Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About f00z
09-10-2019
Stats
Member since
11-02-2017
5
Posts
0
Helpful
0
Solutions
08-10-2019
01:06 PM
I see what you are trying to do now. Ours is set up a bit differently using BGP to reroute and can reroute to other appliances if one fails. One thing you could do is put a switch and use subinterfaces and set up a routing adjacency, so subinterface 50 (tag 50) goes through 50.ASR -> 50switch ->(untag) appliance (untag)-> (tag51)switch -> ASR.51, and then subinterface 100 goes 100.ASR -> switch -> ASR.100. Of course this requires adding a switch. The metric on the routing adjaceny determines if it goes thorugh the appliance or not. For the nexthop1 in the ACL you'd set it to drop it into the vrf and not to a specific nexthop. The routing adjacencies would default originate. So if the appliance dies, the adjacency will go down and it will pick up to the backup route on another subinterface. I have done this before in some other circumstances, using IOS of course. IOS-XR has some strange limitations, like the tunnel to itself work fine on 6500/7600 for example, although it recirculates. Hopefully it will allow routing adjacencies to itself. On IOS this works but you have to manually set the MAC addr on the interface. You'd think since ASR9K is more NPU than ASIC it would be much more flexible.
... View more
08-08-2019
05:06 PM
Usually in this case I set up the appliance to accept traffic on vlan X and return traffic on vlan Y so you only need to use one bundle interface with two subinterfaces one for egress one for ingress, and that way it only uses one set of physical ports. The traffic is unidirectional so this works out. Inside the 'dirty' vrf you can set a default route that points back to the other vrf or leak the routes from the other vrf, a few options there. The way mine is currently set up is similar to this however it's backwards, there's a clean vrf instead of a dirty, and the routes are injected via bgp, so they can be removed/rerouted if the appliance has issues or even the appliance itself can do the BGP injection and if it goes down so does the BGP. IP SLA another option. Last resort you could create a tunnel interface to itself (I've done this on other platforms for some internal hacks to get something working, although it requires recirculation). Haven't tested it on ASR9k though.
... View more
08-08-2019
01:14 PM
Doing some deep dive testing into LPTS for ddos/security/exploit reasons and came across what I consider some shortcomings. Love to hear other people's opinions/test results! I'm not sure if I'm missing something or this is the way it is intended. For one, the OSPF-known unicast lpts policer gets applied to interfaces where OSPF is enabled, however it allows ALL OSPF unicast packets and it doesn't (like i think it should) add an entry per unicast neighbor once it gets the multicast hello. This opens up a vector for ddos. I spoofed ospf unicast packets across the network (from a few devices away) and i can easily overwhelm this policer. Some OSPF sessions p2p use unicast and will fail to come up if the packets aren't allowed. The lpts on asr9k doesn't seem to do dynamic flows (like NCS). I think there's a lot of work that needs to be done in this area. The main 'problem' I have here is that LPTS doesn't allow you to implement your own CoPP. Since it doesn't allow us to implement our own filters, the automatic ones need to be more robust. Not just OSPF but some of the others as well.. The BGP ones are done decently and I'm still doing tests on those to see if it actually does per-flow policing (in other words once a bgp session is established it goes into its own policer like a microflow/ubrl type scenario). I'll be testing each one individually but this will take some time. I'd be curious to see anyone else's lpts configuration and iACLs that may have a workaround for some of this to protect the control plane more fully.
... View more
Labels:
Created by
f00z
in Data Center Switches
09-08-2019
09-08-2019
Surprised no one else has noticed this. It's driving our NMS systems
crazy.
Created by
f00z
in Data Center Switches
08-23-2019
08-23-2019
Posting to see if anyone else has encountered this same issue, when
polling the nexus 3064 for trans...
08-10-2019
I see what you are trying to do now. Ours is set up a bit differently
using BGP to reroute and can r...
08-08-2019
Usually in this case I set up the appliance to accept traffic on vlan X
and return traffic on vlan Y...
Public Statistics
| Date Registered | 11-02-2017 06:52 PM |
| Date Last Visited | 09-10-2019 11:14 AM |
| Total Messages Posted | 5 |
