IPv5

PE1# sh ver
Cisco IOS XE Software, Version 03.16.07b.S - Extended Support Release

1 2	PE1# sh ver Cisco IOS XE Software, Version 03.16.07b.S - Extended Support Release

IOS-XE не поддерживает маркировку DSCP у исходящих пакетов с коробки, как это делается например на IOS-XR:

!
ntp
 ipv4 dscp cs2
!

ntp

ipv4 dscp cs2

На IOS XE по умолчанию трафик отправляется в CS6:

ACL для матчинга NTP трафика с CP:

!
ip access-list extended ACL_LOCAL_NTP
 permit udp any any eq ntp
!

ip access-list extended ACL_LOCAL_NTP

permit udp any any eq ntp

Включаем захват пакетов на RP:

PE1# monitor capture NTP control-plane out
PE1# monitor capture NTP access-list ACL_LOCAL_NTP
PE1# monitor capture NTP start
PE1# show monitor capture NTP
Status Information for Capture NTP
  Target Type:
   Interface: Control Plane, Direction : out
   Status : Active
  Filter Details:
   Access-list: ACL_LOCAL_NTP
  Buffer Details:
   Buffer Type: LINEAR (default)
   Buffer Size (in MB): 10
  Limit Details:
   Number of Packets to capture: 0 (no limit)
   Packet Capture duration: 0 (no limit)
   Packet Size to capture: 0 (no limit)
   Maximum number of packets to capture per second: 1000
   Packet sampling rate: 0 (no sampling)

PE1# monitor capture NTP control-plane out

PE1# monitor capture NTP access-list ACL_LOCAL_NTP

PE1# monitor capture NTP start

PE1# show monitor capture NTP

Status Information for Capture NTP

Target Type:

Interface: Control Plane, Direction : out

Status : Active

Filter Details:

Access-list: ACL_LOCAL_NTP

Buffer Details:

Buffer Type: LINEAR (default)

Buffer Size (in MB): 10

Limit Details:

Number of Packets to capture: 0 (no limit)

Packet Capture duration: 0 (no limit)

Packet Size to capture: 0 (no limit)

Maximum number of packets to capture per second: 1000

Packet sampling rate: 0 (no sampling)

PE1(config)# ntp server 10.200.167.17

1	PE1(config)# ntp server 10.200.167.17

PE1# show ntp associations
  address         ref clock       st   when   poll reach  delay  offset   disp
*~10.200.167.17    194.18.200.100   2      5     64     1  0.934   0.352 188.51
 * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

PE1# show ntp associations

address ref clock st when poll reach delay offset disp

*~10.200.167.17 194.18.200.100 2 5 64 1 0.934 0.352 188.51

* sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

PE1# show ip access-lists ACL_LOCAL_NTP
Extended IP access list ACL_LOCAL_NTP
    10 permit udp any any eq ntp (144 matches)

PE1# show ip access-lists ACL_LOCAL_NTP

Extended IP access list ACL_LOCAL_NTP

10 permit udp any any eq ntp (144 matches)

PE1# show monitor capture NTP buffer
 buffer size (KB) : 10240
 buffer used (KB) : 128
 packets in buf   : 14
 packets dropped  : 0
 packets per sec  : 0

PE1# monitor capture NTP stop

PE1# show monitor capture NTP buffer

buffer size (KB) : 10240

buffer used (KB) : 128

packets in buf : 14

packets dropped : 0

packets per sec : 0

PE1# monitor capture NTP stop

DSCP=C0(dec:192)

PE1# show monitor capture NTP buffer detailed
 -------------------------------------------------------------
 #   size   timestamp     source             destination   protocol
 -------------------------------------------------------------
   0   90    0.000000   10.200.64.64     ->  10.200.167.17     UDP
  0000:  00000000 00000000 00000000 080045C0   ..............E.
  0010:  004C049F 0000FF11 BAE60AC8 40400AC8   .L..........@@..
  0020:  A711007B 007B0038 05E6E300 06F60000   ...{.{.8........
  0030:  00000000 00D54E55 4C4CE0EB B00C0B85   ..z....NULL......

PE1# show monitor capture NTP buffer detailed

-------------------------------------------------------------

# size timestamp source destination protocol

-------------------------------------------------------------

0 90 0.000000 10.200.64.64 -> 10.200.167.17 UDP

0000: 00000000 00000000 00000000 080045C0 ..............E.

0010: 004C049F 0000FF11 BAE60AC8 40400AC8 .L..........@@..

0020: A711007B 007B0038 05E6E300 06F60000 ...{.{.8........

0030: 00000000 00D54E55 4C4CE0EB B00C0B85 ..z....NULL......

Принудительно перемаркируем

!
route-map RP_MARK_SELF_TRAFFIC permit 10
 match ip address ACL_LOCAL_NTP
 set ip precedence 2
route-map RP_MARK_SELF_TRAFFIC permit 20
!
ip local policy route-map RP_MARK_SELF_TRAFFIC
!

route-map RP_MARK_SELF_TRAFFIC permit 10

match ip address ACL_LOCAL_NTP

set ip precedence 2

route-map RP_MARK_SELF_TRAFFIC permit 20

ip local policy route-map RP_MARK_SELF_TRAFFIC

PE1# monitor capture NTP clear
PE1# monitor capture NTP start

1 2	PE1# monitor capture NTP clear PE1# monitor capture NTP start

Для тестирования NTP сервера берем первый попавшийся адрес из таблицы маршрутизации(собственный loopback использовать нельзя, трафик сам на себя не попадет под данную политику):

PE1(config)# ntp server 10.1.1.1

1	PE1(config)# ntp server 10.1.1.1

PE1# show monitor capture NTP buffer
 buffer size (KB) : 10240
 buffer used (KB) : 128
 packets in buf   : 6
 packets dropped  : 0
 packets per sec  : 0

PE1# monitor capture NTP stop

PE1# show monitor capture NTP buffer

buffer size (KB) : 10240

buffer used (KB) : 128

packets in buf : 6

packets dropped : 0

packets per sec : 0

PE1# monitor capture NTP stop

DSCP=40(dec:64)

PE1# show monitor capture NTP buffer detailed
 -------------------------------------------------------------
 #   size   timestamp     source             destination   protocol
 -------------------------------------------------------------
   0   90    0.000000   10.200.64.64     ->  10.1.1.1        UDP
  0000:  00000000 00000000 00000000 08004540   ..............E@
  0010:  004C0864 0000FF11 3DC10AC8 40400A01   .L.d....=...@@..
  0020:  0101007B 007B0038 B64D2303 06F60000    ..{.{.8.M#.....
  0030:  03410000 17820A10 A611E0EC 1F760B85   .A...........v..

PE1# show monitor capture NTP buffer detailed

-------------------------------------------------------------

# size timestamp source destination protocol

-------------------------------------------------------------

0 90 0.000000 10.200.64.64 -> 10.1.1.1 UDP

0000: 00000000 00000000 00000000 08004540 ..............E@

0010: 004C0864 0000FF11 3DC10AC8 40400A01 .L.d....=...@@..

0020: 0101007B 007B0038 B64D2303 06F60000 ..{.{.8.M#.....

0030: 03410000 17820A10 A611E0EC 1F760B85 .A...........v..

Такая же картина с syslog ( logging host), трафик по умолчанию отправляется в BE.

          ISIS                  OSPF
+----+   Area 49.001 +----+     Area 0  +----+
|    |               |    |             |    |
| R1 +---------------+ R2 +-------------+ R3 |
|    |               |    |             |    |
+----+               +----+             +----+

ISIS OSPF

+----+ Area 49.001 +----+ Area 0 +----+

| | | | | |

| R1 +---------------+ R2 +-------------+ R3 |

| | | | | |

+----+ +----+ +----+

На R2 выполняется взаимная редистрибуция OSPF<->ISIS

root@R2# show policy-options
policy-statement PM_ISIS_TO_OSPF {
    from protocol isis;
    then accept;
}
policy-statement PM_OSPF_TO_ISIS {
    from protocol ospf;
    then accept;
}

root@R2# show protocols ospf
export PM_ISIS_TO_OSPF;
area 0.0.0.0 {
    interface ge-0/0/1.0 {
        interface-type p2p;
    }
    interface lo0.0 {
        passive;
    }
}

root@R2# show protocols isis
export PM_OSPF_TO_ISIS;
level 1 disable;
interface ge-0/0/0.0 {
    point-to-point;
}
interface lo0.0 {
    point-to-point;
    passive;
}

root@R2# show policy-options

policy-statement PM_ISIS_TO_OSPF {

from protocol isis;

then accept;

}

policy-statement PM_OSPF_TO_ISIS {

from protocol ospf;

then accept;

}

root@R2# show protocols ospf

export PM_ISIS_TO_OSPF;

area 0.0.0.0 {

interface ge-0/0/1.0 {

interface-type p2p;

}

interface lo0.0 {

passive;

}

root@R2# show protocols isis

export PM_OSPF_TO_ISIS;

level 1 disable;

interface ge-0/0/0.0 {

point-to-point;

}

interface lo0.0 {

point-to-point;

passive;

}

На R1 есть маршрут к R3:

root@R1> show route 3.3.3.3
inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

3.3.3.3/32         *[IS-IS/165] 00:03:30, metric 11
                    > to 10.0.0.2 via ge-0/0/0.0

root@R1> show route 3.3.3.3

inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

3.3.3.3/32 *[IS-IS/165] 00:03:30, metric 11

> to 10.0.0.2 via ge-0/0/0.0

Но пинг не успешен:

root@R1> ping 3.3.3.3 count 3 wait 1
PING 3.3.3.3 (3.3.3.3): 56 data bytes
--- 3.3.3.3 ping statistics ---
3 packets transmitted, 0 packets received, 100% packet loss

root@R1> ping 3.3.3.3 count 3 wait 1

PING 3.3.3.3 (3.3.3.3): 56 data bytes

--- 3.3.3.3 ping statistics ---

3 packets transmitted, 0 packets received, 100% packet loss

Исходя из вывода выше, src у пакетов берется с интерфейса ge-0/0/0.0 :

root@R1> show interfaces ge-0/0/0.0 terse
Interface               Admin Link Proto    Local                 Remote
ge-0/0/0.0              up    up   inet     10.0.0.1/30
                                   iso
                                   multiservice

root@R1> show interfaces ge-0/0/0.0 terse

Interface Admin Link Proto Local Remote

ge-0/0/0.0 up up inet 10.0.0.1/30

iso

multiservice

Если взять src с lo0.0 то все ок,

root@R1> ping 3.3.3.3 no-resolve wait 1 count 1 source 1.1.1.1
PING 3.3.3.3 (3.3.3.3): 56 data bytes
64 bytes from 3.3.3.3: icmp_seq=0 ttl=63 time=7.695 ms
--- 3.3.3.3 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 7.695/7.695/7.695/0.000 ms

root@R1> ping 3.3.3.3 no-resolve wait 1 count 1 source 1.1.1.1

PING 3.3.3.3 (3.3.3.3): 56 data bytes

64 bytes from 3.3.3.3: icmp_seq=0 ttl=63 time=7.695 ms

--- 3.3.3.3 ping statistics ---

1 packets transmitted, 1 packets received, 0% packet loss

round-trip min/avg/max/stddev = 7.695/7.695/7.695/0.000 ms

Очевидно connected сети нет в OSPF, хотя она конечно есть в topology db ISIS:

root@R1> show isis database R2.00-00 level 2 detail
IS-IS level 2 link-state database:

R2.00-00 Sequence: 0x7, Checksum: 0xcfee, Lifetime: 768 secs
   IS neighbor: R1.00                         Metric:       10
   IP prefix: 2.2.2.2/32                      Metric:        0 Internal Up
   IP prefix: 3.3.3.3/32                      Metric:        1 External Up
   IP prefix: 10.0.0.0/30                     Metric:       10 Internal Up

root@R1> show isis database R2.00-00 level 2 detail

IS-IS level 2 link-state database:

R2.00-00 Sequence: 0x7, Checksum: 0xcfee, Lifetime: 768 secs

IS neighbor: R1.00 Metric: 10

IP prefix: 2.2.2.2/32 Metric: 0 Internal Up

IP prefix: 3.3.3.3/32 Metric: 1 External Up

IP prefix: 10.0.0.0/30 Metric: 10 Internal Up

На первый вгляд кажется, что R2 должен заглянуть в ISIS DB, и перелить все это в OSPF, но это конечно не так. Чтобы перелить например из ISIS в OSPF коробка ищет активные ISIS маршруты в RIB (в данном случае это inet.0) и переливает в OSPF.

Например так:

root@R2> show route protocol isis
inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

1.1.1.1/32         *[IS-IS/18] 00:33:34, metric 10
                    > to 10.0.0.1 via ge-0/0/0.0

root@R2> show route protocol isis

inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

1.1.1.1/32 *[IS-IS/18] 00:33:34, metric 10

> to 10.0.0.1 via ge-0/0/0.0

root@R2> show ospf database external detail
    OSPF AS SCOPE link state database
 Type       ID               Adv Rtr           Seq      Age  Opt  Cksum  Len
Extern  *1.1.1.1          2.2.2.2          0x80000001   736  0x22 0xfaa1  36
  mask 255.255.255.255
  Topology default (ID 0)
    Type: 2, Metric: 10, Fwd addr: 0.0.0.0, Tag: 0.0.0.0

root@R2> show ospf database external detail

OSPF AS SCOPE link state database

Type ID Adv Rtr Seq Age Opt Cksum Len

Extern *1.1.1.1 2.2.2.2 0x80000001 736 0x22 0xfaa1 36

mask 255.255.255.255

Topology default (ID 0)

Type: 2, Metric: 10, Fwd addr: 0.0.0.0, Tag: 0.0.0.0

Если маршрут к 1.1.1.1/32 будет не активным в RIB, редистрибуция конечно работать не будет:

root@R2# set routing-options static route 1.1.1.1/32 discard
root@R2# commit
commit complete

root@R2# set routing-options static route 1.1.1.1/32 discard

root@R2# commit

commit complete

root@R2> show route 1.1.1.1
inet.0: 8 destinations, 9 routes (8 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

1.1.1.1/32         *[Static/5] 00:00:07
                      Discard
                    [IS-IS/18] 00:36:09, metric 10
                    > to 10.0.0.1 via ge-0/0/0.0

root@R2> show route 1.1.1.1

inet.0: 8 destinations, 9 routes (8 active, 0 holddown, 0 hidden)

+ = Active Route, - = Last Active, * = Both

1.1.1.1/32 *[Static/5] 00:00:07

Discard

[IS-IS/18] 00:36:09, metric 10

> to 10.0.0.1 via ge-0/0/0.0

root@R2> show ospf database external detail
root@R2>

1 2	root@R2> show ospf database external detail root@R2>

Как решение можно перелить direct в OSPF (генерируется TYPE5 LSA),

root@R2# show policy-options policy-statement PM_ISIS_TO_OSPF
term ISIS {
    from protocol isis;
    then accept;
}
term DIRECT {
    from {
        protocol direct;
        interface ge-0/0/0.0;
    }
    then accept;
}

root@R2# show policy-options policy-statement PM_ISIS_TO_OSPF

term ISIS {

from protocol isis;

then accept;

}

term DIRECT {

from {

protocol direct;

interface ge-0/0/0.0;

}

then accept;

}

root@R2> show ospf database external
    OSPF AS SCOPE link state database
 Type       ID               Adv Rtr           Seq      Age  Opt  Cksum  Len
Extern  *1.1.1.1          2.2.2.2          0x80000001   405  0x22 0xfaa1  36
Extern  *10.0.0.0         2.2.2.2          0x80000001    92  0x22 0x3073  36

root@R2> show ospf database external

OSPF AS SCOPE link state database

Type ID Adv Rtr Seq Age Opt Cksum Len

Extern *1.1.1.1 2.2.2.2 0x80000001 405 0x22 0xfaa1 36

Extern *10.0.0.0 2.2.2.2 0x80000001 92 0x22 0x3073 36

Или включить OSPF как passive на данном линке:

root@R2# set protocols ospf area 0 interface ge-0/0/0.0 passive

[edit]
root@R2# commit
commit complete

root@R2# set protocols ospf area 0 interface ge-0/0/0.0 passive

[edit]

root@R2# commit

commit complete

root@R2> show ospf database router advertising-router self detail
    OSPF database, Area 0.0.0.0
 Type       ID               Adv Rtr           Seq      Age  Opt  Cksum  Len
Router  *2.2.2.2          2.2.2.2          0x80000005   106  0x22 0xa517  72
  bits 0x2, link count 4
  id 10.0.0.0, data 255.255.255.252, Type Stub (3)
    Topology count: 0, Default metric: 1
  id 3.3.3.3, data 10.0.1.1, Type PointToPoint (1)
    Topology count: 0, Default metric: 1
  id 10.0.1.0, data 255.255.255.252, Type Stub (3)
    Topology count: 0, Default metric: 1
  id 2.2.2.2, data 255.255.255.255, Type Stub (3)
    Topology count: 0, Default metric: 0
  Topology default (ID 0)
    Type: PointToPoint, Node ID: 3.3.3.3
      Metric: 1, Bidirectional

root@R2> show ospf database router advertising-router self detail

OSPF database, Area 0.0.0.0

Type ID Adv Rtr Seq Age Opt Cksum Len

Router *2.2.2.2 2.2.2.2 0x80000005 106 0x22 0xa517 72

bits 0x2, link count 4

id 10.0.0.0, data 255.255.255.252, Type Stub (3)

Topology count: 0, Default metric: 1

id 3.3.3.3, data 10.0.1.1, Type PointToPoint (1)

Topology count: 0, Default metric: 1

id 10.0.1.0, data 255.255.255.252, Type Stub (3)

Topology count: 0, Default metric: 1

id 2.2.2.2, data 255.255.255.255, Type Stub (3)

Topology count: 0, Default metric: 0

Topology default (ID 0)

Type: PointToPoint, Node ID: 3.3.3.3

Metric: 1, Bidirectional

root@R1> ping 3.3.3.3 no-resolve wait 1 count 1
PING 3.3.3.3 (3.3.3.3): 56 data bytes
64 bytes from 3.3.3.3: icmp_seq=0 ttl=63 time=62.106 ms
--- 3.3.3.3 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max/stddev = 62.106/62.106/62.106/0.000 ms

root@R1> ping 3.3.3.3 no-resolve wait 1 count 1

PING 3.3.3.3 (3.3.3.3): 56 data bytes

64 bytes from 3.3.3.3: icmp_seq=0 ttl=63 time=62.106 ms

--- 3.3.3.3 ping statistics ---

1 packets transmitted, 1 packets received, 0% packet loss

round-trip min/avg/max/stddev = 62.106/62.106/62.106/0.000 ms

IOS_XE NTP/syslog/etc DSCP remark

Redistribution ISIS-OSPF

Networking