HP 6125XLG Blade Switch High Availability Configuration Guide Part number: 5998-3724 Software version: Release 2306 Document version: 6W100-20130912...
Page 2
HEWLETT-PACKARD COMPANY MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS MATERIAL, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for incidental or consequential damages in connection with the furnishing, performance, or use of this material.
Configuring Ethernet OAM Overview Ethernet Operation, Administration and Maintenance (OAM) is a tool that monitors Layer 2 link status and addresses common link-related issues on the "last mile." Ethernet OAM improves Ethernet management and maintainability. You can use it to monitor the status of the point-to-point link between two directly connected devices.
Page 7
Ethernet OAM connection establishment Ethernet OAM connection is the basis of all the other Ethernet OAM functions. OAM connection establishment is also known as the "Discovery phase," where an Ethernet OAM entity discovers the remote OAM entity to establish a session. In this phase, two connected OAM entities exchange Information OAMPDUs to advertise their OAM configuration and capabilities to each other for a comparison.
Page 8
Ethernet OAM link events Description An errored frame event occurs when the number of detected error frames in Errored frame event the detection window (specified detection interval) exceeds the predefined threshold. An errored frame period event occurs when the number of frame errors in Errored frame period event the detection window (specified number of received frames) exceeds the predefined threshold.
Configuring the Ethernet OAM connection detection timers After an Ethernet OAM connection is established, the Ethernet OAM entities exchange Information OAMPDUs at the handshake packet transmission interval to detect the availability of the Ethernet OAM connection. If an Ethernet OAM entity receives no Information OAMPDU within the Ethernet OAM connection timeout time, the Ethernet OAM connection is considered disconnected.
Configuring errored symbol event detection An errored symbol event occurs when the number of detected symbol errors in the detection window (specified number of received symbols) exceeds the predefined threshold. You can configure this command in system view or interface view. The configuration in system view takes effect on all ports, and the configuration in interface view takes effect on the specified port.
To configure errored frame event detection on a port: Step Command Remarks Enter system view. system-view interface interface-type Enter Ethernet interface view. interface-number Configure the errored frame oam errored-frame window By default, an interface uses the event detection window. window-value value configured globally.
Configuring errored frame seconds event detection CAUTION: Make sure the errored frame seconds triggering threshold is less than the errored frame seconds detection window. Otherwise, no errored frame seconds event can be generated. An errored frame seconds event occurs when the number of times that errored frame seconds are detected on a port in the detection window (specified detection interval) exceeds the predefined threshold.
Step Command Remarks Enter system view. system-view interface interface-type Enter Ethernet interface view. interface-number Configure the action the port oam remote-failure By default, the port only logs the takes after it receives an { connection-expired | Ethernet OAM event it receives Ethernet OAM event from the critical-event | dying-gasp | from the remote end.
Enabling Ethernet OAM remote loopback on the port Step Command Remarks Enter system view. system-view interface interface-type Enter Ethernet interface view. interface-number Enable Ethernet OAM remote By default, Ethernet OAM remote oam remote-loopback start loopback on the port. loopback is disabled. Rejecting the Ethernet OAM remote loopback request from a remote port The Ethernet OAM remote loopback function impacts other services.
Purpose Command Display the statistics on Ethernet OAM link error display oam link-event { local | remote } [ interface events after an Ethernet OAM connection is interface-type interface-number ] established. Clear statistics on Ethernet OAM packets and Ethernet reset oam [ interface interface-type interface-number ] OAM link error events.
Page 17
Use the display oam critical-event command to display the statistics of Ethernet OAM critical link events. For example: # Display the statistics of Ethernet OAM critical link events on all the ports of Device A. [DeviceA] display oam critical-event -----------[Ten-GigabitEthernet1/1/5] ----------- Local link status : UP Event statistics...
Configuring CFD Overview Connectivity Fault Detection (CFD), which conforms to IEEE 802.1ag Connectivity Fault Management (CFM), is an end-to-end per-VLAN link layer OAM mechanism used for link connectivity detection, fault verification, and fault location. Basic CFD concepts Maintenance domain A maintenance domain (MD) defines the network or part of the network where CFD plays its role. An MD is identified by its MD name.
Page 19
An MA serves the specified VLAN or no VLAN. An MA that serves a VLAN is considered carrying VLAN attribute. An MA that serves no VLAN is considered having no VLAN attribute. An MP can receive packets sent by other MPs in the same MA. The level of an MA equals the level of the MD that the MA belongs to.
Page 20
Figure 3 Procedure of creating MIPs Figure 4 demonstrates a grading example of the CFD module. Four levels of MDs (0, 2, 3, and 5) are designed. The bigger the number, the higher the level and the larger the area covered. MPs are configured on the ports of Device A through Device F.
CFD functions CFD works effectively only in networks that are configured correctly. Its functions, which are implemented through the MPs, include: • Continuity check (CC) Loopback (LB) • Linktrace (LT) • Continuity check Connectivity faults are usually caused by device faults or configuration errors. Continuity check checks the connectivity between MEPs.
Changes occur to the VLAN attribute of a port. • • The rule specified in the cfd mip-rule command changes. An MA with no VLAN attribute is mainly used to detect direct link status. It cannot generate MIPs. For an MA with VLAN attribute, if the same or higher level MEP exists on the interface, no MIP is generated for the MA on the interface.
Configurations in Layer 2 aggregate interface view take effect on the aggregate interface and all • its member ports. Configurations on a member port take effect only when the member port leaves the aggregation • group. To configure CC on a MEP: Step Command Remarks...
Step Command Remarks cfd linktrace service-instance Find the path between a instance-id mep mep-id { target-mac Available in any view. source MEP and a target MEP. mac-address | target-mep target-mep-id } [ ttl ttl-value ] [ hw-only ] Enter system view. system-view Enable LT messages automatic cfd linktrace auto-detection [ size...
Page 27
In MD_A, Device B is designed to have MIPs when its port is configured with low level MEPs. Port • Ten-GigabitEthernet 1/1/7 is configured with MEPs of MD_B, and the MIPs of MD_A can be configured on this port. You should configure the MIP generation rule of MD_A as explicit. •...
Page 28
[DeviceB] cfd md MD_B level 3 [DeviceB] cfd service-instance 2 ma-id vlan-based md MD_B vlan 100 Configure Device D as you configure Device B. # Create MD_B (level 3) on Device C, and create service instance 2 (in which the MA is identified by a VLAN and serves VLAN 100).
[DeviceA] interface ten-gigabitethernet 1/1/5 [DeviceA-Ten-GigabitEthernet1/1/5] cfd cc service-instance 1 mep 1001 enable [DeviceA-Ten-GigabitEthernet1/1/5] quit # On Device B, enable the sending of CCM frames for MEP 2001 in service instance 2 on Ten-GigabitEthernet 1/1/7. [DeviceB] interface ten-gigabitethernet 1/1/7 [DeviceB-Ten-GigabitEthernet1/1/7] cfd cc service-instance 2 mep 2001 enable [DeviceB-Ten-GigabitEthernet1/1/7] quit # On Device D, enable the sending of CCM frames for MEP 4001 in service instance 2 on Ten-GigabitEthernet 1/1/5, and enable the sending of CCM frames for MEP 4002 in service...
Configuring DLDP Overview Unidirectional links occur when one end of a link can receive packets from the other end, but the other end cannot receive packets sent by the first end. Unidirectional fiber links include the following types: Occur when fibers are cross-connected. •...
Basic concepts DLDP neighbor states If port A and B are on the same link and port A can receive link-layer packets from port B, port B is a DLDP neighbor of port A. Two ports that can exchange packets are neighbors. Table 6 DLDP neighbor states DLDP timer Description...
DLDP timer Description If a port is physically down, the device triggers the DelayDown timer (the default is 1 second and is configurable), rather than removing the corresponding neighbor entry. DelayDown timer When the DelayDown timer expires, the device removes the corresponding DLDP neighbor information if the port is down, and does not perform any operation if the port is up.
Page 33
Port 1 receives the RecoverProbe packet from Port 4, and returns a RecoverEcho packet. Port 4 cannot receive any RecoverEcho packet from Port 1, so Port 4 cannot become the neighbor of Port 1. Port 3 can receive the RecoverEcho packet from Port 1, but Port 3 is not the intended destination, so Port 3 cannot become the neighbor of Port 1.
packet to Port 2. At the same time, Port 1 deletes the neighborship with Port 2, and starts the RecoverProbe timer. Port 2 stays in Inactive state during this process. Detecting multiple neighbors When multiple devices are connected through a hub, enable DLDP on all interfaces connected to the hub to detect unidirectional links among the neighbors.
Configuration prerequisites Configure the full duplex mode for the ports at two ends of the link, and configure a speed for the two ports, rather than letting them negotiate a speed. Enabling DLDP To properly configure DLDP on the device, you must enable DLDP globally and on each port. To enable DLDP: Step Command...
Step Command Remarks Enter system view. system-view The default is 1 second. Set the DelayDown timer. dldp delaydown-timer time The DelayDown timer setting applies to all DLDP-enabled ports. Setting the port shutdown mode On detecting a unidirectional link, the ports can be shut down in one of the following two modes. Auto mode.
Step Command Remarks By default, no password is configured for DLDP authentication. If you do not configure the Configure the password for dldp authentication-password authentication password after you DLDP authentication. { cipher cipher | simple simple } configure the authentication mode, the authentication mode is none no matter which authentication mode you configure.
Page 38
<DeviceA> system-view [DeviceA] dldp global enable # Configure Ten-GigabitEthernet 1/1/5 to operate in full duplex mode and at 10000 Mbps, and enable DLDP on the port. [DeviceA] interface ten-gigabitethernet 1/1/5 [DeviceA-Ten-GigabitEthernet1/1/5] duplex full [DeviceA-Ten-GigabitEthernet1/1/5] speed 10000 [DeviceA-Ten-GigabitEthernet1/1/5] dldp enable [DeviceA-Ten-GigabitEthernet1/1/5] quit # Configure Ten-GigabitEthernet 1/1/6 to operate in full duplex mode and at 10000 Mbps, and enable DLDP on the port.
Page 39
DLDP unidirectional-shutdown mode: Auto DLDP delaydown-timer value: 1s Number of enabled ports: 2 Interface Ten-GigabitEthernet1/1/5 DLDP port state: Bidirectional Number of the port’s neighbors: 1 Neighbor MAC address: 0023-8956-3600 Neighbor port index: 1 Neighbor state: Confirmed Neighbor aged time: 11s Interface Ten-GigabitEthernet1/1/6 DLDP port state: Bidirectional Number of the port’s neighbors: 1...
Number of enabled ports: 2 Interface Ten-GigabitEthernet1/1/5 DLDP port state: Unidirectional Number of the port’s neighbors: 0 (Maximum number ever detected: 1) Interface Ten-GigabitEthernet1/1/6 DLDP port state: Unidirectional Number of the port’s neighbors: 0 (Maximum number ever detected: 1) The output shows that the DLDP port status of both Ten-GigabitEthernet 1/1/5 and Ten-GigabitEthernet 1/1/6 is unidirectional, which indicates that DLDP detects unidirectional links on them and automatically shuts down the two ports.
Page 41
Figure 11 Network diagram Configuration procedure Configure Device A: # Enable DLDP globally. <DeviceA> system-view [DeviceA] dldp enable # Configure Ten-GigabitEthernet 1/1/5 to operate in full duplex mode and at 10000 Mbps, and enable DLDP on the port. [DeviceA] interface ten-gigabitethernet 1/1/5 [DeviceA-Ten-GigabitEthernet1/1/5] duplex full [DeviceA-Ten-GigabitEthernet1/1/5] speed 10000 [DeviceA-Ten-GigabitEthernet1/1/5] dldp enable...
Page 42
[DeviceB-Ten-GigabitEthernet1/1/6] dldp enable [DeviceB-Ten-GigabitEthernet1/1/6] quit # Set the port shutdown mode to manual. [DeviceB] dldp unidirectional-shutdown manual Verify the configuration: After the configurations are complete, you can use the display dldp command to display the DLDP configuration globally and on ports. # Display the DLDP configuration globally and on all the DLDP-enabled ports of Device A.
Page 43
%Jul 12 08:29:25:004 2012 DeviceA IFNET/3/PHY_UPDOWN: Ten-GigabitEthernet1/1/5 link status is UP. %Jul 12 08:29:25:005 2012 DeviceA IFNET/5/LINK_UPDOWN: Line protocol on the interface Ten-GigabitEthernet1/1/5 is UP. %Jul 12 08:29:25:893 2012 DeviceA IFNET/3/PHY_UPDOWN: Ten-GigabitEthernet1/1/6 link status is UP. %Jul 12 08:29:25:894 2012 DeviceA IFNET/5/LINK_UPDOWN: Line protocol on the interface Ten-GigabitEthernet1/1/6 is UP.
Page 44
[DeviceA-Ten-GigabitEthernet1/1/6] shutdown Correct the fiber connections and bring up the two ports: # Bring up Ten-GigabitEthernet 1/1/6. [DeviceA-Ten-GigabitEthernet1/1/6] undo shutdown The following log information is displayed on Device A: [DeviceA-Ten-GigabitEthernet1/1/6]%Jul 12 08:46:17:677 2012 DeviceA IFNET/3/PHY_UPDOWN: Ten-GigabitEthernet1/1/6 link status is UP. %Jul 12 08:46:17:678 2012 DeviceA IFNET/5/LINK_UPDOWN: Line protocol on the interface Ten-GigabitEthernet1/1/6 is UP.
Configuring VRRP The interfaces that VRRP involves can be only Layer 3 Ethernet interfaces and VLAN interfaces unless otherwise specified. You can configure an Ethernet port as a Layer 3 interface by using the port link-mode route command (see Layer 2—LAN Switching Configuration Guide). Overview Typically, you can configure a default gateway for every host on a LAN.
Load balancing mode—Extends the VRRP standard mode to distribute load across VRRP group • members. For more information, see "VRRP load balancing mode." VRRP has two versions: VRRPv2 and VRRPv3. VRRPv2 supports IPv4 VRRP. VRRPv3 supports IPv4 VRRP and IPv6 VRRP. VRRP standard mode In VRRP standard mode, only the master in the VRRP group can provide gateway service.
Preemptive mode—A backup starts a new master election and takes over as master when it detects • that it has a higher priority than the current master. Preemptive mode makes sure the router with the highest priority in a VRRP group always acts as the master. Authentication method To avoid attacks from unauthorized users, VRRP member routers add authentication keys in VRRP packets to authenticate one another.
Master election Routers in a VRRP group determine their roles by priority. When a router joins a VRRP group, it has a backup role. The router role changes according to the following situations: • If the backup does not receive any VRRP advertisement when the timer (3 × advertisement interval + Skew_Time) expires, it becomes the master.
Page 49
Figure 14 VRRP in master/backup mode Assume that Router A is acting as the master to forward packets to external networks, and Router B and Router C are backups in listening state. When Router A fails, Router B and Router C elect a new master to forward packets for hosts on the subnet.
VRRP group 1—Router A is the master. Router B and Router C are the backups. • • VRRP group 2—Router B is the master. Router A and Router C are the backups. VRRP group 3—Router C is the master. Router A and Router B are the backups. •...
Page 51
Figure 16 Virtual MAC address assignment Network Router A Router B Master Backup Virtual IP: 10.1.1.1/24 Virtual MAC: 000f-e2ff-0012 Virtual MAC: 000f-e2ff-0011 Allocate Virtual MAC 000f-e2ff-0012 to Router B Gateway IP: 10.1.1.1/24 Gateway IP: 10.1.1.1/24 Host A Host B When an ARP request arrives, the master (Router A) selects a virtual MAC address based on the load balancing algorithm to answer the ARP request.
Figure 18 Sending packets to different routers for forwarding Virtual forwarder Virtual forwarder creation Virtual MAC addresses enable traffic distribution across routers in a VRRP group. To enable routers in the VRRP group to forward packets, VFs must be created on them. Each VF is associated with a virtual MAC address in the VRRP group and forwards packets that are sent to this virtual MAC address.
Page 53
On a router that does not own the VF, if the weight of the VF is higher than or equal to the lower limit • of failure, the priority of the VF is calculated as weight/(number of local AVFs +1). If the weight of the VF is lower than the lower limit of failure, the priority of the VF is 0.
Redirect timer—Before this timer expires, the master still uses the virtual MAC address • corresponding to the failed AVF to respond to ARP/ND requests from hosts, and the VF owner can share traffic load if the VF owner resumes normal operation within this time. When this timer expires, the master stops using the virtual MAC address corresponding to the failed AVF to respond to ARP/ND requests from hosts.
Specifying an IPv4 VRRP operating mode A VRRP group can operate in either of the following modes: • Standard mode—Only the master can forward packets. Load balancing mode—All members that have an AVF can forward packets. • After an IPv4 VRRP operating mode is configured on a router, all IPv4 VRRP groups on the router operate in the specified operating mode.
When a router is the IP address owner in a VRRP group, do not configure the network command on • the interface to use the IP address of the interface, or the virtual IP address of the VRRP group, to establish a neighbor relationship with the adjacent router.
Step Command Remarks By default, the router in a VRRP Enable the preemptive mode vrrp vrid virtual-router-id group operates in preemptive for the router in a VRRP group preempt-mode [ delay mode and the preemption delay and configure the preemption delay-value ] time is 0 seconds, which means an delay time.
Configuring VF tracking You can configure VF tracking in both standard mode and load balancing mode, but the function takes effect only in load balancing mode. In load balancing mode, you can establish the collaboration between the VFs and NQA or BFD through the tracking function.
Step Command Remarks Enter system view. system-view • Specify the standard mode: undo vrrp ipv6 mode Use one of the commands. Specify an IPv6 VRRP • Specify the load balancing By default, VRRP operates in operating mode. mode: standard mode. vrrp ipv6 mode load-balance Creating a VRRP group and assigning a virtual IPv6 address A VRRP group can work properly after you create it and assign at least one virtual IPv6 address for it.
Step Command Remarks (Optional.) Assign a virtual By default, no global unicast vrrp ipv6 vrid virtual-router-id IPv6 address, which is a address is assigned for an IPv6 virtual-ip virtual-address global unicast address. VRRP group. Configuring the router priority, preemptive mode, and tracking function Configuration guidelines The running priority of an IP address owner is always 255, and you do not need to configure it.
When the weight of a VF owner is higher than or equal to the lower limit of failure, its priority is • always 255 and does not change with the weight. To guarantee that an LVF can take over the VF owner as the AVF when the upstream link of the VF owner fails, the reduced weight for the VF owner must be higher than 245 so the weight of the VF owner can drop below the lower limit of failure.
Disabling an IPv6 VRRP group You can temporarily disable an IPv6 VRRP group. After being disabled, the VRRP group stays in initialized state, and its configurations remain unchanged. You can change the configuration of a VRRP group when it is disabled. Your changes take effect when you enable the VRRP group again. To disable an IPv6 VRRP group: Step Command...
Page 64
Figure 20 Network diagram Configuration procedure Configure Switch A: # Configure VLAN 2. <SwitchA> system-view [SwitchA] vlan 2 [SwitchA-vlan2] port ten-gigabitethernet 1/1/5 [SwitchA-vlan2] quit [SwitchA] interface vlan-interface 2 [SwitchA-Vlan-interface2] ip address 10.1.1.1 255.255.255.0 # Create VRRP group 1 on VLAN-interface 2, and set its virtual IP address to 10.1.1.111. [SwitchA-Vlan-interface2] vrrp vrid 1 virtual-ip 10.1.1.111 # Assign Switch A a higher priority than Switch B in VRRP group 1, so Switch A can become the master.
Page 65
[SwitchB-Vlan-interface2] vrrp vrid 1 preempt-mode delay 5 Verify the configuration: # Ping Host B from Host A. (Details not shown.) # Display detailed information about VRRP group 1 on Switch A. [SwitchA-Vlan-interface2] display vrrp verbose IPv4 Virtual Router Information: Running Mode : Standard Total number of virtual routers : 1 Interface Vlan-interface2...
Master IP : 10.1.1.2 The output shows that when Switch A fails, Switch B takes over to forward packets from Host A to Host B. # Recover the link between Host A and Switch A, and display detailed information about VRRP group 1 on Switch A.
Page 67
Figure 21 Network diagram Configuration procedure Configure Switch A: # Configure VLAN 2. <SwitchA> system-view [SwitchA] vlan 2 [SwitchA-vlan2] port ten-gigabitethernet 1/1/5 [SwitchA-vlan2] quit [SwitchA] interface vlan-interface 2 [SwitchA-Vlan-interface2] ip address 10.1.1.1 255.255.255.128 # Create VRRP group 1, and set its virtual IP address to 10.1.1.100. [SwitchA-Vlan-interface2] vrrp vrid 1 virtual-ip 10.1.1.100 # Assign Switch A a higher priority than Switch B in VRRP group 1, so Switch A can become the master in the group.
Page 68
[SwitchB-Vlan-interface2] ip address 10.1.1.2 255.255.255.128 # Create VRRP group 1, and set its virtual IP address to 10.1.1.100. [SwitchB-Vlan-interface2] vrrp vrid 1 virtual-ip 10.1.1.100 [SwitchB-Vlan-interface2] quit # Configure VLAN 3. [SwitchB] vlan 3 [SwitchB-vlan3] port ten-gigabitethernet 1/1/6 [SwitchB-vlan3] quit [SwitchB] interface vlan-interface 3 [SwitchB-Vlan-interface3] ip address 10.1.1.131 255.255.255.128 # Create VRRP group 2, and set its virtual IP address to 10.1.1.200.
Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time Auth Type : None Virtual IP : 10.1.1.100 Master IP : 10.1.1.1 Interface Vlan-interface3 VRID Adver Timer : 100 Admin Status : Up State : Master Config Pri : 110 Running Pri...
Page 71
[SwitchA] interface vlan-interface 2 [SwitchA-Vlan-interface2] vrrp vrid 1 weight track 1 reduced 250 Configure Switch B: # Configure VLAN 2. <SwitchB> system-view [SwitchB] vlan 2 [SwitchB-vlan2] port ten-gigabitethernet 1/1/5 [SwitchB-vlan2] quit # Configure VRRP to operate in load balancing mode. [SwitchB] vrrp mode load-balance # Create VRRP group 1, and set its virtual IP address to 10.1.1.1.
Page 72
# Configure the VFs in VRRP group 1 to monitor track entry 1, and decrease their weights by 250 when the track entry transits to Negative. [SwitchC] interface vlan-interface 2 [SwitchC-Vlan-interface2] vrrp vrid 1 weight track 1 reduced 250 Verify the configuration: # Verify that Host A can ping the external network.
Page 73
Total number of virtual routers : 1 Interface Vlan-interface2 VRID Adver Timer : 100 Admin Status : Up State : Backup Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time Auth Type : None Virtual IP : 10.1.1.1 Member IP List : 10.1.1.3 (Local, Backup) 10.1.1.2 (Master)
Page 74
10.1.1.3 (Backup) Forwarder Information: 3 Forwarders 1 Active Config Weight : 255 Running Weight : 255 Forwarder 01 State : Listening Virtual MAC : 000f-e2ff-0011 (Learnt) Owner ID : 0000-5e01-1101 Priority : 127 Active : 10.1.1.2 Forwarder 02 State : Listening Virtual MAC : 000f-e2ff-0012 (Learnt) Owner ID...
Page 75
Owner ID : 0000-5e01-1101 Priority Active : 10.1.1.4 Forwarder 02 State : Initialize Virtual MAC : 000f-e2ff-0012 (Learnt) Owner ID : 0000-5e01-1103 Priority Active : 10.1.1.3 Forwarder 03 State : Initialize Virtual MAC : 000f-e2ff-0013 (Learnt) Owner ID : 0000-5e01-1105 Priority Active : 10.1.1.4...
Page 76
State : Active Virtual MAC : 000f-e2ff-0013 (Owner) Owner ID : 0000-5e01-1105 Priority : 255 Active : local Forwarder Weight Track Information: Track Object State : Positive Weight Reduced : 250 The output shows that when VLAN-interface 3 on Switch A fails, the weights of the VFs on Switch A drop below the lower limit of failure.
IPv4 Virtual Router Information: Running Mode : Load Balance Total number of virtual routers : 1 Interface Vlan-interface2 VRID Adver Timer : 100 Admin Status : Up State : Master Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time Auth Type...
Page 78
Figure 23 Network diagram Virtual IPv6 address: FE80::10 1::10/64 XGE1/1/5 Vlan-int2 FE80::1 1::1/64 Switch A Gateway: 1::10/64 Internet XGE1/1/5 Host B Host A Vlan-int2 FE80::2 1::2/64 Switch B Configuration procedure Configure Switch A: # Configure VLAN 2. <SwitchA> system-view [SwitchA] vlan 2 [SwitchA-vlan2] port ten-gigabitethernet 1/1/5 [SwitchA-vlan2] quit [SwitchA] interface vlan-interface 2...
Page 79
# Create VRRP group 1 and set its virtual IPv6 addresses to FE80::10 and 1::10. [SwitchB-Vlan-interface2] vrrp ipv6 vrid 1 virtual-ip fe80::10 link-local [SwitchB-Vlan-interface2] vrrp ipv6 vrid 1 virtual-ip 1::10 # Configure Switch B to operate in preemptive mode, and set the preemption delay to 5 seconds. [SwitchB-Vlan-interface2] vrrp ipv6 vrid 1 preempt-mode delay 5 # Enable Switch B to send RA messages, so Host A can learn the default gateway address.
Total number of virtual routers : 1 Interface Vlan-interface2 VRID Adver Timer : 100 Admin Status : Up State : Master Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time Auth Type : None Virtual IP : FE80::10 1::10 Virtual MAC...
Page 81
Figure 24 Network diagram Configuration procedure Configure Switch A: # Configure VLAN 2. <SwitchA> system-view [SwitchA] vlan 2 [SwitchA-vlan2] port ten-gigabitethernet 1/1/5 [SwitchA-vlan2] quit [SwitchA] interface vlan-interface 2 [SwitchA-Vlan-interface2] ipv6 address fe80::1 link-local [SwitchA-Vlan-interface2] ipv6 address 1::1 64 # Create VRRP group 1, and set its virtual IPv6 addresses to FE80::10 to 1::10. [SwitchA-Vlan-interface2] vrrp ipv6 vrid 1 virtual-ip fe80::10 link-local [SwitchA-Vlan-interface2] vrrp ipv6 vrid 1 virtual-ip 1::10 # Assign Switch A a higher priority than Switch B in VRRP group 1, so Switch A can become the...
Page 82
[SwitchA-Vlan-interface3] vrrp ipv6 vrid 2 virtual-ip 2::10 # Enable Switch A to send RA messages, so hosts in VLAN 3 can learn the default gateway address. [SwitchA-Vlan-interface3] undo ipv6 nd ra halt Configure Switch B: # Configure VLAN 2. <SwitchB> system-view [SwitchB-vlan2] port ten-gigabitethernet 1/1/5 [SwitchB-vlan2] quit [SwitchB] interface vlan-interface 2...
Auth Type : None Virtual IP : FE80::10 1::10 Virtual MAC : 0000-5e00-0201 Master IP : FE80::1 Interface Vlan-interface3 VRID Adver Timer : 100 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time Auth Type...
Page 84
Network requirements Switch A, Switch B, and Switch C form a load balanced VRRP group and use the virtual IPv6 addresses FE80::10 and 1::10 to provide gateway service for subnet 1::/64, as shown in Figure Hosts on subnet 1::/64 learn 1::10 as their default gateway from RA messages sent by the switches. Configure VFs on Switch A, Switch B, or Switch C to monitor their respective VLAN-interface 3.
Page 85
[SwitchA-Vlan-interface2] vrrp ipv6 vrid 1 priority 120 # Configure Switch A to operate in preemptive mode, so it can become the master whenever it operates properly. Set the preemption delay to 5 seconds to avoid frequent status switchover. [SwitchA-Vlan-interface2] vrrp ipv6 vrid 1 preempt-mode delay 5 # Enable Switch A to send RA messages, so hosts on subnet 1::/64 can learn the default gateway address.
# Configure VLAN 2. <SwitchC> system-view [SwitchC] vlan 2 [SwitchC-vlan2] port ten-gigabitethernet 1/1/5 [SwitchC-vlan2] quit # Configure VRRP to operate in load balancing mode. [SwitchC] vrrp ipv6 mode load-balance # Create VRRP group 1, and set its virtual IPv6 addresses to FE80::10 and 1::10. [SwitchC] interface vlan-interface 2 [SwitchC-Vlan-interface2] ipv6 address fe80::3 link-local [SwitchC-Vlan-interface2] ipv6 address 1::3 64...
Page 87
Forwarder 01 State : Active Virtual MAC : 000f-e2ff-4011 (Owner) Owner ID : 0000-5e01-1101 Priority : 255 Active : local Forwarder 02 State : Listening Virtual MAC : 000f-e2ff-4012 (Learnt) Owner ID : 0000-5e01-1103 Priority : 127 Active : FE80::2 Forwarder 03 State : Listening...
Page 88
Owner ID : 0000-5e01-1103 Priority : 255 Active : local Forwarder 03 State : Listening Virtual MAC : 000f-e2ff-4013 (Learnt) Owner ID : 0000-5e01-1105 Priority : 127 Active : FE80::3 Forwarder Weight Track Information: Track Object State : Positive Weight Reduced : 250 # Display detailed information about VRRP group 1 on Switch C.
Page 89
Forwarder Weight Track Information: Track Object State : Positive Weight Reduced : 250 The output shows that Switch A is the master in VRRP group 1, and each of the three switches has one AVF and two LVFs. # Disconnect the link of VLAN-interface 3 on Switch A and display detailed information about VRRP group 1 on Switch A.
Page 90
Total number of virtual routers : 1 Interface Vlan-interface2 VRID Adver Timer : 100 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time Auth Type : None Virtual IP : FE80::10 1::10 Member IP List : FE80::3 (Local, Backup)
Page 91
Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time Auth Type : None Virtual IP : FE80::10 1::10 Member IP List : FE80::3 (Local, Backup) FE80::1 (Master) FE80::2 (Backup) Forwarder Information: 2 Forwarders 1 Active Config Weight : 255 Running Weight : 255...
Owner ID : 0000-5e01-1103 Priority : 255 Active : local Forwarder 03 State : Listening Virtual MAC : 000f-e2ff-4013 (Learnt) Owner ID : 0000-5e01-1105 Priority : 127 Active : FE80::3 Forwarder Weight Track Information: Track Object State : Positive Weight Reduced : 250 The output shows that when Switch A fails, Switch B becomes the master because it has a higher priority than Switch C, and the VF for virtual MAC address 000f-e2ff-4011 is removed.
Solution Ping between these masters, and do the following checks: • If the ping fails, examine network connectivity. If the ping succeeds, check for configuration inconsistencies in the number of virtual IP addresses, • virtual IP addresses, and authentication. For IPv4 VRRP, also make sure a consistent version of VRRP is configured on all routers in the VRRP group.
Configuring BFD The term "interface" in this chapter refers to Layer 3 interfaces, including VLAN interfaces and Layer 3 Ethernet interfaces. You can configure an Ethernet port as a Layer 3 interface by using the port link-mode route command (see Layer 2—LAN Switching Configuration Guide). Introduction to BFD Bidirectional forwarding detection (BFD) provides a general-purpose, standard, medium- and protocol-independent fast failure detection mechanism.
Control packets—Encapsulated into UDP packets with port number 3784 for single-hop detection • or port number 4784 for multi-hop detection. Echo packet mode The local end of the link sends echo packets to establish BFD sessions and monitor link status. The peer end does not establish BFD sessions and only forwards the packets back to the originating end.
Protocols and standards RFC 5880, Bidirectional Forwarding Detection (BFD) • • RFC 5881, Bidirectional Forwarding Detection (BFD) for IPv4 and IPv6 (Single Hop) RFC 5882, Generic Application of Bidirectional Forwarding Detection (BFD) • RFC 5883, Bidirectional Forwarding Detection (BFD) for Multihop Paths •...
Page 97
Step Command Remarks Enter system view. system-view Specify the mode for bfd session init-mode { active | By default, active is specified. establishing a BFD session. passive } interface interface-type Enter interface view. interface-number Configure the authentication bfd authentication-mode simple By default, single-hop BFD packets mode for single-hop control key-id { cipher cipher-string | plain...
Step Command Remarks Configure the minimum bfd multi-hop The default setting is 400 interval for transmitting min-transmit-interval value milliseconds. multi-hop BFD control packets. Displaying and maintaining BFD Execute the display command in any view and the reset command in user view. Task Command Display BFD session information.
Configuring Track Overview The Track module works between application and detection modules, as shown in Figure 26. It shields the differences between various detection modules from application modules. Collaboration is enabled after you associate the Track module with a detection module and an application module.
BFD. • • Interface management module. Collaboration between the Track module and an application module The following application modules can be associated with the Track module: • VRRP. Static routing. • Policy-based routing. • When configuring a track entry for an application module, you can set a notification delay to avoid immediate notification of status changes, which can cause communication failure.
Tasks at a glance Remarks (Required.) Associating the Track module with an application module: • Associating Track with VRRP Use one of the methods. • Associating Track with static routing • Associating Track with PBR Associating the Track module with a detection module Associating Track with NQA NQA supports multiple test types to analyze network performance, services, and service quality.
If the BFD detects that the link is operating properly, the Track module sets the track entry to the • Positive state. Configuration prerequisites Before you associate Track with BFD, configure the source IP address of BFD echo packets. For more information, see "Configuring BFD."...
Step Command Remarks • Create a track entry, associate it with the interface management module to monitor the link status of an interface, and specify the delay time for the Track module to notify the associated application module when the track entry status changes: track track-entry-number interface interface-type interface-number [ delay...
Monitor the master on a backup. If a fault occurs on the master, the backup operating in switchover • mode will switch to the master immediately to maintain normal communication. When VRRP is operating in load balancing mode, associate the Track module with the VRRP Virtual Forwarder (VF) to change the priority of the active VF (AVF) according to its uplink state.
Page 105
The disadvantage of using static routes is that they cannot adapt to network topology changes. Faults or topological changes in the network can make the routes unreachable, causing network breaks. To prevent this problem, configure another route to back up the static route. When the static route is reachable, packets are forwarded through the static route.
Associating Track with PBR PBR is a routing mechanism based on user-defined policies. Different from the traditional destination-based routing mechanism, PBR allows you to use a policy (based on such criteria as the source address and packet length) to route packets. You can specify the VPN instance, packet priority, outgoing interface, next hop, default outgoing interface, default next hop, and other parameters to guide the forwarding of packets that match specific ACLs or have specific lengths.
Step Command Remarks Define an ACL match By default, no packets are if-match acl acl-number criterion. filtered. By default, no next hop is set. apply ip-address next-hop [ vpn-instance Set the next hop, and You can set two next hops vpn-instance-name ] { ip-address [ direct ] associate it with a track entry.
Page 108
Figure 27 Network diagram Configuration procedure Create VLANs and assign corresponding ports to them. Configure the IP address of each VLAN interface as shown in Figure 27. (Details not shown.) Configure an NQA test group on Switch A: # Create an NQA test group with the administrator name admin and the operation tag test. <SwitchA>...
Page 109
# Set the authentication mode of VRRP group 1 to simple, and the authentication key to hello. [SwitchA-Vlan-interface2] vrrp vrid 1 authentication-mode simple hello # Configure the master to send VRRP packets at an interval of 500 centiseconds. [SwitchA-Vlan-interface2] vrrp vrid 1 timer advertise 500 # Configure Switch A to operate in preemptive mode, and set the preemption delay to 5 seconds.
Page 110
Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time Become Master : 2200ms left Auth Type : Simple : ****** Virtual IP : 10.1.1.10 Master IP : 10.1.1.1 The output shows that in VRRP group 1, Switch A is the master, and Switch B is a backup.
Configuring BFD for a VRRP backup to monitor the master Network requirements As shown in Figure 28, Switch A and Switch B belong to VRRP group 1, whose virtual IP address is • 192.168.0.10. The default gateway of the hosts in the LAN is 192.168.0.10. When Switch A operates correctly, the •...
Page 112
Configure BFD on Switch B: # Configure the source address of BFD echo packets as 10.10.10.10. <SwitchB> system-view [SwitchB] bfd echo-source-ip 10.10.10.10 Create the track entry to be associated with the BFD session on Switch B: # Create track entry 1 to be associated with the BFD session to check whether Switch A is reachable.
Page 113
VRRP Track Information: Track Object State : Positive Switchover # Display information about track entry 1 on Switch B. <SwitchB> display track 1 Track ID: 1 State: Positive Duration: 0 days 0 hours 0 minutes 32 seconds Notification delay: Positive 0, Negative 0 (in seconds) Tracked object: BFD session mode: Echo Outgoing interface: Vlan-interface2...
Configuring BFD for the VRRP master to monitor the uplinks Network requirements As shown in Figure 29, Switch A and Switch B belong to VRRP group 1, whose virtual IP address is • 192.168.0.10. The default gateway of the hosts in the LAN is 192.168.0.10. •...
Page 115
Configure VRRP on Switch A: # Create VRRP group 1, and configure the virtual IP address of the group as 192.168.0.10. Configure the priority of Switch A in VRRP group 1 as 110. Configure VRRP group 1 to monitor the status of track entry 1.
Page 116
<SwitchB> display vrrp verbose IPv4 Virtual Router Information: Running Mode : Standard Total number of virtual routers : 1 Interface Vlan-interface2 VRID Adver Timer : 100 Admin Status : Up State : Backup Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time...
Total number of virtual routers : 1 Interface Vlan-interface2 VRID Adver Timer : 100 Admin Status : Up State : Master Config Pri : 100 Running Pri : 100 Preempt Mode : Yes Delay Time Auth Type : None Virtual IP : 192.168.0.10 Virtual MAC : 0000-5e00-0101...
Page 118
Figure 30 Network diagram Configuration procedure Create VLANs and assign corresponding ports to them. Configure the IP address of each VLAN interface as shown in Figure 30. (Details not shown.) Configure Switch A: # Configure a static route to 30.1.1.0/24, with the address of the next hop as 10.1.1.2 and the default priority 60.
Page 119
[SwitchA] nqa schedule admin test start-time now lifetime forever # Configure track entry 1, and associate it with reaction entry 1 of the NQA test group (with the administrator admin, and the operation tag test). [SwitchA] track 1 nqa entry admin test reaction 1 Configure Switch B: # Configure a static route to 30.1.1.0/24, with the address of the next hop as 10.2.1.4.
Page 120
[SwitchD] track 1 nqa entry admin test reaction 1 Verifying the configuration # Display information about the track entry on Switch A. [SwitchA] display track all Track ID: 1 State: Positive Duration: 0 days 0 hours 0 minutes 32 seconds Notification delay: Positive 0, Negative 0 (in seconds) Tracked object: NQA entry: admin test...
Page 121
Destination/Mask Proto Cost NextHop Interface 10.1.1.0/24 Direct 0 10.1.1.1 Vlan2 10.1.1.1/32 Direct 0 127.0.0.1 InLoop0 10.2.1.0/24 Static 60 10.1.1.2 Vlan2 10.3.1.0/24 Direct 0 10.3.1.1 Vlan3 10.3.1.1/32 Direct 0 127.0.0.1 InLoop0 20.1.1.0/24 Direct 0 20.1.1.1 Vlan6 20.1.1.1/32 Direct 0 127.0.0.1 InLoop0 30.1.1.0/24 Static 80 10.3.1.3...
Static routing-Track-BFD collaboration configuration example Network requirements As shown in Figure 31, Switch A, Switch B, and Switch C are connected to two segments 20.1.1.0/24 and 30.1.1.0/24. Configure static routes on these routers so that the two segments can communicate with each other.
Page 123
[SwitchA] ip route-static 30.1.1.0 24 10.2.1.2 track 1 # Configure a static route to 30.1.1.0/24, with the address of the next hop as 10.3.1.3 and the priority 80. [SwitchA] ip route-static 30.1.1.0 24 10.3.1.3 preference 80 # Configure the source address of BFD echo packets as 10.10.10.10. [SwitchA] bfd echo-source-ip 10.10.10.10 # Configure track entry 1, and associate it with the BFD session.
Page 124
Destinations : 9 Routes : 9 Destination/Mask Proto Cost NextHop Interface 10.2.1.0/24 Direct 0 10.2.1.1 Vlan2 10.2.1.1/32 Direct 0 127.0.0.1 InLoop0 10.3.1.0/24 Direct 0 10.3.1.1 Vlan3 10.3.1.1/32 Direct 0 127.0.0.1 InLoop0 20.1.1.0/24 Direct 0 20.1.1.1 Vlan5 20.1.1.1/32 Direct 0 127.0.0.1 InLoop0 30.1.1.0/24 Static 60...
# When the master route fails, the hosts in 20.1.1.0/24 can still communicate with the hosts in 30.1.1.0/24. [SwitchA] ping -a 20.1.1.1 30.1.1.1 PING 30.1.1.1: 56 data bytes, press CTRL_C to break Reply from 30.1.1.1: bytes=56 Sequence=1 ttl=254 time=2 ms Reply from 30.1.1.1: bytes=56 Sequence=2 ttl=254 time=1 ms Reply from 30.1.1.1: bytes=56 Sequence=3 ttl=254 time=1 ms Reply from 30.1.1.1: bytes=56 Sequence=4 ttl=254 time=2 ms...
Page 126
Figure 32 Network diagram Configuration procedure Create VLANs and assign corresponding ports to them. Configure the IP address of each VLAN interface as shown in Figure 32. (Details not shown.) Configure a track entry on Switch A: # Configure track entry 1 and associate it with the link status of the uplink interface VLAN-interface [SwitchA] track 1 interface vlan-interface 3 Configure VRRP on Switch A: # Create VRRP group 1 and configure the virtual IP address 10.1.1.10 for the group.
Page 127
VRID Adver Timer : 100 Admin Status : Up State : Master Config Pri : 110 Running Pri : 110 Preempt Mode : Yes Delay Time Auth Type : None Virtual IP : 10.1.1.10 Virtual MAC : 0000-5e00-0101 Master IP : 10.1.1.1 VRRP Track Information: Track Object...
Page 128
Track Object State : Negative Pri Reduced : 30 # After shutting down the uplink interface on Switch A, display detailed information about VRRP group 1 on Switch B. [SwitchB-Vlan-interface2] display vrrp verbose IPv4 Virtual Router Information: Running Mode : Standard Total number of virtual routers : 1 Interface Vlan-interface2 VRID...
Support and other resources Contacting HP For worldwide technical support information, see the HP support website: http://www.hp.com/support Before contacting HP, collect the following information: Product model names and numbers • Technical support registration number (if applicable) • • Product serial numbers Error messages •...
Conventions This section describes the conventions used in this documentation set. Command conventions Convention Description Boldface Bold text represents commands and keywords that you enter literally as shown. Italic Italic text represents arguments that you replace with actual values. Square brackets enclose syntax choices (keywords or arguments) that are optional. Braces enclose a set of required syntax choices separated by vertical bars, from which { x | y | ...
Page 131
Network topology icons Represents a generic network device, such as a router, switch, or firewall. Represents a routing-capable device, such as a router or Layer 3 switch. Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports Layer 2 forwarding and other Layer 2 features.