cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

TrustSec ASR1k Specific Troubleshooting Information

1248
Views
0
Helpful
0
Comments

 

<< BACK TO THE MAIN TRUSTSEC TROUBLESHOOTING GUIDE

 

TrustSec ASR1k Specific Troubleshooting Information

How to check the ASR hardware programming of a CTS enabled link?

With the following configured:

interface GigabitEthernet0/1/1

cts manual

  policy static sgt 2 trusted

Prompt-ASR#show platform hardware qfp active feature cts client interface

Interface GigabitEthernet0/1/1(11):

        Enable=1, Policy=0, Trust=1, Propagate=1, Internal=0    <----- SGT on the link trusted and propagate SGT enabled

        SGT=2, SGT_caching_in=1 SGT_caching_eg=0    <----- 'policy static sgt 2' configured and caching is enabled

        IN_dbg/ IN_err=0/0, OUT_dbg/ OUT_err=0/0

 

ASR1K: How to check if inline tags are successfully being transmitted or received?

Prompt-ASR#show platform hardware qfp active feature cts datapath stats

Tagged Packets rcv: 744        xmt: 2278       Def tag: 0

         Unknown SGT: 4052      Unknown DGT: 0

Invalid tags (drop): 0 Bad format (drop): 0

No xmt buffer: 0

IPSec SGT tagged packets received: 0

IPSec Invalid SGT tagged packets received: 0

GRE SGT tagged packets received: 0

GRE Invalid SGT tagged packets received: 0

GRE invalid next protocol 0

LISP SGT tagged packets received: 0

LISP Invalid SGT tagged packets received: 0

 

How to check the presence of inline tagging on the ASR by using caching?

Caching needs to be enabled:

Be careful in a live deployment. Enabling caching will dramatically reduce platform performance.

Prompt-ASR#show platform hardware qfp active feature cts datapath cache-data

Sgt-caching is Active

Total number of bindings = 2

==============================================================================

IP Address      SGT   Interface                 Age        Exptime Mode VRFID

                                                (hh:mm:ss)   (sec)           

==============================================================================

10.1.100.2      1001  GigabitEthernet0/1/1      00:01:22   297     In   0   

10.3.4.1        2     GigabitEthernet0/1/1      00:01:33   294     In   0   

 

How to check the global ASR drop stats?

Prompt-ASR#show platform hardware qfp active statistics drop

-------------------------------------------------------------------------

Global Drop Stats                         Packets                  Octets 

-------------------------------------------------------------------------

Disabled                                        2                     792 

Ipv4NoRoute                                   190                   30327 

UnconfiguredIpv4Fia                            13                    2327 

UnconfiguredIpv6Fia                           934                  103102

 

How to Check the SGT and DGT Bindings in the Forwarding Manager?

Prompt-ASR#show platform software cts forwarding-manager F0|FP|R0|RP [active]

SGT Binding Table

Number of bindings: 14

1.1.1.1/32

SGT Src: 2

SGT Dst: 2

10.1.100.4/32

SGT Src: 14

SGT Dst: 14

10.3.1.2/32

SGT Src: 2

SGT Dst: 2

SGT Binding Table

10.3.2.2/32

SGT Src: 2

SGT Dst: 2

10.3.4.2/32

SGT Src: 2

SGT Dst: 2

10.3.5.1/32

SGT Src: 2

SGT Dst: 2

10.4.1.1/32

SGT Src: 2

SGT Dst: 2

10.4.1.3/32

SGT Src: 2

SGT Dst: 2

10.5.1.1/32

SGT Src: 2

SGT Dst: 2

10.5.3.1/32

SGT Src: 2

SGT Dst: 2

10.6.1.1/32

SGT Src: 2

SGT Dst: 2

10.7.1.1/32

SGT Src: 2

SGT Dst: 2

SGT Binding Table

10.8.1.1/32

SGT Src: 2

SGT Dst: 2

10.9.1.1/32

SGT Src: 2

SGT Dst: 2

 

<< BACK TO THE MAIN TRUSTSEC TROUBLESHOOTING GUIDE