Inhaltsverzeichnis
Einfaches SPB-Netz mit Debian Workstations (VMs)
Dieses Beispielnetz verwendet die ALE „Intelligent Fabric“ (Auto-Fabric) und ist weitestgehend automatisch konfiguriert worden.
An diesem Artikel wird noch gearbeitet. :)
Netzwerkdiagramm
Konsolenausgaben
Die virtuellen Debian-basierten Systeme sind an folgenden Ports angeschlossen:
- Debian9-WS1 → OS6900-Oben 1/1/3
- Debian9-WS2 → OS6900-Unten 1/1/5
- Debian9-WS3 → OS6860 1/1/7
Die VMs haben die IPs 10.10.10.1 / 10.10.10.2 und 10.10.10.3 und verwenden den VLAN-Tag 55. Die Konfiguration auf den VMs erfolgt wie folgt.
Debian9-WS1
sudo ip link add link ens7 name ens7.55 type vlan id 55 sudo ip addr add 10.10.10.1/24 brd 10.10.10.255 dev ens7.55 sudo ip link set dev ens7 up sudo ip link set dev ens7.55 up
Debian9-WS2
sudo ip link add link ens7 name ens7.55 type vlan id 55 sudo ip addr add 10.10.10.2/24 brd 10.10.10.255 dev ens7.55 sudo ip link set dev ens7 up sudo ip link set dev ens7.55 up
Debian9-WS3
sudo ip link add link ens7 name ens7.55 type vlan id 55 sudo ip addr add 10.10.10.3/24 brd 10.10.10.255 dev ens7.55 sudo ip link set dev ens7 up sudo ip link set dev ens7.55 up
Stille Geräte (Silent Devices)
Schön zu sehen ist dieser Effekt mit den Debian-VMs, die anders als Windows-Systeme, nicht regelmäßig vor sich herkommunizieren.
OS6900-Oben-> show spb isis services Legend: * indicates locally configured ISID SPB ISIS Services Info: System ISID BVLAN (Name : BMAC) MCAST(T/R) ------------+-------+----------------------------------------+----------- ISIDs: 0 OS6900-Oben-> show mac-learning domain spb Legend: Mac Address: * = address not valid, Mac Address: & = duplicate static address, Domain Vlan/SrvcId[ISId/vnId] Mac Address Type Operation Interface ------------+----------------------+-------------------+------------------+-------------+------------------------- Total number of Valid MAC addresses above = 0
Setzt man nun einen Ping ab, werden die Dienste wieder „gelernt“ oder man konfiguriert den Port entsprechend um. Seit AOS 8.5R4 kann man dafür den Service „fest“ auf den UNP-Port binden.
OS6900-Oben-> show configuration snapshot da-unp ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/3 port-type access unp port 1/1/3 port-template accessDefaultPortTemplate OS6900-Oben-> unp port 1/1/3 profile systemDefault10000055 OS6900-Oben-> show spb isis services Legend: * indicates locally configured ISID SPB ISIS Services Info: System ISID BVLAN (Name : BMAC) MCAST(T/R) ------------+-------+----------------------------------------+----------- * 10000055 4007 OS6900-Oben : e8:e7:32:11:ca:d1 ISIDs: 1
OS6900-Unten-> show configuration snapshot da-unp ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/5 port-type access unp port 1/1/5 port-template accessDefaultPortTemplate OS6900-Unten-> unp port 1/1/5 profile systemDefault10000055 OS6900-Unten-> show spb isis services Legend: * indicates locally configured ISID SPB ISIS Services Info: System ISID BVLAN (Name : BMAC) MCAST(T/R) ------------+-------+----------------------------------------+----------- * 10000055 4007 OS6900-Oben : e8:e7:32:11:ca:d1 * 10000055 4007 OS6900-Unten : e8:e7:32:11:ca:ed ISIDs: 2 OS6900-Unten-> show mac-learning domain spb Legend: Mac Address: * = address not valid, Mac Address: & = duplicate static address, Domain Vlan/SrvcId[ISId/vnId] Mac Address Type Operation Interface ------------+----------------------+-------------------+------------------+-------------+------------------------- SPB 32775:10000055 00:25:90:5d:e3:64 dynamic servicing sap:1/1/5:55 SPB 32775:10000055 00:25:90:5d:e3:65 dynamic servicing sdp:32782:32775 Total number of Valid MAC addresses above = 2
Das unp profile sorgt dafür dass der SAP im egress bestehend bleibt, so dass das Gerät (das vergessen wurde) weiterhin für Anfragen erreichbar ist.
OS6860-> show service spb 32775 ports Legend: (*) dyn unicast object (+) remote mcast object (#) local mcast object SPB Service 32775 (Dynamic Service isid=10000055 for UNP) Admin : Up, Oper : Up, Stats : N, Mtu : 9194, VlanXlation : Y, ISID : 10000055, BVlan : 4007, MCast-Mode : Headend, Tx/Rx : 0/0, RemoveIngTag: N Sap Trusted:Priority/ Sap Description / Identifier Adm Oper Stats Sdp SystemId:BVlan Intf Sdp SystemName ----------------------+----+----+-----+--------------------+--------+-------------------------------- sap:1/1/17:55* Up Up N Y:x 1/1/17 Dynamic SAP for UNP sdp:32775:32775* Up Up Y e8e7.3211.cad1:4007 0/127 OS6900-Oben sdp:32791:32775* Up Up Y e8e7.3211.caed:4007 0/126 OS6900-Unten Total Ports: 3 OS6860-> show mac-learning domain spb Legend: Mac Address: * = address not valid, Mac Address: & = duplicate static address, Domain Vlan/SrvcId[ISId/vnId] Mac Address Type Operation Interface ------------+----------------------+-------------------+------------------+-------------+------------------------- SPB 32775:10000055 00:25:90:5d:e3:64 dynamic servicing sdp:32791:32775 Total number of Valid MAC addresses above = 1
Nun ein ping von 10.10.10.1 → 10.10.10.3
benny@debian9ws1:~$ ping 10.10.10.3 PING 10.10.10.3 (10.10.10.3) 56(84) bytes of data. 64 bytes from 10.10.10.3: icmp_seq=6 ttl=64 time=0.264 ms 64 bytes from 10.10.10.3: icmp_seq=7 ttl=64 time=0.239 ms ^C
Das System ist nun wieder erreichbar. Ich muss hier mit den US-Kollegen mal sprechen ob es dem erwarteten Verhalten entspricht dass hier die ersten Pakete verloren gehen (ISIS-LSDB etc).
OS6860-> show mac-learning domain spb Legend: Mac Address: * = address not valid, Mac Address: & = duplicate static address, Domain Vlan/SrvcId[ISId/vnId] Mac Address Type Operation Interface ------------+----------------------+-------------------+------------------+-------------+------------------------- SPB 32775:10000055 00:25:90:5d:e1:7f dynamic servicing sap:1/1/17:55 SPB 32775:10000055 00:25:90:5d:e3:64 dynamic servicing sdp:32791:32775 Total number of Valid MAC addresses above = 2
Konfiguration OS6860
! Chassis: system name "OS6860" ! Configuration: configuration error-file-limit 2 ! Capability Manager: hash-control extended ! Virtual Flow Control: ! LFP: ! Interface: ! Port_Manager: ! Link Aggregate: linkagg lacp agg 126 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 126 name "Created by Auto-Fabric on Tue Jun 18 19:32:57 2019" linkagg lacp agg 126 actor admin-key 65534 linkagg lacp agg 127 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 127 name "Created by Auto-Fabric on Tue Jun 18 19:32:57 2019" linkagg lacp agg 127 actor admin-key 65535 linkagg lacp port 1/1/25 actor admin-key 65535 linkagg lacp port 1/1/27 actor admin-key 65534 ! VLAN: vlan 1 admin-state enable vlan 100 admin-state enable spb bvlan 4000 admin-state enable spb bvlan 4000 name "AutoFabric 6/18/2019 19:33:16" spb bvlan 4001-4015 admin-state enable spb bvlan 4001-4015 name "AutoFabric 6/18/2019 19:33:16" vlan 100 members port 1/1/17 untagged ! PVLAN: ! Spanning Tree: spantree mode flat spantree vlan 1 admin-state enable spantree vlan 100 admin-state enable spantree vlan 4000 admin-state disable spantree vlan 4001 admin-state disable spantree vlan 4002 admin-state disable spantree vlan 4003 admin-state disable spantree vlan 4004 admin-state disable spantree vlan 4005 admin-state disable spantree vlan 4006 admin-state disable spantree vlan 4007 admin-state disable spantree vlan 4008 admin-state disable spantree vlan 4009 admin-state disable spantree vlan 4010 admin-state disable spantree vlan 4011 admin-state disable spantree vlan 4012 admin-state disable spantree vlan 4013 admin-state disable spantree vlan 4014 admin-state disable spantree vlan 4015 admin-state disable ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/17 port-type access unp port 1/1/17 port-template accessDefaultPortTemplate ! Bridging: ! Port Mirroring: ! Port Mapping: ! IP: ip interface dhcp-client vlan 1 ifindex 1 ip interface dhcp-client option-60 OmniSwitch-OS6860E-P24 ! IPv6: ! IPSec: ! IPMS: ! AAA: aaa authentication default "local" aaa authentication console "local" aaa authentication ssh "local" aaa tacacs command-authorization disable ! NTP: ntp server clock0.ovcirrus.com ntp server clock1.ovcirrus.com ntp server clock2.ovcirrus.com ntp server clock3.ovcirrus.com ntp client admin-state enable ! QOS: ! Policy Manager: ! VLAN Stacking: ! ERP: ! MVRP: mvrp enable ! LLDP: ! UDLD: ! Server Load Balance: ! High Availability Vlan: ! Session Manager: session cli timeout 999 session prompt default "OS6860->" ! Web: ! Trap Manager: ! Health Monitor: ! System Service: ip domain-name home ip name-server 192.168.2.1 ip domain-lookup ! SNMP: ! BFD: ! IP Route Manager: ! VRRP: ! UDP Relay: ! RIP: ! OSPF: ! IP Multicast: ! DVMRP: ! IPMR: ! RIPng: ! OSPF3: ! BGP: ! ISIS: ! Module: ! LAN Power: ! RDP: ! DHL: ! Ethernet-OAM: ! SAA: ! SPB-ISIS: spb isis bvlan 4000 ect-id 1 spb isis bvlan 4001 ect-id 2 spb isis bvlan 4002 ect-id 3 spb isis bvlan 4003 ect-id 4 spb isis bvlan 4004 ect-id 5 spb isis bvlan 4005 ect-id 6 spb isis bvlan 4006 ect-id 7 spb isis bvlan 4007 ect-id 8 spb isis bvlan 4008 ect-id 9 spb isis bvlan 4009 ect-id 10 spb isis bvlan 4010 ect-id 11 spb isis bvlan 4011 ect-id 12 spb isis bvlan 4012 ect-id 13 spb isis bvlan 4013 ect-id 14 spb isis bvlan 4014 ect-id 15 spb isis bvlan 4015 ect-id 16 spb isis control-bvlan 4000 spb isis interface linkagg 126-127 spb isis admin-state enable ! SVCMGR: ! LDP: ! EVB: ! APP-FINGERPRINT: ! FCOE: ! QMR: ! OPENFLOW: ! Dynamic auto-fabric: auto-fabric admin-state enable ! SIP Snooping: ! DHCP Server: ! DHCPv6 Relay: ! DHCPv6 Snooping: ! DHCPv6 Server: ! DHCP Message Service: ! DHCP Active Lease Service: ! Virtual Chassis Split Protection: ! DHCP Snooping: ! APP-MONITORING: ! Loopback Detection: loopback-detection enable ! VM-SNOOPING: ! PPPOE-IA: ! Security: ! Zero Configuration: ! MAC Security: ! OVC: ! EFM-OAM: ! ALARM-MANAGER: ! DEVICE-PROFILE: ! PTP: ! IP DHCP RELAY: ! TEST-OAM: ! LOOPBACK TEST: ! UDP6 RELAY: ! MGMT AGENT:
Konfiguration OS6900-Oben
! Chassis: system name "OS6900-Oben" ! Configuration: configuration error-file-limit 2 ! Capability Manager: ! Virtual Flow Control: ! LFP: ! Interface: ! Port_Manager: ! Link Aggregate: linkagg lacp agg 126 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 126 name "Created by Auto-Fabric on Tue Jun 18 17:39:35 2019" linkagg lacp agg 126 actor admin-key 65534 linkagg lacp agg 127 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 127 name "Created by Auto-Fabric on Tue Jun 18 17:32:58 2019" linkagg lacp agg 127 actor admin-key 65535 linkagg lacp port 1/1/1 actor admin-key 65534 linkagg lacp port 1/1/13 actor admin-key 65535 ! VLAN: vlan 1 admin-state enable vlan 100 admin-state enable spb bvlan 4000 admin-state enable spb bvlan 4000 name "AutoFabric 6/18/2019 17:33:17" spb bvlan 4001-4015 admin-state enable spb bvlan 4001-4015 name "AutoFabric 6/18/2019 17:33:17" vlan 100 members port 1/1/3 untagged ! PVLAN: ! Spanning Tree: spantree mode flat spantree vlan 1 admin-state enable spantree vlan 100 admin-state enable spantree vlan 4000 admin-state disable spantree vlan 4001 admin-state disable spantree vlan 4002 admin-state disable spantree vlan 4003 admin-state disable spantree vlan 4004 admin-state disable spantree vlan 4005 admin-state disable spantree vlan 4006 admin-state disable spantree vlan 4007 admin-state disable spantree vlan 4008 admin-state disable spantree vlan 4009 admin-state disable spantree vlan 4010 admin-state disable spantree vlan 4011 admin-state disable spantree vlan 4012 admin-state disable spantree vlan 4013 admin-state disable spantree vlan 4014 admin-state disable spantree vlan 4015 admin-state disable ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/3 port-type access unp port 1/1/3 port-template accessDefaultPortTemplate ! Bridging: ! Port Mirroring: ! Port Mapping: ! IP: ip interface dhcp-client vlan 1 ifindex 1 ip interface dhcp-client option-60 OmniSwitch-OS6900-X20 ! IPv6: ! IPSec: ! IPMS: ! AAA: aaa authentication default "local" aaa authentication console "local" aaa authentication ssh "local" aaa tacacs command-authorization disable ! NTP: ntp server clock0.ovcirrus.com ntp server clock1.ovcirrus.com ntp server clock2.ovcirrus.com ntp server clock3.ovcirrus.com ntp client admin-state enable ! QOS: ! Policy Manager: ! VLAN Stacking: ! ERP: ! MVRP: mvrp enable ! LLDP: ! UDLD: ! Server Load Balance: ! High Availability Vlan: ! Session Manager: session cli timeout 999 session prompt default "OS6900-Oben->" ! Web: ! Trap Manager: ! Health Monitor: ! System Service: ip domain-name home ip name-server 192.168.2.1 ip domain-lookup ! SNMP: ! BFD: ! IP Route Manager: ! VRRP: ! UDP Relay: ! RIP: ! OSPF: ! IP Multicast: ! DVMRP: ! IPMR: ! RIPng: ! OSPF3: ! BGP: ! ISIS: ! Module: ! LAN Power: ! RDP: ! DHL: ! Ethernet-OAM: ! SAA: ! SPB-ISIS: spb isis bvlan 4000 ect-id 1 spb isis bvlan 4001 ect-id 2 spb isis bvlan 4002 ect-id 3 spb isis bvlan 4003 ect-id 4 spb isis bvlan 4004 ect-id 5 spb isis bvlan 4005 ect-id 6 spb isis bvlan 4006 ect-id 7 spb isis bvlan 4007 ect-id 8 spb isis bvlan 4008 ect-id 9 spb isis bvlan 4009 ect-id 10 spb isis bvlan 4010 ect-id 11 spb isis bvlan 4011 ect-id 12 spb isis bvlan 4012 ect-id 13 spb isis bvlan 4013 ect-id 14 spb isis bvlan 4014 ect-id 15 spb isis bvlan 4015 ect-id 16 spb isis control-bvlan 4000 spb isis interface linkagg 126-127 spb isis admin-state enable ! SVCMGR: ! LDP: ! EVB: ! APP-FINGERPRINT: ! FCOE: fibre-channel vsan 1 admin-state enable name DEFAULT ! QMR: ! OPENFLOW: ! Dynamic auto-fabric: auto-fabric admin-state enable ! SIP Snooping: ! DHCP Server: ! DHCPv6 Relay: ! DHCPv6 Snooping: ! DHCPv6 Server: ! DHCP Message Service: ! DHCP Active Lease Service: ! Virtual Chassis Split Protection: ! DHCP Snooping: ! APP-MONITORING: ! Loopback Detection: loopback-detection enable ! VM-SNOOPING: ! PPPOE-IA: ! Security: ! Zero Configuration: ! MAC Security: ! OVC: ! EFM-OAM: ! ALARM-MANAGER: ! DEVICE-PROFILE: ! PTP: ! IP DHCP RELAY: ! TEST-OAM: ! LOOPBACK TEST: ! UDP6 RELAY: ! MGMT AGENT:
Konfiguration OS6900-Unten
! Chassis: system name "OS6900-Unten" ! Configuration: configuration error-file-limit 2 ! Capability Manager: ! Virtual Flow Control: ! LFP: ! Interface: ! Port_Manager: ! Link Aggregate: linkagg lacp agg 126 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 126 name "Created by Auto-Fabric on Tue Jun 18 17:39:35 2019" linkagg lacp agg 126 actor admin-key 65534 linkagg lacp agg 127 size 16 hash tunnel-protocol admin-state enable linkagg lacp agg 127 name "Created by Auto-Fabric on Tue Jun 18 17:32:58 2019" linkagg lacp agg 127 actor admin-key 65535 linkagg lacp port 1/1/1 actor admin-key 65534 linkagg lacp port 1/1/13 actor admin-key 65535 ! VLAN: vlan 1 admin-state enable vlan 100 admin-state enable spb bvlan 4000 admin-state enable spb bvlan 4000 name "AutoFabric 6/18/2019 17:33:17" spb bvlan 4001-4015 admin-state enable spb bvlan 4001-4015 name "AutoFabric 6/18/2019 17:33:17" vlan 100 members port 1/1/5 untagged ! PVLAN: ! Spanning Tree: spantree mode flat spantree vlan 1 admin-state enable spantree vlan 100 admin-state enable spantree vlan 4000 admin-state disable spantree vlan 4001 admin-state disable spantree vlan 4002 admin-state disable spantree vlan 4003 admin-state disable spantree vlan 4004 admin-state disable spantree vlan 4005 admin-state disable spantree vlan 4006 admin-state disable spantree vlan 4007 admin-state disable spantree vlan 4008 admin-state disable spantree vlan 4009 admin-state disable spantree vlan 4010 admin-state disable spantree vlan 4011 admin-state disable spantree vlan 4012 admin-state disable spantree vlan 4013 admin-state disable spantree vlan 4014 admin-state disable spantree vlan 4015 admin-state disable ! DA-UNP: unp profile "systemDefault10000000" unp profile "systemDefault10000055" unp profile "systemDefault10000000" map service-type spb tag-value 0 isid 10000000 bvlan 4000 multicast-mode headend vlan-xlation unp profile "systemDefault10000055" map service-type spb tag-value 55 isid 10000055 bvlan 4007 multicast-mode headend vlan-xlation unp port 1/1/5 port-type access unp port 1/1/5 port-template accessDefaultPortTemplate ! Bridging: ! Port Mirroring: ! Port Mapping: ! IP: ip interface dhcp-client vlan 1 ifindex 1 ip interface dhcp-client option-60 OmniSwitch-OS6900-X20 ! IPv6: ! IPSec: ! IPMS: ! AAA: aaa authentication default "local" aaa authentication console "local" aaa authentication ssh "local" aaa tacacs command-authorization disable ! NTP: ntp server clock0.ovcirrus.com ntp server clock1.ovcirrus.com ntp server clock2.ovcirrus.com ntp server clock3.ovcirrus.com ntp client admin-state enable ! QOS: ! Policy Manager: ! VLAN Stacking: ! ERP: ! MVRP: mvrp enable ! LLDP: ! UDLD: ! Server Load Balance: ! High Availability Vlan: ! Session Manager: session cli timeout 999 session prompt default "OS6900-Unten->" ! Web: ! Trap Manager: ! Health Monitor: ! System Service: ip domain-name home ip name-server 192.168.2.1 ip domain-lookup ! SNMP: ! BFD: ! IP Route Manager: ! VRRP: ! UDP Relay: ! RIP: ! OSPF: ! IP Multicast: ! DVMRP: ! IPMR: ! RIPng: ! OSPF3: ! BGP: ! ISIS: ! Module: ! LAN Power: ! RDP: ! DHL: ! Ethernet-OAM: ! SAA: ! SPB-ISIS: spb isis bvlan 4000 ect-id 1 spb isis bvlan 4001 ect-id 2 spb isis bvlan 4002 ect-id 3 spb isis bvlan 4003 ect-id 4 spb isis bvlan 4004 ect-id 5 spb isis bvlan 4005 ect-id 6 spb isis bvlan 4006 ect-id 7 spb isis bvlan 4007 ect-id 8 spb isis bvlan 4008 ect-id 9 spb isis bvlan 4009 ect-id 10 spb isis bvlan 4010 ect-id 11 spb isis bvlan 4011 ect-id 12 spb isis bvlan 4012 ect-id 13 spb isis bvlan 4013 ect-id 14 spb isis bvlan 4014 ect-id 15 spb isis bvlan 4015 ect-id 16 spb isis control-bvlan 4000 spb isis interface linkagg 126-127 spb isis admin-state enable ! SVCMGR: ! LDP: ! EVB: ! APP-FINGERPRINT: ! FCOE: fibre-channel vsan 1 admin-state enable name DEFAULT ! QMR: ! OPENFLOW: ! Dynamic auto-fabric: auto-fabric admin-state enable ! SIP Snooping: ! DHCP Server: ! DHCPv6 Relay: ! DHCPv6 Snooping: ! DHCPv6 Server: ! DHCP Message Service: ! DHCP Active Lease Service: ! Virtual Chassis Split Protection: ! DHCP Snooping: ! APP-MONITORING: ! Loopback Detection: loopback-detection enable ! VM-SNOOPING: ! PPPOE-IA: ! Security: ! Zero Configuration: ! MAC Security: ! OVC: ! EFM-OAM: ! ALARM-MANAGER: ! DEVICE-PROFILE: ! PTP: ! IP DHCP RELAY: ! TEST-OAM: ! LOOPBACK TEST: ! UDP6 RELAY: ! MGMT AGENT: