Hello, this document will briefly discuss my implementation on how to configure OTV on ASR 1000 series routers. I know there is plenty of documentation out there, and many people have questions about which interfaces are useable etc...
There are some prerequisites that you should be aware of.
- OTV technology and terminology
- Multicast knowledge
- OSPF
- Basic knowledge of ASR 1K platform
GOAL: to extend vlan 724 across datacenters and be able to see a mac address from vlan 724 originating from the other DC and seeing it in the other DC.
In my scenario I have ASR 1002's but within the same network I have ASR1001's working too. The layer 2/3 devices consist of 6500's and a 3750 - will follow a multi-homing setup.
Here is a diagram of the physical network.
Multicast has already been setup, with one single RP.
I'll be using one link on the INSIDE for both routing and trunking. So from each 6500 and 3750 is a trunk carrying my OTV vlan that I want to stretch across datacenters and also an SVI for my routing in OSPF area 0.
All my layer 3 is in place and have full connectivity everywhere. Each link is a point-to-point link.
ASR's need a dedicated vlan for the AED election to take place on the INSIDE.
Note: A lot of engineers out there have a problem in getting OTV working because there is something wrong with the election. This would look a little like this:
ASR-TEST#show otv
Overlay Interface Overlay1
VPN name : overlay1
VPN ID : 1
State : UP
AED Capable : No, overlay DIS not elected
IPv4 control group : 239.1.1.1
Mcast data group range(s): 232.0.0.0/8
Join interface(s) : GigabitEthernet0/0/0
Join IPv4 address : 10.99.99.2
Tunnel interface(s) : Tunnel0
Encapsulation format : GRE/IPv4
Site Bridge-Domain : 401
Capability : Multicast-reachable
Is Adjacency Server : No
Adj Server Configured : No
Prim/Sec Adj Svr(s) : None
Also another thing that caught me out is having the election vlan on the overlay interface - it should not be on the overlay interface! only the INSIDE interface.
So in our case we will use VLAN 8 and call this the 'OTV' vlan for the elections. The election will take place on this segment and the 6500 and the 3750 will provide that transport mechanism for this.
Also we mentioned that we want to extend vlan 724 across our datacenters, so we will configure this too
Not to mention we will also configure gi9/14 on both sides and an SVI for routing purposes. The 6500's have a trunk between them which is allowing all vlans across it.
DC1-6509-1 | DC1-6509-2 |
|---|---|
conf t ! vlan 8 name OTV ! vlan 724 name Server ! interface gi9/14 switchport switchport trunk encapsulation dot1q switchport mode trunk switchport trunk allowed vlan 8,724,1511 ! interface vlan 1511 description ## ROUTED TO ASR01 ## ip address 192.168.11.2 255.255.255.252 ip ospf 1 area 0 ip ospf network point-to-point | conf t ! vlan 8 name OTV ! vlan 724 name Server ! interface gi9/14 switchport switchport trunk encapsulation dot1q switchport mode trunk switchport trunk allowed vlan 8,724,1512 ! interface vlan 1512 description ## ROUTED TO ASR02 ## ip address 192.168.12.2 255.255.255.252 ip ospf 1 area 0 ip ospf network point-to-point |
Now we have the 6509's set up lets go to the ASR's (1002) where things get more interesting!
Here we will configure the INSIDE interfaces which will be towards the trunk, also a sub-interface for our routing with vlan 15XX. The join interface which will be a LOOPBACK interface! and lastly the Overlay interface.
Note that the loopback interface is also advertised by OSPF.
| DC-ASR1002-01 | DC-ASR1002-02 |
|---|---|
ip multicast-routing distributed ! otv site bridge-domain 8 ! otv site-identifier 0000.0000.0001 ! interface Loopback10 description ## OTV JOIN INTERFACE ## ip address 192.168.230.254 255.255.255.255 ip mtu 1600 ip pim passive ip igmp version 3 ! interface Overlay1 no ip address otv control-group 239.1.1.1 otv data-group 232.1.1.0/28 otv join-interface Loopback10 !service instance 724 ethernet encapsulation dot1q 724 bridge-domain 724 ! interface GigabitEthernet0/0/1 description ## OTV INSIDE to 6509-1 Gi9/14 ## no ip address negotiation auto cdp enable service instance 8 ethernet encapsulation dot1q 8 bridge-domain 8 !service instance 724 ethernet encapsulation dot1q 724 bridge-domain 724 ! interface GigabitEthernet0/0/1.1511 description ## ROUTED TO ASR01 ## ip address 192.168.11.1 255.255.255.252 ip pim sparse-mode ip ospf 1 area 0 ip ospf network point-to-point | ip multicast-routing distributed ! otv site bridge-domain 8 ! otv site-identifier 0000.0000.0001 ! interface Loopback10 description ## OTV JOIN INTERFACE ## ip address 192.168.230.253 255.255.255.255 ip mtu 1600 ip pim passive ip igmp version 3 ! interface Overlay1 no ip address otv control-group 239.1.1.1 otv data-group 232.1.1.0/28 otv join-interface Loopback10 ! service instance 724 ethernet encapsulation dot1q 724 bridge-domain 724 ! interface GigabitEthernet0/0/1 description ## OTV INSIDE to 6509-2 Gi9/14 ## no ip address negotiation auto cdp enable service instance 8 ethernet encapsulation dot1q 8 bridge-domain 8 ! service instance 724 ethernet encapsulation dot1q 724 bridge-domain 724 ! interface GigabitEthernet0/0/1.1512 description ## ROUTED TO ASR01 ## ip address 192.168.12.1 255.255.255.252 ip pim sparse-mode ip ospf 1 area 0 ip ospf network point-to-point |
I haven't shown the WAN interfaces - its pretty standard point-to-point connections.
Now going to do some show commands:
DC1-ASR1002-02#show otv site
Site Adjacency Information (Site Bridge-Domain: 8)
Overlay1 Site-Local Adjacencies (Count: 2)
Hostname System ID Last Change Ordinal AED Enabled Status
DC1-ASR1002-01 5057.A898.F700 7w0d 0 site overlay
*DC1-ASR1002-02 5057.A899.3300 7w0d 1 site overlay
DC1-ASR1002-02#show otv overlay 1
Overlay Interface Overlay1
VPN name : None
VPN ID : 1
State : UP
AED Capable : Yes
IPv4 control group : 239.1.1.1
Mcast data group range(s): 232.1.1.0/28
Join interface(s) : Loopback10
Join IPv4 address : 192.168.230.253
Tunnel interface(s) : Tunnel2
Encapsulation format : GRE/IPv4
Site Bridge-Domain : 8
Capability : Multicast-reachable
Is Adjacency Server : No
Adj Server Configured : No
Prim/Sec Adj Svr(s) : None
DC-ASR1002-02#show otv vlan
Key: SI - Service Instance
Overlay 1 VLAN Configuration Information
Inst VLAN Bridge-Domain Auth Site Interface(s)
0 724 724 no Gi0/0/1:SI724
Since DC1-ASR1002-02 is not the primary AED for this instance we'll have to take a look at 01 to see if it see's any mac addresses in this vlan on the INSIDE interface. I have plugged in several devices in to the 6509 on vlan 724:
DC1-ASR1002-01#show otv route vlan 724
Codes: BD - Bridge-Domain, AD - Admin-Distance,
SI - Service Instance, * - Backup Route
OTV Unicast MAC Routing Table for Overlay1
Inst VLAN BD MAC Address AD Owner Next Hops(s)
----------------------------------------------------------
0 724 724 000c.29f5.8b08 40 BD Eng Gi0/0/1:SI724
0 724 724 001f.2959.e17f 40 BD Eng Gi0/0/1:SI724
Good, so there are, our aim is to be able to see these on the switch on the other side!
Lets go over to DC2 - the ASR's:
| DC2-ASR1002-01 | DC2-ASR1002-02 |
|---|---|
ip multicast-routing distributed ! otv site bridge-domain 8 ! otv site-identifier 0000.0000.0003 interface Loopback10 ip address 192.168.230.251 255.255.255.255 ip mtu 1600 ip pim passive ip igmp version 3 ! interface Overlay1 no ip address otv control-group 239.1.1.1 otv data-group 232.1.1.0/28 otv join-interface Loopback10 service instance 724 ethernet encapsulation dot1q 724 bridge-domain 724 ! interface GigabitEthernet0/0/2 description ## Trunk OTV & ROUTE ## Gi0/1 ## no ip address negotiation auto cdp enable service instance 8 ethernet encapsulation dot1q 8 bridge-domain 8 !service instance 724 ethernet encapsulation dot1q 724 bridge-domain 724 ! interface GigabitEthernet0/0/2.1521 description ## Core Routing DR-3750-1 P2P ## VLAN1521 ## encapsulation dot1Q 1521 ip address 192.168.21.2 255.255.255.252 ip pim sparse-mode ip ospf network point-to-point ip ospf 1 area 0 | ip multicast-routing distributed ! otv site bridge-domain 8 ! otv site-identifier 0000.0000.0003 interface Loopback10 ip address 192.168.230.250 255.255.255.255 ip mtu 1600 ip pim passive ip igmp version 3 ! interface Overlay1 no ip address otv control-group 239.1.1.1 otv data-group 232.1.1.0/28 otv join-interface Loopback10 service instance 724 ethernet encapsulation dot1q 724 bridge-domain 724 ! interface GigabitEthernet0/0/2 description ## Trunk - OTV & ROUTE ## Gi0/1 ## no ip address negotiation auto cdp enable service instance 8 ethernet encapsulation dot1q 8 bridge-domain 8 ! service instance 724 ethernet encapsulation dot1q 724 bridge-domain 724 !interface GigabitEthernet0/0/2.1522 description ## Core Routing DR-3750-1 P2P ## VLAN1521 ## encapsulation dot1Q 1522 ip address 192.168.22.2 255.255.255.252 ip pim sparse-mode ip ospf network point-to-point ip ospf 1 area 0 |
Now we need to get that 3750 up and running so we'd do this:
conf t
!
vlan 8
name OTV
!
vlan 724
name server
!
interface GigabitEthernet1/1/1
description ## Trunk to DC2-ASR1002-01 ## Gi0/0/2 ##
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 8,724,1521
switchport mode trunk
!
interface GigabitEthernet2/1/1
description ## Trunk to DC2-ASR1002-02 ## Gi0/0/2 ##
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 8,724,1522
switchport mode trunk
!
interface Vlan1521
description ## Core Routing DC2-ASR002-01 P2P ## VLAN 1521 ##
ip address 192.168.21.1 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
!
interface Vlan1522
description ## Core Routing DC2-ASR002-02 P2P ## VLAN 1522 ##
ip address 192.168.22.1 255.255.255.252
ip ospf network point-to-point
ip ospf 1 area 0
Now we have this done, OTV should be working fine, so lets check it out.
DC1-ASR1002-01#show otv adjacency
Overlay 1 Adjacency Database
Hostname System-ID Dest Addr Up Time State
DC1-ASR1002-02 5057.a899.3300 192.168.230.253 28w3d UP
DC2-ASR1002-01 5057.a898.fa00 192.168.230.251 1w1d UP
DC2-ASR1002-02 5057.a898.fa03 192.168.230.250 1w1d UP ]
Now we are able to see all the ASR's that are adjacent, lets look if the mac addresses are in the IS-IS routing table that OTV uses.
Remember we saw these?
0 724 724 000c.29f5.8b08 40 BD Eng Gi0/0/1:SI724
0 724 724 001f.2959.e17f 40 BD Eng Gi0/0/1:SI724
So if we do a 'show otv route | inc 001f.2959.e17f on DC2-ASR1002-01 we should see that it is learnt via ISIS:
DR-ASR1002-01#show otv route | inc 001f.2959.e17f
0 724 724 001f.2959.e17f 50 ISIS DC1-ASR1002-01
Finally, almost there - couple more checks, we know that the ASR knows how to route via OTV to that mac address, we just need to check if the 3750 on the other side knows about it too!
So we'll hop over to the 3750 and do a 'show mac address-table | inc 001f.2959.e17f'
DR-3750-01#show mac address-table | inc 001f.2959.e17f
724 001f.2959.e17f DYNAMIC Gi1/1/1
We see the mac address! learnt dynamically from the uplink Gi1/1/1 to DC2-ASR1002-01.
And i've tested ping's from hosts in both sides and it works!
I have the same setup working with:
ASR1002 and ASR1001 with different versions of code! But to name a few, just because its quicker for me to do a show ver - here's what Im running.
ASR1002:
Cisco IOS Software, IOS-XE Software (PPC_LINUX_IOSD-ADVENTERPRISEK9-M), Version 15.2(2)S, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Mon 26-Mar-12 15:23 by mcpre
IOS XE Version: 03.06.00.S
Cisco IOS-XE software, Copyright (c) 2005-2012 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.
ROM: IOS-XE ROMMON
DR-ASR1002-01 uptime is 3 weeks, 15 hours, 45 minutes
Uptime for this control processor is 3 weeks, 15 hours, 47 minutes
System returned to ROM by reload at 17:39:43 UTC Wed Apr 3 2013
System restarted at 17:43:21 UTC Wed Apr 3 2013
System image file is "bootflash:asr1000rp1-adventerprisek9.03.06.00.S.152-2.S.bin"
Last reload reason: Reload Command
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
cisco ASR1002 (2RU) processor with 1689232K/6147K bytes of memory.
Processor board ID FOX1603G9GE
4 Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
7757823K bytes of eUSB flash at bootflash:.
Configuration register is 0x2102
ASR1001
Cisco IOS Software, IOS-XE Software (X86_64_LINUX_IOSD-UNIVERSALK9-M), Version 15.2(2)S, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Mon 26-Mar-12 16:23 by mcpre
IOS XE Version: 03.06.00.S
Cisco IOS-XE software, Copyright (c) 2005-2012 by cisco Systems, Inc.
All rights reserved. Certain components of Cisco IOS-XE software are
licensed under the GNU General Public License ("GPL") Version 2.0. The
software code licensed under GPL Version 2.0 is free software that comes
with ABSOLUTELY NO WARRANTY. You can redistribute and/or modify such
GPL code under the terms of GPL Version 2.0. For more details, see the
documentation or "License Notice" file accompanying the IOS-XE software,
or the applicable URL provided on the flyer accompanying the IOS-XE
software.
ROM: IOS-XE ROMMON
IH-ASR1001-01 uptime is 9 weeks, 4 days, 15 hours, 7 minutes
Uptime for this control processor is 9 weeks, 4 days, 15 hours, 8 minutes
System returned to ROM by reload at 18:19:04 UTC Sat Feb 16 2013
System restarted at 18:21:51 GMT Sat Feb 16 2013
System image file is "bootflash:asr1001-universalk9.03.06.00.S.152-2.S.bin"
Last reload reason: Reload Command
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
License Level: advipservices
License Type: Permanent
Next reload license Level: advipservices
cisco ASR1001 (1RU) processor with 1163576K/6147K bytes of memory.
Processor board ID SSI16050CNJ
8 Gigabit Ethernet interfaces
32768K bytes of non-volatile configuration memory.
4194304K bytes of physical memory.
7741439K bytes of eUSB flash at bootflash:.
Configuration register is 0x2102
I hope this helps others! I had a great experience when setting this up.
Also please make reference to official documentation too: http://www.cisco.com/en/US/docs/ios-xml/ios/wan_otv/configuration/xe-3s/asr1000/wan-otv-confg.html
Bilal
Just thought I will prove you and others wrong (in the politest possible way with a video showing loopbacks used) since you had the audacity to tell me to "fix this right away"
