (*,G) Join/Prune, j/p - (S,G) Join/Prune SGR-P - (S,G,R) Prune Timers: Uptime/Expires * : Inherited port [...]

PIM Sparse-Mode | 775 Figure 34-13. PIM-SM snooping: show ip pim summary FTOS# show ip pim summary PIM TIB version 495 Uptime 22:44:52 Entries in PIM-TIB/MFC : 2/2 Active Modes : PIM-SNOOPING Interface summary: 1 active PIM interface 0 passive PIM interfaces 3 active PIM neighbors TIB summary: 1/1 (*,G) entries in PIM-TIB/MFC 1/1 (S,G) entries in P[...]

776 | PIM Sparse-Mode www.dell.com | support.dell.com Figure 34-14. PIM-SM snooping: show ip mroute snooping Figure 34-15. PIM-SM snooping: show running-config Figure 34-16. PIM-SM snooping: show configuration FTOS# show ip mroute snooping IPv4 Multicast Snooping Table (*, 224.0.0.0), uptime 17:46:23 Incoming vlan: Vlan 2 Outgoing interface list: G[...]

PIM Source-Specific Mode | 777 35 PIM Source-Specific Mode PIM Source-Specific Mode is supported on platforms: c e s PIM-SSM is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. PIM-Source-Specific Mode (PIM-SSM) is a multicast protocol that forwards multicast traffic from a single source to a subnet. In the other versions of[...]

778 | PIM Source-Specific Mode www.dell.com | support.dell.com Figure 35-1. PIM-SM with IGMPv2 versus PIM-SM with IGMPv3 R1 R2 R3 Source 2 10.11.1.2 Source 1 10.11.5.2 Receiver 2 10.11.4.2 Receiver 1 10.11.3.2 1/31 3/11 2/11 2/31 3/21 interface Vlan 300 ip pim sparse-mode ip address 10.11.3.1/24 untagged GigabitEthernet 1/1 no shutdown interface Gi[...]

PIM Source-Specific Mode | 779 Implementation Information • The Dell Force10 implementation of PIM-SSM is based on RFC 3569. • C-Series supports a maximum of 31 PIM interfaces and 4K multicast entries including (*,G), and (S,G) entries. There is no limit on the number of PIM neighbors C-Series can have. • S-Series supports a maximum of 31 PIM[...]

780 | PIM Source-Specific Mode www.dell.com | support.dell.com Enable PIM-SSM To enable PIM-SSM: Display address ranges in the PIM-SSM range using the command show [ ip | ipv6 ] pim ssm-range from EXEC Privilege mode. Figure 35-2. Enabling PIM-SSM Use PIM-SSM with IGMP version 2 Hosts PIM-SSM requires receivers that support IGMP version 3. You can [...]

PIM Source-Specific Mode | 781 • When an extended ACL is associated with this command, FTOS displays an error message. If you apply an extended ACL before you create it, FTOS accepts the configuration, but when the ACL is later defined, FTOS ignores the ACL and the stated mapping has no effect. Display the source to which a group is mapped using [...]

782 | PIM Source-Specific Mode www.dell.com | support.dell.com Figure 35-3. Using PIM-SM with IGMPv2 versus PIM-SSM with IGMPv2 R1 R2 R3 Source 2 10.11.1.2 Source 1 10.11.5.2 Receiver 2 10.11.4.2 Receiver 1 10.11.3.2 1/31 3/11 2/11 2/31 3/21 interface Vlan 300 ip pim sparse-mode ip address 10.11.3.1/24 untagged GigabitEthernet 1/1 no shutdown inter[...]

PIM Source-Specific Mode | 783 Figure 35-4. Configuring PIM-SSM with IGMPv2 R1(conf)#do show run pim ! ip pim rp-address 10.11.12.2 group-address 224.0.0.0/4 ip pim ssm-range ssm R1(conf)#do show run acl ! ip access-list standard map seq 5 permit host 239.0.0.2 ! ip access-list standard ssm seq 5 permit host 239.0.0.2 R1(conf)#ip igmp ssm-map map 1[...]

784 | PIM Source-Specific Mode www.dell.com | support.dell.com[...]

Power over Ethernet | 785 36 Power over Ethernet Power over Ethernet (PoE) is supported only on platforms: c s This chapter contains the following major sections: • Configuring Power over Ethernet on page 786 • Power Additional PoE Ports on the S-Series on page 794 • Deploying VOIP on page 795 FTOS supports Power over Ethernet (PoE), as descr[...]

786 | Power over Ethernet www.dell.com | support.dell.com For the C-Series, FTOS requires that a minimum number of AC power supplies (PSU) be installed before PoE can be enabled, and some PSUs are reserved for PoE redundancy, as described in Table 36-2 . On the C-Series, though each PSU used for PoE (units 4-7 on the C300, and 3-4 on the C150) prov[...]

Power over Ethernet | 787 Related Configuration Tasks • Manage Ports using Power Priority and the Power Budget on page 789 • Monitor the Power Budget on page 792 • Manage Power Priorities on page 792 • Recover from a Failed Power Supply on page 793 • Power Additional PoE Ports on the S-Series on page 794 Enabling PoE on a Port PoE is disa[...]

788 | Power over Ethernet www.dell.com | support.dell.com View the amount of power that a port is consuming using the show power inline command from EXEC privilege mode. Figure 36-2. PoE Allocation Displayed with show power inline Command Table 36-3 describes the fields that the show power inline command displays: View the total power consumption o[...]

Power over Ethernet | 789 Table 36-4 describes the fields that the show power detail command displays. Manage Ports using Power Priority and the Power Budget The allocation and return of power on ports depends on the total inline power available in the system and the power priority calculation. Determine the Power Priority for a Port FTOS uses a so[...]

790 | Power over Ethernet www.dell.com | support.dell.com power-inline priority , it breaks the tie using the third parameter, the LLDP-MED Priority advertised by the PD, which like power-inline priority could be “Critical,” “High,” or “Low”. After this, if FTOS still finds a tie, priority is based on the fourth parameter which is the p[...]

Power over Ethernet | 791 Determine the Affect of a Port on the Power Budget The PoE power budget is affected differently depending on how PoE is enabled and whether a device is connected: 1. When you configure a port with power inline auto without the max_milliwatts power limit option, power is only allocated after you connect a device to the port[...]

792 | Power over Ethernet www.dell.com | support.dell.com Monitor the Power Budget The power budget is the amount of power available from the installed PSUs minus the power required to operate the chassis. Use the show power inline (Figure 36-2 on page 788) and show power detail ( Figure 36-3 on page 788 ) commands to help you determine if power is[...]

Power over Ethernet | 793 You can augment the default prioritization using the command [ no ] power inline priority { critical | high | low }, where critical is the highest priority, and low is the lowest. FTOS ignores any LLDP-MED priority on this port if you configure a priority with this command. If you do not configure a port priority with this[...]

794 | Power over Ethernet www.dell.com | support.dell.com Figure 36-5. Order of PoE Termination For the configuration in Figure 36-2 : • Power for ports 7/1 and 7/2 is terminated first because it is configured with inline power auto . • Power for port 7/2 is terminated before PoE for port 7/1 because port 7/1 has a lower port number. • Power [...]

Power over Ethernet | 795 Deploying VOIP VoIP phones on the market today follow the same basic boot and operations process: 1. Wait for an LLDP from the Ethernet switch. 2. Obtain an IP address from a DHCP server. 3. Send an LLDP-MED frame to the switch. 4. Wait for an LLDP-MED frame from the switch and read the Network Policy TLV to get the VLAN I[...]

796 | Power over Ethernet www.dell.com | support.dell.com Figure 36-8. Creating VLANs for an Office VOIP Deployment Configure LLDP-MED for an Office VOIP Deployment VOIP deployments may optionally use LLDP-MED. LLDP-MED advertises VLAN, dot1P, and DSCP configurations on the switch so that you do not need to manually configure every phone with this [...]

Power over Ethernet | 797 Configure Quality of Service for an Office VOIP Deployment There are multiple ways you can use QoS to map ingress phone and PC traffic so that you can give them each a different quality of service. See Chapter 41, Quality of Service . Honor the incoming DSCP value On both the C-Series or S-Series, if you know traffic origi[...]

798 | Power over Ethernet www.dell.com | support.dell.com Classifying VOIP traffic and applying QoS policies Avoid congestion and give precedence to voice and signaling traffic by classifying traffic based on subnet and using strict priority and bandwidth weights on egress, as outlined in the steps below. Figure 36-12 depicts the topology and shows[...]

Power over Ethernet | 799 Figure 36-13. Classifying VOIP Traffic and Applying QoS Policies for an Office VOIP Deployment FTOS#sh run acl ! ip access-list extended pc-subnet seq 5 permit ip 201.1.1.0/24 any ! ip access-list extended phone-signalling seq 5 permit ip 192.1.1.0/24 host 192.1.1.1 ! ip access-list extended phone-subnet seq 5 permit ip 19[...]

800 | Power over Ethernet www.dell.com | support.dell.com[...]

Policy-based Routing | 801 37 Policy-based Routing Policy-based Routing is supported on platforms: c e s PBR is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. PBR is supported on the E-Series TeraScale, C-Series, and S-Series platforms in FTOS 8.4.2.0 and later. This chapter covers the following topics: • Overview • Im[...]

802 | Policy-based Routing www.dell.com | support.dell.com Figure 37-1. PBR Example To enable a PBR, you create a Redirect List. Redirect lists are defined by rules, or routing policies. The following parameters can be defined in the routing policies or rules: • IP address of the forwarding router (next-hop IP address) • Protocol as defined in [...]

Policy-based Routing | 803 2. If the specified next-hops are not reachable, then the normal routing table is used to forward the traffic. 3. FTOS supports multiple next-hop entries in the redirect lists. 4. Redirect-Lists are applied at Ingress. Implementing Policy-based Routing with FTOS Non-contiguous bitmasks for PBR Non-contiguous bitmasks for [...]

804 | Policy-based Routing www.dell.com | support.dell.com Configuration Task List for Policy-based Routing To enable the PBR: 1. Create a Redirect List 2. Create a Rule for a Redirect-list 3. Apply a Redirect-list to an Interface using a Redirect-group Create a Redirect List Use the following command in CONFIGURATION mode: The following example cr[...]

Policy-based Routing | 805 Create a Rule for a Redirect-list Use the following command in CONFIGURATION REDIRECT-LIST mode to set the rules for the redirect list. You can enter the command multiple times and create a sequence of redirect rules. Use the seq nn redirect version of the command to organize your rules . Figure 37-4 shows a step-by-step [...]

806 | Policy-based Routing www.dell.com | support.dell.com Figure 37-4. Creating a Rule Example Multiple rules can be applied to a single redirect-list. The rules are applied in ascending order, starting with the rule that has the lowest sequence number in a redirect-list. Figure 37-5 displays the correct method for applying multiple rules to one l[...]

Policy-based Routing | 807 PBR Exceptions (Permit) Use the command permit to create an exception to a redirect list. Exceptions are used when a forwarding decision should be based on the routing table rather than a routing policy. FTOS assigns the first available sequence number to a rule configured without a sequence number and inserts the rule in[...]

808 | Policy-based Routing www.dell.com | support.dell.com Apply a Redirect-list to an Interface using a Redirect-group IP redirect lists are supported on physical interfaces as well as VLAN and port-channel interfaces. Use the following command in INTERFACE mode to apply a redirect list to an interface. Multiple redirect-lists can be applied to a [...]

Policy-based Routing | 809 Show Redirect List Configuration To view the configuration redirect list configuration, use the following command in EXEC mode: List the redirect list configuration using the show ip redirect-list redirect-list-name command. The non-contiguous mask is displayed in dotted format (x.x.x.x). The contiguous mask is displayed [...]

810 | Policy-based Routing www.dell.com | support.dell.com Figure 37-12. Showing CAM PBR Configuration Example Sample Configuration The following configuration is an example for setting up a PBR. These are not comprehensive directions. They are intended to give you a some guidance with typical configurations. You can copy and paste from these examp[...]

Policy-based Routing | 811 Figure 37-13. PBR Sample Illustration Customer Support 192.168.1.0 /24 192.168.2.0 /24 45 Mbps 1.5 Mbps 10 Mbps Internet 10.0.0.0 /16 10.1.0.0 /16 GigE 2/11 10.22.22.100 10.44.44.13 EDGE_ROUTER[...]

812 | Policy-based Routing www.dell.com | support.dell.com Figure 37-14. PBR Sample Configuration Create the Redirect-List GOLD. EDGE_ROUTER(conf-if-gi-3/23)#ip redirect-list GOLD EDGE_ROUTER(conf-redirect-list)#description Route GOLD traffic to ISP_GOLD. EDGE_ROUTER(conf-redirect-list)#$direct 10.99.99.254 ip 192.168.1.0/24 any EDGE_ROUTER(conf-re[...]

Port Monitoring | 813 38 Port Monitoring Port Monitoring is supported on platforms: c e s Port Monitoring is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Port Monitoring is a feature that copies all incoming or outgoing packets on one port and forwards (mirrors) them to another port. The source port is the monitored port[...]

814 | Port Monitoring www.dell.com | support.dell.com • A source port (MD) can only be monitored by one destination port (MG). The following error is displayed if you try to assign a monitored port to more than one monitoring port. FTOS(conf)#mon ses 1 FTOS(conf-mon-sess-1)#$gig 0/0 destination gig 0/60 direction both FTOS(conf-mon-sess-1)#do sho[...]

Port Monitoring | 815 E-Series TeraScale The E-Series TeraScale system supports 1 monitoring session per port-pipe. E-Series TeraScale supports a maximum of 28 port pipes. On the E-Series TeraScale, FTOS supports a single source-destination statement in a monitor session ( Message 2 ). E-Series TeraScale supports only one source and one destination[...]

816 | Port Monitoring www.dell.com | support.dell.com Port Monitoring on C-Series and S-Series The C-Series and S-Series support multiple source-destination statements in a monitor session, but there may only be one destination port in a monitoring session ( Message 4 ). The number of source ports FTOS allows within a port-pipe is equal to the numb[...]

Port Monitoring | 817 Figure 38-3. Number of Monitoring Ports on the C-Series and S-Series In Figure 38-4 , 0/25 and 0/26 belong to Port-pipe 1. This port-pipe again has the same restriction of only four destination ports, new or used. Figure 38-4. Number of Monitoring Ports on the C-Series and S-Series A source port may only be monitored by one de[...]

818 | Port Monitoring www.dell.com | support.dell.com Figure 38-5. Port Monitoring Configurations on the C-Series and S-Series FTOS Behavior: On the C-Series and S-Series, all monitored frames are tagged if the configured monitoring direction is transmit (TX), regardless of whether the monitored port (MD) is a Layer 2 or Layer 3 port. If the MD por[...]

Port Monitoring | 819 Configuring Port Monitoring To configure port monitoring: Display monitor sessions using the command show monitor session from EXEC Privilege mode, as shown in Figure 38-6 . Figure 38-6. Configuring Port-based Monitoring In Figure 38-7 , the host and server are exchanging traffic which passes through interface gigabitethernet [...]

820 | Port Monitoring www.dell.com | support.dell.com Figure 38-7. Port Monitoring Example Flow-based Monitoring Flow-based Monitoring is supported only on platform e Flow-based monitoring conserves bandwidth by monitoring only specified traffic instead all traffic on the interface. This feature is particularly useful when looking for malicious tra[...]

Port Monitoring | 821 Figure 38-8. Configuring Flow-based Monitoring Remote Port Mirroring Remote Port Mirroring is supported on platforms: e x . While local port monitoring allows you to monitor traffic from one or more source ports by directing it to a destination port on the same switch/router, remote port mirroring allows you to monitor Layer 2[...]

822 | Port Monitoring www.dell.com | support.dell.com Remote port mirroring uses the analyzers shown in the aggregation network in Site A. The VLAN traffic on monitored links from the access network is tagged and assigned to a dedicated L2 VLAN. Monitored links are configured in two source sessions shown with orange and green circles. Each source s[...]

Port Monitoring | 823 • You can configure any switch in the network with source ports and destination ports, and allow it to function in an intermediate transport session for a reserved VLAN at the same time for multiple remote-port mirroring sessions. You can enable and disable individual mirroring sessions. • BPDU monitoring is not required t[...]

824 | Port Monitoring www.dell.com | support.dell.com - The VLAN consists of more than 128 ports. - You add a port to a VLAN, which has already been configured in a source session, and the newly added port exceeds the 128-port limit. - You configure a range of VLANs in a source session and the combined number of ports in the VLANs exceeds 128. • [...]

Port Monitoring | 825 To remove the remote-port mirroring assignment from a VLAN, enter the no mode remote-port-mirroring command. Configure a dedicated L2 VLAN for Remote Port Mirroring Step Command Syntax Command Mode Task 1 interface vlan vlan-id CONFIGURATION Create a VLAN to transport mirrored traffic in remote port mirroring. Valid vlan-id va[...]

826 | Port Monitoring www.dell.com | support.dell.com To delete one or more source ports or source VLANs from a mirroring session, enter the no source destination remote-vlan vlan-id command, specifying the ports to be deleted in the command syntax. To change the reserved L2 VLAN used in a source session, you can delete the session ( no monitor ses[...]

Port Monitoring | 827 To delete one or more destination ports from a destination session, enter the no source remote-vlan vlan-id destination command. To change the reserved L2 VLAN used in the destination session, you must first remove all destination ports. Then delete the current VLAN by entering the no monitor session session-id source remote-v[...]

828 | Port Monitoring www.dell.com | support.dell.com Displaying Remote-Port Mirroring Configurations To display the current configuration of remote port mirroring for a specified session, enter the show config command in MONITOR SESSION configuration mode. To display the currently configured source and destination sessions for remote port mirrorin[...]

Port Monitoring | 829 Sample Configuration: Remote Port Mirroring Remote port mirroring requires a source session (monitored ports on different source switches), a reserved tagged VLAN for transporting mirrored traffic (configured on source, intermediate, and destination switches), and a destination session (destination ports connected to analyzers[...]

830 | Port Monitoring www.dell.com | support.dell.com Figure 38-12 shows a sample configuration of remote port mirroring on a destination switch. Note that in the show monitor session output of a destination session, the source is the reserved VLAN (for example, remote-vlan 22) and the destination is the destination port (for example, Gi 4/73) to w[...]

Private VLANs | 831 39 Private VLANs Private VLANs is available on platforms: c s Private VLANs (PVLANs) provide Layer 2 isolation between ports within the same VLAN. That is, peer-to-peer communication is restricted or blocked. This is done by dividing the VLAN, into subdomains, and then restricting or blocking traffic flow between them. The VLAN [...]

832 | Private VLANs www.dell.com | support.dell.com There are three types of ports in PVLAN: • Host Ports —these ports are the ones that Private VLAN aims to isolate. They are connected to end-stations. • Promiscuous Ports —these ports are members of the primary VLAN, and function as gateways to the primary and secondary VLANs. • Trunk Po[...]

Private VLANs | 833 Related Configuration Tasks • Private VLAN show Commands on page 834 Configure PVLAN Ports You must assign switchports a PVLAN Port role—host, promiscuous, or trunk—before you can add them to a primary or secondary VLAN. • Host ports may not be a part of a non-private (regular) VLAN. • Promiscuous ports may be a member[...]

834 | Private VLANs www.dell.com | support.dell.com Place the Secondary VLANs in a Primary VLAN A primary VLAN is a port-based VLAN that is specifically designated as a private VLAN. Doing so enables the VLAN to be divided into secondary VLANs. Private VLAN show Commands Step Task Command Syntax Command Mode 1 Access INTERFACE VLAN mode for the VLA[...]

Per-VLAN Spanning Tree Plus | 835 40 Per-VLAN Spanning Tree Plus Per-VLAN Spanning Tree Plus is supported platforms: c e s Port Monitoring is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Per-VLAN Spanning Tree Plus (PVST+) is a variation of Spanning Tree—developed by a third party— that allows you t[...]

836 | Per-VLAN Spanning Tree Plus www.dell.com | support.dell.com FTOS supports three other variations of Spanning Tree, as shown in Table 40-1 . Implementation Information • The FTOS implementation of PVST+ is based on IEEE Standard 802.1d. • The FTOS implementation of PVST+ uses IEEE 802.1s costs as the default costs ( Table 40-2 ). Other imp[...]

Per-VLAN Spanning Tree Plus | 837 Enable PVST+ When you enable PVST+, FTOS instantiates STP on each active VLAN. To enable PVST+ globally: Disable PVST+ Display your PVST+ configuration by entering the command show config from PROTOCOL PVST context, as shown in fig. Figure 40-2. Display the PVST+ Configuration Influence PVST+ Root Selection In Figu[...]

838 | Per-VLAN Spanning Tree Plus www.dell.com | support.dell.com Figure 40-3. Load Balancing with PVST+ The bridge with the bridge value for bridge priority is elected root. Since all bridges use the default priority (until configured otherwise), lowest MAC address is used as a tie-breaker. Assign bridges a low non-default value for bridge priorit[...]

Per-VLAN Spanning Tree Plus | 839 Figure 40-4. Display the PVST+ Forwarding Topology Force10_E600(conf)#do show spanning-tree pvst vlan 100 VLAN 100 Root Identifier has priority 4096, Address 0001.e80d.b6d6 Root Bridge hello time 2, max age 20, forward delay 15 Bridge Identifier has priority 4096, Address 0001.e80d.b6d6 Configured hello time 2, max[...]

840 | Per-VLAN Spanning Tree Plus www.dell.com | support.dell.com Modify Global PVST+ Parameters The root bridge sets the values for forward-delay, and hello-time and overwrites the values set on other PVST+ bridges. • Forward-delay is the amount of time an interface waits in the Listening State and the Learning State before it transitions to the[...]

Per-VLAN Spanning Tree Plus | 841 Table 40-2 lists the default values for port cost by interface. To change the port cost or priority of an interface: The values for interface PVST+ parameters are given in the output of the command show spanning-tree pvst , as shown in Figure 40-4 . Configure an EdgePort The EdgePort feature enables interfaces to b[...]

842 | Per-VLAN Spanning Tree Plus www.dell.com | support.dell.com To enable EdgePort on an interface, use the following command: The EdgePort status of each interface is given in the output of the command show spanning-tree pvst , as shown in Figure 40-4 . Task Command Syntax Command Mode Enable EdgePort on an interface. spanning-tree pvst edge-por[...]

Per-VLAN Spanning Tree Plus | 843 Configure a Root Guard Use the Root Guard feature in a Layer 2 PVST+ network to avoid bridging loops. You enable root guard on a per-port or per-port-channel basis. To enable a root guard on a PVST-enabled port or port-channel interface, enter the spanning-tree pvst rootguard command. Refer to STP Root Guard on pag[...]

844 | Per-VLAN Spanning Tree Plus www.dell.com | support.dell.com Configure a Loop Guard The Loop Guard feature provides protection against Layer 2 forwarding loops (STP loops) caused by a hardware failure, such as a cable failure or an interface fault. When a cable or interface fails, a participating STP link may become unidirectional (STP require[...]

Per-VLAN Spanning Tree Plus | 845 PVST+ in Multi-vendor Networks Some non-Dell Force10 systems which have hybrid ports participating in PVST+ transmit two kinds of BPDUs: an 802.1D BPDU and an untagged PVST+ BPDU. Dell Force10 systems do not expect PVST+ BPDU (tagged or untagged) on an untagged port. If this happens, FTOS places the port in error-d[...]

846 | Per-VLAN Spanning Tree Plus www.dell.com | support.dell.com Displaying STP Guard Configuration To verify the STP guard configured on PVST interfaces, enter the show spanning-tree pvst [ vlan vlan-id ] guard command. Refer to Chapter 52, “Spanning Tree Protocol,” on page 1049 for information on how to configure and use the STP root guard, [...]

Per-VLAN Spanning Tree Plus | 847 PVST+ Sample Configurations Figure 40-7 , Figure 40-8 , and Figure 40-9 provide the running configurations for the topology shown in Figure 40-3 . Figure 40-7. PVST+ Sample Configuration: R1 Running-configuration interface GigabitEthernet 1/22 no ip address switchport no shutdown ! interface GigabitEthernet 1/32 no[...]

848 | Per-VLAN Spanning Tree Plus www.dell.com | support.dell.com Figure 40-8. PVST+ Sample Configuration: R2 Running-configuration Figure 40-9. PVST+ Sample Configuration: R3 Running-configuration interface GigabitEthernet 2/12 no ip address switchport no shutdown ! interface GigabitEthernet 2/32 no ip address switchport no shutdown ! interface Vl[...]

Quality of Service | 849 41 Quality of Service Quality of Service (QoS) is supported on platforms: c e s Differentiated service is accomplished by classifying and queuing traffic, and assigning priorities to those queues. The E-Series has eight unicast queues per port and 128 multicast queues per-port pipe. Traffic is queued on ingress and egress. [...]

850 | Quality of Service www.dell.com | support.dell.com Create an input QoS policy c e s Ingress Configure policy-based rate policing c e s Set a DSCP value for egress packets c e s Set a dot1p value for egress packets c e s Create an output QoS policy c e s Egress Configure policy-based rate limiting e Configure policy-based rate shaping c e s Al[...]

Quality of Service | 851 Figure 41-1. Dell Force10 QoS Architecture Implementation Information Dell Force10 QoS implementation complies with IEEE 802.1p User Priority Bits for QoS Indication . It also implements these Internet Engineering Task Force (IETF) documents: • RFC 2474, Definition of the Differentiated Services Field (DS Field) in the IP[...]

852 | Quality of Service www.dell.com | support.dell.com Port-based QoS Configurations You can configure the following QoS features on an interface: • Set dot1p Priorities for Incoming Traffic on page 852 • Configure Port-based Rate Policing on page 854 • Configure Port-based Rate Limiting on page 855 • Configure Port-based Rate Shaping on [...]

Quality of Service | 853 Honor dot1p Priorities on Ingress Traffic By default FTOS does not honor dot1p priorities on ingress traffic. Use the command service-class dynamic dot1p from INTERFACE mode to honor dot1p priorities on ingress traffic, as shown in Figure 41-3 . You can configure this feature on physical interfaces and port-channels, but yo[...]

854 | Quality of Service www.dell.com | support.dell.com Configure Port-based Rate Policing Rate policing ingress traffic on an interface using the command rate police from INTERACE mode, as shown in Figure 41-4 . If the interface is a member of a VLAN, you may specify the VLAN for which ingress packets are policed. Figure 41-4. Rate Policing Ingre[...]

Quality of Service | 855 Configure Port-based Rate Limiting Configure Port-based Rate Limiting is supported only on platform e Rate limit egress traffic on an interface using the command rate limit from INTERFACE mode, as shown in Figure 41-6 . If the interface is a member of a VLAN, you may specify the VLAN for which egress packets are rate limite[...]

856 | Quality of Service www.dell.com | support.dell.com Configure Port-based Rate Shaping Rate shaping buffers, rather than drops, traffic exceeding the specified rate until the buffer is exhausted. If any stream exceeds the configured bandwidth on a continuous basis, it can consume all of the buffer space that is allocated to the port. Apply rate[...]

Quality of Service | 857 Policy-based QoS Configurations Policy-based QoS configurations consist of the components shown in Figure 41-9 . Figure 41-9. Constructing Policy-based QoS Configurations Classify Traffic Class maps differentiate traffic so that you can apply separate quality of service policies to each class. For both class maps, Layer 2 a[...]

858 | Quality of Service www.dell.com | support.dell.com 2. Once you create a class-map, FTOS places you in CLASS MAP mode. From this mode, specify your match criteria using the command match ip , as shown in Figure 41-10 . Match-any class maps allow up to five ACLs, and match-all class-maps allow only one ACL. 3. After you specify your match crite[...]

Quality of Service | 859 Determine the order in which ACLs are used to classify traffic When you link class-maps to queues using the command service-queue , FTOS matches the class-maps according to queue priority (queue numbers closer to 0 have lower priorities). For example, in Figure 41-10 , class-map cmap2 is matched against ingress packets befo[...]

860 | Quality of Service www.dell.com | support.dell.com FTOS Behavior: An explicit “deny any" rule in a Layer 3 ACL used in a (match any or match all) class-map creates a "default to Queue 0" entry in the CAM, which causes unintended traffic classification. Below, traffic is classified in two Queues, 1 and 2. Class-map ClassAF1 is[...]

Quality of Service | 861 Create a QoS Policy There are two types of QoS policies: input and output. Input QoS policies regulate Layer 3 and Layer 2 ingress traffic. The regulation mechanisms for input QoS policies are rate policing and setting priority values. There are two types of input QoS policies: Layer 3 and Layer 2. • Layer 3 QoS input pol[...]

862 | Quality of Service www.dell.com | support.dell.com Figure 41-12. Marking DSCP Values for Egress Packets Set a dot1p value for egress packets Set a dot1p value for egress packets using the command set mac-dot1p from QOS-POLICY-IN mode. Create an output QoS policy To create an output QoS policy: 1. Create an output QoS policy using the command [...]

Quality of Service | 863 Configure policy-based rate shaping Rate shape egress traffic using the command rate-shape from QOS-POLICY-OUT mode. Output QoS policy can be applied to an output policy map with a policy aggregate or to an specific queue. Per queue rate shaping is supported on C-Series and S-Series only; see Create Output Policy Maps on pa[...]

864 | Quality of Service www.dell.com | support.dell.com Table 41-4 shows an example of choosing bandwidth weights for all four queues to achieve a target bandwidth allocation. Specify WRED drop precedence Specify WRED drop precedence is supported only on platform e Specify a WRED profile to yellow and/or green traffic using the command wred from Q[...]

Quality of Service | 865 Apply an input QoS policy to an input policy map Apply an input QoS policy to an input policy map using the command policy-aggregate from POLICY-MAP-IN mode. Honor DSCP values on ingress packets FTOS provides the ability to honor DSCP values on ingress packets using Trust DSCP feature. Enable this feature using the command [...]

866 | Quality of Service www.dell.com | support.dell.com Honoring dot1p values on ingress packets FTOS provides the ability to honor dot1p values on ingress packets with the Trust dot1p feature. Enable Trust dot1p using the command trust dot1p from POLICY-MAP-IN mode. Table 41-6 specifies the queue to which the classified traffic is sent based on t[...]

Quality of Service | 867 In the following configuration, packets are classified to queues using the three class maps: ! policy-map-input input-policy service-queue 1 class-map qos-BE1 service-queue 3 class-map qos-AF3 service-queue 4 class-map qos-AF4 ! class-map match-any qos-AF3 match ip dscp 24 match ip access-group qos-AF3-ACL ! class-map match[...]

868 | Quality of Service www.dell.com | support.dell.com On the C-Series and S-Series all traffic is by default mapped to the same queue, Queue 0. If you honor dot1p on ingress, then you can create service classes based the queueing strategy in Table 41-6 using the command service-class dynamic dot1p from INTERFACE mode. You may apply this queuing [...]

Quality of Service | 869 Specify an aggregate QoS policy Specify an aggregate QoS policy using the command policy-aggregate from POLICY-MAP-OUT mode. Apply an output policy map to an interface Apply an input policy map to an interface using the command service-policy output from INTERFACE mode. You can apply the same policy map to multiple interfac[...]

870 | Quality of Service www.dell.com | support.dell.com Strict-priority Queueing You can assign strict-priority to one unicast queue, 1-7, using the command strict-priority from CONFIGURATION mode. Strict-priority means that FTOS dequeues all packets from the assigned queue before servicing any other queues. • The strict-priority supersedes band[...]

Quality of Service | 871 You can create a custom WRED profile or use on of the five pre-defined profiles listed in Table 41-7 . Create WRED Profiles To create a WRED profile: 1. Create a WRED profile using the command wred from CONFIGURATION mode. 2. The command wred places you in WRED mode. From this mode, specify minimum and maximum threshold val[...]

872 | Quality of Service www.dell.com | support.dell.com WRED can be used in combination with storm control to regulate broadcast and unknown-unicast traffic. This feature is available through an additional option in command storm-control [ broadcast | unknown-unicast ] at CONFIGURATION. See the FTOS Command Line Reference for information on using [...]

Quality of Service | 873 Figure 41-15. show qos statistics Command Example Allocating Bandwidth to Multicast Queues Allocating Bandwidth to Multicast Queues is supported on platform: e The E-Series has 128 multicast queues per port-pipe, which are transparent, and eight unicast queues per port. You can allocate a specific bandwidth percentage per p[...]

874 | Quality of Service www.dell.com | support.dell.com For example, if you configure 70% bandwidth to multicast, 80% bandwidth to one queue in unicast and 0 % to all remaining unicast queues, then first, FTOS assigns 70% bandwidth to multicast, then FTOS derives the 80% bandwidth for unicast from the remaining 30% of total bandwidth. Pre-calculat[...]

Quality of Service | 875 • Status indicates whether or not the specified policy-map can be completely applied to an interface in the port-pipe. • Allowed indicates that the policy-map can be applied because the estimated number of CAM entries is less or equal to the available number of CAM entries. The number of interfaces in the port-pipe to w[...]

876 | Quality of Service www.dell.com | support.dell.com[...]

Routing Information Protocol | 877 42 Routing Information Protocol Routing Information Protocol is supported only on platforms: c e s RIP is supported on the S-Series following the release of FTOS version 7.8.1.0, and on the C-Series with FTOS versions 7.6.1.0 and after. RIP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later[...]

878 | Routing Information Protocol www.dell.com | support.dell.com RIP must receive regular routing updates to maintain a correct routing table. Response messages containing a router’s full routing table are transmitted every 30 seconds. If a router does not send an update within a certain amount of time, the hop count to that route is changed to[...]

Routing Information Protocol | 879 Configuration Task List for RIP • Enable RIP globally on page 879 (mandatory) • Configure RIP on interfaces on page 880 (optional) • Control RIP routing updates on page 881 (optional) • Set send and receive version on page 882 (optional) • Generate a default route on page 884 (optional) • Control route[...]

880 | Routing Information Protocol www.dell.com | support.dell.com When the RIP process has learned the RIP routes, use the show ip rip database command in the EXEC mode to view those routes (Figure 385) . Figure 42-2. show ip rip database Command Example (Partial) To disable RIP globally, use the no router rip command in the CONFIGURATION mode. Co[...]

Routing Information Protocol | 881 Control RIP routing updates By default, RIP broadcasts routing information out all enabled interfaces, but you can configure RIP to send or to block RIP routing information, either from a specific IP address or a specific interface. To control which devices or interfaces receive routing updates, you must configure[...]

882 | Routing Information Protocol www.dell.com | support.dell.com To add routes from other routing instances or protocols, use any of the following commands in the ROUTER RIP mode: To view the current RIP configuration, use the show running-config command in the EXEC mode or the show config command in the ROUTER RIP mode. Set send and receive vers[...]

Routing Information Protocol | 883 Figure 42-3 shows an example of the RIP configuration after the ROUTER RIP mode version command is set to RIPv2. When the ROUTER RIP mode version command is set, the interface (GigabitEthernet 0/0) participating in the RIP process is also set to send and receive RIPv2. Figure 42-3. show ip protocols Command Exampl[...]

884 | Routing Information Protocol www.dell.com | support.dell.com Figure 42-5. show ip protocols Command Example Generate a default route Traffic is forwarded to the default route when the traffic’s network is not explicitly listed in the routing table. Default routes are not enabled in RIP unless specified. Use the default-information originate[...]

Routing Information Protocol | 885 If you must perform routing between discontiguous subnets, disable automatic summarization. With automatic route summarization disabled, subnets are advertised. The command autosummary requires no other configuration commands. To disable automatic route summarization, in the ROUTER RIP mode, enter no autosummary .[...]

886 | Routing Information Protocol www.dell.com | support.dell.com To enable RIP debugging, use the following command in the EXEC privilege mode: Figure 42-6 shows the confirmation when the debug function is enabled. Figure 42-6. debug ip rip Command Example To disable RIP, use the no debug ip rip command. RIP Configuration Example The example in t[...]

Routing Information Protocol | 887 Configuring RIPv2 on Core 2 Figure 42-8. Configuring RIPv2 on Core 2 Core 2 Output The screenshots in this section are: • Figure 42-9 : Using show ip rip database command to display Core 2 RIP database • Figure 42-10 : Using show ip route command to display Core 2 RIP setup • Figure 42-11 : Using show ip pro[...]

888 | Routing Information Protocol www.dell.com | support.dell.com Figure 42-10. Using show ip route Command to Show RIP Configuration on Core 2 Figure 42-11. Using show ip protocols Command to Show RIP Configuration Activity on Core 2 Core2#show ip route Codes: C - connected, S - static, R - RIP, B - BGP, IN - internal BGP, EX - external BGP,LO - [...]

Routing Information Protocol | 889 RIP Configuration on Core 3 Figure 42-12. RIP Configuration on Core 3 Core 3 RIP Output The screenshots in this section are: • Figure 42-13 : Using show ip rip database command to display Core 3 RIP database • Figure 42-14 : Using show ip route command to display Core 3 RIP setup • Figure 42-15 : Using show [...]

890 | Routing Information Protocol www.dell.com | support.dell.com Figure 42-14. Using show ip routes for Core 3 RIP Setup Figure 42-15. Using show ip protocols Command to Show RIP Configuration Activity on Core 3 Core3#show ip routes Codes: C - connected, S - static, R - RIP, B - BGP, IN - internal BGP, EX - external BGP,LO - Locally Originated, O[...]

Routing Information Protocol | 891 RIP Configuration Summary Figure 42-16. Summary of Core 2 RIP Configuration Using Output of show run Command Figure 42-17. Summary of Core 3 RIP Configuration Using Output of show run Command ! interface GigabitEthernet 2/11 ip address 10.11.10.1/24 no shutdown ! interface GigabitEthernet 2/31 ip address 10.11.20.[...]

892 | Routing Information Protocol www.dell.com | support.dell.com[...]

Remote Monitoring | 893 43 Remote Monitoring Remote Monitoring is supported on platform c e s Remote Monitoring is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. This chapter describes the Remote Monitoring (RMON): • Implementation on page 893 • Fault Recovery on page 894 Remote Monitoring (RMON) is an industry-standar[...]

894 | Remote Monitoring www.dell.com | support.dell.com Fault Recovery RMON provides the following fault recovery functions: Interface Down —When an RMON-enabled interface goes down, monitoring continues. However, all data values are registered as 0xFFFFFFFF (32 bits) or ixFFFFFFFFFFFFFFFF (64 bits). When the interface comes back up, RMON monitor[...]

Remote Monitoring | 895 Set rmon alarm To set an alarm on any MIB object, use the rmon alarm or rmon hc-alarm command in GLOBAL CONFIGURATION mode. To disable the alarm, use the no form of this command: The following example configures an RMON alarm using the rmon alarm command. Command Syntax Command Mode Purpose [no] rmon alarm number variable in[...]

896 | Remote Monitoring www.dell.com | support.dell.com Figure 43-1. rmon alarm Command Example The above example configures RMON alarm number 10. The alarm monitors the MIB variable 1.3.6.1.2.1.2.2.1.20.1 (ifEntry.ifOutErrors) once every 20 seconds until the alarm is disabled, and checks the rise or fall of the variable. The alarm is triggered whe[...]

Remote Monitoring | 897 Figure 43-2. rmon event Command Example The above configuration example creates RMON event number 1, with the description “High ifOutErrors”, and generates a log entry when the event is triggered by an alarm. The user nms1 owns the row that is created in the event table by this command. This configuration also generates [...]

898 | Remote Monitoring www.dell.com | support.dell.com Configure RMON collection history To enable the RMON MIB history group of statistics collection on an interface, use the rmon collection history command in interface configuration mode. To remove a specified RMON history group of statistics collection, use the no form of this command. Enable a[...]

Rapid Spanning Tree Protocol | 899 44 Rapid Spanning Tree Protocol Rapid Spanning Tree Protocol is supported on platforms: c e s RSTP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Rapid Spanning Tree Protocol (RSTP) is a Layer 2 protocol—specified by IEEE 802.1w—that is essentially the same as Spa[...]

900 | Rapid Spanning Tree Protocol www.dell.com | support.dell.com • Modify Interface Parameters on page 906 • Configure an EdgePort on page 906 • Preventing Network Disruptions with BPDU Guard on page 1057 • Influence RSTP Root Selection on page 908 • Configuring Spanning Trees as Hitless on page 1064 • Fast Hellos for Link State Detec[...]

Rapid Spanning Tree Protocol | 901 To configure the interfaces for Layer 2 and then enable them: Verify that an interface is in Layer 2 mode and enabled using the show config command from INTERFACE mode. Figure 44-2. Verifying Layer 2 Configuration Enable Rapid Spanning Tree Protocol Globally Rapid Spanning Tree Protocol must be enabled globally on[...]

902 | Rapid Spanning Tree Protocol www.dell.com | support.dell.com Figure 44-3. Verifying RSTP is Enabled When you enable Rapid Spanning Tree, all physical and port-channel interfaces that are enabled and in Layer 2 mode are automatically part of the RST topology. • Only one path from any bridge to any other bridge is enabled. • Bridges block a[...]

Rapid Spanning Tree Protocol | 903 Figure 44-5. show spanning-tree rstp Command Example Confirm that a port is participating in Rapid Spanning Tree using the show spanning-tree rstp brief command from EXEC privilege mode. FTOS#show spanning-tree rstp Root Identifier has priority 32768, Address 0001.e801.cbb4 Root Bridge hello time 2, max age 20, fo[...]

904 | Rapid Spanning Tree Protocol www.dell.com | support.dell.com Figure 44-6. show spanning-tree rstp brief Command Example Add and Remove Interfaces • To add an interface to the Rapid Spanning Tree topology, configure it for Layer 2 and it is automatically added. If you previously disabled RSTP on the interface using the command no spanning-tr[...]

Rapid Spanning Tree Protocol | 905 Table 44-2 displays the default values for RSTP. To change these parameters, use the following commands, on the root bridge: View the current values for global parameters using the show spanning-tree rstp command from EXEC privilege mode. See Figure 44-5 . Table 44-2. RSTP Default Values RSTP Parameter Default Val[...]

906 | Rapid Spanning Tree Protocol www.dell.com | support.dell.com Modify Interface Parameters On interfaces in Layer 2 mode, you can set the port cost and port priority values. • Port cost is a value that is based on the interface type. The default values are listed in Table 44-2 . The greater the port cost, the less likely the port will be sele[...]

Rapid Spanning Tree Protocol | 907 Verify that EdgePort is enabled on a port using the show spanning-tree rstp command from the EXEC privilege mode or the show config command from INTERFACE mode; Dell Force10 recommends using the show config command, as shown in Figure 44-7 . Figure 44-7. EdgePort Enabled on Interface FTOS Behavior: Regarding bpdug[...]

908 | Rapid Spanning Tree Protocol www.dell.com | support.dell.com Influence RSTP Root Selection The Rapid Spanning Tree Protocol determines the root bridge, but you can assign one bridge a lower priority to increase the likelihood that it will be selected as the root bridge. To change the bridge priority, use the following command: A console messa[...]

Rapid Spanning Tree Protocol | 909 Fast Hellos for Link State Detection Fast Hellos for Link State Detection is available only on platform: s Use RSTP Fast Hellos to achieve sub-second link-down detection so that convergence is triggered faster. The standard RSTP link-state detection mechanism does not offer the same low link-state detection speed.[...]

910 | Rapid Spanning Tree Protocol www.dell.com | support.dell.com Configure a Root Guard Use the Root Guard feature in a Layer 2 RSTP network to avoid bridging loops. You enable root guard on a per-port or per-port-channel basis. To enable a root guard on an RSTP-enabled port or port-channel interface, enter the spanning-tree rstp rootguard comman[...]

Rapid Spanning Tree Protocol | 911 Configure a Loop Guard The Loop Guard feature provides protection against Layer 2 forwarding loops (STP loops) caused by a hardware failure, such as a cable failure or an interface fault. When a cable or interface fails, a participating STP link may become unidirectional (STP requires links to be bidirectional) an[...]

912 | Rapid Spanning Tree Protocol www.dell.com | support.dell.com Displaying STP Guard Configuration To verify the STP guard configured on RSTP port or port-channel interfaces, enter the show spanning-tree rstp guard command. Refer to Chapter 52, “Spanning Tree Protocol,” on page 1049 for information on how to configure and use the STP root gu[...]

Security | 913 45 Security Security features are supported on platforms c e s This chapter discusses several ways to provide access security to the Dell Force10 system. Platform-specific features are identified by the c , e or s icons (as shown below). Security features are supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. ?[...]

914 | Security www.dell.com | support.dell.com Configuration Task List for AAA Accounting The following sections present the AAA Accounting configuration tasks: • Enable AAA Accounting on page 914 (mandatory) • Suppress AAA Accounting for null username sessions on page 915 (optional) • Configure Accounting of EXEC and privilege-level command [...]

Security | 915 Suppress AAA Accounting for null username sessions When AAA Accounting is activated, the FTOS software issues accounting records for all users on the system, including users whose username string, because of protocol translation, is NULL. An example of this is a user who comes in on a line where the AAA Authentication login method-li[...]

916 | Security www.dell.com | support.dell.com No specific show command exists for TACACS+ accounting. To obtain accounting records displaying information about users currently logged in, perform the following task in Privileged EXEC mode: Figure 45-1. show accounting Command Example for AAA Accounting Command Syntax Command Mode Purpose show accou[...]

Security | 917 AAA Authentication FTOS supports a distributed client/server system implemented through Authentication, Authorization, and Accounting (AAA) to help secure networks against unauthorized access. In the Dell Force10 implementation, the Dell Force10 system acts as a RADIUS or TACACS+ client and sends authentication requests to a central [...]

918 | Security www.dell.com | support.dell.com Configure AAA Authentication login methods To configure an authentication method and method list, use these commands in the following sequence in the CONFIGURATION mode: To view the configuration, use the show config command in the LINE mode or the show running-config in the EXEC Privilege mode. You ca[...]

Security | 919 Enable AAA Authentication To enable AAA authentication, use the following command in the CONFIGURATION mode: If the default list is not set, only the local enable is checked. This has the same effect as issuing: aaa authentication enable default enable AAA Authentication—RADIUS To enable authentication from the RADIUS server, and u[...]

920 | Security www.dell.com | support.dell.com Server-side configuration TACACS+ : When using TACACS+, Dell Force10 sends an initial packet with service type SVC_ENABLE, and then, a second packet with just the password. The TACACS server must have an entry for username $enable$. RADIUS : When using RADIUS authentication, FTOS sends an authenticatio[...]

Security | 921 By default, commands in FTOS are assigned to different privilege levels. You can access those commands only if you have access to that privilege level. For example, to reach the protocol spanning-tree command, you must log in to the router, enter the enable command for privilege level 15 (this is the default level for the command) an[...]

922 | Security www.dell.com | support.dell.com Configure the enable password command To configure FTOS, you must use the enable command to enter the EXEC Privilege level 15. After entering the command, FTOS requests that you enter a password. Privilege levels are not assigned to passwords, rather passwords are assigned to a privilege level. A passw[...]

Security | 923 To assign commands and passwords to a custom privilege level, you must be in privilege level 15 and use these commands in the following sequence in the CONFIGURATION mode: To view the configuration, use the show running-config command in the EXEC Privilege mode. Figure 45-2 is an example of a configuration to allow a user “john” [...]

924 | Security www.dell.com | support.dell.com Figure 45-2. Configuring a Custom Privilege Level Figure 45-3 is a screen shot of the Telnet session for user “john”. The show privilege command output confirms that “john” is in privilege level 8. In the EXEC Privilege mode, “john” can access only the commands listed. In CONFIGURATION mode[...]

Security | 925 To specify a password for the terminal line, use the following commands, in any order, in the LINE mode: To view the password configured for a terminal, use the show config command in the LINE mode. Enable and disabling privilege levels Enter the enable or enable privilege-level command in the EXEC Privilege mode to set a user’s se[...]

926 | Security www.dell.com | support.dell.com RADIUS Authentication and Authorization FTOS supports RADIUS for user authentication (text password) at login and can be specified as one of the login authentication methods in the aaa authentication login command. When configuring AAA authorization, you can configure to limit the attributes of service[...]

Security | 927 79 RADIUS_EAP_MSG 80 RADIUS_MSG_AUTHENTICATOR 81 RADIUS_TUNNEL_PRIVATE_GROUP_ID 95 NAS_IPv6_ADDRESS RADIUS exec-authorization stores a user-shell profile and that is applied during user login. You may name the relevant named-lists with either a unique name or the default name. When authorization is enabled by the RADIUS server, the s[...]

928 | Security www.dell.com | support.dell.com Auto-command You can configure the system through the RADIUS server to automatically execute a command when you connect to a specific line. To do this, use the command auto-command . The auto-command is executed when the user is authenticated and before the prompt appears to the user. Set access to pri[...]

Security | 929 Apply the method list to terminal lines To enable RADIUS AAA login authentication for a method list, you must apply it to a terminal line. To configure a terminal line for RADIUS authentication and authorization, enter the following commands: Specify a RADIUS server host When configuring a RADIUS server host, you can set different co[...]

930 | Security www.dell.com | support.dell.com To specify multiple RADIUS server hosts, configure the radius-server host command multiple times. If multiple RADIUS server hosts are configured, FTOS attempts to connect with them in the order in which they were configured. When FTOS attempts to authenticate a user, the software connects with the RADI[...]

Security | 931 To view the configuration of RADIUS communication parameters, use the show running-config command in the EXEC Privilege mode. Monitor RADIUS To view information on RADIUS transactions, use the following command in the EXEC Privilege mode: TACACS+ FTOS supports Terminal Access Controller Access Control System (TACACS+ client, includin[...]

932 | Security www.dell.com | support.dell.com To select TACACS as the login authentication method, use these commands in the following sequence in the CONFIGURATION mode: To view the configuration, use the show config in the LINE mode or the show running-config tacacs+ command in the EXEC Privilege mode. If authentication fails using the primary m[...]

Security | 933 Figure 45-4. Failed Authentication Monitor TACACS+ To view information on TACACS+ transactions, use the following command in the EXEC Privilege mode: TACACS+ Remote Authentication and Authorization FTOS takes the access class from the TACACS+ server. Access class is the class of service that restricts Telnet access and packet sizes. [...]

934 | Security www.dell.com | support.dell.com Figure 45-5 demonstrates how to configure the access-class from a TACACS+ server. This causes the configured access-class on the VTY line to be ignored. If you have configured a deny10 ACL on the TACACS+ server, FTOS downloads it and applies it. If the user is found to be coming from the 10.0.0.0 subne[...]

Security | 935 To delete a TACACS+ server host, use the no tacacs-server host { hostname | ip-address } command. Command Authorization The AAA command authorization feature configures FTOS to send each configuration command to a TACACS server for authorization before it is added to the running configuration. By default, the AAA authorization comman[...]

936 | Security www.dell.com | support.dell.com FTOS supports both inbound and outbound SSH sessions using IPv4 or IPv6 addressing. Inbound SSH supports accessing the system through the management interface as well as through a physical Layer 3 interface. For details on command syntax, see the Security chapter in the FTOS Command Line Interface Refe[...]

Security | 937 Figure 45-6. Specifying an SSH version To disable SSH server functions, enter no ip ssh server enable . Using SCP with SSH to copy a software image To use Secure Copy (SCP) to copy a software image through an SSH connection from one switch to another, use the following procedure: This example shows the use of SCP and SSH to copy a so[...]

938 | Security www.dell.com | support.dell.com • ip ssh connection-rate-limit: Configure the maximum number of incoming SSH connections per minute. • ip ssh hostbased-authentication enable: Enable hostbased-authentication for the SSHv2 server. • ip ssh key-size: Configure the size of the server-generated RSA SSHv1 key. • ip ssh password-aut[...]

Security | 939 Figure 45-8. Enabling SSH Password Authentication RSA Authentication of SSH The following procedure authenticates an SSH client based on an RSA key using RSA authentication. This method uses SSH version 2: Host-based SSH Authentication Authenticate a particular host. This method uses SSH version 2. Step Task Command Syntax Command Mo[...]

940 | Security www.dell.com | support.dell.com To configure host-based authentication: Client-based SSH Authentication SSH from the chassis to the SSH client using using the command ssh ip_address . This method uses SSH version 1 or version 2. If the SSH port is a non-default value, use the command ip ssh server port number , to change the default [...]

Security | 941 Figure 45-12. Client-based SSH Authentication Troubleshooting SSH • You may not bind id_rsa.pub to RSA authentication while logged in via the console. In this case, Message 2 appears. • Host-based authentication must be enabled on the server (Dell Force10 system) and the client (Unix machine). Message 3 appears if you attempt to [...]

942 | Security www.dell.com | support.dell.com Trace Lists The Trace Lists feature is supported only on the E-Series: e You can log packet activity on a port to confirm the source of traffic attacking a system. Once the Trace list is enabled on the system, you view its traffic log to confirm the source address of the attacking traffic. In FTOS, Tra[...]

Security | 943 Since traffic passes through the filter in the order of the filter’s sequence, you can configure the trace list by first entering the TRACE LIST mode and then assigning a sequence number to the filter. To create a filter for packets with a specified sequence number, use these commands in the following sequence, starting in the CONF[...]

944 | Security www.dell.com | support.dell.com To create a filter for UDP packets with a specified sequence number, use these commands in the following sequence, starting in the CONFIGURATION mode: When you create the filters with a specific sequence number, you can create the filters in any order and the filters are placed in the correct order. Fi[...]

Security | 945 Figure 45-13. Trace list Using seq Command Example If you are creating a Trace list with only one or two filters, you can let FTOS assign a sequence number based on the order in which the filters are configured. FTOS assigns filters in multiples of 5. To configure a filter for a Trace list without a specified sequence number, use any[...]

946 | Security www.dell.com | support.dell.com Figure 45-14 illustrates a Trace list in which the sequence numbers were assigned by the software. The filters were assigned sequence numbers based on the order in which they were configured (for example, the first filter was given the lowest sequence number). The show config command in the TRACE LIST [...]

Security | 947 Figure 45-14. Trace List Example To view all configured Trace lists and the number of packets processed through the Trace list, use the show ip accounting trace-list command (Figure 110) in the EXEC Privilege mode. Apply trace lists After you create a Trace list, you must enable it. Without enabling the Trace list, no traffic is filt[...]

948 | Security www.dell.com | support.dell.com VTY Line and Access-Class Configuration Various methods are available to restrict VTY access in FTOS. These depend on which authentication scheme you use — line, local, or remote: FTOS provides several ways to configure access classes for VTY lines, including: • VTY Line Local Authentication and Au[...]

Security | 949 Figure 45-16. Example Access-Class Configuration Using Local Database VTY Line Remote Authentication and Authorization FTOS retrieves the access class from the VTY line. The Dell Force10 OS takes the access class from the VTY line and applies it to ALL users. FTOS does not need to know the identity of the incoming user and can immedi[...]

950 | Security www.dell.com | support.dell.com Figure 45-18. Example Access Class Configuration Using TACACS+ Without Prompt FTOS(conf)#mac access-list standard sourcemac FTOS(config-std-mac)#permit 00:00:5e:00:01:01 FTOS(config-std-mac)#deny any FTOS(conf)# FTOS(conf)#line vty 0 9 FTOS(config-line-vty)#access-class sourcemac FTOS(config-line-vty)#[...]

Service Provider Bridging | 951 46 Service Provider Bridging Service Provider Bridging is supported on platforms: c e s This chapter contains the following major sections: • VLAN Stacking on page 951 • VLAN Stacking Packet Drop Precedence on page 962 • Dynamic Mode CoS for VLAN Stacking on page 965 • Layer 2 Protocol Tunneling on page 967 ?[...]

952 | Service Provider Bridging www.dell.com | support.dell.com In at the access point of a VLAN-stacking network, service providers add a VLAN tag, the S-Tag, to each frame before the 802.1Q tag. From this point, the frame is double-tagged. The service provider uses the S-Tag, to forward the frame traffic across its network. At the egress edge, th[...]

Service Provider Bridging | 953 Configure VLAN Stacking Configuring VLAN-Stacking is a three-step process: 1. Create access and trunk ports. See page 953. 2. Assign access and trunk ports to a VLAN. See page 954. 3. Make the VLAN VLAN-stacking capable. Related Configuration Tasks • Configure the Protocol Type Value for the Outer VLAN Tag on page [...]

954 | Service Provider Bridging www.dell.com | support.dell.com Display the VLAN-Stacking configuration for a switchport using the command show config from INTERFACE mode, as shown in Figure 46-3 . Figure 46-3. Displaying the VLAN-Stack Configuration on a Layer 2 Port Enable VLAN-Stacking for a VLAN To enable VLAN-Stacking for a VLAN: Display the s[...]

Service Provider Bridging | 955 FTOS Options for Trunk Ports 802.1ad trunk ports may also be tagged members of a VLAN so that it can carry single and double-tagged traffic. You can enable trunk ports to carry untagged, single-tagged, and double-tagged VLAN traffic by making the trunk port a hybrid port. In Figure 46-5 GigabitEthernet 0/1 a trunk po[...]

956 | Service Provider Bridging www.dell.com | support.dell.com VLAN Stacking in Multi-vendor Networks The first field in the VLAN tag is the Tag Protocol Identifier (TPID), which is two bytes. In a VLAN-stacking network, once the frame is double tagged, the outer tag TPID must match the TPID of the next-hop system. While 802.1Q requires that the i[...]

Service Provider Bridging | 957 Figure 46-6. TPID Match and First-byte Match on the E-Series TeraScale TPID 0x8100 on E-Series TeraScale Systems E-Series TeraScale treats TPID 0x8100 as a normal VLAN even when on the outer tag. E-Series TeraScale makes forwarding decisions based strictly on the protocol type, without regard for whether the port is [...]

958 | Service Provider Bridging www.dell.com | support.dell.com Figure 46-7. TPID Mismatch and 0x8100 Match on the E-Series TeraScale VLAN Stacking with E-Series ExaScale Systems E-Series ExaScale, beginning with FTOS version 8.2.1.0, allows you to configure both bytes of the 2-byte TPID. TeraScale systems allow you to configure the first byte only[...]

Service Provider Bridging | 959 Figure 46-8. First-byte TPID Match on the E-Series ExaScale Table 46-1 details the outcome of matched and mis-matched TPIDs in a VLAN-stacking network with the E-Series. VLAN Stacking with C-Series and S-Series The default TPID for the outer VLAN tag is 0x9100. Beginning with FTOS version 8.2.1.0, both the C-Series a[...]

960 | Service Provider Bridging www.dell.com | support.dell.com You can configure the first eight bits of the TPID using the command vlan-stack protocol-type . The TPID on the C-Series and S-Series systems is global. Ingress frames that do not match the system TPID are treated as untagged. This rule applies for both the outer tag TPID of a double-t[...]

Service Provider Bridging | 961 Figure 46-10. Single and Double-tag First-byte TPID Match on C-Series and S-Series Figure 46-11. Single and Double-tag TPID Mismatch on the C-Series and S-Series DE FAULT VL AN I N T E R N E T S E R V I C E P R O V I D E R VL AN GREE N , VLAN PURP L E VLAN G REE N VL AN PU RPLE VL AN BLUE VLAN RED V LAN R E D VL A N [...]

962 | Service Provider Bridging www.dell.com | support.dell.com Table 46-2 details the outcome of matched and mismatched TPIDs in a VLAN-stacking network with the C-Series and S-Series. VLAN Stacking Packet Drop Precedence VLAN Stacking Packet Drop Precedence is available only on platform: c s The Drop Eligible Indicator (DEI) bit in the S-Tag indi[...]

Service Provider Bridging | 963 Enable Drop Eligibility You must enable Drop Eligibility globally before you can honor or mark the DEI value. When Drop Eligibility is enabled, DEI mapping or marking takes place according to the defaults. In this case, the CFI is affected according to Table 46-3 . Honor the Incoming DEI Value To honor the incoming D[...]

964 | Service Provider Bridging www.dell.com | support.dell.com Mark Egress Packets with a DEI Value On egress, you can set the DEI value according to a different mapping than ingress (see Honor the Incoming DEI Value ). FTOS#show interface dei-honor Default Drop precedence: Green Interface CFI/DEI Drop precedence ----------------------------------[...]

Service Provider Bridging | 965 Dynamic Mode CoS for VLAN Stacking Dynamic Mode CoS for VLAN Stacking is available only on platforms: c s One of the ways to ensure quality of service for customer VLAN-tagged frames is to use the 802.1p priority bits in the tag to indicate the level of QoS desired. When an S-Tag is added to incoming customer frames,[...]

966 | Service Provider Bridging www.dell.com | support.dell.com FTOS Behavior: For Option A above, when there is a conflict between the queue selected by Dynamic Mode CoS ( vlan-stack dot1p-mapping ) and a QoS configuration, the queue selected by Dynamic Mode CoS takes precedence. However, rate policing for the queue is determined by QoS configurat[...]

Service Provider Bridging | 967 To map C-Tag dot1p values to S-Tag dot1p values and mark the frames accordingly: Layer 2 Protocol Tunneling Layer 2 Protocol Tunneling (L2PT) is supported on platforms: c e s L2PT is supported on E-Series ExaScale e x with FTOS 8.2.1.0. and later. Spanning Tree BPDUs use a reserved destination MAC address called the [...]

968 | Service Provider Bridging www.dell.com | support.dell.com Figure 46-13. VLAN Stacking without L2PT You might need to transport control traffic transparently through the intermediate network to the other region. Layer 2 Protocol Tunneling enables BPDUs to traverse the intermediate network by identifying frames with the Bridge Group Address, re[...]

Service Provider Bridging | 969 Figure 46-14. VLAN Stacking with L2PT Implementation Information • L2PT is available for STP, RSTP, MSTP, and PVST+ BPDUs. • No protocol packets are tunneled when VLAN Stacking is enabled. • L2PT requires the default CAM profile. I N T E R N E T S E R V R I C E P R O V I D E R w / w w S P A P P N N I N G T R E [...]

970 | Service Provider Bridging www.dell.com | support.dell.com Enable Layer 2 Protocol Tunneling Specify a Destination MAC Address for BPDUs By default, FTOS uses a Force10-unique MAC address for tunneling BPDUs. You can configure another value. Rate-limit BPDUs on the E-Series In order to rewrite the destination MAC address on BPDUs, they are for[...]

Service Provider Bridging | 971 Rate-limit BPDUs on the C-Series and S-Series CAM space is allocated in sections called Field Processor (FP) blocks. There are total 13 user-configurable FP blocks on the C-Series and S-Series. The default number of blocks for L2PT is 0; you must allocate at least one to enable BPDU rate-limiting. Debug Layer 2 Proto[...]

972 | Service Provider Bridging www.dell.com | support.dell.com The same is true for GVRP. 802.1ad specifies that provider bridges participating in GVRP use a reserved destination MAC address called the Provider Bridge GVRP Address, 01-80-C2-00-00-0D, to exchange GARP PDUs instead of the GVRP Address, 01-80-C2-00-00-21, specified in 802.1Q. Only br[...]

sFlow | 973 47 sFlow sFlow is supported on platforms c e s sFlow is supported on E-Series ExaScale e x with FTOS 8.1.1.0. and later . • Enable and Disable sFlow on page 975 • sFlow Show Commands on page 976 • Configure Collectors on page 978 • Polling Intervals on page 978 • Sampling Rate on page 979 • Back-off Mechanism on page 980 •[...]

974 | sFlow www.dell.com | support.dell.com Figure 47-1. sFlow Traffic Monitoring System Implementation Information Dell Force10 sFlow is designed so that the hardware sampling rate is per line card port-pipe and is decided based upon all the ports in that port-pipe. If sFlow is not enabled on any port specifically, then the global sampling rate is[...]

sFlow | 975 • FTOS exports all sFlow packets to the collector. A small sampling rate can equate to a large number of exported packets. A backoff mechanism will automatically be applied to reduce this amount. Some sampled packets may be dropped when the exported packet rate is high and the backoff mechanism is about to or is starting to take effec[...]

976 | sFlow www.dell.com | support.dell.com sFlow Show Commands FTOS includes the following sFlow display commands: • Show sFlow Globally on page 49 • Show sFlow on an Interface on page 50 • Show sFlow on a Line Card on page 50 Show sFlow Globally Use the following command to view sFlow statistics: Figure 47-2 is a sample output from the show[...]

sFlow | 977 Figure 47-3. Command Example: show sflow interface The configuration, shown in Figure 47-2 , is also displayed in the running configuration ( Figure 47-4 ): Figure 47-4. Command Example: show running-config interface Show sFlow on a Line Card Use the following command to view sFlow statistitics on a specified line card: Figure 47-5 is a[...]

978 | sFlow www.dell.com | support.dell.com Configure Collectors The sflow collector command allows you to configure sFlow collectors to which sFlow datagrams are forwarded. You can configure up to two sFlow collectors (IPv4 or IPv6). If you configure two collectors, traffic samples are sent to both devices. sFlow collection through the Management [...]

sFlow | 979 Sampling Rate Sampling Rate is supported on platform e t . The sFlow sampling rate is the number of packets that are skipped before the next sample is taken. sFlow does not have time-based packet sampling. The sflow sample-rate command, when issued in CONFIGURATION mode, changes the default sampling rate. By default, the sampling rate o[...]

980 | sFlow www.dell.com | support.dell.com Note the absence of a configured rate in the equation. That is because when the hardware sampling rate value on the port-pipe exceeds the configured sampling rate value for an interface, the actual rate changes to the hardware rate. The sub-sampling rate never goes below a value of one. Back-off Mechanism[...]

sFlow | 981 Use the command sflow [ extended-switch ] [ extended-router ] [ extended-gateway ] enable command. By default packing of any of the extended information in the datagram is disabled. Use the command show sflow to confirm that extended information packing is enabled, as shown in Figure 47-6 . Figure 47-6. Confirming that Extended sFlow is[...]

982 | sFlow www.dell.com | support.dell.com Important Points to Remember • The IP destination address has to be learned via BGP in order to export extended-gateway data, prior to FTOS version 7.8.1.0. • If the IP destination address is not learned via BGP the Dell Force10 system does not export extended-gateway data, prior to FTOS version 7.8.1[...]

Simple Network Management Protocol | 983 48 Simple Network Management Protocol Simple Network Management Protocol is supported on platforms c e s SNMP is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. Protocol Overview Network management stations use Simple Network Management Protocol (SNMP) to retrieve or alter management[...]

984 | Simple Network Management Protocol www.dell.com | support.dell.com Configuring SNMP requires only a single step: 1. Create a community. See page 984. Related Configuration Tasks The following list contains configuration tasks for SNMP: • Read Managed Object Values on page 985 • Write Managed Object Values on page 986 • Subscribe to Mana[...]

Simple Network Management Protocol | 985 View your SNMP configuration, using the command show running-config snmp from EXEC Privilege mode, as shown in Figure 48-1 . Figure 48-1. Creating an SNMP Community Read Managed Object Values You may only retrieve (read) managed object values if your management station is a member of the same community as th[...]

986 | Simple Network Management Protocol www.dell.com | support.dell.com Write Managed Object Values You may only alter (write) a managed object value if your management station is a member of the same community as the SNMP agent, and the object is writable. To write or write-over the value of a managed object: Figure 48-5. Writing over the Current[...]

Simple Network Management Protocol | 987 Configure Contact and Location Information using SNMP You may configure system contact and location information from the Dell Force10 system or from the management station using SNMP. To configure system contact and location information from the Dell Force10 system: To configure the system from the manumitti[...]

988 | Simple Network Management Protocol www.dell.com | support.dell.com Subscribe to Managed Object Value Updates using SNMP By default, the Dell Force10 system displays some unsolicited SNMP messages (traps) upon certain events and conditions. You can also configure the system to send the traps to a management station. Traps cannot be saved on th[...]

Simple Network Management Protocol | 989 Table 48-2. Dell Force10 Enterprise-specific SNMP Traps Command Option Trap Examples envmon CARD_SHUTDOWN: %sLine card %d down - %s CARD_DOWN: %sLine card %d down - %s LINECARDUP: %sLine card %d is up CARD_MISMATCH: Mismatch: line card %d is type %s - type %s required. RPM_STATE: RPM1 is in Active State RPM_[...]

990 | Simple Network Management Protocol www.dell.com | support.dell.com Copy Configuration Files Using SNMP Use SNMP from a remote client to: • copy the running-config file to the startup-config file, or • copy configuration files from the Dell Force10 system to a server • copy configuration files from a server to the Dell Force10 system stp[...]

Simple Network Management Protocol | 991 All of these tasks can be performed using IPv4 or IPv6 addresses. The examples in this section use IPv4 addresses; IPv6 addresses can be substituted for the IPv4 addresses in all of the examples. The relevant MIBs for these functions are: Table 48-3. MIB Objects for Copying Configuration Files via SNMP MIB O[...]

992 | Simple Network Management Protocol www.dell.com | support.dell.com To copy a configuration file: Table 7 shows examples of using the command snmpset to copy a configuration. These examples assume that: • the server OS is Unix • you are using SNMP version 2c • the community name is public, and • the file f10-copy-config.mib is in the c[...]

Simple Network Management Protocol | 993 Note: In Unix, enter the command snmpset for help using this command. Place the file f10-copy-config.mib the directory from which you are executing the snmpset command or in the snmpset tool path. Table 48-4. Copying Configuration Files via SNMP Task Copy the running-config to the startup-config using the fo[...]

994 | Simple Network Management Protocol www.dell.com | support.dell.com • server-ip-address must be preceded by the keyword a . • values for copyUsername and copyUserPassword must be preceded by the keyword s . Figure 48-10. Copying Configuration Files via SNMP and FTP to a Remote Server Copy the startup-config to the server via TFTP using the[...]

Simple Network Management Protocol | 995 Dell Force10 provides additional MIB Objects to view copy statistics. These are provided in Table 48-5 . To obtain a value for any of the MIB Objects in Table 48-5 : Figure 48-13 and Figure 48-14 are examples of using the command snmpget to obtain a MIB object value. These examples assume that: • the serve[...]

996 | Simple Network Management Protocol www.dell.com | support.dell.com Figure 48-13 shows the command syntax using MIB object names, and Figure 48-14 shows the same command using the object OIDs. In both cases, the object is followed by same index number used in the snmpset command. Figure 48-13. Obtaining MIB Object Values for a Copy Operation u[...]

Simple Network Management Protocol | 997 Manage VLANs using SNMP The qBridgeMIB managed objects in the Q-BRIDGE-MIB, defined in RFC 2674, enable you to use SNMP manage VLANs. Create a VLAN Use the dot1qVlanStaticRowStatus object to create a VLAN. The snmpset operation in Figure 48-15 creates VLAN 10 by specifying a value of 4 for instance 10 of the[...]

998 | Simple Network Management Protocol www.dell.com | support.dell.com Figure 48-17. Identifying the VLAN Interface Index Number To display the ports in a VLAN, send an snmpget request for the object dot1qStaticEgressPorts using the interface index as the instance number, as shown for an S-Series in Figure 48-18 . Figure 48-18. Display the Ports [...]

Simple Network Management Protocol | 999 Figure 48-18 shows the output for an S-Series. All hex pairs are 00, indicating that no ports are assigned to VLAN 10. In Figure 48-19 , Port 0/2 is added to VLAN 10 as untagged. And the first hex pair changes from 00 to 04. Figure 48-19. Displaying Ports in a VLAN using SNMP The value 40 is in the first set[...]

1000 | Simple Network Management Protocol www.dell.com | support.dell.com Figure 48-20. Adding Untagged Ports to a VLAN using SNMP In Figure 48-21 , Port 0/2 is added as a tagged member of VLAN 10. Figure 48-21. Adding Tagged Ports to a VLAN using SNMP >snmpset -v2c -c mycommunity 10.11.131.185 .1.3.6.1.2.1.17.7.1.4.3.1.2.1107787786 x " 40 [...]

Simple Network Management Protocol | 1001 Enable and Disable a Port using SNMP Fetch Dynamic MAC Entries using SNMP Dell Force10 supports the RFC 1493 dot1d table for the default VLAN and the dot1q table for all other VLANs. In Figure 48-22 , R1 has one dynamic MAC address, learned off of port GigabitEthernet 1/21, which a member of the default VLA[...]

1002 | Simple Network Management Protocol www.dell.com | support.dell.com Each object is comprised an OID concatenated with an instance number. In the case of these objects, the instance number is the decimal equivalent of the MAC address; derive the instance number by converting each hex pair to its decimal equivalent. For example, the decimal equ[...]

Simple Network Management Protocol | 1003 Deriving Interface Indices FTOS assigns an interface number to each (configured or unconfigured) physical and logical interface. Display the interface index number using the command show interface from EXEC Privilege mode, as shown in Figure 48-25 . Figure 48-25. Display the Interface Index Number The inter[...]

1004 | Simple Network Management Protocol www.dell.com | support.dell.com Figure 48-27. Binary Representation of Interface Index For interface indexing, slot and port numbering begins with the binary one. If the Dell Force10 system begins slot and port numbering from 0, then the binary 1 represents slot and port 0. For example, the index number in [...]

Simple Network Management Protocol | 1005 If we learn mac address for the LAG, status will be shown for those as well dot3aCurAggVlanId SNMPv2-SMI::enterprises.6027.3.2.1.1.4.1.1.1.0.0.0.0.0.1.1 = INTEGER: 1 dot3aCurAggMacAddr SNMPv2-SMI::enterprises.6027.3.2.1.1.4.1.2.1.0.0.0.0.0.1.1 = Hex-STRING: 00 00 00 00 00 01 dot3aCurAggIndex SNMPv2-SMI::ent[...]

1006 | Simple Network Management Protocol www.dell.com | support.dell.com[...]

SONET/SDH | 1007 49 SONET/SDH SONET/SDH is supported on platform e SONET/SDH is supported on the E-Series ExaScale platform with FTOS 8.1.1.2 and later. FTOS supports two line cards with SONET—Packet-Over-SONET (POS) and PPP-over-SONET/SDH. This chapter covers the following topics: • Packet Over SONET (POS) Interfaces • 10GE WAN Physical Inte[...]

1008 | SONET/SDH www.dell.com | support.dell.com • Protection switching is not supported. • POS interfaces cannot be mirrored ports. • Configurable alarm thresholds (SF/SD BER, B1/B 2/B3 TC) are not supported. • The CRC type and S1S0 flag cannot be changed. Configuring POS Interfaces POS interfaces require several configuration consideratio[...]

SONET/SDH | 1009 Configuring Maximum Transmission Unit (MTU) Maximum Transmission Unit is an integer value that represents the greatest number of bytes that any given interface on the system can handle. MTU settings allow the router to determine if a large packet needs to be fragmented before transmission. PPP must be enabled on a SONET interface b[...]

1010 | SONET/SDH www.dell.com | support.dell.com Figure 49-2. wanport command example Figure 49-3 displays the active alarms for the interface. Figure 49-3. show controllers tengigabitEthernet command example SONET Alarm Reporting SONET equipment detects events and alarms at each of SONET's three layers—section, line, and path. Typically, a [...]

SONET/SDH | 1011 While performance monitoring provides advanced alert of link degradation, alarms indicate a failure. Fault management involves alarm monitoring and generation, reporting, logging, correlation, and clearing. E-Series POS and 10GE WAN interfaces support the SONET alarms shown in Table 49-1 : • Section alarms—SLOS, SLOF • Line a[...]

1012 | SONET/SDH www.dell.com | support.dell.com Use the alarm-report command to configure the SONET alarms that a POS or 10 GE WAN interface can activate. Table 49-2 defines the alarms that you can enable. To view active alarms and defects, use the show controllers sonet command in EXEC Privilege mode. When an E-Series POS or 10GE WAN interface de[...]

SONET/SDH | 1013 SONET TRAP Example SONET Traps on page 1015 describes the traps and OIDs for SONET alarms that are reported on an SNMP trap receiver. Figure 49-4 shows an example of a SONET trap. Figure 49-4. SONET Trap example SONET Syslog Example Syslog messages are generated for Critical, Major, and Minor alarm conditions detected on a SONET in[...]

1014 | SONET/SDH www.dell.com | support.dell.com By default, certain alarms (LOS, LOF, LAIS, PLOP) bring the line protocol down immediately. Use this command, with the line option, to delay that trigger event by 100ms. By default, path alarms (AIS, RDI, LOP) do not cause (or trigger) the interface line protocol to go down. The delay triggers comman[...]

SONET/SDH | 1015 SONET MIB Table 49-3 lists the managed objects supported in the SONET MIB, as defined in RFC 2558. SONET Traps Table 49-4 describes SONET traps supported in the Force10-specific MIB. Table 49-3. SONET MIB: Managed Objects SONET Managed Object Description sonetMediumType Sonet or SDH depending on the configuration sonetMediumTimeEla[...]

1016 | SONET/SDH www.dell.com | support.dell.com SONET_L_RDI Line Remote Defect Indication 1.3.6.1.4.1.6027.3.3.2.2.0.10 alarm state (1.3.6.1.4.1.6027.3.3.1.2.1.1.3), alarm type(1.3.6.1.4.1.6027.3.3.1.2.1.1.2), ifindex(1.3.6.1.4.1.6027.3.3.1.2.1.1.4), slot(1.3.6.1.4.1.6027.3.3.1.2.1.1.5), port(1.3.6.1.4.1.6027.3.3.1.2.1.1.6) SONET_L_FEBE Line Far-e[...]

SONET/SDH | 1017 SONET_P_PSE 1.3.6.1.4.1.6027.3.3.2.2.0.22 alarm state (1.3.6.1.4.1.6027.3.3.1.2.1.1.3), alarm type(1.3.6.1.4.1.6027.3.3.1.2.1.1.2), ifindex(1.3.6.1.4.1.6027.3.3.1.2.1.1.4), slot(1.3.6.1.4.1.6027.3.3.1.2.1.1.5), port(1.3.6.1.4.1.6027.3.3.1.2.1.1.6) SONET_P_NSE 1.3.6.1.4.1.6027.3.3.2.2.0.23 alarm state (1.3.6.1.4.1.6027.3.3.1.2.1.1.3[...]

1018 | SONET/SDH www.dell.com | support.dell.com[...]

Stacking S-Series Switches | 1019 50 Stacking S-Series Switches Stacking S-Series Switches is supported on platform s This chapter contains the following sections: • S-Series Stacking Overview on page 1019 • Important Points to Remember on page 1026 • S-Series Stacking Configuration Tasks on page 1035 S-Series Stacking Overview Up to eight S-[...]

1020 | Stacking S-Series Switches www.dell.com | support.dell.com Figure 50-1. S-Series Stack Manager Redundancy Management Unit Selection on S-Series Stacks FTOS has a selection algorithm to decide which stack units will be the primary and secondary management units. During the bootup of a single unit or the stack, FTOS compares the priority value[...]

Stacking S-Series Switches | 1021 Figure 50-2. Electing the Stack Manager MAC Addressing on S-Series Stacks The S-Series has three MAC addressees: the chassis MAC, interface MAC, and null interface MAC. All interfaces in the stack use the interface MAC address of the management unit (stack manager), and the chassis MAC for the stack is the master?[...]

1022 | Stacking S-Series Switches www.dell.com | support.dell.com Figure 50-3. Adding a Standalone with a Lower MAC Address to a Stack— Before -------------------------------STANDALONE BEFORE CONNECTION---------------------------------- Standalone#show system brief Stack MAC : 00:01:e8:d5: ef :81 -- Stack Info -- Unit UnitType Status ReqTyp CurTy[...]

Stacking S-Series Switches | 1023 Figure 50-4. Adding a Standalone with a Lower MAC Address and Equal Priority to a Stack—After -------------------------------STANDALONE AFTER CONNECTION---------------------------------- Standalone#%STKUNIT0-M:CP %POLLMGR-2-ALT_STACK_UNIT_STATE: Alternate Stack-unit is present 00:20:20: %STKUNIT0-M:CP %CHMGR-5-ST[...]

1024 | Stacking S-Series Switches www.dell.com | support.dell.com Figure 50-5. Adding a Standalone with a Lower MAC Address but Higher Priority to a Stack— Before -------------------------------STANDALONE BEFORE CONNECTION---------------------------------- Standalone#show system brief Stack MAC : 00:01:e8:d5: ef :81 -- Stack Info -- Unit UnitType[...]

Stacking S-Series Switches | 1025 Figure 50-6. Adding a Standalone with a Lower MAC Address but Higher Priority to a Stack—After Management Access on S-Series Stacks You can access the stack via the console port or VTY line. • Console access : You may access the stack through the console port of the stack manager only. Like a standby RPM, the c[...]

1026 | Stacking S-Series Switches www.dell.com | support.dell.com Figure 50-7. Accessing Non-Master Units on a Stack via the Console Port Important Points to Remember • YYou may stack up to eight S25/S50 systems in combination. • You may stack up to 12 S60 systems • You may stack up to 3 S4810 systems • You may not stack different S-Series [...]

Stacking S-Series Switches | 1027 You may stack any combination of S-Series models that have the same FTOS version. Figure 50-8 shows two common stacking topologies, ring and cascade (also called daisy-chain). A ring topology provides some performance gains and stack integrity. Figure 50-8. Common S-Series Stacking Topologies Facing the rear of an [...]

1028 | Stacking S-Series Switches www.dell.com | support.dell.com To display the status of the stacking ports, including the topology: Figure 50-9 shows a daisy-chain topology. Figure 50-10 shows the same stack converted to a ring by connecting stack-port 2/51 to 0/51; you may rearrange the stacking cables without triggering a unit reset, so long a[...]

Stacking S-Series Switches | 1029 Figure 50-11. Stacking Cable Redundancy LED Status Indicators on an S-Series Stack The stack unit is displayed in an LED panel on the front of each switch. Each panel displays the stack unit ID — from 0 through 7 — and: • A for the management unit • B for the standby management unit • 0 for stack members [...]

1030 | Stacking S-Series Switches www.dell.com | support.dell.com To manually assign a new unit a position in the stack: Figure 50-12. Adding a Stack Unit with a Conflicting Stack Number—Before Step Task Command Syntax Command Mode 1 While the unit is unpowered, install stacking modules in the new unit. 2 On the stack, determine the next availabl[...]

Stacking S-Series Switches | 1031 Figure 50-13. Adding a Stack Unit with a Conflicting Stack Number—After Figure 50-14. Adding a Stack Unit with a Conflicting Stack Provision—Before ------------------------STANDALONE AFTER CONNECTION---------------------------------- 00:08:45: %STKUNIT1-M:CP %POLLMGR-2-ALT_STACK_UNIT_STATE: Alternate Stack-unit[...]

1032 | Stacking S-Series Switches www.dell.com | support.dell.com Figure 50-15. Adding a Stack Unit with a Conflicting Stack Number—After Remove a Unit from an S-Series Stack The running-configuration and startup-configuration are synchronized on all stack units. A stack member that is disconnected from the stack maintain this configuration. To r[...]

Stacking S-Series Switches | 1033 Figure 50-16. Removing a Stack Member—Before ----------------------------STANDALONE BEFORE DISCONNECTION---------------------------------- Standalone (stack-member-2) #? reset-self Reset this unit alone show Show running system information Standalone(stack-member-2)#show ? version Software version ---------------[...]

1034 | Stacking S-Series Switches www.dell.com | support.dell.com Figure 50-17. Removing a Stack Member—After Merge Two S-Series Stacks You may merge two stacks while they are powered and online. To merge two stacks, connect one stack to the other using stacking cables. You may not connect 12G and 24G stack ports. • FTOS selects a primary stack[...]

Stacking S-Series Switches | 1035 Split an S-Series Stack To split a stack, unplug the desired stacking cables.You may do this at any time, whether the stack is powered or unpowered, and the units are online or offline. Each portion of the split stack retains the startup and running configuration of the original stack. For a parent stack that is sp[...]

1036 | Stacking S-Series Switches www.dell.com | support.dell.com Create a Virtual Stack Unit on an S-Series Stack Use virtual stack units to configure ports on the stack before adding a new unit, or to prevent FTOS from assigning a particular stack-number. Display Information about an S-Series Stack Task Command Syntax Command Mode Create a virtua[...]

Stacking S-Series Switches | 1037 Figure 50-18. Displaying Information about an S-Series Stack—show system FTOS#show system Stack MAC : 00:01:e8:d5:f9:6f -- Unit 0 -- Unit Type : Member Unit Status : online Next Boot : online Required Type : S50V - 48-port E/FE/GE with POE (SB) Current Type : S50V - 48-port E/FE/GE with POE (SB) Master priority :[...]

1038 | Stacking S-Series Switches www.dell.com | support.dell.com Figure 50-19. Displaying Information about an S-Series Stack—show system brief Figure 50-20. Displaying Information about an S-Series Stack—show system stack-ports FTOS#show system brief Stack MAC : 00:01:e8:d5:f9:6f -- Stack Info -- Unit UnitType Status ReqTyp CurTyp Version Por[...]

Stacking S-Series Switches | 1039 Influence Management Unit Selection on an S-Series Stack Stack Priority is the system variable that FTOS uses to determine which units in the stack will be the primary and secondary management units. If multiple units tie for highest priority, then the unit with the highest MAC address prevails. If management was d[...]

1040 | Stacking S-Series Switches www.dell.com | support.dell.com Monitor an S-Series Stack with SNMP S-Series supports the following tables in f10-ss-chassis.mib for stack management through SNMP: • chStackUnitTable • chSysStackPortTable Troubleshoot an S-Series Stack • Recover from Stack Link Flaps on page 1040 • Recover from a Card Probl[...]

Stacking S-Series Switches | 1041 Figure 50-21. Recovering from a Stack Link Flapping Error Recover from a Card Problem State on an S-Series Stack If a unit added to a stack has a different FTOS version, the unit does not come online, and FTOS cites a card problem error, as shown in Figure 50-22 . To recover, disconnect the new unit from the stack,[...]

1042 | Stacking S-Series Switches www.dell.com | support.dell.com Figure 50-23. Recovering from a Card Mismatch State on an S-Series Stack -----------------------------------STANDALONE UNIT BEFORE------------------------------------ Standalone#show system brief Stack MAC : 00:01:e8:d5:ef:81 -- Stack Info -- Unit UnitType Status ReqTyp CurTyp Versio[...]

Broadcast Storm Control | 1043 51 Broadcast Storm Control Broadcast Storm Control is supported on platforms: c e s This chapter contains the following configuration topics: • Layer 3 Broadcast Storm Control on page 1044 • Layer 2 Broadcast Storm Control on page 1045 • Multicast Storm Control on page 1046 Storm Control Overview FTOS Storm Cont[...]

1044 | Broadcast Storm Control www.dell.com | support.dell.com Implementation Information • Storm Control is supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. • The percentage of storm control is calculated based on the advertised rate of the line card, not by the speed setting of the interface. • Do not apply per-VLAN [...]

Broadcast Storm Control | 1045 Enable Broadcast Storm Control on an Interface Enabling Storm control on an interface affects only ingress broadcasts. Enable Broadcast Storm Control on all Interfaces The result of enabling Storm Control globally varies by platform: • On the E-Series, enabling Storm Control from CONFIGURATION mode limits ingress an[...]

1046 | Broadcast Storm Control www.dell.com | support.dell.com Multicast Storm Control Multicast Storm Control is supported only on platforms: c s Storm Control Show Commands The show storm-control commands display the current storm control configuration of the entire Dell Force10 platform. These show commands are accessed from within either the EX[...]

Broadcast Storm Control | 1047 FTOS#show storm-control broadcast gigabitethernet 11/11 Broadcast storm control configuration Interface Direction Percentage Wred Profile -------------------------------------------------------------- Gi 11/11 Ingress 5.6 Gi 11/11 Egress 5.6 - FTOS# The following example displays the output of the show storm-control b[...]

1048 | Broadcast Storm Control www.dell.com | support.dell.com[...]

Spanning Tree Protocol | 1049 52 Spanning Tree Protocol Spanning Tree Protocol is supported on platforms: c e s STP is supported on the E-Series ExaScale platform with FTOS 8.1.1.2 and later. Protocol Overview Spanning Tree Protocol (STP) is a Layer 2 protocol—specified by IEEE 802.1d—that eliminates loops in a bridged topology by enabling only[...]

1050 | Spanning Tree Protocol www.dell.com | support.dell.com Related Configuration Tasks • Adding an Interface to the Spanning Tree Group on page 1054 • Removing an Interface from the Spanning Tree Group on page 1054 • Modifying Global Parameters on page 1055 • Modifying Interface STP Parameters on page 1056 • Enabling PortFast on page 1[...]

Spanning Tree Protocol | 1051 Configuring Interfaces for Layer 2 Mode All interfaces on all switches that will participate in Spanning Tree must be in Layer 2 mode and enabled. Figure 52-1. Example of Configuring Interfaces for Layer 2 Mode To configure the interfaces for Layer 2 and then enable them: Verify that an interface is in Layer 2 mode and[...]

1052 | Spanning Tree Protocol www.dell.com | support.dell.com Enabling Spanning Tree Protocol Globally Spanning Tree Protocol must be enabled globally; it is not enabled by default. To enable Spanning Tree globally for all Layer 2 interfaces: Verify that Spanning Tree is enabled using the show config command from PROTOCOL SPANNING TREE mode. Figure[...]

Spanning Tree Protocol | 1053 Figure 52-4. Spanning Tree Enabled Globally View the Spanning Tree configuration and the interfaces that are participating in STP using the show spanning-tree 0 command from EXEC privilege mode. If a physical interface is part of a port channel, only the port channel is listed in the command output. Figure 52-5. show s[...]

1054 | Spanning Tree Protocol www.dell.com | support.dell.com Confirm that a port is participating in Spanning Tree using the show spanning-tree 0 brief command from EXEC privilege mode. Figure 52-6. show spanning-tree brief Command Example Adding an Interface to the Spanning Tree Group To add a Layer 2 interface to the Spanning Tree topology: Remo[...]

Spanning Tree Protocol | 1055 Modifying Global Parameters You can modify Spanning Tree parameters. The root bridge sets the values for forward-delay, hello-time, and max-age and overwrites the values set on other bridges participating in Spanning Tree. Table 52-2 displays the default values for Spanning Tree. To change STP global parameters: Note: [...]

1056 | Spanning Tree Protocol www.dell.com | support.dell.com View the current values for global parameters using the show spanning-tree 0 command from EXEC privilege mode. See Figure 52-5 . Modifying Interface STP Parameters You can set the port cost and port priority values of interfaces in Layer 2 mode. • Port cost is a value that is based on [...]

Spanning Tree Protocol | 1057 To enable PortFast on an interface: Verify that PortFast is enabled on a port using the show spanning-tree command from the EXEC privilege mode or the show config command from INTERFACE mode; Dell Force10 recommends using the show config command, as shown in Figure 52-7 . Figure 52-7. PortFast Enabled on Interface Prev[...]

1058 | Spanning Tree Protocol www.dell.com | support.dell.com Figure 52-8 shows a scenario in which an edgeport might unintentionally receive a BPDU. The port on the Dell Force10 system is configured with Portfast. If the switch is connected to the hub, the BPDUs that the switch generates might trigger an undesirable topology change. If BPDU Guard [...]

Spanning Tree Protocol | 1059 Figure 52-8. Enabling BPDU Guard To verify the Portfast BPDU loop guard configuration on a port or port-channel interface, enter the show spanning-tree 0 guard [ interface interface ] command in global configuration mode. STP Root Selection Although the Spanning Tree Protocol determines the root bridge, you can assign [...]

1060 | Spanning Tree Protocol www.dell.com | support.dell.com To change the bridge priority or specify that a bridge is the root or secondary root: View only the root information using the show spanning-tree root command (see Figure 52-9 ) from EXEC privilege mode. Figure 52-9. show spanning-tree root Command Example STP Root Guard STP Root Guard i[...]

Spanning Tree Protocol | 1061 In STP topology 2 ( Figure 52-10 upper right), STP is enabled on device D on which a software bridge application is started to connect to the network. Because the priority of the bridge in device D is lower than the root bridge in Switch A, device D is elected as root, causing the link between Switches A and B to enter[...]

1062 | Spanning Tree Protocol www.dell.com | support.dell.com Figure 52-10. STP Root Guard Prevents Bridging Loops 1 3 2 Port State: STP Block STP Root-Inconsistent[...]

Spanning Tree Protocol | 1063 Root Guard Configuration You enable STP root guard on a per-port or per-port-channel basis. To enable the root guard on an STP-enabled port or port-channel interface in instance 0, enter the spanning-tree 0 rootguard command: To disable STP root guard on a port or port-channel interface, enter the no spanning-tree 0 ro[...]

1064 | Spanning Tree Protocol www.dell.com | support.dell.com Configuring Spanning Trees as Hitless Configuring Spanning Trees as Hitless is supported only on platforms: c e You can configure Spanning Tree (STP), Rapid Spanning Tree (RSTP), Multiple Spanning Tree (MSTP), and Per-Vlan Spanning Tree (PVST+) to be hitless (all or none must be configur[...]

Spanning Tree Protocol | 1065 As shown in STP topology 3 ( Figure 52-12 bottom middle), after you enable loop guard on an STP port or port-channel on Switch C, if no BPDUs are received and the max-age timer expires, the port transitions from a blocked state to a loop-inconsistent state (instead of to a forwarding state). Loop guard blocks the STP p[...]

1066 | Spanning Tree Protocol www.dell.com | support.dell.com Figure 52-12. STP Loop Guard Prevents Forwarding Loops Port State: STP Loop-Inconsistent No traffic is transmitted 1 1 2 2 3[...]

Spanning Tree Protocol | 1067 Loop Guard Configuration You enable STP loop guard on a per-port or per-port channel basis. To enable a loop guard on an STP-enabled port or port-channel interface, enter the spanning-tree 0 loopguard command: To disable STP loop guard on a port or port-channel interface, enter the no spanning-tree 0 loopguard command [...]

1068 | Spanning Tree Protocol www.dell.com | support.dell.com Displaying STP Guard Configuration To verify the STP guard configured on port or port-channel interfaces, enter the show spanning-tree 0 guard [ interface interface ] command. Figure 52-13 shows an example for an STP network (instance 0) in which: • Root guard is enabled on a port that[...]

System Time and Date | 1069 53 System Time and Date Chapter 53, System Time and Date settings, and Network Time Protocol are supported on platforms: c e s Time and Date and NTP are supported on the E-Series ExaScale platform with FTOS 8.1.1.0 and later. System times and dates can be set and maintained through the Network Time Protocol (NTP). They a[...]

1070 | System Time and Date www.dell.com | support.dell.com NTP is designed to produce three products: clock offset, roundtrip delay, and dispersion, all of which are relative to a selected reference clock. • Clock offset represents the amount to adjust the local clock to bring it into correspondence with the reference clock. • Roundtrip delay [...]

System Time and Date | 1071 Figure 53-1. NTP Fields Implementation Information • Dell Force10 systems can only be an NTP client. Configuring Network Time Protocol Configuring NTP is a one-step process: 1. Enable NTP. See page 1072. Related Configuration Tasks • Configure NTP broadcasts on page 1073 • Set the Hardware Clock with the Time Deriv[...]

1072 | System Time and Date www.dell.com | support.dell.com Enable NTP NTP is disabled by default. To enable it, specify an NTP server to which the Dell Force10 system will synchronize. Enter the command multiple times to specify multiple servers. You may specify an unlimited number of servers at the expense of CPU resources. Display the system clo[...]

System Time and Date | 1073 Set the Hardware Clock with the Time Derived from NTP Figure 53-4. Displaying the Calculated NTP Synchronization Variables Configure NTP broadcasts With FTOS, you can receive broadcasts of time information. You can set interfaces within the system to receive NTP information through broadcast. To configure an interface to[...]

1074 | System Time and Date www.dell.com | support.dell.com To disable NTP on an interface, use the following command in the INTERFACE mode: To view whether NTP is configured on the interface, use the show config command in the INTERFACE mode. If ntp disable is not listed in the show config command output, then NTP is enabled. (The show config comm[...]

System Time and Date | 1075 Configure NTP authentication NTP authentication and the corresponding trusted key provide a reliable means of exchanging NTP packets with trusted time sources. NTP authentication begins when the first NTP packet is created following the configuration of keys. NTP authentication in FTOS uses the MD5 algorithm and the key [...]

1076 | System Time and Date www.dell.com | support.dell.com R6_E300(conf)#1w6d23h : NTP: xmit packet to 192.168.1.1: leap 0, mode 3, version 3, stratum 2, ppoll 1024 rtdel 0219 (8.193970), rtdsp AF928 (10973.266602), refid C0A80101 (192.168.1.1) ref CD7F4F63.6BE8F000 (14:51:15.421 UTC Thu Apr 2 2009) org CD7F4F63.68000000 (14:51:15.406 UTC Thu Apr [...]

System Time and Date | 1077 • Root Delay (sys.rootdelay, peer.rootdelay, pkt.rootdelay): This is a signed fixed-point number indicating the total roundtrip delay to the primary reference source at the root of the synchronization subnet, in seconds. Note that this variable can take on both positive and negative values, depending on clock precision[...]

1078 | System Time and Date www.dell.com | support.dell.com Set the time and date for the switch hardware clock Set the time and date for the switch software clock You can change the order of the month and day parameters to enter the time and date as time day month year . You cannot delete the software clock. Command Syntax Command Mode Purpose cal[...]

System Time and Date | 1079 The software clock runs only when the software is up. The clock restarts, based on the hardware clock, when the switch reboots. Command Syntax Command Mode Purpose clock set time month day year EXEC Privilege Set the system software clock to the current time and date. time: Enter the time in hours:minutes:seconds. For th[...]

1080 | System Time and Date www.dell.com | support.dell.com Set the timezone Coordinated Universal Time (UTC) is the time standard based on the International Atomic Time standard, commonly known as Greenwich Mean time. When determining system time, you must include the differentiator between UTC and your local timezone. For example, San Jose, CA is[...]

System Time and Date | 1081 Set Daylight Saving Time Once Set a date (and time zone) on which to convert the switch to daylight savings time on a one-time basis. Command Syntax Command Mode Purpose clock summer-time time-zone date start-month start-day start-year start-time end-month end-day end-year end-time [ offset ] CONFIGURATION Set the clock [...]

1082 | System Time and Date www.dell.com | support.dell.com Set Recurring Daylight Saving Time Set a date (and time zone) on which to convert the switch to daylight savings time on a specific day every year. If you have already set daylight savings for a one-time setting, you can set that date and time as the recurring setting with the clock summer[...]

System Time and Date | 1083 start-year: Enter a four-digit number as the year. Range: 1993 to 2035 start-time: Enter the time in hours:minutes. For the hour variable, use the 24-hour format, example, 17:15 is 5:15 pm. end-week: If you entered a start-week, Enter the one of the following as the week that daylight savings ends: • week-number: enter[...]

1084 | System Time and Date www.dell.com | support.dell.com Command Syntax Command Mode Purpose FTOS(conf)#clock summer-time pacific recurring ? <1-4> Week number to start first Week number to start last Week number to start <cr> FTOS(conf)#clock summer-time pacific recurring FTOS(conf)#02:10:57: %RPM0-P:CP %CLOCK-6-TIME CHANGE: Summert[...]

Uplink Failure Detection (UFD) | 1085 54 Uplink Failure Detection (UFD) Uplink Failure Detection (UFD) is supported on platform: s (S50 only) Feature Description Uplink Failure Detection (UFD) provides detection of the loss of upstream connectivity and, if used with NIC teaming, automatic recovery from a failed link. A switch provides upstream conn[...]

1086 | Uplink Failure Detection (UFD) www.dell.com | support.dell.com Figure 54-1. Uplink Failure Detection How Uplink Failure Detection Works UFD creates an association between upstream and downstream interfaces. The association of uplink and downlink interfaces is called an uplink-state group . An interface in an uplink-state group can be a physi[...]

Uplink Failure Detection (UFD) | 1087 Figure 54-2. Uplink Failure Detection Example If only one of the upstream interfaces in an uplink-state group goes down, a specified number of downstream ports associated with the upstream interface are put into a link-down state. This number is user-configurable and is calculated by the ratio of upstream port [...]

1088 | Uplink Failure Detection (UFD) www.dell.com | support.dell.com Important Points to Remember When you configure Uplink Failure Detection, the following conditions apply: • You can configure up to sixteen uplink-state groups. By default, no uplink-state groups are created. An uplink-state group is considered to be operationally up if it has [...]

Uplink Failure Detection (UFD) | 1089 Configuring Uplink Failure Detection To configure Uplink Failure Detection, follow these steps: Step Command Syntax and Mode Description 1 uplink-state-group group-id Command Mode: CONFIGURATION Creates an uplink-state group and enabling the tracking of upstream links on the switch/router. Valid group-id values[...]

1090 | Uplink Failure Detection (UFD) www.dell.com | support.dell.com Clearing a UFD-Disabled Interface You can manually bring up a downstream interface in an uplink-state group that has been disabled by UFD and is in a UFD-disabled error state. To re-enable one or more disabled downstream interfaces and clear the UFD-disabled error state, enter th[...]

Uplink Failure Detection (UFD) | 1091 Message 1 shows the Syslog messages displayed when you clear the UFD-disabled state from all disabled downstream interfaces in an uplink-state group by entering the clear ufd-disable uplink-state-group group-id command. All downstream interfaces return to an operationally up state. Message 1 Syslog Messages bef[...]

1092 | Uplink Failure Detection (UFD) www.dell.com | support.dell.com Displaying Uplink Failure Detection To display information on the Uplink Failure Detection feature, enter any of the following show commands: Show Command Syntax Description show uplink-state-group [ group-id ] [detail] Command Mode: EXEC Displays status information on a specifie[...]

Uplink Failure Detection (UFD) | 1093 Figure 54-3. show uplink-state-group Command Output FTOS# show uplink-state-group Uplink State Group: 1 Status: Enabled, Up Uplink State Group: 3 Status: Enabled, Up Uplink State Group: 5 Status: Enabled, Down Uplink State Group: 6 Status: Enabled, Up Uplink State Group: 7 Status: Enabled, Up Uplink State Group[...]

1094 | Uplink Failure Detection (UFD) www.dell.com | support.dell.com Figure 54-4. show interfaces Command: UFD Output Figure 54-5. show running-config uplink-state-group Command: UFD Output Figure 54-6. show configuration Command: UFD Output FTOS# show interfaces gigabitethernet 7/45 GigabitEthernet 7/45 is up, line protocol is down (error-disable[...]

Uplink Failure Detection (UFD) | 1095 Sample Configuration: Uplink Failure Detection Figure 54-7 shows a sample configuration of Uplink Failure Detection on a switch/router in which you: • Configure uplink-state group 3. • Add downstream links Gigabitethernet 0/1, 0/2, 0/5, 0/9, 0/11, and 0/12. • Configure two downstream links to be disabled [...]

1096 | Uplink Failure Detection (UFD) www.dell.com | support.dell.com[...]

Upgrade Procedures | 1097 55 Upgrade Procedures Find the upgrade procedures Go to the FTOS Release Notes for your system type to see all the requirements to upgrade to the desired FTOS version. Follow the procedures in the FTOS Release Notes for the software version you wish to upgrade to . Get Help with upgrades Direct any questions or concerns ab[...]

1098 | Upgrade Procedures www.dell.com | support.dell.com[...]

VLAN | 1099 56 VLAN VLANs are supported on platforms: c e s This chapter contains the following configuration topics: • Create a VLAN on page 1103 • Assign Interfaces to VLANs on page 1104 • Enable Routing between VLANs on page 1105 • Use a Native VLAN on Trunk Ports on page 1106 • Change the Default VLAN ID on page 1107 • Set the Null [...]

1100 | VLAN www.dell.com | support.dell.com Virtual LANs (VLANs) are a cost-effective method of segmenting and organizing a network. A single switch can be divided into multiple broadcast domains so that devices can be grouped and isolated; each logical segment is virtual LAN. Applying VLANs reduces broadcast traffic, introduces flexibility in the [...]

VLAN | 1101 VLAN Tagging Since a port may belong to more than one VLAN, the switch must be able to identify the VLAN two which a broadcast frame belongs. For this case, IEEE 802.1Q defines a method of marking frames to indicate the VLAN on which the frame originated. The marker, called a VLAN tag , is 4 bytes and is inserted after the source MAC in[...]

1102 | VLAN www.dell.com | support.dell.com Figure 56-4. Switch Behavior for Tagged/Untagged Port Mismatch Default VLAN The Default VLAN and is part of the system startup configuration, and is by default VLAN 1. You may make another VLAN the default VLAN. The default VLAN cannot be deleted, disabled, or configured (you cannot assign it an IP addres[...]

VLAN | 1103 • Set the Null VLAN as the Default VLAN on page 1107 • Enable VLAN Interface Counters on page 1108 Related Protocols and Topics The following protocols and topics are premised on VLANs, and contain more information about the utility of VLANs: • 802.1X • Chapter 17, GARP VLAN Registration Protocol . • Chapter 46, Service Provid[...]

1104 | VLAN www.dell.com | support.dell.com Assign Interfaces to VLANs A port may either be an untagged member of a single VLAN, or a tagged member of perhaps multiple VLANs. • Untagged Ports — ports that do not append an 802.1Q VLAN tag to frames on egress, and do not accept tagged frames on ingress (tagged frames are dropped). Untagged ports [...]

VLAN | 1105 Enable Routing between VLANs Each VLAN is a broadcast domain. For devices in two different broadcast domains to communicate, traffic must be routed, and so in this case each VLAN needs an IP address. FTOS#show vlan Codes: * - Default VLAN, G - GVRP VLANs NUM Status Q Ports * 1 Inactive 2 Active T Po1(So 0/0-1) T Gi 3/0 3 Active T Po1(So[...]

1106 | VLAN www.dell.com | support.dell.com Figure 56-5. Communicating between VLANs Use a Native VLAN on Trunk Ports Traditionally, a port may either be an untagged member of a single VLAN or a tagged member of multiple VLANs. However, FTOS allows you to make a port an untagged member and a tagged member of VLANs, concurrently. Ports that are an u[...]

VLAN | 1107 To configure a port so that it has a native VLAN: Change the Default VLAN ID By default, VLAN 1 is the Default VLAN. You can make another VLAN the default (which then enables you to configure VLAN 1). Set the Null VLAN as the Default VLAN In a Carrier Ethernet for Metro Service environment, service providers who perform frequent reconfi[...]

1108 | VLAN www.dell.com | support.dell.com Enable VLAN Interface Counters Use a Native VLAN on Trunk Ports is available only on platform: e x Note: VLAN egress counters might be higher than expected because source-suppression drops are counted. Task Command Syntax Command Mode Configure ingress, egress or both counters for VLAN interfaces. enable [...]

Virtual Routing and Forwarding (VRF) | 1109 57 Virtual Routing and Forwarding (VRF) Virtual Routing and Forwarding (VRF) (VRF) is supported only on platform: e VRF allows a physical router to partition itself into multiple Virtual Routers (VRs). The control and data plane are isolated in each VR so that traffic does NOT flow across VRs.Virtual Rout[...]

1110 | Virtual Routing and Forwarding (VRF) www.dell.com | support.dell.com Figure 57-1. VRF Network Example VRF Configuration Notes On E-Series routers, Dell Force10 VRF supports up to 15 VRF instances: 1 to 14 and the default VRF (0). Although there is no restriction on the number of VLANs that can be assigned to a VRF instance, the total number [...]

Virtual Routing and Forwarding (VRF) | 1111 Only Layer 3 interfaces can belong to a VRF. VRF is supported on following types of interface: • physical Ethernet interfaces • physical Sonet interfaces • port-channel interfaces (static & dynamic using LACP) • VLAN interfaces • loopback interfaces VRF supports route redistribution between [...]

1112 | Virtual Routing and Forwarding (VRF) www.dell.com | support.dell.com CAM Profiles Layer 3 CAM resources are shared among all VRF instances. To ensure that each VRF instance has sufficient CAM space: • On an E-Series Terascale platform, use the cam-profile ipv4-vrf or cam-profile ipv4-v6-vrf command and reload the system command to activate[...]

Virtual Routing and Forwarding (VRF) | 1113 • On an E-Series Exascale platform, use the cam-profile command to set the CAM size. Then select and enable VRF microcode for use with the VRF CAM-profile template, and reload the system to activate the profile. You can set the CAM size to 40M (default) which supports both IPv4 and IPv6 or 10M which sup[...]

1114 | Virtual Routing and Forwarding (VRF) www.dell.com | support.dell.com DHCP DHCP requests are not forwarded across VRF instances. The DHCP client and server must be on the same VRF instance. IP addressing Starting in release 8.4.1.0, you can configure identical or overlapping IP subnets on different interfaces if each interface belongs to a di[...]

Virtual Routing and Forwarding (VRF) | 1115 Load the VRF CAM Profile On an E-series Terascale platform, select the IPv4 or IPv6 CAM profile used to support VRF and reload the system to activate the profile. On an E-series Exascale platform, configure the CAM size used to support VRF. Then enable VRF microcode for use with the CAM profile and reload[...]

1116 | Virtual Routing and Forwarding (VRF) www.dell.com | support.dell.com Assign an Interface to a VRF You must enter the ip vrf forwarding command before you configure the IP address or any other setting on an interface. When you assign a VLAN interface to a VRF instance, the following conditions apply: • VLANs assigned to the same VRF have th[...]

Virtual Routing and Forwarding (VRF) | 1117 View VRF instance information To display information about VRF configuration, enter the show ip vrf command. Task Command Syntax Command Mode Display the interfaces assigned to a VRF instance. To display information on all VRF instances (including the default VRF 0), do not enter a value for vrf-name . sh[...]

1118 | Virtual Routing and Forwarding (VRF) www.dell.com | support.dell.com Connect an OSPF process to a VRF instance OSPF routes are supported on all VRF instances. Refer to Chapter 32, Open Shortest Path First (OSPFv2 and OSPFv3) for complete OSPF configuration information. Assign an OSPF process to a VRF instance . Return to CONFIGURATION mode t[...]

Virtual Routing and Forwarding (VRF) | 1119 Figure 57-2. Set up OSPF and static routes 3/0 3/0 7/0 7/1 7/2 9/18 9/19 9/20 R1 R2 router ospf 1 vrf blue router-id 1.0.0.1 network 1.0.0.0/24 area 0 network 10.0.0.0/24 area 0 router ospf 2 vrf orange router-id 2.0.0.1 network 2.0.0.0/24 area 0 network 20.0.0.0/24 area 0 ip route vrf green 31.0.0.0/24 3[...]

1120 | Virtual Routing and Forwarding (VRF) www.dell.com | support.dell.com Figure 57-3. Set up VRF interfaces 3/0 3/0 7/0 7/1 7/2 9/18 9/19 9/20 R1 R2 interface GigabitEthernet 7/0 ip vrf forwarding blue ip address 10.0.0.1/24 no shutdown interface GigabitEthernet 7/1 ip vrf forwarding orange ip address 20.0.0.1/24 no shutdown interface GigabitEth[...]

Virtual Routing and Forwarding (VRF) | 1121 The following example relates to the configuration shown in Figure 57-2 and Figure 57-3 . ROUTER 1 cam-profile ipv4-vrf microcode ipv4-vrf ! ip vrf default-vrf 0 ! ip vrf blue 1 ! ip vrf orange 2 ! ip vrf green 3 ! interface TenGigabitEthernet 3/0 no ip address switchport no shutdown ! interface GigabitEt[...]

1122 | Virtual Routing and Forwarding (VRF) www.dell.com | support.dell.com ROUTER 1 continued router ospf 1 vrf blue router-id 1.0.0.1 network 1.0.0.0/24 area 0 network 10.0.0.0/24 area 0 ! router ospf 2 vrf orange router-id 2.0.0.1 network 2.0.0.0/24 area 0 network 20.0.0.0/24 area 0 ! ip route vrf green 31.0.0.0/24 3.0.0.2! =====================[...]

Virtual Routing and Forwarding (VRF) | 1123 The following shows the output of the show commands on Router 1. ROUTER 2 continued interface Vlan 192 ip vrf forwarding orange ip address 2.0.0.2/24 tagged TenGigabitEthernet 3/0 no shutdown ! interface Vlan 256 ip vrf forwarding green ip address 3.0.0.2/24 tagged TenGigabitEthernet 3/0 no shutdown ! rou[...]

1124 | Virtual Routing and Forwarding (VRF) www.dell.com | support.dell.com . ROUTER 1 continued FTOS#show ip ospf 1 neighbor Neighbor ID Pri State Dead Time Address Interface Area 1.0.0.2 1 FULL/DR 00:00:32 1.0.0.2 Vl 128 0 FTOS#sh ip ospf 2 neighbor Neighbor ID Pri State Dead Time Address Interface Area 2.0.0.2 1 FULL/DR 00:00:37 2.0.0.2 Vl 192 0[...]

Virtual Routing and Forwarding (VRF) | 1125 The following shows the output of the show commands on Router 2. ROUTER 2 FTOS#show ip vrf VRF-Name VRF-ID Interfaces default-vrf 0 Gi 1/0-89, Te 3/0-3, Gi 4/0-89, Gi 5/0-89, Gi 6/0-89, Gi 9/0-17,21-47, Gi 11/0-47, Gi 12/0-47, Gi 13/0-47, Ma 0/0, Ma 1/0, Nu 0, Vl 1 blue 1 Gi 9/18, Vl 128 orange 2 Gi 9/19,[...]

1126 | Virtual Routing and Forwarding (VRF) www.dell.com | support.dell.com ROUTER 2 continued FForce10#show ip route vrf orange Codes: C - connected, S - static, R - RIP, B - BGP, IN - internal BGP, EX - external BGP,LO - Locally Originated, O - OSPF, IA - OSPF inter area, N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2, E1 - OSPF e[...]

Virtual Router Redundancy Protocol (VRRP) | 1127 58 Virtual Router Redundancy Protocol (VRRP) IPv4 Virtual Router Redundancy Protocol (VRRP) is available on platforms: c e s IPv6 VRRP (VRRP version 3) is available on platforms: c e s This chapter covers the following information: • VRRP Overview • VRRP Benefits • VRRP Implementation • VRRP [...]

1128 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Figure 58-1 shows a typical network configuration using VRRP. Instead of configuring the hosts on the network 10.10.10.0 with the IP address of either Router A or Router B as their default router; their default router is the IP Address configured on the virtual router.[...]

Virtual Router Redundancy Protocol (VRRP) | 1129 VRRP Benefits With VRRP configured on a network, end-station connectivity to the network is not subject to a single point-of-failure. End-station connections to the network are redundant and they are not dependent on IGP protocols to converge or update routing tables. VRRP Implementation On E-Series [...]

1130 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com The recommendations in Table 58-1 may vary depending on various factors like ARP broadcasts, IP broadcasts, or STP before changing the advertisement interval. When the number of packets processed by RP2/CP/FP processor increases or decreases based on the dynamics of th[...]

Virtual Router Redundancy Protocol (VRRP) | 1131 VRRP Configuration By default, VRRP is not configured. The following list specifies the configuration tasks for VRRP: • Create a Virtual Router on page 1131 (mandatory) • Assign Virtual IP addresses on page 1132 (mandatory) • Set VRRP Group (Virtual Router) Priority on page 1135 (optional) • [...]

1132 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Figure 58-3. Command Example Display: show config for the Interface Assign Virtual IP addresses Virtual routers contain virtual IP addresses configured for that VRRP Group (VRID). A VRRP group does not transmit VRRP packets until you assign the Virtual IP address to th[...]

Virtual Router Redundancy Protocol (VRRP) | 1133 • If the virtual IP address and the interface’s primary/secondary IP address are the same, the priority on that VRRP group is automatically set to 255. The interface then becomes the MASTER/OWNER router of the VRRP group and the interface’s physical MAC address is changed to that of the owner V[...]

1134 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Figure 58-6 shows the same VRRP group configured on multiple interfaces on different subnets. Figure 58-6. Command Example Display: show vrrp When the VRRP process completes its initialization, the State field contains either Master or Backup. Note: show vrrp displays [...]

Virtual Router Redundancy Protocol (VRRP) | 1135 Set VRRP Group (Virtual Router) Priority Setting a Virtual Router priority to 255 ensures that router is the “owner” virtual router for the VRRP group. VRRP elects the MASTER router by choosing the router with the highest priority. The default priority for a Virtual Router is 100. The higher the [...]

1136 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Configure VRRP Authentication Simple authentication of VRRP packets ensures that only trusted routers participate in VRRP processes. When authentication is enabled, FTOS includes the password in its VRRP transmission, and the receiving router uses that password to veri[...]

Virtual Router Redundancy Protocol (VRRP) | 1137 Disable Preempt The preempt command is enabled by default, and it forces the system to change the MASTER router if another router with a higher priority comes online. Prevent the BACKUP router with the higher priority from becoming the MASTER router by disabling preempt . Since preempt is enabled by [...]

1138 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Change the Advertisement interval By default, the MASTER router transmits a VRRP advertisement to all members of the VRRP group every 1 second, indicating it is operational and is the MASTER router. If the VRRP group misses 3 consecutive advertisements, then the electi[...]

Virtual Router Redundancy Protocol (VRRP) | 1139 Track an Interface or Object In previous releases, you could set FTOS to track the state of an interface for a specified virtual group. Starting in release 8.4.1.0, you can track additional objects for a virtual group, such as Layer 3 interfaces (IPv4 and IPv6), IPv4/IPv6 route reachability, and thre[...]

1140 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com To track an interface or configured object for a virtual group, use the track command in the VRRP mode: Figure 58-14. Command Example: track interface Figure 58-15. Command Example: show configuration in VRID mode Task Command Syntax Command Mode Monitor an interface o[...]

Virtual Router Redundancy Protocol (VRRP) | 1141 Figure 58-16. Command Example: show track Figure 58-17. Command Example: show vrrp Figure 58-18. Command Example: show running-config interface FTOS#show track Track 2 IPv6 route 2040::/64 metric threshold Metric threshold is Up (STATIC/0/0) 5 changes, last change 00:02:16 Metric threshold down 255 u[...]

1142 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com VRRP on a VRF Interface VRRP is supported with Virtual Routing and Forwarding (VRF) only on platform: e Starting in release 8.4.1.0, you can configure the VRRP feature on interfaces that belong to a non-default Virtual Routing and Forwarding (VRF) instance on E-Series [...]

Virtual Router Redundancy Protocol (VRRP) | 1143 Note: On E-Series routers, the VRID used by the VRRP protocol changes according to whether VRF microcode is loaded or not: • When VRF microcode is not loaded in CAM, the VRID for a VRRP group is the same as the VRID number configured with the vrrp-group or vrrp-ipv6-group c ommand: Figure 58-19. VR[...]

1144 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Sample Configurations VRRP for IPv4 Configuration The configuration in Figure 58-21 shows how to enable IPv4 VRRP. This example does not contain comprehensive directions and is intended to provide guidance for only a typical VRRP configuration. You can copy and paste f[...]

Virtual Router Redundancy Protocol (VRRP) | 1145 Figure 58-22. Configure VRRP for IPv4 Router 2 R2(conf)#int gi 2/31 R2(conf-if-gi-2/31)#ip address 10.1.1.1/24 R2(conf-if-gi-2/31)#vrrp-group 99 R2(conf-if-gi-2/31-vrid-99)#priority 200 R2(conf-if-gi-2/31-vrid-99)#virtual 10.1.1.3 R2(conf-if-gi-2/31-vrid-99)#no shut R2(conf-if-gi-2/31)#show conf ! in[...]

1146 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com VRRP for IPv6 Configuration Figure 58-22 shows an example of a VRRP for IPv6 configuration in which the IPv6 VRRP group consists of two routers. This example does not contain comprehensive directions and is intended to provide guidance for only a typical VRRP configura[...]

Virtual Router Redundancy Protocol (VRRP) | 1147 Figure 58-23. VRRP for IPv6 Topology Note: In a VRRP or VRRPv3 group, if two routers come up with the same priority and another router already has MASTER status, the router with master status continues to be master even if one of two routers has a higher IP or IPv6 address. Master State: Although bot[...]

1148 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Figure 58-24. Configure VRRP for IPv6 Router 2 R2(conf)#interface gigabitethernet 0/0 R2(conf-if-gi-0/0)#no ip address R2(conf-if-gi-0/0)#ipv6 address 1::1/64 R2(conf-if-gi-0/0)#vrrp-group 10 R2(conf-if-gi-0/0-vrid-10)# virtual-address fe80::10 R2(conf-if-gi-0/0-vrid-1[...]

Virtual Router Redundancy Protocol (VRRP) | 1149 VRRP in VRF Configuration The example in this section shows how to enable VRRP operation in a VRF virtualized network for the following scenarios: • Multiple VRFs on physical interfaces running VRRP • Multiple VRFs on VLAN interfaces running VRRP To view a VRRP in VRF configuration, use the show [...]

1150 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Both Switch-1 and Switch-2 have three VRF instances defined: VRF-1, VRF-2, and VRF-3. Each VRF has a separate physical interface to a LAN switch and an upstream VPN interface to connect to the Internet. Both Switch-1 and Switch-2 use VRRP groups on each VRF instance in[...]

Virtual Router Redundancy Protocol (VRRP) | 1151 Figure 58-27. VRRP in VRF: Switch-2 Non-VLAN Configuration VLAN Scenario In another scenario, VRF-1, VRF-2, and VRF-3 use a single physical interface with multiple tagged VLANS (instead of separate physical interfaces) to connect to the LAN. In this case, three VLANs are configured: VLAN-100, VLAN-20[...]

1152 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Figure 58-28. VRRP in VRF: Switch-1 VLAN Configuration Switch-1 S1(conf)#ip vrf VRF-1 1 ! S1(conf)#ip vrf VRF-2 2 ! S1(conf)#ip vrf VRF-3 3 ! S1(conf)#interface GigabitEthernet 12/4 S1(conf-if-gi-12/4)#no ip address S1(conf-if-gi-12/4)#switchport S1(conf-if-gi-12/4)#no[...]

Virtual Router Redundancy Protocol (VRRP) | 1153 Figure 58-29. VRRP in VRF: Switch-2 VLAN Configuration Switch-2 S2(conf)#ip vrf VRF-1 1 ! S2(conf)#ip vrf VRF-2 2 ! S2(conf)#ip vrf VRF-3 3 ! S2(conf)#interface GigabitEthernet 12/4 S2(conf-if-gi-12/4)#no ip address S2(conf-if-gi-12/4)#switchport S2(conf-if-gi-12/4)#no shutdown ! S2(conf-if-gi-12/4)#[...]

1154 | Virtual Router Redundancy Protocol (VRRP) www.dell.com | support.dell.com Displaying a VRRP in VRF Configuration To display information on a VRRP group that is configured on an interface that belongs to a VRF instance, enter the show running-config track [ interface interface ] command: Figure 58-30. Command Example: show running-config trac[...]

FTOS XML Feature | 1155 59 FTOS XML Feature FTOS XML Feature is supported on platforms: c e This chapter describes the FTOS XML Feature in the following major sections: • XML Functionality on page 1155 • The Form of XML Requests and Responses on page 1156 • The Configuration Request and Response on page 1157 • The “Show” Request and Res[...]

1156 | FTOS XML Feature www.dell.com | support.dell.com — show linecard slot ID — show linecard all — show sfm slot ID — show logging 1-65535 — show logging reverse — show sfm — show sfm all — show version — show running-config —Only the full report is supported, no options. — show interfaces —All the options are supported e[...]

FTOS XML Feature | 1157 Response Format Similarly, every response from FTOS begins with the XML declaration, followed by a “Response” tag: <?xml version="1.0" encoding="UTF-8"?> <Response MajorVersion="1" MinorVersion="0"> :: :: </Response> What goes between the Response tags depends on [...]

1158 | FTOS XML Feature www.dell.com | support.dell.com The “Show” Request and Response To generate an XML request that encapsulates a “show” command (to request a report), you use the <action> tag instead of the <configuration> tag as the Operation type. The schema of a show request allows only one <command>, as shown her[...]

FTOS XML Feature | 1159 Run an FTOS XML session Use the following procedure to start, run, and close an FTOS XML session: Figure 59-1 , below, illustrates entering FTOS XML mode. Figure 59-1 on page 1159 , below, illustrates the full sequence of invoking an XML session, entering a command, receiving a success response, and leaving the session with [...]

1160 | FTOS XML Feature www.dell.com | support.dell.com Figure 59-2. Example of a Successful XML Session FTOS# terminal xml FTOS(xml)# Enter XML request with CTRL-Y or empty line Clear XML request with CTRL-C Exit XML mode with CTRL-Z: <?xml version="1.0" encoding="UTF-8"?> <request MajorVersion="1" MinorVersi[...]

FTOS XML Feature | 1161 Configure a standard ACL To configure a standard ACL with XML, first enter FTOS XML mode, and then construct a configuration request, as described above. An example of a complete standard ACL configuration request message is: <?xml version="1.0" encoding="UTF-8"?> <request MajorVersion="1&qu[...]

1162 | FTOS XML Feature www.dell.com | support.dell.com Create an egress ACL and apply rules to the ACL To create an egress ACL and apply rules to the ACL in one single XML request, first enter FTOS XML mode, and then construct the configuration request (see Run an FTOS XML session on page 1159 ). The following example shows a configuration request[...]

FTOS XML Feature | 1163 — Invalid CLI commands or keywords — Invalid range of data specified in the CLI command • XML_SCHEMA_ERROR—This error is caused by: — Invalid XML method or operation tags — Invalid object hierarchy or value out of range • APPLICATION_ERROR—This error is caused by a failure to process the request, or a problem[...]

1164 | FTOS XML Feature www.dell.com | support.dell.com XML schema error This following XML request has transposed the <configuration> and <cli> tag sets: <?xml version="1.0" encoding="UTF-8"?> <request MajorVersion="1" MinorVersion="0"> <configuration> <cli> <command>[...]

FTOS XML Feature | 1165 The second command in this XML request also makes an invalid request: <?xml version="1.0" encoding="UTF-8"?> <request MajorVersion="1" MinorVersion="0"> <cli> <configuration> <command> ip access standard test1 </command> <command> no permit hos[...]

1166 | FTOS XML Feature www.dell.com | support.dell.com Figure 59-3. Example: show linecard 0 | display xml FTOS>#show linecard 0 | display xml <?xml version="1.0" encoding="UTF-8" ?> <response MajorVersion="1" MinorVersion="0"> <action> <linecard> <slotId>0</slotId> <[...]

C-Series Debugging and Diagnostics | 1167 60 C-Series Debugging and Diagnostics In addition to standard manageability features such as LEDs, SNMP alarms and traps, and Syslogging, the C-Series supports several diagnostic and debugging features that are crucial to isolating and resolving support issues during the operations and maintenance phase. ?[...]

1168 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Switch Fabric overview The switch fabric is formed through the installed RPMs and line cards via C-Series Switch Fabric (CSF) ASICs. Each RPM includes four CSFs, each of which provides eight Backplane Data (BDP) links, one link for each line card slot. In total, an RPM provid[...]

C-Series Debugging and Diagnostics | 1169 FTOS Switch Agent (SWAGT) monitors the IDP and BDP links on the line cards. FTOS Link Monitoring task continually polls the status of the IDP and BDP links. If it finds an open link, the system brings down the link and reports the condition via a message similar to the one shown in Message 1 . If a backplan[...]

1170 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 60-3. show sfm Command Example Use the FTOS Syslogging feature to monitor the overall status of the switch fabric. Changes in switch fabric status are reported via messages similar those in Message 2 . Runtime hardware status monitoring The FTOS Poll Manager (POLLMGR) [...]

C-Series Debugging and Diagnostics | 1171 Figure 60-4 illustrates the IPC subsystem, including the IRC links between the RPMs, and the relevant troubleshooting commands. Figure 60-4. IPC Sub-system POLLMGR-2-POLLMGR_RP M_ECC_ERR_DETECT Indicates that the system detected a single-bit ECC memory error in the RPM CPU memory (SDRAM). The system tracks [...]

1172 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Inter-CPU timeouts The CP monitors the health status of the other processors using heartbeat messaging exchange. FTOS automatically saves critical information about the IPC failure to NVRAM. Such information includes: • Status counters on the internal Ethernet interface •[...]

C-Series Debugging and Diagnostics | 1173 FTOS actually saves up to three persistent files depending upon the type of failure. When reporting an RPM failover triggered by a loss of the IPC or IRC heartbeats, look for failure records in the following directories: — Application or kernel core dump RP in the CORE_DUMP_DIR — CP trace log file (look[...]

1174 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 60-5. show environment rpm Command Example Recognize an overtemperature condition An overtemperature condition occurs, for one of two reasons: • The card genuinely is too hot. • A sensor has malfunctioned. Inspect cards adjacent to the one reporting the condition t[...]

C-Series Debugging and Diagnostics | 1175 2. Check air flow through the system. On the C-Series, air flows sideways from right to left. Ensure the air ducts are clean and that all fans are working correctly. 3. Once the software has determined that the temperature levels are within normal limits, the card can be re-powered safely. Use the power-on [...]

1176 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com The TRACE_LOG_DIR/TRACE_CURR_BOOT directory can be reached by FTP or by using the show file command from the flash://TRACE_LOG_DIR directory. Automatic trace log updates The system automatically saves trace files to the internal flash. The files are saved to the TRACE_LOG_DIR[...]

C-Series Debugging and Diagnostics | 1177 To manually write the contents of an RPM log to the internal flash: To manually write the contents of a line card log to the internal flash: Figure 60-7. TRACE_CURR_BOOT Directory example Disable writing the contents of a hardware log to the internal the flash: View the hardware log contents or clear them w[...]

1178 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com When the trace messages are being saved on reload, Message 9 is displayed. The CP and LP trace file names at chassis reload are: • CP: reload_traceRPM0_CP • LP: reload_traceLP[0-7] Figure 60-8. TRACE_LAST_BOOT Directory example CP software exceptions When a RPM resets due[...]

C-Series Debugging and Diagnostics | 1179 Figure 60-9. Command Example: show command-history Clearing the command history Clear the command history buffer using the command clear command-history from EXEC Privilege mode, as shown in Figure 60-10 . Figure 60-10. Clearing the Command History Advanced debugging commands The C-Series supports advanced [...]

1180 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 60-11. debug Command Tree show hardware commands The show hardware command tree consists of EXEC Privilege commands that have been created or changed specially for use with the C-Series. These commands display information from a hardware sub-component, such as an FP or[...]

C-Series Debugging and Diagnostics | 1181 Recognizing a High CPU Condition A high CPU condition exist when any of the messages in Message 10 appear. Troubleshoot a high CPU condition If FTOS indicates a high CPU condition or you suspect one: show hardware cpu data-plane View driver-level statistics for the data-plane port on the CPU for the specifi[...]

1182 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Monitoring hardware components with SNMP The SNMP traps and OIDs in Table 60-4 provide information on C-Series hardware components. Table 60-4. SNMP Traps and OIDs OID String OID Name Description RPM .1.3.6.1.4.1.6027.3.1.1.3.8 chRPMMajorAlarmStatus Fault status of the major [...]

C-Series Debugging and Diagnostics | 1183 Hardware watchdog timer The hardware watchdog command automatically reboots an FTOS switch/router with a single RPM that is unresponsive. This is a last resort mechanism intended to prevent a manual power cycle. .1.3.6.1.4.1.6027.3.1.1.2.1.1.2 chSysPowerSupplyOperStatus Each entry in the chSysPowerSupplyTab[...]

1184 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Offline diagnostics The offline diagnostics test suite is useful for isolating faults and debugging hardware. Diagnostics are invoked from the FTOS CLI. While diagnostics are running, the status can be monitored via the CLI. The tests results are written to a file in flash me[...]

C-Series Debugging and Diagnostics | 1185 • The complete diagnostics test suite normally runs for 4 to 6 minutes; the 48-port 1-Gigabit line card takes slightly longer than the 4-port 10-Gigabit line card. Take the line card offline Place the line card in an offline state using the offline linecard command, as shown in Figure 60-12 . Figure 60-12[...]

1186 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 60-15. show diag linecard Command Example Use the show file flash:/ filename view the detailed test results in the test report saved to flash memory on the RPM. Use the command. Figure 60-16 shows the filename of the test results, and Figure 60-16 shows the contents of[...]

C-Series Debugging and Diagnostics | 1187 Figure 60-16. Viewing Offline Diagnostics Test Results FTOS#show diag linecard 5 Diag status of Linecard slot 5: ------------------------------------------------------------------- Card is currently offline. Card alllevels diag issued at THU FEB 08, 2018 04:10:05 PM. Current diag status: Card diags are done[...]

1188 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 60-17. Viewing Offline Diagnostics Test Results (continued) Bring the line card online Bring the card back online using the online linecard command. The card will be reset. Use the show linecard all command to verify the online status of the line card. Test 107 - NVRAM[...]

C-Series Debugging and Diagnostics | 1189 Buffer tuning Buffer Tuning allows you to modify the way your switch allocates buffers from its available memory, and helps prevent packet drops during a temporary burst of traffic. The C-Series and S-Series ASICs implement the key functions of queuing, feature lookups, and forwarding lookups in hardware. ?[...]

1190 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com • Available packet pointers (2k per interface). Each packet is managed in the buffer using a unique packet pointer. Thus, each interface can manage up to 2k packets. You can configure dynamic buffers per port on both 1G and 10G FPs and per queue on CSFs. By default, the FP [...]

C-Series Debugging and Diagnostics | 1191 Buffer tuning commands Configuration changes take effect immediately and appear in the running configuration. Since under normal conditions all ports do not require the maximum possible allocation, the configured dynamic allocations can exceed the actual amount of available memory; this is called oversubscr[...]

1192 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Display the allocations for any buffer profile using the show commands in Figure 60-20 . Display the default buffer profile using the command show buffer-profile { summary | detail } from EXEC Privilege mode, as shown in Figure 60-19 . Figure 60-19. Display the Default Buffer[...]

C-Series Debugging and Diagnostics | 1193 Figure 60-20. Displaying Buffer Profile Allocations FTOS#show running-config interface tengigabitethernet 2/0 ! interface TenGigabitEthernet 2/0 no ip address mtu 9252 switchport no shutdown buffer-policy myfsbufferprofile FTOS# sho buffer-profile detail int gi 0/10 Interface Gi 0/10 Buffer-profile fsqueue-[...]

1194 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com Use a pre-defined buffer profile FTOS provides two pre-defined buffer profiles, one for single queue (i.e non-QoS) applications, and one for four queue (i.e QoS) applications. You must reload the system for the global buffer-profile to take effect ( Message 12 ). The buffer-p[...]

C-Series Debugging and Diagnostics | 1195 Figure 60-21. Single Queue Application With Default Packet Pointers ! buffer-profile fp fsqueue-fp buffer dedicated queue0 3 queue1 3 queue2 3 queue3 3 queue4 3 queue5 3 queue6 3 queue7 3 buffer dynamic 1256 ! buffer-profile fp fsqueue-hig buffer dedicated queue0 3 queue1 3 queue2 3 queue3 3 queue4 3 queue5[...]

1196 | C-Series Debugging and Diagnostics www.dell.com | support.dell.com[...]

E-Series TeraScale Debugging and Diagnostics | 1197 61 E-Series TeraScale Debugging and Diagnostics This chapter addresses E-Series TeraScale Debugging and Diagnostics TeraScale platforms. Refer to Chapter 63, E-Series ExaScale Debugging and Diagnostics for information relating to that platform. In addition to the FTOS high availability features, E[...]

1198 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com • Write the contents of the trace buffer on page 1216 • Recognize a high CPU condition on page 1217 • Configure an action upon a hardware error on page 1217 • Core dumps on page 1218 Overview The FTOS diagnostics and debugging features are a proactive approa[...]

E-Series TeraScale Debugging and Diagnostics | 1199 Figure 61-1. Dataplane Loopback If three consecutive packets are lost, an error message is logged and then one of the following happens: • The RPM-SFM runtime loopback test failure initiates an SFM walk whenever it is enabled, feasible and necessary. The system automatically places each SFM (in [...]

1200 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com • An SFM walk will not be able to identify multiple faulty SFMs, faulty linecards, or faulty RPM. In this case, the following event is logged. • If a line card runtime loopback test fails, the system does not launch an SFM walk. A message is logged indicating th[...]

E-Series TeraScale Debugging and Diagnostics | 1201 RPM-SFM bring down If a full set of SFMs are online during the runtime loopback test and a RPM-SFM runtime loopback test failure occurs, an automatic SFM walk is launched in an attempt to determine if the failure is due to a faulty SFM. If confirmed, the single SFM is identified and disabled (brin[...]

1202 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com If the RPM-SFM or line card-SFM loopback test detects an SFM failure, an attempt is made to isolate a single faulty SFM by automatically walking the SFMs. For this failure case, error messages similar to the runtime loopback test error are generated. In the example [...]

E-Series TeraScale Debugging and Diagnostics | 1203 When there are a full set of SFMs online, powering down one SFM will reduce the total bandwidth supported by the chassis, and may affect data flow. A warning message is issued at the command line that requires user confirmation to proceed with the command ( Figure 61-3 ). Figure 61-3. power-off sf[...]

1204 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com Reset the SFM When the SFM is taken offline due to an error condition, you can execute the reset sfm command and initiate a manual recovery. When an error is detected on an SFM module, this command is a manual recovery mechanism. Since this command can be used with [...]

E-Series TeraScale Debugging and Diagnostics | 1205 The PCDFO polling feature monitors data received over the switch fabric. When a DFO error is detected, no automatic action is initiated by the system. The message issued is similar to: The following graphic illustrates the E600 and E1200 switch fabric architecture. Each ingress and egress Buffer a[...]

1206 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com For the transient case, PCDFO errors are not reported to the log. The hardware system automatically recovers from the error state, and the dataplane continues to function properly. In persistent case, PCDFO errors will appear in the log, and the error state is likel[...]

E-Series TeraScale Debugging and Diagnostics | 1207 The three CPUs use Fast Ethernet connections to communicate to each other and to the line card CPUs using Inter-Processor Communication (IPC). The CP monitors the health status of the other processors using heartbeat messaging exchange. FTOS automatically saves critical information about the IPC f[...]

1208 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com In a dual RPM system, the two RPMs send synchronization messages via inter-RPM communication (IRC). As described in the High Availability chapter, an RPM failover can be triggered by loss of the heartbeat (similar to a keepalive message) between the two RPMs. FTOS r[...]

E-Series TeraScale Debugging and Diagnostics | 1209 Show hardware commands The show hardware command tree consists of privileged EXEC commands created or changed specially for use with the E-Series. These commands display information from a hardware sub-component, such as the Buffer and Traffic Management (BTM) ASIC and the Forwarding and Packet Cl[...]

1210 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com • total run count • total failure count • consecutive failure count • error code The diagnostics tests are grouped into three levels: Level 0—Check the inventory of devices. Verify the existence of devices (e.g., device ID test). Level 1—Verify the devic[...]

E-Series TeraScale Debugging and Diagnostics | 1211 3. Execute the show diag command to view a report of the test results. 4. Report any test failures to your Dell Force10 technical support engineer. 5. Bring the card back online with the online linecard { slot# } command. The card will be reset. Parity error detection and correction There are two [...]

1212 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com To enable Parity Error Correction: FTOS displays Message 8 on the console, when you enable Parity Error Correction. FTOS also records the messages in Message 9 in the trace log when you enable and disable Parity Error Correction, or insert a line card with Parity Er[...]

E-Series TeraScale Debugging and Diagnostics | 1213 The line card status does not reflect transient errors until FTOS encounters five recoverable or 50 phantom transient errors on a card within an hour, as shown in Figure 61-9 . The text “Last Event” indicates the last type of parity error (transient or real) that occurred. Use SNMP to poll the[...]

1214 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com Trace logs In addition to the syslog buffer, FTOS buffers trace messages which are continuously written by various FTOS software tasks to report hardware and software events and status information. Each trace message provides the date, time, and name of the FTOS pro[...]

E-Series TeraScale Debugging and Diagnostics | 1215 Manual reload condition When the chassis is reloaded manually (through the CLI), trace messages in all of the buffers (software and hardware) in CP and linecards are saved to the flash as reload_traceRPM0_CP and reload_traceLP1 in flash:/TRACE_LOG_DIR/TRACE_CURR_BOOT . After reload, you can see th[...]

1216 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com Figure 61-10. show command-history Command Example Write the contents of the trace buffer The trace logs are saved to automatically but you can save the contents of a buffer manually via the CLI. To manually write the contents of a trace buffer on CP to a file on th[...]

E-Series TeraScale Debugging and Diagnostics | 1217 Recognize a high CPU condition A high CPU condition exists when any of the messages in Message 14 appear. Configure an action upon a hardware error You can configure FTOS to take an action if it encounters an BTM, FPC, or MAC hardware error. Buffer traffic manager hardware errors FTOS displays Mes[...]

1218 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com Flexible packet classifier hardware errors FTOS displays Message 19 in case of a parity error on an FPC. Configure an action using the command hardware monitor linecard asic fpc action-on-error . You may place the line card in a problem state, reset the card, or shu[...]

E-Series TeraScale Debugging and Diagnostics | 1219 Kernel core dump —The E-Series supports kernel core dumps for CP and for RP1/RP2 using a naming convention of f10{cp|rp{1|2}}.kcore.gz . RP kernel core dumps are enabled by default. New files are written in flash until space is exhausted, in which case the write is aborted. CP kernel core dumps [...]

1220 | E-Series TeraScale Debugging and Diagnostics www.dell.com | support.dell.com Line card core dumps are disabled by default. To enable line card core dumps and specify the shutdown mode: Once the core dump file has been created with the logging coredump command, the file can be deleted from the Standby RPM flash although the space is not relea[...]

S-Series Debugging and Diagnostics | 1221 62 S-Series Debugging and Diagnostics The chapter contains the following major sections: • Offline diagnostics • Trace logs on page 1225 • Hardware watchdog timer on page 1226 • Buffer tuning on page 1226 • Troubleshooting packet loss on page 1232 • Application core dumps on page 1237 • Mini c[...]

1222 | S-Series Debugging and Diagnostics www.dell.com | support.dell.com Important Points to Remember • You can only perform offline diagnostics on an offline standalone unit or offline member unit of a stack of three or more. You cannot perform diagnostics on the management or standby unit in a stack of two or more ( Message 1 ). • Perform of[...]

S-Series Debugging and Diagnostics | 1223 Figure 62-2. Verifying the Offline/Online Status of an S-Series Stack Unit 3. Start diagnostics on the unit using the command diag , as shown in Figure 62-3 . When the tests are complete, the system displays syslog Message 2 , and automatically reboots the unit. Diagnostic results are printed to a file in t[...]

1224 | S-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 62-3. Running Offline Diagnostics on an S-Series Standalone Unit Figure 62-4 shows the output of the master and member units when you run offline diagnostics on a member unit. Figure 62-4. Running Offline Diagnostics on an S-Series Stack Member 4. View the results of t[...]

S-Series Debugging and Diagnostics | 1225 Figure 62-5. Viewing the Results of Offline Diagnostics on a Standalone Unit Trace logs In addition to the syslog buffer, FTOS buffers trace messages which are continuously written by various FTOS software tasks to report hardware and software events and status information. Each trace message provides the d[...]

1226 | S-Series Debugging and Diagnostics www.dell.com | support.dell.com Auto Save on Crash or Rollover Exception information on for master or standby units is stored in the flash:/TRACE_LOG_DIR directory. This directory contains files that save trace information when there has been a task crash or timeout. On a master unit, the TRACE_LOG_DIR file[...]

S-Series Debugging and Diagnostics | 1227 1. CSF – Output queues going from the CSF. 2. FP Uplink—Output queues going from the FP to the CSF IDP links. 3. Front-End Link—Output queues going from the FP to the front-end PHY. All ports support eight queues, 4 for data traffic and 4 for control traffic. All 8 queues are tunable. Physical memory [...]

1228 | S-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 62-6. Buffer Tuning Points Deciding to tune buffers Dell Force10 recommends exercising caution when configuring any non-default buffer settings, as tuning can significantly affect system performance. The default values work for most cases. As a guideline, consider tuni[...]

S-Series Debugging and Diagnostics | 1229 Buffer tuning commands Configuration changes take effect immediately and appear in the running configuration. Since under normal conditions all ports do not require the maximum possible allocation, the configured dynamic allocations can exceed the actual amount of available memory; this is called oversubscr[...]

1230 | S-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 62-7. Display the Default Buffer Profile Figure 62-8. Displaying Buffer Profile Allocations FTOS#show buffer-profile detail interface gigabitethernet 0/1 Interface Gi 0/1 Buffer-profile - Dynamic buffer 194.88 (Kilobytes) Queue# Dedicated Buffer Buffer Packets (Kilobyt[...]

S-Series Debugging and Diagnostics | 1231 Using a pre-defined buffer profile FTOS provides two pre-defined buffer profiles, one for single-queue (i.e non-QoS) applications, and one for four-queue (i.e QoS) applications. You must reload the system for the global buffer profile to take effect ( Message 3 ). The buffer-profile global command fails if [...]

1232 | S-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 62-9. Single Queue Application for S50N with Default Packet Pointers Troubleshooting packet loss The show hardware stack-unit command, introduced in FTOS 7.7.1.0 is intended primarily to troubleshoot packet loss. FTOS 7.7.1.1 augmented the statistics reported by existi[...]

S-Series Debugging and Diagnostics | 1233 Figure 62-10. Displaying Drop Counter Statistics Display drop counters with the show hardware stack-unit drops unit port command: FTOS#show hardware stack-unit 0 drops UNIT No: 0 Total Ingress Drops :0 Total IngMac Drops :0 Total Mmu Drops :0 Total EgMac Drops :0 Total Egress Drops :0 UNIT No: 1 Total Ingre[...]

1234 | S-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 62-11. Displaying Drop Counters Dataplane Statistics The show hardware stack-unit cpu data-plane statistics command provides insight into the packet types coming to the CPU. As shown in Figure 62-12 , the command output has been augmented, providing detailed RX/TX pack[...]

S-Series Debugging and Diagnostics | 1235 Figure 62-12. Displaying Dataplane Statistics The show hardware stack-unit cpu party-bus statistics command displays input and output statistics on the party bus, which carries inter-process communication traffic between CPUs, as shown in Figure 62-13 . Figure 62-13. Displaying Party Bus Statistics FTOS#sho[...]

1236 | S-Series Debugging and Diagnostics www.dell.com | support.dell.com Displaying Stack Port Statistics The show hardware stack-unit stack-port command displays input and output statistics for a stack-port interface, as shown in Figure 62-14 . Figure 62-14. Displaying Stack Unit Statistics Displaying Stack Member Counters The show hardware stack[...]

S-Series Debugging and Diagnostics | 1237 Application core dumps Application core dumps are disabled by default. A core dump file can be very large. Due to memory requirements the file can only be sent directly to an FTP server. It is not stored on the local flash. Enable full application core dumps with the following: Undo this command using the n[...]

1238 | S-Series Debugging and Diagnostics www.dell.com | support.dell.com Figure 62-16. Mini application core file naming example When a member or standby unit crashes, the mini core file gets uploaded to master unit. When the master unit crashes, the mini core file is uploaded to new master. Figure 62-17. Mini core text file example The panic stri[...]

Standards Compliance | 1239 63 Standards Compliance This appendix contains the following sections: • IEEE Compliance • RFC and I-D Compliance • MIB Location IEEE Compliance • 802.1AB — LLDP • 802.1D — Bridging, STP • 802.1p — L2 Prioritization • 802.1Q — VLAN Tagging, Double VLAN Tagging, GVRP • 802.1s — MSTP • 802.1w ?[...]

1240 | Standards Compliance www.dell.com | support.dell.com • Dell Force10 — PVST+ • SFF-8431 — SFP+ Direct Attach Cable (10GSFP+Cu) • MTU — 9,252 bytes RFC and I-D Compliance The following standards are supported by FTOS, and are grouped by related protocol. The columns showing support by platform indicate which version of FTOS first s[...]

Standards Compliance | 1241 General IPv4 Protocols FTOS support, per platform RFC# Full Name S-Series C-Series E-Series TeraScale E-Series ExaScale 791 Internet Protocol 7.6.1 7.5.1  8.1.1 792 Internet Control Message Protocol 7.6.1 7.5.1  8.1.1 826 An Ethernet Address Resolution Protocol 7.6.1 7.5.1  8.1.1 1027 Using ARP to Implement Tran[...]

1242 | Standards Compliance www.dell.com | support.dell.com General IPv6 Protocols FTOS support, per platform RFC# Full Name S-Series C-Series E-Series TeraScale E-Series ExaScale 1886 DNS Extensions to support IP version 6 7.8.1 7.8.1  8.2.1 1981 (Partial) Path MTU Discovery for IP version 6 7.8.1 7.8.1  8.2.1 2460 Internet Protocol, Version[...]

Standards Compliance | 1243 Border Gateway Protocol (BGP) FTOS support, per platform RFC# Full Name S-Series C-Series E-Series TeraScale E-Series ExaScale 1997 BGP Communities Attribute 7.8.1 7.7.1  8.1.1 2385 Protection of BGP Sessions via the TCP MD5 Signature Option 7.8.1 7.7.1  8.1.1 2439 BGP Route Flap Damping 7.8.1 7.7.1  8.1.1 2545 [...]

1244 | Standards Compliance www.dell.com | support.dell.com Intermediate System to Intermediate System (IS-IS) FTOS support, per platform RFC# Full Name S-Series C-Series E-Series TeraScale E-Series ExaScale 1142 OSI IS-IS Intra-Domain Routing Protocol (ISO DP 10589)  8.1.1 1195 Use of OSI IS-IS for Routing in TCP/IP and Dual Environments  8.[...]

Standards Compliance | 1245 Multiprotocol Label Switching (MPLS) FTOS support, per platform RFC# Full Name S-Series C-Series E-Series TeraScale E-Series ExaScale 2702 Requirements for Traffic Engineering Over MPLS 8.3.1 3031 Multiprotocol Label Switching Architecture 8.3.1 3032 MPLS Label Stack Encoding 8.3.1 3209 RSVP-TE: Extensions to RSVP for LS[...]

1246 | Standards Compliance www.dell.com | support.dell.com Multicast FTOS support, per platform RFC# Full Name S-Series C-Series E-Series TeraScale E-Series ExaScale 1112 Host Extensions for IP Multicasting 7.8.1 7.7.1  8.1.1 2236 Internet Group Management Protocol, Version 2 7.8.1 7.7.1  8.1.1 2710 Multicast Listener Discovery (MLD) for IPv[...]

Standards Compliance | 1247 Network Management FTOS support, per platform RFC# Full Name S-Series C-Series E-Series TeraScale E-Series ExaScale 1155 Structure and Identification of Management Information for TCP/IP-based Internets 7.6.1 7.5.1  8.1.1 1156 Management Information Base for Network Management of TCP/IP-based internets 7.6.1 7.5.1 [...]

1248 | Standards Compliance www.dell.com | support.dell.com 2576 Coexistence Between Version 1, Version 2, and Version 3 of the Internet-standard Network Management Framework 7.6.1 7.5.1  8.1.1 2578 Structure of Management Information Version 2 (SMIv2) 7.6.1 7.5.1  8.1.1 2579 Textual Conventions for SMIv2 7.6.1 7.5.1  8.1.1 2580 Conformanc[...]

Standards Compliance | 1249 3815 Definitions of Managed Objects for the Multiprotocol Label Switching (MPLS), Label Distribution Protocol (LDP) 8.3.1 5060 Protocol Independent Multicast MIB 7.8.1 7.8.1 7.7.1 8.1.1 ANSI/TIA-1057 The LLDP Management Information Base extension module for TIA-TR41.4 Media Endpoint Discovery information 7.7.1 7.6.1 7.6.[...]

1250 | Standards Compliance www.dell.com | support.dell.com FORCE10-CS-C HASSIS-MIB Dell Force10 C-Series Enterprise Chassis MIB 7.5.1 FORCE10-IF-EX TENSION-MIB Dell Force10 Enterprise IF Extension MIB (extends the Interfaces portion of the MIB-2 (RFC 1213) by providing proprietary SNMP OIDs for other counters displayed in the ”show interfaces”[...]

Standards Compliance | 1251 MIB Location Dell Force10 MIBs are under the Force10 MIBs subhead on the Documentation page of iSupport: https://www.force10networks.com/csportal20/KnowledgeBase/Documentation.aspx You also can obtain a list of selected MIBs and their OIDs at the following URL: https://www.force10networks.com/csportal20/MIBs/MIB_OIDs.asp[...]

1252 | Standards Compliance www.dell.com | support.dell.com[...]

Index | 1253 Index Numerics 10/100/1000 Base-T Ethernet line card, auto negotiation 455 100/1000 Ethernet interfaces port channels 429 4-Byte AS Numbers 218 802.1AB 1239 802.1D 1239 802.1p 1239 802.1p/Q 1239 802.1Q 1239 802.1s 1239 802.1w 1239 802.1X 1239 802.3ab 1239 802.3ac 1239 802.3ad 1239 802.3ae 1239 802.3af 1239 802.3ak 1239 802.3i 1239 802.[...]

1254 | Index www.dell.com | support.dell.com defaults 225 Distance defaults 225 enabling a peer group 233 establishing BGP process 227 External BGP requirements 226 Fast External Fallover 225 filtering routes based on AS-PATH 256 filtering routes using a route map 256 filtering routes using IP Community list 249 filtering routes using prefix lists [...]

Index | 1255 flowcontrol 452 Force 10 Resilient Ring Protocol 335 forward delay 905 , 1055 FRRP 335 FRRP Master Node 335 FRRP Transit Node 336 FTOS 699 FTOS XML session management 1159 FTP 68 G GARP VLAN Registration Protocol (GVRP) 373 graceful restart 390 grep option 43 GVRP (GARP VLAN Registration Protocol) 373 H Hash algorithm 439 hash algorith[...]

1256 | Index www.dell.com | support.dell.com assigning IP address to interface 421 assigning to interface 465 assigning to port channel 435 composition 464 configuring static routes 466 IP fragmentation 450 IP hashing scheme 438 IP MTU configuring 453 maximum size 450 IP prefix lists "permit all" statement 154 applying to OSPF routes 157 [...]

Index | 1257 LSAs 692 AS Boundary 699 AS External 699 Network 699 Network Summary 699 NSSA External 700 Opaque Area-local 699 Opaque Link-local 700 Router 699 types supported 699 LSPs 508 M MAC hashing scheme 438 management interface 420 accessing 423 configuring a management interface 423 configuring IP address 423 definition 423 IP address consid[...]

1258 | Index www.dell.com | support.dell.com router ID 709 using loopback interfaces 710 using prefix lists 721 viewing configuration of neighboring router 723 , 744 viewing interface areas 709 viewing virtual link configuration 720 OSPFv23 redistribute routes 730 OSPFv3 authentication 734 configuration 726 configure a passive interface 729 default[...]

Index | 1259 adding routes 882 auto summarization default 878 changing RIP version 882 configuring interfaces to run RIP 880 debugging RIP 886 default values 878 default version 879 disabling RIP 880 ECMP paths supported 878 enabling RIP 879 route information 881 setting route metrics 885 summarizing routes 885 timer values 878 version 1 descriptio[...]

1260 | Index www.dell.com | support.dell.com disabling STP 901 , 1052 forward delay 905 , 1055 hello time 905 , 1055 interfaces 902 , 1052 max age 905 , 1055 port cost 906 , 1056 port ID 1050 port priority 905 , 906 , 1055 , 1056 Portfast 906 , 1056 root bridge 908 , 1059 system log 393 T TACACS+ 931 deleting a server host 935 selecting TACACS+ as [...]

Index | 1261 remote authentication and local authorization 949 TACACS+ authentication, support for local authorization 949 VTYlines local authentication and authorization 948 W warm upgrade 393 X XML 1155 , 1159 XML CLI apply ACL 1161 configure extended ACL 1161 configure standard ACL 1161 create egress ACL and apply rules 1162 error conditions 116[...]

1262 | Index www.dell.com | support.dell.com[...]