Thursday, August 30, 2012
ipSpace.net: BGP next hop processing
ipSpace.net: BGP next hop processing: Following my IBGP or EBGP in an enterprise network post a few people have asked for a more graphical explanation of IBGP/EBGP differences....
ipSpace.net: Penultimate Hop Popping (PHP) demystified
ipSpace.net: Penultimate Hop Popping (PHP) demystified: I got an interesting question after writing the Asymmetric MPLS MTU Problem post: “ Why does PHP happen only on directly-connected interfac...
Friday, August 24, 2012
Dependence between ARP max age time and MAC-address aging on Cisco switches
Let's begin with an example of typical switched network with multilayer distribution switches.
Assume that all the links between switches are trunk links, that both DL1 and DL2 are participating in HSRP groups where DL1 active for VLAN1 and VLAN3 and DL2 for VLAN2. STP is configured proportionally to block the rightmost links at access layer switches for even VLAN's and the leftmost links for odd VLAN's.
Now let's pretend that host C1 pings host C2.
Let's follow the path of the packet on its way to C2:
1. Since C1 resides in the different VLAN than host C2, then it should send the packets to its default gateway (DL1's VLAN1 interace). By means of ARP request C1 discovers MAC address of VLAN1 interface and sends the first ICMP packet.
2. DL1 routes the packet. VLAN2 is a directly connected network, so DL1 discovers with ARP MAC address of C2 and sends the packet to it (Packet traverse the link between DL1 and DL2 and then to AL2 since the leftmost link is blocked by STP for VLAN2 on AL2).
Important note: to this moment internal switch on DL1 have the following MAC-addresses: C1 in VLAN1 and C2 in VLAN2.
ICMP-reply from C2 follows the same path except that its default gateway will be DL2's VLAN2 interface. This means that in this network the routing between VLAN's is asymmetric.
What happens if the pings are coming for example for 10 minutes?
DL1 ages MAC-address entry for C2 in VLAN2 since it sees no new frames from it (remember, that reverse packets are first routed at DL2 and then sent from its VLAN1 interface?) and begins to flood the frames for C2 out of all its ports in VLAN2. Mirrored result is seen on DL2 for reverse packets.
The problem relies to the fact that router holds the arp entries for 14,400 seconds or 4 hours, but the switch ages CAM table in 5 minutes.
For this not to happen the timers on ARP and CAM table should be in SYNC!
The easiest way is to increase MAC aging time to 14,400 seconds.
For Catalyst 6500 it can be done with the following command:
mac-address-table aging-time seconds [vlan vlan_id]
Happy switching!
Assume that all the links between switches are trunk links, that both DL1 and DL2 are participating in HSRP groups where DL1 active for VLAN1 and VLAN3 and DL2 for VLAN2. STP is configured proportionally to block the rightmost links at access layer switches for even VLAN's and the leftmost links for odd VLAN's.
Now let's pretend that host C1 pings host C2.
Let's follow the path of the packet on its way to C2:
1. Since C1 resides in the different VLAN than host C2, then it should send the packets to its default gateway (DL1's VLAN1 interace). By means of ARP request C1 discovers MAC address of VLAN1 interface and sends the first ICMP packet.
2. DL1 routes the packet. VLAN2 is a directly connected network, so DL1 discovers with ARP MAC address of C2 and sends the packet to it (Packet traverse the link between DL1 and DL2 and then to AL2 since the leftmost link is blocked by STP for VLAN2 on AL2).
Important note: to this moment internal switch on DL1 have the following MAC-addresses: C1 in VLAN1 and C2 in VLAN2.
ICMP-reply from C2 follows the same path except that its default gateway will be DL2's VLAN2 interface. This means that in this network the routing between VLAN's is asymmetric.
What happens if the pings are coming for example for 10 minutes?
DL1 ages MAC-address entry for C2 in VLAN2 since it sees no new frames from it (remember, that reverse packets are first routed at DL2 and then sent from its VLAN1 interface?) and begins to flood the frames for C2 out of all its ports in VLAN2. Mirrored result is seen on DL2 for reverse packets.
The problem relies to the fact that router holds the arp entries for 14,400 seconds or 4 hours, but the switch ages CAM table in 5 minutes.
For this not to happen the timers on ARP and CAM table should be in SYNC!
The easiest way is to increase MAC aging time to 14,400 seconds.
For Catalyst 6500 it can be done with the following command:
mac-address-table aging-time seconds [vlan vlan_id]
Happy switching!
Thursday, August 23, 2012
Waiting for your comments
Reading another great post of Ivan Pepelnjak from blog.ioshints.info, I followed a link to Cisco website with an article about Unicast Flooding in Switched Campus networks. When I looked at "Cause 1: Asymmetric Routing" diagram, I came to conclusion, that the packets won't be flooded, as it said there in article, because at the reverse route, S1 will reply with its own mac-address to RouterB ARP-request, so switchB will have it in its CAM table, so it will forward the packet to the proper interface toward SwitchA.
What do you think? Am I wrong?
Link, again.
P.S. I even lab'ed it. No unknown unicast happened.
UPD.: I came to yet another conclusion: the situation described above can be true, if entry in the switch's CAM table is timed-out. If the router still has the mac-address of S1, then it will send the packets without subsequent arp-requests, however the switch will now flood the unicast frames.
What do you think? Am I wrong?
Link, again.
P.S. I even lab'ed it. No unknown unicast happened.
UPD.: I came to yet another conclusion: the situation described above can be true, if entry in the switch's CAM table is timed-out. If the router still has the mac-address of S1, then it will send the packets without subsequent arp-requests, however the switch will now flood the unicast frames.
Wednesday, August 22, 2012
Monday, August 20, 2012
ipSpace.net: Fix router configuration after a reload
ipSpace.net: Fix router configuration after a reload: Sometimes, parts of router configuration get lost during the reload process: although the configuration commands are saved in NVRAM, they ar...
Thursday, August 2, 2012
ASA 8.4
1. Download archive from here.
2. Download AIO version of GNS3 for Windows (Qemu should be patched or it won't start with asa's connected interfaces). My version was 0.8.3.
3. Configure Qemu in GNS3 with following settings:
Qemu Options: -vnc none -vga none -m 1024 -icount auto -hdachs 980,16,32
Kernel cmd line: -append ide_generic.probe_mask=0x01 ide_core.chs=0.0:980,16,32 auto nousb console=ttyS0,9600 bigphysarea=65536
4. Configure the paths to image.
5. The hardest part - start you lab and enjoy :)
2. Download AIO version of GNS3 for Windows (Qemu should be patched or it won't start with asa's connected interfaces). My version was 0.8.3.
3. Configure Qemu in GNS3 with following settings:
Qemu Options: -vnc none -vga none -m 1024 -icount auto -hdachs 980,16,32
Kernel cmd line: -append ide_generic.probe_mask=0x01 ide_core.chs=0.0:980,16,32 auto nousb console=ttyS0,9600 bigphysarea=65536
4. Configure the paths to image.
5. The hardest part - start you lab and enjoy :)
Subscribe to:
Posts (Atom)