====== Einfaches SPB-Netz mit Debian Workstations (VMs) ====== Dieses Beispielnetz verwendet die ALE "Intelligent Fabric" (Auto-Fabric) und ist weitestgehend automatisch konfiguriert worden. An diesem Artikel wird noch gearbeitet. :) ===== Netzwerkdiagramm ===== {{::screen_shot_2019-06-19_at_10.05.09.png?direct|}} ===== Konsolenausgaben ===== Die virtuellen Debian-basierten Systeme sind an folgenden Ports angeschlossen: * Debian9-WS1 -> OS6900-Oben 1/1/3 * Debian9-WS2 -> OS6900-Unten 1/1/5 * Debian9-WS3 -> OS6860 1/1/7 Die VMs haben die IPs 10.10.10.1 / 10.10.10.2 und 10.10.10.3 und verwenden den VLAN-Tag 55. Die Konfiguration auf den VMs erfolgt wie folgt. ==== Debian9-WS1 ==== sudo ip link add link ens7 name ens7.55 type vlan id 55 sudo ip addr add 10.10.10.1/24 brd 10.10.10.255 dev ens7.55 sudo ip link set dev ens7 up sudo ip link set dev ens7.55 up ==== Debian9-WS2 ==== sudo ip link add link ens7 name ens7.55 type vlan id 55 sudo ip addr add 10.10.10.2/24 brd 10.10.10.255 dev ens7.55 sudo ip link set dev ens7 up sudo ip link set dev ens7.55 up ==== Debian9-WS3 ==== sudo ip link add link ens7 name ens7.55 type vlan id 55 sudo ip addr add 10.10.10.3/24 brd 10.10.10.255 dev ens7.55 sudo ip link set dev ens7 up sudo ip link set dev ens7.55 up ===== Stille Geräte (Silent Devices) ===== Schön zu sehen ist dieser Effekt mit den Debian-VMs, die anders als Windows-Systeme, nicht regelmäßig vor sich herkommunizieren. OS6900-Oben-> show spb isis services Legend: * indicates locally configured ISID SPB ISIS Services Info: System ISID BVLAN (Name : BMAC) MCAST(T/R) ------------+-------+----------------------------------------+----------- ISIDs: 0 OS6900-Oben-> show mac-learning domain spb Legend: Mac Address: * = address not valid, Mac Address: & = duplicate static address, Domain Vlan/SrvcId[ISId/vnId] Mac Address Type Operation Interface ------------+----------------------+-------------------+------------------+-------------+------------------------- Total number of Valid MAC addresses above = 0 Setzt man nun einen Ping ab, werden die Dienste wieder "gelernt" oder man konfiguriert den Port entsprechend um. Seit AOS 8.5R4 kann man dafür den Service "fest" auf den UNP-Port binden. OS6900-Oben-> show configuration snapshot da-unp ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/3 port-type access unp port 1/1/3 port-template accessDefaultPortTemplate OS6900-Oben-> unp port 1/1/3 profile systemDefault10000055 OS6900-Oben-> show spb isis services Legend: * indicates locally configured ISID SPB ISIS Services Info: System ISID BVLAN (Name : BMAC) MCAST(T/R) ------------+-------+----------------------------------------+----------- * 10000055 4007 OS6900-Oben : e8:e7:32:11:ca:d1 ISIDs: 1 OS6900-Unten-> show configuration snapshot da-unp ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/5 port-type access unp port 1/1/5 port-template accessDefaultPortTemplate OS6900-Unten-> unp port 1/1/5 profile systemDefault10000055 OS6900-Unten-> show spb isis services Legend: * indicates locally configured ISID SPB ISIS Services Info: System ISID BVLAN (Name : BMAC) MCAST(T/R) ------------+-------+----------------------------------------+----------- * 10000055 4007 OS6900-Oben : e8:e7:32:11:ca:d1 * 10000055 4007 OS6900-Unten : e8:e7:32:11:ca:ed ISIDs: 2 OS6900-Unten-> show mac-learning domain spb Legend: Mac Address: * = address not valid, Mac Address: & = duplicate static address, Domain Vlan/SrvcId[ISId/vnId] Mac Address Type Operation Interface ------------+----------------------+-------------------+------------------+-------------+------------------------- SPB 32775:10000055 00:25:90:5d:e3:64 dynamic servicing sap:1/1/5:55 SPB 32775:10000055 00:25:90:5d:e3:65 dynamic servicing sdp:32782:32775 Total number of Valid MAC addresses above = 2 Das unp profile sorgt dafür dass der SAP im egress bestehend bleibt, so dass das Gerät (das vergessen wurde) weiterhin für Anfragen erreichbar ist. OS6860-> show service spb 32775 ports Legend: (*) dyn unicast object (+) remote mcast object (#) local mcast object SPB Service 32775 (Dynamic Service isid=10000055 for UNP) Admin : Up, Oper : Up, Stats : N, Mtu : 9194, VlanXlation : Y, ISID : 10000055, BVlan : 4007, MCast-Mode : Headend, Tx/Rx : 0/0, RemoveIngTag: N Sap Trusted:Priority/ Sap Description / Identifier Adm Oper Stats Sdp SystemId:BVlan Intf Sdp SystemName ----------------------+----+----+-----+--------------------+--------+-------------------------------- sap:1/1/17:55* Up Up N Y:x 1/1/17 Dynamic SAP for UNP sdp:32775:32775* Up Up Y e8e7.3211.cad1:4007 0/127 OS6900-Oben sdp:32791:32775* Up Up Y e8e7.3211.caed:4007 0/126 OS6900-Unten Total Ports: 3 OS6860-> show mac-learning domain spb Legend: Mac Address: * = address not valid, Mac Address: & = duplicate static address, Domain Vlan/SrvcId[ISId/vnId] Mac Address Type Operation Interface ------------+----------------------+-------------------+------------------+-------------+------------------------- SPB 32775:10000055 00:25:90:5d:e3:64 dynamic servicing sdp:32791:32775 Total number of Valid MAC addresses above = 1 Nun ein ping von 10.10.10.1 -> 10.10.10.3 benny@debian9ws1:~$ ping 10.10.10.3 PING 10.10.10.3 (10.10.10.3) 56(84) bytes of data. 64 bytes from 10.10.10.3: icmp_seq=6 ttl=64 time=0.264 ms 64 bytes from 10.10.10.3: icmp_seq=7 ttl=64 time=0.239 ms ^C Das System ist nun wieder erreichbar. Ich muss hier mit den US-Kollegen mal sprechen ob es dem erwarteten Verhalten entspricht dass hier die ersten Pakete verloren gehen (ISIS-LSDB etc). OS6860-> show mac-learning domain spb Legend: Mac Address: * = address not valid, Mac Address: & = duplicate static address, Domain Vlan/SrvcId[ISId/vnId] Mac Address Type Operation Interface ------------+----------------------+-------------------+------------------+-------------+------------------------- SPB 32775:10000055 00:25:90:5d:e1:7f dynamic servicing sap:1/1/17:55 SPB 32775:10000055 00:25:90:5d:e3:64 dynamic servicing sdp:32791:32775 Total number of Valid MAC addresses above = 2 ===== Konfiguration OS6860 ===== ! Chassis: system name "OS6860" ! Configuration: configuration error-file-limit 2 ! Capability Manager: hash-control extended ! Virtual Flow Control: ! LFP: ! Interface: ! Port_Manager: ! Link Aggregate: linkagg lacp agg 126 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 126 name "Created by Auto-Fabric on Tue Jun 18 19:32:57 2019" linkagg lacp agg 126 actor admin-key 65534 linkagg lacp agg 127 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 127 name "Created by Auto-Fabric on Tue Jun 18 19:32:57 2019" linkagg lacp agg 127 actor admin-key 65535 linkagg lacp port 1/1/25 actor admin-key 65535 linkagg lacp port 1/1/27 actor admin-key 65534 ! VLAN: vlan 1 admin-state enable vlan 100 admin-state enable spb bvlan 4000 admin-state enable spb bvlan 4000 name "AutoFabric 6/18/2019 19:33:16" spb bvlan 4001-4015 admin-state enable spb bvlan 4001-4015 name "AutoFabric 6/18/2019 19:33:16" vlan 100 members port 1/1/17 untagged ! PVLAN: ! Spanning Tree: spantree mode flat spantree vlan 1 admin-state enable spantree vlan 100 admin-state enable spantree vlan 4000 admin-state disable spantree vlan 4001 admin-state disable spantree vlan 4002 admin-state disable spantree vlan 4003 admin-state disable spantree vlan 4004 admin-state disable spantree vlan 4005 admin-state disable spantree vlan 4006 admin-state disable spantree vlan 4007 admin-state disable spantree vlan 4008 admin-state disable spantree vlan 4009 admin-state disable spantree vlan 4010 admin-state disable spantree vlan 4011 admin-state disable spantree vlan 4012 admin-state disable spantree vlan 4013 admin-state disable spantree vlan 4014 admin-state disable spantree vlan 4015 admin-state disable ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/17 port-type access unp port 1/1/17 port-template accessDefaultPortTemplate ! Bridging: ! Port Mirroring: ! Port Mapping: ! IP: ip interface dhcp-client vlan 1 ifindex 1 ip interface dhcp-client option-60 OmniSwitch-OS6860E-P24 ! IPv6: ! IPSec: ! IPMS: ! AAA: aaa authentication default "local" aaa authentication console "local" aaa authentication ssh "local" aaa tacacs command-authorization disable ! NTP: ntp server clock0.ovcirrus.com ntp server clock1.ovcirrus.com ntp server clock2.ovcirrus.com ntp server clock3.ovcirrus.com ntp client admin-state enable ! QOS: ! Policy Manager: ! VLAN Stacking: ! ERP: ! MVRP: mvrp enable ! LLDP: ! UDLD: ! Server Load Balance: ! High Availability Vlan: ! Session Manager: session cli timeout 999 session prompt default "OS6860->" ! Web: ! Trap Manager: ! Health Monitor: ! System Service: ip domain-name home ip name-server 192.168.2.1 ip domain-lookup ! SNMP: ! BFD: ! IP Route Manager: ! VRRP: ! UDP Relay: ! RIP: ! OSPF: ! IP Multicast: ! DVMRP: ! IPMR: ! RIPng: ! OSPF3: ! BGP: ! ISIS: ! Module: ! LAN Power: ! RDP: ! DHL: ! Ethernet-OAM: ! SAA: ! SPB-ISIS: spb isis bvlan 4000 ect-id 1 spb isis bvlan 4001 ect-id 2 spb isis bvlan 4002 ect-id 3 spb isis bvlan 4003 ect-id 4 spb isis bvlan 4004 ect-id 5 spb isis bvlan 4005 ect-id 6 spb isis bvlan 4006 ect-id 7 spb isis bvlan 4007 ect-id 8 spb isis bvlan 4008 ect-id 9 spb isis bvlan 4009 ect-id 10 spb isis bvlan 4010 ect-id 11 spb isis bvlan 4011 ect-id 12 spb isis bvlan 4012 ect-id 13 spb isis bvlan 4013 ect-id 14 spb isis bvlan 4014 ect-id 15 spb isis bvlan 4015 ect-id 16 spb isis control-bvlan 4000 spb isis interface linkagg 126-127 spb isis admin-state enable ! SVCMGR: ! LDP: ! EVB: ! APP-FINGERPRINT: ! FCOE: ! QMR: ! OPENFLOW: ! Dynamic auto-fabric: auto-fabric admin-state enable ! SIP Snooping: ! DHCP Server: ! DHCPv6 Relay: ! DHCPv6 Snooping: ! DHCPv6 Server: ! DHCP Message Service: ! DHCP Active Lease Service: ! Virtual Chassis Split Protection: ! DHCP Snooping: ! APP-MONITORING: ! Loopback Detection: loopback-detection enable ! VM-SNOOPING: ! PPPOE-IA: ! Security: ! Zero Configuration: ! MAC Security: ! OVC: ! EFM-OAM: ! ALARM-MANAGER: ! DEVICE-PROFILE: ! PTP: ! IP DHCP RELAY: ! TEST-OAM: ! LOOPBACK TEST: ! UDP6 RELAY: ! MGMT AGENT: ===== Konfiguration OS6900-Oben ===== ! Chassis: system name "OS6900-Oben" ! Configuration: configuration error-file-limit 2 ! Capability Manager: ! Virtual Flow Control: ! LFP: ! Interface: ! Port_Manager: ! Link Aggregate: linkagg lacp agg 126 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 126 name "Created by Auto-Fabric on Tue Jun 18 17:39:35 2019" linkagg lacp agg 126 actor admin-key 65534 linkagg lacp agg 127 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 127 name "Created by Auto-Fabric on Tue Jun 18 17:32:58 2019" linkagg lacp agg 127 actor admin-key 65535 linkagg lacp port 1/1/1 actor admin-key 65534 linkagg lacp port 1/1/13 actor admin-key 65535 ! VLAN: vlan 1 admin-state enable vlan 100 admin-state enable spb bvlan 4000 admin-state enable spb bvlan 4000 name "AutoFabric 6/18/2019 17:33:17" spb bvlan 4001-4015 admin-state enable spb bvlan 4001-4015 name "AutoFabric 6/18/2019 17:33:17" vlan 100 members port 1/1/3 untagged ! PVLAN: ! Spanning Tree: spantree mode flat spantree vlan 1 admin-state enable spantree vlan 100 admin-state enable spantree vlan 4000 admin-state disable spantree vlan 4001 admin-state disable spantree vlan 4002 admin-state disable spantree vlan 4003 admin-state disable spantree vlan 4004 admin-state disable spantree vlan 4005 admin-state disable spantree vlan 4006 admin-state disable spantree vlan 4007 admin-state disable spantree vlan 4008 admin-state disable spantree vlan 4009 admin-state disable spantree vlan 4010 admin-state disable spantree vlan 4011 admin-state disable spantree vlan 4012 admin-state disable spantree vlan 4013 admin-state disable spantree vlan 4014 admin-state disable spantree vlan 4015 admin-state disable ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/3 port-type access unp port 1/1/3 port-template accessDefaultPortTemplate ! Bridging: ! Port Mirroring: ! Port Mapping: ! IP: ip interface dhcp-client vlan 1 ifindex 1 ip interface dhcp-client option-60 OmniSwitch-OS6900-X20 ! IPv6: ! IPSec: ! IPMS: ! AAA: aaa authentication default "local" aaa authentication console "local" aaa authentication ssh "local" aaa tacacs command-authorization disable ! NTP: ntp server clock0.ovcirrus.com ntp server clock1.ovcirrus.com ntp server clock2.ovcirrus.com ntp server clock3.ovcirrus.com ntp client admin-state enable ! QOS: ! Policy Manager: ! VLAN Stacking: ! ERP: ! MVRP: mvrp enable ! LLDP: ! UDLD: ! Server Load Balance: ! High Availability Vlan: ! Session Manager: session cli timeout 999 session prompt default "OS6900-Oben->" ! Web: ! Trap Manager: ! Health Monitor: ! System Service: ip domain-name home ip name-server 192.168.2.1 ip domain-lookup ! SNMP: ! BFD: ! IP Route Manager: ! VRRP: ! UDP Relay: ! RIP: ! OSPF: ! IP Multicast: ! DVMRP: ! IPMR: ! RIPng: ! OSPF3: ! BGP: ! ISIS: ! Module: ! LAN Power: ! RDP: ! DHL: ! Ethernet-OAM: ! SAA: ! SPB-ISIS: spb isis bvlan 4000 ect-id 1 spb isis bvlan 4001 ect-id 2 spb isis bvlan 4002 ect-id 3 spb isis bvlan 4003 ect-id 4 spb isis bvlan 4004 ect-id 5 spb isis bvlan 4005 ect-id 6 spb isis bvlan 4006 ect-id 7 spb isis bvlan 4007 ect-id 8 spb isis bvlan 4008 ect-id 9 spb isis bvlan 4009 ect-id 10 spb isis bvlan 4010 ect-id 11 spb isis bvlan 4011 ect-id 12 spb isis bvlan 4012 ect-id 13 spb isis bvlan 4013 ect-id 14 spb isis bvlan 4014 ect-id 15 spb isis bvlan 4015 ect-id 16 spb isis control-bvlan 4000 spb isis interface linkagg 126-127 spb isis admin-state enable ! SVCMGR: ! LDP: ! EVB: ! APP-FINGERPRINT: ! FCOE: fibre-channel vsan 1 admin-state enable name DEFAULT ! QMR: ! OPENFLOW: ! Dynamic auto-fabric: auto-fabric admin-state enable ! SIP Snooping: ! DHCP Server: ! DHCPv6 Relay: ! DHCPv6 Snooping: ! DHCPv6 Server: ! DHCP Message Service: ! DHCP Active Lease Service: ! Virtual Chassis Split Protection: ! DHCP Snooping: ! APP-MONITORING: ! Loopback Detection: loopback-detection enable ! VM-SNOOPING: ! PPPOE-IA: ! Security: ! Zero Configuration: ! MAC Security: ! OVC: ! EFM-OAM: ! ALARM-MANAGER: ! DEVICE-PROFILE: ! PTP: ! IP DHCP RELAY: ! TEST-OAM: ! LOOPBACK TEST: ! UDP6 RELAY: ! MGMT AGENT: ===== Konfiguration OS6900-Unten ===== ! Chassis: system name "OS6900-Unten" ! Configuration: configuration error-file-limit 2 ! Capability Manager: ! Virtual Flow Control: ! LFP: ! Interface: ! Port_Manager: ! Link Aggregate: linkagg lacp agg 126 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 126 name "Created by Auto-Fabric on Tue Jun 18 17:39:35 2019" linkagg lacp agg 126 actor admin-key 65534 linkagg lacp agg 127 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 127 name "Created by Auto-Fabric on Tue Jun 18 17:32:58 2019" linkagg lacp agg 127 actor admin-key 65535 linkagg lacp port 1/1/1 actor admin-key 65534 linkagg lacp port 1/1/13 actor admin-key 65535 ! VLAN: vlan 1 admin-state enable vlan 100 admin-state enable spb bvlan 4000 admin-state enable spb bvlan 4000 name "AutoFabric 6/18/2019 17:33:17" spb bvlan 4001-4015 admin-state enable spb bvlan 4001-4015 name "AutoFabric 6/18/2019 17:33:17" vlan 100 members port 1/1/5 untagged ! PVLAN: ! Spanning Tree: spantree mode flat spantree vlan 1 admin-state enable spantree vlan 100 admin-state enable spantree vlan 4000 admin-state disable spantree vlan 4001 admin-state disable spantree vlan 4002 admin-state disable spantree vlan 4003 admin-state disable spantree vlan 4004 admin-state disable spantree vlan 4005 admin-state disable spantree vlan 4006 admin-state disable spantree vlan 4007 admin-state disable spantree vlan 4008 admin-state disable spantree vlan 4009 admin-state disable spantree vlan 4010 admin-state disable spantree vlan 4011 admin-state disable spantree vlan 4012 admin-state disable spantree vlan 4013 admin-state disable spantree vlan 4014 admin-state disable spantree vlan 4015 admin-state disable ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/5 port-type access unp port 1/1/5 port-template accessDefaultPortTemplate ! Bridging: ! Port Mirroring: ! Port Mapping: ! IP: ip interface dhcp-client vlan 1 ifindex 1 ip interface dhcp-client option-60 OmniSwitch-OS6900-X20 ! IPv6: ! IPSec: ! IPMS: ! AAA: aaa authentication default "local" aaa authentication console "local" aaa authentication ssh "local" aaa tacacs command-authorization disable ! NTP: ntp server clock0.ovcirrus.com ntp server clock1.ovcirrus.com ntp server clock2.ovcirrus.com ntp server clock3.ovcirrus.com ntp client admin-state enable ! QOS: ! Policy Manager: ! VLAN Stacking: ! ERP: ! MVRP: mvrp enable ! LLDP: ! UDLD: ! Server Load Balance: ! High Availability Vlan: ! Session Manager: session cli timeout 999 session prompt default "OS6900-Unten->" ! Web: ! Trap Manager: ! Health Monitor: ! System Service: ip domain-name home ip name-server 192.168.2.1 ip domain-lookup ! SNMP: ! BFD: ! IP Route Manager: ! VRRP: ! UDP Relay: ! RIP: ! OSPF: ! IP Multicast: ! DVMRP: ! IPMR: ! RIPng: ! OSPF3: ! BGP: ! ISIS: ! Module: ! LAN Power: ! RDP: ! DHL: ! Ethernet-OAM: ! SAA: ! SPB-ISIS: spb isis bvlan 4000 ect-id 1 spb isis bvlan 4001 ect-id 2 spb isis bvlan 4002 ect-id 3 spb isis bvlan 4003 ect-id 4 spb isis bvlan 4004 ect-id 5 spb isis bvlan 4005 ect-id 6 spb isis bvlan 4006 ect-id 7 spb isis bvlan 4007 ect-id 8 spb isis bvlan 4008 ect-id 9 spb isis bvlan 4009 ect-id 10 spb isis bvlan 4010 ect-id 11 spb isis bvlan 4011 ect-id 12 spb isis bvlan 4012 ect-id 13 spb isis bvlan 4013 ect-id 14 spb isis bvlan 4014 ect-id 15 spb isis bvlan 4015 ect-id 16 spb isis control-bvlan 4000 spb isis interface linkagg 126-127 spb isis admin-state enable ! SVCMGR: ! LDP: ! EVB: ! APP-FINGERPRINT: ! FCOE: fibre-channel vsan 1 admin-state enable name DEFAULT ! QMR: ! OPENFLOW: ! Dynamic auto-fabric: auto-fabric admin-state enable ! SIP Snooping: ! DHCP Server: ! DHCPv6 Relay: ! DHCPv6 Snooping: ! DHCPv6 Server: ! DHCP Message Service: ! DHCP Active Lease Service: ! Virtual Chassis Split Protection: ! DHCP Snooping: ! APP-MONITORING: ! Loopback Detection: loopback-detection enable ! VM-SNOOPING: ! PPPOE-IA: ! Security: ! Zero Configuration: ! MAC Security: ! OVC: ! EFM-OAM: ! ALARM-MANAGER: ! DEVICE-PROFILE: ! PTP: ! IP DHCP RELAY: ! TEST-OAM: ! LOOPBACK TEST: ! UDP6 RELAY: ! MGMT AGENT: