EEM Without IPSLA

[soldnermichael]

I'm about as green as you can get when it comes to EEM so I'm wondering if the following is possible w/out using IPSLA (our 65's don't support it).

Basically what I'm looking for is a way to do the following:

1.  Track a downstream, internal IP.

2.  If that IP fails after "x" pings inject a line into a ACL.

Is this even possible?  (Oh and I should add TCL scripting is another VERY green area).

Thanks!

[ngoldwat]

Hi,

Yes, you should be able to do so with enhanced object tracking and EEM.

Configuring Enhanced Object Tracking

http://www.cisco.com/en/US/docs/ios-xml/ios/ipapp/configuration/12-4/iap-eot.html

An example:

track 10 ip route 192.168.0.1/32 reachability

delay down 3 up 3

event manager applet Link1

event track 10 state up

action 1.0 cli command "enable"

action 2.0 cli command "configure terminal"

action 3.0 cli command "int cell0/1/0"

action 4.0 cli command "shut"

action 5.0 cli command "exit"

action 6.0 cli command "clear ip nat trans force"

action 7.0 cli command "end"

event manager applet Link2

event track 10 state down

action 1.0 cli command "enable"

action 2.0 cli command "configure terminal"

action 3.0 cli command "int cell0/1/0"

action 4.0 cli command "no shut"

action 5.0 cli command "exit"

action 6.0 cli command "clear ip nat trans force"

action 7.0 cli command "end"

Here is a link to an excellent EEM post: https://supportforums.cisco.com/docs/DOC-12757

I doubt you will remain green for long

[Joe Clarke]

Nick's example is 100% correct.  However, while you do have IP SLA (I'd be very surprised if you lack IP SLA entirely) with 6500s, you do not have the ability to do Enhanced Object Tracking with EEM.  That said, Nick's examples could be adapted to use the syslog event detector instead (depending on the release of code on the 6500s).  If you change the event registration lines to something like:

event syslog "TRACKING-5-STATE:.*Down->Up"

event syslog "TRACKING-5-STATE:.*Up->Down"

You should be able to accomplish what you what.

Also, be careful when injecting your ACE.  You may have to completely reconfigure the ACL to get the order correct.

[soldnermichael]

Great suggestions, thanks.  Unfortunately, the device is behind an SVI so I don't have an interface I could track otherwise it would work.

And unfortunately Mr. Clarke we completely lack the ip sla command. 

Either way, the traffic this currently pertains to has no SLA so redundancy isn't that huge I need to spend a ton of time on it. 

Message was edited by: Mike Soldner

[Joe Clarke]

The IP SLA feature has had a number of CLI syntaxes over time.  Chances are the "rtr" command is available on your 6500.  This is the same IP SLA feature.  You should be able to use that to configure the collector such as:

rtr 1

type echo protocol ipIcmpEcho 10.1.1.1

!

rtr schedule 1 life forever start now

Then track that collector using:

track 1 rtr 1 reachability

Of course, without knowing your version of IOS, I cannot say if the track syntax will work.  The IP SLA should definitely work, and if so, we can use SNMP to watch for state changes.

[Joe Clarke]

I missed your edit.  The IP SLA feature doesn't need redundancy per se.  It's just the easiest way to do the ping test you want in an automated fashion.

[Robert Rowland III]

I had a similar desire with add/deleting nat pools on firewalls that may/may not be reachagle and I did not want to run a routing process between them so I did the below.  lines 130 and 140 could just have easily been an add ACL or delete ACL.  I ping 12.13.14.15, if the % is 0 I delete a route to a firewall with a nat pool otherwise I add the route.  Runs every 15 seconds and works fine.  This is done on 2 devices and it maintains appropriate internal route reachability - and yes, the IPs were made up here.

event manager applet ww_routes

event timer watchdog time 15

action 100 cli command "enable"

action 105 cli command "ping 12.13.14.15"

action 110 regexp "([0-9]+) percent" "$_cli_result" result result1

action 115 cli command "conf t"

action 120 if $result1 eq "0"

action 130  cli command "no ip route 12.13.20.0 255.255.224.0"

action 135 elseif $result1 eq 100

action 140  cli command "ip route 12.13.20.0 255.255.224.0 12.13.14.15"

action 150 end