Cisco Q-in-Q Configuration Example

  

Cisco Q-in-Q Configuration Example:

Cisco switches(not all of them) supports IEEE 802.1Q tunneling(Q-in-Q) and Layer 2 protocol tunneling features to carry customer’s multiple vlans across the service provider’s L2 backbone.

In this example, we will do Q-in-Q configuration.

Here is the topology for this example:

 

 

Q-in-Q configuration on PE Switch-1:

interface GigabitEthernet0/2

 port-type nni

 switchport access vlan 100

 switchport mode dot1q-tunnel

Q-in-Q configuration on PE Switch-2:

interface GigabitEthernet0/2

 port-type nni

 switchport access vlan 100

 switchport mode dot1q-tunnel

Uplink Port Configuration of CE Switch-1

interface FastEthernet3

 switchport mode trunk

interface Vlan10

 ip address 10.10.10.1 255.255.255.0

interface Vlan20

 ip address 20.20.20.1 255.255.255.0

Uplink Port Configuration of CE Switch-2

interface FastEthernet3

 switchport mode trunk

interface Vlan10

 ip address 10.10.10.2 255.255.255.0

interface Vlan20

 ip address 20.20.20.2 255.255.255.0

 

Lets test the L2TP(Layer2 Tunneling Protocol) configuration:

CE –Switch-1#ping 10.10.10.2               

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

We see that connection works.

Lets increase the size of the packet:

CE –Switch-1#ping 10.10.10.2 size 1496 df-bit

Type escape sequence to abort.

Sending 5, 1496-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:

Packet sent with the DF bit set

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

It’s ok again..

Lets increase the size 1-byte more..

CE –Switch-1#ping 10.10.10.2 size 1497 df-bit

Type escape sequence to abort.

Sending 5, 1497-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:

Packet sent with the DF bit set

.....

Success rate is 0 percent (0/5)

It doesn’t work.Because  PE switch adds a new 802.1q header.The size of this heades is 4-byte.So, the MTU must be increased at all switches of the Service Provider.New value must be 1504 or more. 

Bgp route filtering with Route-map

Bgp route filtering with Route-map

In this example we are only announcing default route and filtering specific routes.

Here is the configuration:

router bgp 65500
 no synchronization
 bgp log-neighbor-changes
 network 0.0.0.0
 network 192.168.1.0 mask 255.255.255.0
 neighbor 10.10.10.2 remote-as 65500
 neighbor 10.10.10.2 route-map spoke-out out

ip prefix-list defaultroute seq 5 permit 0.0.0.0/0

route-map spoke-out permit 10
 match ip address prefix-list defaultroute
 set metric 0
 set ip next-hop 10.10.10.1

We see that, we have 192.168.1.0/24 network in our bgp table.

R1#show ip bgp
BGP table version is 4, local router ID is 10.10.10.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
*> 0.0.0.0          10.10.10.254               0         32768 i
*> 192.168.1.0      0.0.0.0                    0         32768 i

But we are not advertising it to the remote neighbor:

R1#show ip bgp neighbors 10.10.10.2 advertised-routes 
BGP table version is 4, local router ID is 10.10.10.1
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
*> 0.0.0.0          10.10.10.254               0         32768 i
Total number of prefixes 1

Lets also check the remote router:

R4#show ip bgp neighbors 10.10.10.1 routes
BGP table version is 3, local router ID is 10.10.10.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network          Next Hop            Metric LocPrf Weight Path
*>i0.0.0.0          10.10.10.1             0    100      0 i
Total number of prefixes 1

Cisco Remote Switched Port Analyzer(RSPAN)

Cisco Remote Switched Port Analyzer(RSPAN) 

The captured traffic from the sources is copied into the RSPAN vlan.Then it is forwarded over trunk ports that are allowed to carry the RSPAN vlan.The switch which attached to the network analyzer device, got the RSPAN traffic and delivers it to the network analyzer.

Configuration example on source switches:

monitor session 1 source vlan 100 - 120

monitor session 1 destination remote vlan 200

Configuration example on destionation switch:

monitor session 1 source remote vlan 200

monitor session 1 destination interface Gigabitethernet0/5

Cisco Switched Port Analyzer (SPAN)

The Switched Port Analyzer (SPAN) , which is also called port mirroring, sends the network traffic to a network analyzer(sniffer).

In this example there is a sniffer on port Gigabitethernet5/1.We want to capture all network on port GigabitEthernet5/2 and send the copy of this traffic to port GigabitEthernet5/1:

 

monitor session 1 source interface GigabitEthernet5/2

monitor session 1 destination interface GigabitEthernet5/1

In this example there is a sniffer on port Gigabitethernet3/1.We want to capture all network on vlan 100 and send the copy of this traffic to port GigabitEthernet3/1:

monitor session 1 source vlan 100

monitor session 1 destination interface GigabitEthernet3/1

Cisco BGP Dynamic Neighbor

Cisco BGP Dynamic Neighbor

After an IPv4 subnet range is configured for a iBGP peer group and a TCP session is initiated
by another router which has an IP address in the IPv4 subnet range, a new BGP neighbor will be dynamically established as a member of that group.

 Here is the example:

router bgp 1
 bgp listen range 10.1.1.0/24 peer-group SPOKES
 bgp listen limit 1000
 neighbor SPOKES peer-group
 neighbor SPOKES remote-as 1
 neighbor SPOKES transport connection-mode passive
 neighbor SPOKES route-reflector-client



HUB#show ip bgp sum

Neighbor    V      AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
*10.1.1.3    4        1   70069   70100      160    0    0 5w0d            3
*10.1.1.4    4        1   80416   80459      160    0    0 5w1d            3
* Dynamically created based on a listen range command
Dynamically created neighbors: 2 Subnet ranges: 1
BGP peergroup DMVPN listen range group members:
  10.1.1.0/24
Total dynamically created neighbors: 2/(1000 max), Subnet ranges: 1

BGP Authentication

BGP authentication configuration example

BGP authentication is provided through TCP Option 19, the MD5 hash.

We will use Cisco IOS routers in this example.Here is the basic BGP authentication configurations:

on R1:

router bgp 100
neighbor 10.10.10.2 remote-as 200
neighbor 10.10.10.2 password PASSWORD1

on R2:

router bgp 200
neighbor 10.10.10.1 remote-as 100
neighbor 10.10.10.1 password PASSWORD1

R2#show ip bgp neighbors 10.10.10.1 | include BGP state|Flags
BGP state = Established, up for 00:01:38
Flags: active open, nagle, md5

We will change the BGP password at one of the routers for testing:

R2(config)#router bgp 200
R2(config-router)#neighbor 10.10.10.1 password PASSWORD2
R2(config-router)#end
R2#clear ip bgp *
%BGP-5-ADJCHANGE: neighbor 10.10.10.1 Down User reset
%TCP-6-BADAUTH: Invalid MD5 digest from 10.10.10.1(179) to 192.10.1.2(19999)

We understand that the passwords must be matched.

BGP Conditional default-route advertisement

BGP Conditional default-route advertisement

Conditional default-route advertisement is done by associating a route-map with the “neighbor default-originate” statement. The default route is advertised if the route-map matches the prefix which is in the routing table.If the route is not in the routing table, the related prefix will not be advertised to the neighbor.

We can match ip prefixes with the route-map using either access-lists or prefix-lists.

Here is the example:

We will send default-route when 10.1.10.0/24 network is in the routing table:

ip prefix-list test seq 5 permit 10.1.10.0/24

route-map test permit 10

 match ip address prefix-list test

router bgp 1

 no synchronization

 bgp log-neighbor-changes

 bgp redistribute-internal

 timers bgp 10 30

 neighbor 10.10.10.6 remote-as 1

 neighbor 10.10.10.6 default-originate route-map test

 no auto-summary

R1#sh run int f0/0.10

Building configuration...

Current configuration : 112 bytes

!

interface FastEthernet0/0.10

 encapsulation dot1Q 10

 ip address 10.1.10.1 255.255.255.0

 end

R1#debug ip bgp update (to see updates)

BGP updates debugging is on for address family: IPv4 Unicast

R1#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

R1(config)#int f0/0.10

R1(config-subif)#shut

R1(config-subif)#

*Mar  1 00:28:52.063: BGP(0): 10.10.10.6 send unreachable 0.0.0.0/0

*Mar  1 00:28:52.063: BGP(0): 10.10.10.6 enqueued default-originate update

R1(config-subif)#no shut

R1(config-subif)#

*Mar  1 00:29:00.031: BGP(0): 10.10.10.6 enqueued default-originate update

BGP Timers

BGP Timers

BGP peers send keepalive message(default interval is 60 seconds) to inform each other of their availability.

They advertise their hold-time interval(default value is 180 seconds) when establishing BGP session.

Peers may advertise different hold-time interval.Lower values are used.

We can change the keepalive and hold-time intervals in BGP configuration mode  using the command timers bgp <keepalive> <holdtime>

Or per neighbor

Neighbor <ip> timers <keepalive> <holdtime>

Here is the example

First router

router bgp 1

 no synchronization

 bgp log-neighbor-changes

 timers bgp 10 30

 neighbor 10.10.10.1 remote-as 1

 neighbor 10.10.10.1 timers 15 45

R6#show ip bgp nei 10.10.10.1

BGP neighbor is 10.10.10.1,  remote AS 1, internal link

  BGP version 4, remote router ID 192.168.1.1

  BGP state = Established, up for 00:03:41

  Last read 00:00:00, last write 00:00:00, hold time is 30, keepalive interval is 10 seconds

  Configured hold time is 45,keepalive interval is 15 seconds  Minimum holdtime

Second Router

router bgp 1

 no synchronization

 bgp log-neighbor-changes

 timers bgp 10 30

 neighbor 10.10.10.6 remote-as 1

 no auto-summary

R1#show ip bgp neighbor

BGP neighbor is 10.10.10.6,  remote AS 1, internal link

  BGP version 4, remote router ID 192.168.2.6

  BGP state = Established, up for 00:04:36

  Last read 00:00:05, last write 00:00:05, hold time is 30, keepalive interval is 10 seconds

  Configured hold time is 30,keepalive interval is 10 seconds, Minimum holdtime

BGP Advertise-map

BGP Advertise-map

In this example we have two routers:R1 and R2.

R1 advertises default route with as-path prepending and metric value of 10 if it does not have 3.3.3.3/32 prefix in its BGP table.Here is the configuration:

interface Loopback0
 ip address 10.1.2.1 255.255.255.0 secondary
 ip address 10.1.3.1 255.255.255.0 secondary
 ip address 10.1.1.1 255.255.255.0
!
interface FastEthernet0/0
 ip address 1.1.1.1 255.255.255.0
 !
router bgp 1
 no synchronization
 bgp log-neighbor-changes
 network 0.0.0.0
 network 3.3.3.3 mask 255.255.255.255
 network 10.0.0.0
 network 10.1.1.0 mask 255.255.255.0
 network 10.1.2.0 mask 255.255.255.0
 network 10.1.3.0 mask 255.255.255.0
 neighbor 1.1.1.2 remote-as 2
 neighbor 1.1.1.2 advertise-map AD non-exist-map NONEXIST
 no auto-summary
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Null0
ip route 3.3.3.3 255.255.255.255 Null0
!       
ip prefix-list default seq 5 permit 0.0.0.0/0
!
ip prefix-list exist seq 5 permit 3.3.3.3/32
!
route-map AD permit 10
 match ip address prefix-list default
 set metric 10
 set as-path prepend 1 1 1
!
route-map NONEXIST permit 10
 match ip address prefix-list exist



Verifying:

With this configuration R2 has not the default route, it has only these routes:

R2#sh ip bgp
BGP table version is 21, local router ID is 1.1.1.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 3.3.3.3/32       1.1.1.1                  0             0 1 i
*> 10.1.1.0/24      1.1.1.1                  0             0 1 i
*> 10.1.2.0/24      1.1.1.1                  0             0 1 i
*> 10.1.3.0/24      1.1.1.1                  0             0 1 i

Lets remove the 3.3.3.3/32 route and turn on "debug ip bgp" on R1:

R1#debug ip bgp  
BGP debugging is on for address family: IPv4 Unicast
R1#conf t
Enter configuration commands, one per line.  End with CNTL/Z.
R1(config)#no ip route 3.3.3.3 255.255.255.255 null0
R1(config)#
*Mar  1 02:08:38.747: BGP(0): route 3.3.3.3/32 down
*Mar  1 02:08:38.751: BGP(0): no valid path for 3.3.3.3/32
*Mar  1 02:08:38.751: BGP(0): nettable_walker 3.3.3.3/32 no best path
*Mar  1 02:08:38.755: BGP(0): 1.1.1.2 send unreachable 3.3.3.3/32
*Mar  1 02:08:38.755: BGP(0): 1.1.1.2 send UPDATE 3.3.3.3/32 -- unreachable
R1(config)#
*Mar  1 02:08:48.399: BPG(0): Condition exist changes to Advertise
*Mar  1 02:08:48.399: BPG(0): Condition exist changes to Advertise
*Mar  1 02:08:48.403: BGP(0): net 0.0.0.0/0 matches ADV MAP AD bump version to 26
*Mar  1 02:08:48.859: BGP(0): nettable_walker 0.0.0.0/0 route sourced locally
R1(config)#
*Mar  1 02:09:09.227: BGP(0): 1.1.1.2 0.0.0.0/0 matches advertise map AD, state: Advertise
*Mar  1 02:09:09.227: BGP(0): 1.1.1.2 send UPDATE (format) 0.0.0.0/0, next 1.1.1.1, metric 10, path Local

R2`s BGP table:

R2#show ip bgp
BGP table version is 23, local router ID is 1.1.1.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path
*> 0.0.0.0          1.1.1.1                 10             0 1 1 1 1 i
*> 10.1.1.0/24      1.1.1.1                  0             0 1 i
*> 10.1.2.0/24      1.1.1.1                  0             0 1 i
*> 10.1.3.0/24      1.1.1.1                  0             0 1 i

BGP filtering with Prefix-Lists

BGP filtering with Prefix-Lists

In this example, we will filter the BGP routes by using prefix-list

Here is the initial configuration of the router:

interface Loopback4

 ip address 4.4.4.4 255.255.255.255

!

interface FastEthernet1/0

 ip address 192.168.45.4 255.255.255.0

 !

router bgp 4

 no synchronization

 bgp log-neighbor-changes

 network 4.4.4.4 mask 255.255.255.255

 neighbor 192.168.45.5 remote-as 5

 no auto-summary

Here is the BGP table:

R4#show ip bgp

BGP table version is 4, local router ID is 192.168.0.4

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

*> 4.4.4.4/32       0.0.0.0                  0         32768 i

*> 5.5.5.5/32       192.168.45.5             0             0 5 i

*> 55.55.55.0/24    192.168.45.5             0             0 5 i

Lets filter the 55.55.55.0/24:

Firstly we will create a prefix-list  access-list.

Prefix-list name is R5-in

ip prefix-list R5-in seq 5 deny 55.55.55.0/24

ip prefix-list R5-in seq 10 permit 0.0.0.0/0 le 32

Then, we apply the prefix-list to the BGP configuration:

R4(config)#router bgp 4                                     

R4(config-router)#neighbor 192.168.45.5 prefix-list R5-in in

Then we see that 55.55.55.0/24 IP prefix is no longer exists:

R4#show ip bgp

BGP table version is 5, local router ID is 192.168.0.4

Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,

              r RIB-failure, S Stale

Origin codes: i - IGP, e - EGP, ? - incomplete

   Network          Next Hop            Metric LocPrf Weight Path

*> 4.4.4.4/32       0.0.0.0                  0         32768 i

*> 5.5.5.5/32       192.168.45.5             0             0 5 i