Nortel Secure Router 2330/4134 Configuration IPv6 and Routing. Release: 10.2 Document Revision: NN

Transcription

1 Configuration IPv6 and Routing Release: 10.2 Document Revision: NN

2 . Release: 10.2 Publication: NN Document release date: 7 September 2009 While the information in this document is believed to be accurate and reliable, except as otherwise expressly agreed to in writing NORTEL PROVIDES THIS DOCUMENT "AS IS" WITHOUT WARRANTY OR CONDITION OF ANY KIND, EITHER EXPRESS OR IMPLIED. The information and/or products described in this document are subject to change without notice. Nortel, Nortel Networks, the Nortel logo, and the Globemark are trademarks of Nortel Networks. THE SOFTWARE DESCRIBED IN THIS DOCUMENT IS FURNISHED UNDER A LICENSE AGREEMENT AND MAY BE USED ONLY IN ACCORDANCE WITH THE TERMS OF THAT LICENSE. Cisco is a trademark of Cisco Systems Inc. All other trademarks are the property of their respective owners.

3 . Contents 3 New in this release 11 Features 11 PIM-SM Multipath 11 Anycast RP for PIM-SM 12 Static Multicast Routing Support 12 IPv6 Routing over VLAN 12 BGP multicast 12 Static Mroute configuration procedures 12 PIM-SM configuration procedures 12 MLD configuration procedures 13 MBGP extensions enhancement 13 IPv6 routing fundamentals 15 The IPv6 header 16 IPv6 addresses 17 Address formats 18 IPv6 extension headers 19 Comparison of IPv4 and IPv6 20 ICMPv6 21 Neighbor discovery 21 ND messages 23 ND cache 24 Router discovery 26 IPv6 and the 26 Management access 27 Tunneling 27 Path MTU discovery 31 Routing 32 Static routes 32 Open Shortest Path First (OSPF) protocol 35 OSPFv3 37 Flooding scope 38 Multiple instances per link 38 Link-local addresses 38

4 4 Authentication 38 Packet format 39 New LSAs 39 Unknown LSA types 39 Stub area 40 Routing Information Protocol for IPv6 Networks (RIPng) 40 implementation of RIP 40 Routing Information Protocol 40 Border Gateway Protocol for IPv6 Networks (BGP4+) 42 Hierarchical mechanisms 42 Policy-based routing 43 Route redistribution 43 Security 44 Route reflectors 44 Route flap dampening 44 Route refresh 45 BGP planning considerations 45 BGP multicast 47 Protocol Independent Multicast-Sparse Mode 48 PIM-SM concepts and terminology 48 Shared trees and shortest-path trees 52 Receiver joining group 54 Receiver leaving group 55 Source sending packets to group 55 Required elements for PIM-SM operation 56 PIM-SM simplified example 56 PIM-SM static source groups 58 Static source groups 58 PIM-SM Multipath 58 Anycast RP for PIM-SM 59 Static Multicast Routing Support 59 PIM-SSM 59 SSM features 60 PIM-SSM architecture 60 implementation of SSM and IGMP 62 PIM-SSM static source groups 65 Configuration limitations 65 Multicast link discovery 66 MLD versions 1 and 2 66 IPv6 Routing over VLAN 66 IPv6 routing procedures 67 Enabling unicast routing globally 67 Enabling multicast routing globally 67

5 5 Enabling IPv6 on an Ethernet interface 68 Enabling IPv6 on a bundle 68 Configuring the IPv6 address for an interface 69 Configuring Neighbor Discovery parameters 69 Configuring IPv6 redirects 70 Configuring an IPv6 general-prefix 71 Configuring the IPv6 hop-limit 71 Configuring IPv6 icmp rate limit 72 Configuring IPv6 load balancing 72 Configuring an IPv6 neighbor 73 Configuring IPv6 next-hop address 74 Establishing static routes 74 Configuring a multicast static route 75 Configuring multicast lookup in MRIB only 76 Clearing multicast static routes 77 Creating an access list entry 77 Creating a prefix list 78 Configuring match address of a route 78 Configuring prefix list match entries 79 Displaying IPv6 access lists 79 Displaying general prefix information 80 Displaying IPv6 interface information 80 Displaying the IPv6 multicast routing table 81 Displaying learned pmtu information 81 Displaying IPv6 multicast interface information 82 Displaying Neighbor Discovery cache information 82 Displaying IPv6 prefix list information 82 Displaying the IPv6 routing table 83 Displaying IPv6 Router Advertisement information 83 Removing dynamically learned neighbor entries 84 Clearing a prefix list 84 Clearing multicast route table entries 85 RIPng configuration procedures 87 Enabling RIPng 87 Configuring the IPv6 RIP aggregate address 88 Configuring IPv6 default routes 88 Configuring IPv6 rip default metrics 88 Configuring IPv6 administrative distance 89 Configuring the IPv6 update filters 90 Configuring an IPv6 RIP neighbor 90 Configuring an IPv6 RIP offset-list 91 Configuring an IPv6 RIP passive interface 92 Configuring an IPv6 RIP route-map 92

6 6 Configuring split-horizon 93 Configuring route redistribution 93 Configuring timers 94 Removing RIPng routes 95 Displaying RIPng information 95 Displaying RIPng configuration 96 Displaying all configured RIPng interfaces 96 Displaying IPv6 RIP information 96 Displaying the IPv6 RIP database 97 Displaying IPv6 RIP interface information 97 Clearing an IPv6 RIP route 97 OSPFv3 procedures 99 Configuring OSPFv3 routing 99 Configuring OSPFv3 IPv6 address range 99 Configuring a stub area 100 Configuring a virtual link 100 Configure the OSPF area default cost 101 Configuring default-metric values 101 Configuring a passive interface 101 Configuring redistribution of routes into OSPF 102 Configuring the IPv6 OSPF ABR type 102 Configuring IPv6 OSPF cost for an interface 103 Configuring IPv6 OSPF administrative distance 104 Configuring logging of adjacency state changes 104 Configure OSPFv3 routing on an interface 105 Configuring the dead interval 105 Configuring the hello interval 106 Configuring OSPF priority 106 Configuring IPv6 OSPF link cost 107 Configuring IPv6 OSPF interface MTU 107 Configuring the IPv6 OSPF mtu-ignore setting 108 Configuring the IPv6 OSPF network type 108 Configuring the IPv6 OSPF retransmit interval 109 Configuring the IPv6 OSPF transmission delay 110 Displaying OSPFv3 debugging information 110 Display global and area OSPFv3 information 111 Display OSPFv3 interface information 111 Display OSPFv3 neighbor information 111 Display OSPFv3 route information 112 Display OSPFv3 virtual link information 112 Displaying IPv6 OSPF border routers 112 Displaying the IPv6 OSPF database 113 Clearing IPv6 OSPF routing processes 113

7 7 BGP4+ configuration procedures 115 Enabling BGP 115 Specifying IPv6 address family 115 Configuring a passive session OPEN 116 Advertising the local router ID as nexthop 116 Comparing the MED value of routes learned from ebgp peers 117 Removing private AS numbers from route advertisements 117 Configuring a BGP Confederation 118 Configuring a BGP Route Reflector cluster 119 Enabling an address family for a neighbor 119 Configuring interval for BGP route updates 120 Configuring interval for AS-origination updates 121 Advertising capability to a peer 121 Configuring to originate a default route to neighbor 122 Configuring a neighbor description 123 Configuring a distribution list 124 Disallowing capability negotiation 124 Allowing EBGP neighbors from indirectly connected networks 125 Configuring BGP filters 125 Enabling BGP on an interface 126 Configuring maximum number of prefixes 127 Configuring a neighbor password 128 Configuring peer-group members 128 Configuring a prefix list 129 Configuring AS number of a remote BGP neighbor 130 Configuring a route map to a neighbor 130 Configuring a neighbor as route reflector client 131 Configuring a neighbor as route server client 132 Sending a community attribute to a neighbor 132 Shutting down a neighbor 133 Configuring BGP neighbor timers 133 Configuring a routing update source 134 Configuring weight for a BGP neighbor 135 Modifying a default bestpath selection 135 Configuring client-to-client route reflection 136 Configuring a route reflector cluster-id 137 Configuring AS confederation parameters 137 Enabling route flap dampening 138 Configuring BGP defaults 139 Enforcing first AS for EBGP routes 140 Resetting a session when a peer goes down 140 Logging neighbor changes 141 Overriding current router-id 141

8 8 Configuring background scan interval 142 Defining the administrative distance 143 Configuring IGP synchronization 144 Configuring routing timers 144 Redistributing information from another protocol 145 Configuring BGP aggregate entries 146 Configuring EBGP-ECMP processing 146 Activating the current address family for a neighbor 147 Configuring to accept an AS-path containing the current AS. 147 Configuring to start storing updates 148 Configuring to selectively unsuppress suppressed routes 149 Specifying a network to announce via BGP 149 Configuring aggregation on same next hop 150 Displaying BGP routes matching communities 150 Displaying all BGP4+ community information 151 Displaying detailed BGP4+ neighbor information 151 Displaying routes matching an AS path regular expression 152 Displaying the BGP4+ scan status 152 Displaying BGP attribute information 153 Displaying BGP paths 153 Displaying BGP neighbor status summary 153 Displaying inconsistent AS paths 154 Displaying detailed dampening information 154 Displaying routes matching route map 154 Display routes matching a prefix list 155 Display routes matching a filter list 155 Display routes matching a community list 156 Display routes matching an AS path regular expression 156 Initiating a BGP Route Refresh 157 Resetting all BGP peers in IPv6 family 157 Resetting an IPv6 BGP connection 157 PIM configuration procedures 159 Registering an accept filter 159 Configuring candidate bootstrap router 159 Setting the source address for PIM register 160 Configuring source-specific multicast 161 Configuring the PIM rendezvous point address 161 Configuring a PIM rendezvous point candidate 162 Configuring to not have source-tree switching threshold 163 Enabling a BSR border router 163 Setting Hello message interval 164 Enabling PIM sparse-mode operation 164 Configuring PIM router DR priority 165

9 9 Configuring to exclude Gen-id 166 Configuring a PIM peering filter 166 Configuring PIM neighbor change logging 167 Configuring an anycast member RP address 167 Prerequisites Configuring PIM multipath 168 Displaying PIM RPF 169 Clearing PIM statistics 169 Configuring embedded RP mapping 170 Displaying PIM RP 171 Displaying group-to-rp mappings 171 Displaying PIM statistics 171 Displaying bootstrap router information 172 Displaying the PIM Tree Information Base 172 Displaying PIM interface information 172 Displaying group-to-rp mapping information 173 Displaying PIM neighbor information 173 Displaying PIM Rendezvous Point information 174 Clearing PIM bootstrap router information 174 MLD procedures 175 Configuring multicast group membership 175 Configuring leave latency 175 Configuring query intervals 176 Configuring query timeouts 176 Configuring the robustness variable 177 Configuring the MLD version 177 Configuring MLD last-member query-count 178 Configuring group-specific query interval 178 Configuring the MLD query maximum response time 179 Configuring global state limit 179 Configuring state limit on an interface 180 Configuring the SSM mapping status 181 Configuring a static SSM map 181 definitions 182 Configuring a static group on an interface 182 Displaying MLD statistics 183 Clearing MLD statistics 183 Display MLD groups 184 Display MLD interface information 184 Clearing MLD group entries 185 Clearing MLD interface entries 185

10 10

11 . New in this release 11 The following section details what s new in Nortel Secure Router 2330/4134 (NN ) for Release ATTENTION In this document, the term Secure Router 2330/4134 is used interchangeably to refer to the Secure Router 2330 and the Secure Router Features See the following sections for information about feature changes. PIM-SM Multipath The PIM SM Multipath feature allows you to avoid the duplication of packets in multicast. PIM-SM supports the multipath functionality. See, PIM-SM Multipath (page 58) Configuring an anycast member RP address (page 167) Configuring PIM multipath (page 168)

12 12 New in this release Anycast RP for PIM-SM Anycast RP allows you to map a single group to multiple RPs. See, Anycast RP for PIM-SM (page 59) Static Multicast Routing Support Multicast static routes are unicast routes which allow multicast and unicast topologies to be incongruous. See, Static Multicast Routing Support (page 59) IPv6 Routing over VLAN You can enable IPv6 unicast and multicast routing on VLAN interfaces. For more information on IP services over VLAN enhancement, see, IPv6 Routing over VLAN (page 66) BGP multicast BGP Multicast (MBGP), gives BGP the ability to connect multicast topologies within and outside an AS. For more information about MBGP, see BGP multicast (page 47) and MBGP extensions enhancement (page 13). Static Mroute configuration procedures See the following procedures for information about Static Mroute configuration. Configuring a multicast static route (page 75) Configuring multicast lookup in MRIB only (page 76) Clearing multicast static routes (page 77) PIM-SM configuration procedures See the following procedures for information about PIM-SM configuration. Configuring PIM neighbor change logging (page 167) Configuring an anycast member RP address (page 167) Configuring PIM multipath (page 168) Displaying PIM RPF (page 169) Clearing PIM statistics (page 169) Configuring embedded RP mapping (page 170) Displaying PIM RP (page 171)

13 Features 13 Displaying group-to-rp mappings (page 171) Displaying PIM statistics (page 171) MLD configuration procedures See the following procedures for information about MLD configuration. Configuring global state limit (page 179) Configuring state limit on an interface (page 180) Configuring the SSM mapping status (page 181) Configuring a static SSM map (page 181) Configuring a static group on an interface (page 182) Displaying MLD statistics (page 183) Clearing MLD statistics (page 183) MBGP extensions enhancement See the following sections for information about MBGP extension enhancement: Specifying IPv6 address family (page 115) Displaying BGP routes matching communities (page 150) Displaying all BGP4+ community information (page 151) Displaying detailed BGP4+ neighbor information (page 151) Displaying routes matching an AS path regular expression (page 152) Displaying the BGP4+ scan status (page 152) Displaying BGP attribute information (page 153) Displaying BGP attribute information (page 153) Displaying BGP paths (page 153) Displaying BGP neighbor status summary (page 153) Displaying inconsistent AS paths (page 154) Displaying detailed dampening information (page 154) Displaying routes matching route map (page 154) Display routes matching a prefix list (page 155) Display routes matching a filter list (page 155) Display routes matching a community list (page 156) Display routes matching an AS path regular expression (page 156)

14 14 New in this release

15 . IPv6 routing fundamentals 15 The router-management features apply regardless of which routing protocols you use and include router Internet Protocol version 6 (IPv6) configuration and IPv6 route table management. IPv6 routing fundamentals navigation The IPv6 header (page 16) ICMPv6 (page 21) Neighbor discovery (page 21) Multicast (page 26) IPv6 and the (page 26) Management access (page 27) Tunneling (page 27) Path MTU discovery (page 31) Routing (page 32) OSPFv3 (page 37) Routing Information Protocol for IPv6 Networks (RIPng) (page 40) Border Gateway Protocol for IPv6 Networks (BGP4+) (page 42) BGP multicast (page 47) Protocol Independent Multicast-Sparse Mode (page 48) PIM-SSM (page 59) Multicast link discovery (page 66) PIM-SM Multipath (page 58) Anycast RP for PIM-SM (page 59) Static Multicast Routing Support (page 59) IPv6 Routing over VLAN (page 66)

16 16 IPv6 routing fundamentals The IPv6 header The IPv6 header contains the following fields: a 4-bit Internet Protocol version number, with a value of 6 an 8-bit traffic class field, similar to Type of Service in IPv4 a 20-bit flow label that identifies traffic flow for additional quality of service a 16-bit unsigned integer, the length of the IPv6 payload an 8-bit next header selector, that identifies the following header an 8-bit hop limit unsigned integer that decrements by 1 each time a node forwards the packet. Nodes discard packets with hop limit values of 0. a 128-bit source address a 128-bit destination address Figure 1 "IPv6 header" (page 16) illustrates the IPv6 header. Figure 1 IPv6 header

17 The IPv6 header 17 IPv6 addresses IPv6 addresses are 128 bits in length. The address identifies a single interface or multiple interfaces. IPv4 addresses, in comparison, are 32 bits in length. The increased number of possible addresses in IPv6 solves the inevitable IP Address exhaustion inherent to IPv4. The IPv6 address contains two parts: an address prefix and an IPv6 interface ID. The first 3 bits indicate the type of address that follows. Figure 2 "128-Bit IPv6 address format" (page 17) shows the IPv6 address format. Figure Bit IPv6 address format An example of a unicast IPv6 address is 1080:0:0:0:8:8000:200C:417A Interface ID The interface ID is a unique number that identifies an IPv6 node (a host or a router). For stateless autoconfiguration the ID is 64 bits in length. In IPv6 stateless autoconfiguration, the interface ID is derived by a formula that uses the link layer 48-bit MAC address. (In most cases, the interface ID is a 64-bit interface ID that contains the 48-bit MAC address.) The IPv6 interface ID is as unique as the MAC address. If you manually configure interface IDs or MAC addresses (or both), no relationship between the MAC address and the interface ID is necessary. A manually configured interface ID can be longer or shorter than 64 bits. Anycast Address An IPv6 anycast address is a unicast address identifying a group of IPv6 nodes that share a common variable-length address prefix. A packet bearing an anycast address is delivered to one node in the group. There is no visual way of distinguishing an anycast address from an unicast address. Multicast Address An IPv6 multicast address identifies a group of nodes. A packet bearing a multicast address is delivered to all members of the group. (The function of IPv4 broadcast addresses has been superseded by IPv6 multicast addresses.)

18 18 IPv6 routing fundamentals Figure 3 "Multicast Address Format" (page 18) shows the format of an IPv6 multicast address. Figure 3 Multicast Address Format A value of FF ( ) in the 8 high-order bits of an IPv6 address indicates that the address specifies a multicast group. The 4-bit flags field indicates whether the group is permanent or transient. The 4-bit scope field indicates the scope of the group specified in the 112-bit group ID field. The scope options are: 1 - node local 2 - link-local 3 - subnet local 4 - admin local 5 - site-local 8 - organization-local B - community-local E - global An example of a multicast address is: FF01:0:0:0:0:0:0:101 IPv4-Compatible Address The IPv4-compatible address, which includes an IPv4 address in the low-order 32 bits, is intended for IPv6 nodes that need to inter operate with IPv4 nodes. Figure 4 "IPv4-Compatible Unicast Address Format" (page 18) shows the format of an IPv4-compatible address. Figure 4 IPv4-Compatible Unicast Address Format Address formats The format for representing an IPv6 address is

19 The IPv6 header 19 n:n:n:n:n:n:n:n n is the hexadecimal representation of 16 bits in the address. For example: FF01:0:0:0:0:0:0:43 Each non zero field must contain at least one numeral. Within a given hexadecimal field however, leading zeros are not required. Certain classes of IPv6 addresses commonly include multiple contiguous fields containing hexadecimal 0. The following sample address includes five contiguous fields containing 0 represents contiguous fields containing zeroes with a double colon (::): FF01::43 You can use a double colon to compress the leading zero fields in a hexadecimal address. A double colon can appear once in an address. An IPv4-compatible address combines hexadecimal and decimal values as follows: x:x:x:x:x:x:d.d.d.d x:x:x:x:x:x is a hexadecimal representation of the six high-order 16-bit pieces of the address, and d.d.d.d is a decimal representation of the four 8-bit pieces of the address. For example: 0:0:0:0:0:0: or :: IPv6 extension headers IPv6 extension headers describe processing options. Each extension header contains a separate category of options. A packet can include zero or more extension headers, see Figure 5 "IPv6 Header and Extension Headers" (page 20).

20 20 IPv6 routing fundamentals Figure 5 IPv6 Header and Extension Headers IPv6 examines the destination address in the main header of each packet it receives: this examination determines whether the router is the packet destination or an intermediate node in the packet data path. If the router is the destination of the packet, IPv6 examines the header extensions that contain options for destination processing. If the router is an intermediate node, IPv6 examines the header extensions that contain forwarding options. By examining only the extension headers that apply to the operations it performs, IPv6 reduces the amount of time and processing resources required to process a packet. IPv6 defines the following extension headers: The hop-by-hop extension header contains optional information that all intermediate IPv6 routers examine between the source and the destination. The end-to-end extension header contains optional information for the destination node. The source routing extension header contains a list of one or more intermediate nodes that define a path for the packet to follow through the network, to its destination. The packet source creates this list. This function is similar to the IPv4 source routing options. The fragmentation extension header uses by an IPv6 source to send packets larger than the size specified for the path MTU. The authentication extension header and the security encapsulation extension header, used singly or jointly, provide security services for IPv6 datagrams. Comparison of IPv4 and IPv6 Table 1 "IPv4 and IPv6 differences" (page 21) compares key differences between IPv4 and IPv6.

21 Neighbor discovery 21 Table 1 IPv4 and IPv6 differences Feature IPv4 IPv6 Address length 32 bits 128 bits IPSec support Optional Required QoS support Limited Improved Fragmentation Hosts and routers Hosts only MTU Packet size 576 bytes 1280 bytes Checksum in header Yes No Options in header Yes No Link-layer address resolution ARP (broadcast) Multicast Neighbor Discovery Messages Multicast membership IGMP Multicast Listener Discovery (MLD) Router Discovery Optional Required Uses broadcasts Yes No Configuration Manual, DHCP Automatic, DHCP ICMPv6 Internet Control Message Protocol (ICMP) version 6 maintains and improves upon features from ICMP for IPv4. ICMPv6 reports the delivery of forwarding errors, such as Destination Unreachable, Packet Too Big, Time Exceeded, and Parameter Problem. ICMPv6 also delivers information messages such as echo request and echo reply. ATTENTION ICMPv6 plays an important role in IPv6 features such as Neighbor Discovery, Multicast Listener Discovery and Path MTU Discovery. Neighbor discovery Neighbor discovery (ND) allows IPv6 nodes (routers and hosts) on the same link to discover link layer addresses and to obtain and advertise various network parameters and reachability information. ND combines the services provided for IPv4 with the Address Resolution Protocol (ARP) and router discovery. ND replaces ARP in IPv6. Hosts use ND to discover the routers in the network that you can use as the default routers, and to determine the link layer address of their neighbors attached on their local links. Routers also use ND to discover their neighbors and their link layer information. ND also updates the neighbor database with valid entries, invalid entries, and entries migrated to different locations.

22 22 IPv6 routing fundamentals ND protocol provides you with the following: Address and prefix Discovery: hosts determine the set of addresses that are on-link for the given link. Nodes determine which addresses or prefixes are locally reachable and are remote with address and prefix discovery. Router Discovery: hosts discover neighboring routers with router discovery. Hosts then establish neighbors as default packet-forwarding routers. Parameter Discovery: host and routers discover link parameters such as the link MTU or the hop limit value placed in outgoing packets. Duplicate address detection: hosts and nodes determine if an address is assigned to another router or a host. Address Resolution: hosts determine link layer addresses (MAC for Ethernet) of the local neighbors (attached on the local net), provided the IP address is known. Next-Hop determination: hosts determine how to forward local or remote traffic with next-hop determination. The next-hop can be a local or remote router. Neighbor unreachability detection: hosts determine if the neighbor is reachable, and address resolution must be performed again to update the database. For neighbors you use as routers, hosts attempt to forward traffic through alternate default routers. Redirect: routers inform the host of more efficient routes with redirect messages. Neighbor discovery is categorized into three components: Host-Router discovery Host-Host communication component Redirect See Figure 6 "Neighbor Discovery components" (page 23) for the ND components.

23 Neighbor discovery 23 Figure 6 Neighbor Discovery components ND messages Table 2 "IPv6 and IPv4 Neighbor comparison" (page 23) shows new ICMPv6 message types. Table 2 IPv6 and IPv4 Neighbor comparison IPv4 Neighbor Function IPv6 Neighbor Function Description ARP Request message Neighbor Solicitation message A node sends this message to determine the link-layer address of a neighbor or to verify that a neighbor is still reachable through a cached link-layer address. You can also use Neighbor Solicitations for Duplicate Address Detection. ARP Reply message Neighbor Advertisement A node sends this message either in response to a received Neighbor Solicitation message or to communicate a link-layer address change. ARP cache Neighbor cache The neighbor cache contains information about neighbor types on the network. See ND cache (page 24). Gratuitous ARP Router Solicitation message (optional) Duplicate address detection Router Solicitation (required) A host or node sends a request with its own IP address to determine if another router or host uses the given address. The source receives a reply from the duplicate device. Both hosts and routers use this. The host sends this message upon detecting a change in a network interface operational state. The message requests that routers generate Router Advertisement immediately rather than at the scheduled time.

24 24 IPv6 routing fundamentals Table 2 IPv6 and IPv4 Neighbor comparison (cont d.) IPv4 Neighbor Function IPv6 Neighbor Function Description Router Advertisement message (optional) Router Advertisement (required) Routers send this message to advertise their presence together with various links and Internet parameters either periodically, or in response to a Router Solicitation message. Router Advertisements contain prefixes that you use for on-link determination or address configuration, and a suggested hop limit value. Redirect message Redirect message Routers send this message to inform hosts of a better first hop for a destination. ND cache The neighbor discovery cache lists information about neighbors in your network. The neighbor discovery cache can contain the following types of neighbors: Static: a configured neighbor Local: a device on the local system Dynamic: a discovered neighbor Table 3 "Neighbor cache states" (page 24) describes neighbor cache states. Table 3 Neighbor cache states State Incomplete Reachable Stale Description A node sends a neighbor solicitation message to a multicast device. The multicast device sends no neighbor advertisement message in response. You receive positive confirmation within the last ReachableTime period. A node receives no positive confirmation from the neighbor in the last Reachable Time period.

25 Neighbor discovery 25 Table 3 Neighbor cache states (cont d.) State Delay Description A time period longer than the ReachableTime period passes since the node received the last positive confirmation, and a packet was sent within the last DELAY_FIRST_PROBE_TIME period. If no reachability confirmation is received within DELAY_FIRST_PROBE_TIME period of entering the DELAY state, Neighbor Solicitation is sent and the state is changed to PROBE. Probe Reachability confirmation is sought from the device every RetransmitTimer period. The following events affect the Neighbor cache. Processing the following events involves layer 2 and layer 3 interaction: ATTENTION Administrative actions cause certain events. These events affect system stability. Flushing the VLAN MAC. Remove VLANr. Performing an action on all VLANs. Remove a port from a VLAN. Performing an action that disables a VLAN, such as removing all ports from VLAN. Disable a tagged port that is a member of multiple routable VLANs. Table 4 "IPv4 and IPv6 Neighbor Discovery comparison" (page 25) shows a comparison of IPv4 and IPv6 Neighbor Discovery. Table 4 IPv4 and IPv6 Neighbor Discovery comparison IPv4 Neighbor Functions ARP Request message ARP Reply message ARP cache Gratuitous ARP Router Solicitation message (optional) Router Advertisement message (optional) Redirect message IPv6 Neighbor Functions Neighbor Solicitation message Neighbor Advertisement message Neighbor cache Duplicate address detection Router Solicitation (required) Router Advertisement (required) Redirect message

26 26 IPv6 routing fundamentals Router discovery IPv6 nodes discover routers on the local link with router discovery. The IPv6 router discovery process uses the following messages: Router advertisement (page 26) Router solicitation (page 26) Router advertisement Configured interfaces on an IPv6 router send out router-advertisement messages. Router-advertisements are also sent in response to router-solicitation messages from IPv6 nodes on the link. Router solicitation An IPv6 host without a configured unicast address sends router solicitation messages. Multicast Most of the IPv6 routing protocols use multicast addresses for sending some of the protocol information, especially during the discovery phase. In order to receive these messages the device has register the well-known multicast addresses when a particular protocol is enabled and deregisters when the protocol is disabled. As in IPv4, a multicast address is assigned to a set of interfaces belonging to different nodes. A packet destined to a multicast address is routed to all interfaces identified by that address. The IPv6 multicast address uses the FF00::/8 prefix which is equivalent to the Ethernet multicast address of There is multicast neighbor solicitation for address resolution, duplicate address detection and multicast router solicitation and router advertisement IPv6 and the IPv6 routing provides an underlying mechanism for transmitting blocks of data from source to destination. The source and destination are hosts, identified by fixed-length IPv6 addresses. Transmission control protocol (TCP) and user datagram protocol (UDP) provide transport facility for data transmission. TCP is a reliable mechanism. UDP is not as reliable as TCP. Routing protocols 6 through 8 identify the shortest path from a given source to a destination. Internet Protocol 1 defines a standard format primarily known as the IP header, required for successful delivery of datagram. Transport and routing protocols are physical media agnostic. The next hop path calculated by

27 Tunneling 27 the routing protocol in path from source to destination can result in the next hop being connected on an Ethernet interface. In such a case, the next-hop router must request a mapping of a next-hop IPv6 address to a 48 bit MAC address. IPv6 neighbor-discovery protocol, described in RFC 2461, defines a mechanism to identify existing/upcoming neighbors in the network. This mechanism combines the ARP, router discovery, and redirect information into one. Due to this combination of features, the mechanism supports the auto configuration of host entities. Management access The contains an Ethernet port for both master and standby CPU. These Ethernet ports are configured differently from the regular switch ports. In IPv4, the protocol stack operating for these ports is different than the switch IP stack. The IPv6 functionality for the CPU Ethernet port is offered only when the switch operational state is up, and is not offered from the boot monitor level. The management port has three functions: enabling IPv6 from the boot monitor and from the CLI. configurating IPv6 after the system boots up in the CLI and device management through the configured IPv6 address configuring static routes reachable through the management route for connectivity IPv6 supports multiple addresses on each interface. This is supported for multiple addresses to management IP interface. In addition to the management port, you can configure management routes to reach non local destinations. The Nortel advertises the management port and the management route to the regular routing domain (OSPFv3), but does not include the prefix for the interface in the router advertisement. Tunneling Tunneling is a forwarding technique in which a packet is encapsulated inside another packet. IPv6 supports two kinds of encapsulating tunnels: IPv4 tunnels and IPv6 tunnels. In IPv4 tunneling, a router running both IPv6 and IPv4 encapsulates an IPv6 packet within an IPv4 packet. This technique allows IPv6 nodes in noncontiguous IPv6 regions to forward messages through an intervening region of IPv4 nodes.

28 28 IPv6 routing fundamentals In IPv6 tunneling, a router running IPv6 encapsulates an IPv6 packet in another IPv6 packet. This section covers the following topics: Static IPv4 Tunnel (page 28) Automatic IPv4 Tunnel (page 29) IPv6 Tunnels (page 31) Static IPv4 Tunnel A static tunnel -- also called a configured tunnel -- is a mechanism for forwarding any IPv6 packet through an IPv4 region. Figure 7 "Configured IPv4 Static Tunnel" (page 28) shows a static tunnel between an IPv4 interface on router C and an IPv4 interface on router D. (Note that routers C and D are running both IPv4 and IPv6.) Figure 7 Configured IPv4 Static Tunnel In Figure 7 "Configured IPv4 Static Tunnel" (page 28), for example, a user connected to router B in Region 1 sends a packet addressed to a user on router F in Region 3. The following steps occur:

29 Tunneling 29 1 Router C receives the IPv6 packet and determines that it must be forwarded out its tunnel interface. 2 Router C encapsulates the IPv6 packet in an IPv4 header. The source address in the IPv4 header is the IPv4 address of the local tunnel interface on router C. The destination address is the IPv4 address of the remote tunnel interface on router D. 3 Using the IPv4 header, intermediate IPv4 routers in Region 2 forward the encapsulated packet through the IPv4 region to router D. 4 Router D decapsulates the packet (removing the IPv4 header) and forwards the original IPv6 packet to router F. After you have configured the IPv4 interfaces on the end point routers, the tunnel becomes a permanent point-to-point link in the IPv6 topology. Automatic IPv4 Tunnel An automatic tunnel is a mechanism for forwarding unicast IPv6 packets that use the IPv4-compatible address format. All routers in IPv6 regions that use automatic tunneling must run both IPv6 and IPv4. IPv6 creates the tunnel dynamically as needed for the purpose of forwarding an IPv6 packet through multiple IPv4 and IPv4/IPv6 routers. In Figure 8 "Automatic IPv4 Tunnel" (page 30), for example, a user connected to router B in Region 1 wants to send an IPv6 packet to a user on router J in Region 3.

30 30 IPv6 routing fundamentals Figure 8 Automatic IPv4 Tunnel The following steps occur: 1 Router D receives the packet and determines that the next hop requires an automatic tunnel. 2 Router D encapsulates the packet in an IPv4 header. The source address in the IPv4 header is the IPv4 address of the local tunnel interface on node D. The destination address is the IPv4 address contained in the IPv4-compatible IPv6 address. This is the address of an IPv4 interface on router J. 3 IPv4 routers in Region 2 forward the packet to Region 3. 4 IPv4/IPv6 routers in Region 3 forward the IPv4 packet to router J. 5 Router J decapsulates the packet.

31 Path MTU discovery 31 Note that unlike a configured tunnel, which is a permanent point-to-point link in the IPv6 topology, an automatic tunnel is a dynamic mechanism, created by the encapsulating end point for the purpose of forwarding an IPv6 packet. After the packet reaches its destination, the automatic tunnel no longer exists. IPv6 Tunnels Tunneling provides a mechanism for transferring IPv6 traffic through an IPv4 network. Manually configured tunnels Manually configured tunnels are point-to-point. IPv6 reachability enables tunnel forwarding. Manually configured tunnels provide communication between two isolated IPv6 domains over an IPv4 network. Create a point-to-point connectivity between the two isolated IPv6 devices by configuring the tunnel endpoints. Tunnel interfaces are logical point-to-point interfaces. Enable a routing protocol, such as the open shortest path first (OSPF) protocol, on the interfaces to allow dynamic routing. You cannot configure the maximum transmission unit (MTU) for tunnels. The default MTU value for tunnels is Tunnel operational status depends on the IPv4 reachability of the tunnel endpoint. The Nortel Secure Router 2330/4134 attempts reachability through R modules and updates IPv6 information with changes. Configure IPv6 and IPv4 addresses at each end of the tunnel. The router or host at the source and destination of the tunnel must support both IPv4 and IPv6 protocol stacks. ATTENTION Classic modules cannot perform encapsulation or decapsulation. All IPv4 route reachability requires R modules. Path MTU discovery IPv6 routers do not fragment packets. The source node sends a packet equal in size to the maximum transmission unit (MTU) of the link layer. The packet travels through the network to source. If the packet encounters a link to a smaller MTU, the router sends the source node an ICMP error message containing the MTU size of the next link. The source IPv6 node then resends a packet equal to the size of the MTU included in the ICMP message. The default value for a regular interface is 1500.

32 32 IPv6 routing fundamentals Routing A routing table is present on all nodes. The table stores information about IPv6 network prefixes and how they are reached. IPv6 checks the destination neighbor cache first. If the destination is not in the destination neighbor cache, the routing table determines: the interface used for forwarding (the next-hop interface) the next-hop address Routing protocols to exchange IPv6 routing prefixes are required. IPv6 routes in a routing table can be: directly attached network routes using a 64-bit prefix remote network routes using a 64-bit or lower prefix host routes using a 128-bit prefix length the default route using a prefix of ::/0 Route redistribution is limited to static routes and local device using the OSPFv3 protocol. The dynamic protocols supported are OSPFv3, RIPng and BGP. When routing on a VLAN, an IP address is assigned to the VLAN and is not associated with any particular physical port. Brouter ports are VLANs that route IP packets and bridge nonroutable traffic in a single-port VLAN. This section has the following topics: Static routes (page 32) Open Shortest Path First (OSPF) protocol (page 35) Static routes Static routes provide an alternative method for establishing route reachability. This, with dynamic routes, provides routing information from the forwarding database to the forwarding plane. Only enabled static routes are submitted to the Route Table Manager (RTM), which determines the best route based on reachability, route preference, and cost. The RTM communicates all the updates to best routes to the forwarding plane. You must provide the following options to configure a static route: Route preference: you can specify the route preference for the static routes as follows:

33 Routing 33 Global value for all static routes: either static or dynamic routes are preferred. Preference per static-route-entry: if specified, this value over-rides the global value for the entry. This provides flexibility to change the general behavior of a specific static route. Multiple static routes: specify alternative paths to the same destination. Multiple static routes provide stability and load balancing. To configure a default static route, supply a value of 0 for the prefix and the prefix length. Events that affect static route operation include user-configured changes or other system events, such as: Deleting the Ipv6 addresses of a VLAN. The static route with the corresponding local neighbors are permanently deleted from the RTM, the forwarding database, and the configuration database. Deleting a VLAN. Static routes with a local next-hop option set are removed from the configuration database. Static routes with a non local next-hop option become inactive (they are removed from the forwarding database). Disabling forwarding on a VLAN. Static routes that are reachable through the locally attached network become inactive. Disabling a VLAN, making the static routes inactive. Disabling IPv6 forwarding globally. A change in a dynamically learned neighbor. When a neighbor becomes unreachable or is deleted, the static route with the neighbor becomes inactive, and the configuration is not affected. The static route with the neighbor becomes active in the configuration and is added to the RTM and forwarding database. Enable a static route Add the route to the RTM to change certain static routes to active. Delete a static route. Permanently delete a static route from the configuration. Disable a static route. Change a preference. When the static route preference changes, the selection of best routes for the entries have both static and dynamic paths.

34 34 IPv6 routing fundamentals Delete or disable a tunnel. Deleting or disabling a tunnel removes the tunnel entry from the forwarding table. Enable the tunnel. Enabling a tunnel activates the tunnel static routes and adds an entry to the forwarding table. The local-nexthop-flag is not required in IPv6. An Ipv4 device cannot learn a neighbor ARP entry unless the device has a local route entry. In Ipv6, a host can learn a neighbor entry if the device is physically connected to the neighbor (one hop). The static route becomes active when the next-hop is reachable by a dynamic route neighbor resolution. The static route takes the forwarding information from the dynamic route. If the next-hop is reachable via local route, the neighbor resolution is required. IP static route table The static route table is separate from the system routing table that the router uses to make forwarding decisions. The static route table allows you to change static routes directly. Although the tables are separate, the Static Route Table Manager entries are automatically reflected in the System Routing Table if the next hop address in the static route is reachable and if the static route is enabled. The static route table is indexed by four attributes: Destination Network Destination Mask Next Hop ifindex The maximum number of entries is 100. You can insert static routes using the Static Route Table, and you can delete static routes by using either the Static Route Table or the System Routing Table. ATTENTION The System Routing Table displays only active static routes with the "best route" preference. A static route is active only if the route is enabled and that the next hop address is reachable. You can enter multiple routes (for example, multiple default routes) that have different costs and the lowest-cost route that is reachable appears in the routing table. If you enter multiple next hops for the same route with the same cost, the switch does not replace the existing route. If you enter

35 Routing 35 the same route with the same cost and a different next hop, the first route is used. However, if that first route becomes unreachable, the second route (with a different next hop) is activated with no loss of connectivity. Static routes configured for the management port are applied with the natural mask of the network. Because traffic that originates from the switch refers to these routes before checking the IP routing table, the switch management traffic can be incorrectly forwarded from the management port, even though a specific route exists in the routing table. Black hole static routes While aggregating or injecting routes to other routers, a router may not have a route to the aggregated destination, which causes a "black hole." To avoid routing loops, you can configure a black hole static-route to the destination it is advertising. A black hole route is a route with invalid next hop, so that the data packets destined to this network will be dropped by the switch. When you specify a route preference, be sure that you configure the preference value appropriately so that when the black-hole route is used, it gets elected as the best route. Before adding the black hole route a check is made to ensure that no other static route to that identical destination in an enabled state exists. If such a route exists, then you are not allowed to add the black hole route, and an error message is generated. However, if there is an enabled black hole route, then you will not be allowed to add another static route to that destination. You must first delete or disable the black hole route before you can add a regular static route to that destination. Open Shortest Path First (OSPF) protocol Open Shortest Path First (OSPF) Protocol is an Interior Gateway Protocol (IGP) that distributes routing information between routers belonging to a single autonomous system (AS). OSPF is a link-state protocol intended for use in large networks. This section includes the following topics: Overview (page 36), Benefits (page 36) Neighbors (page 36)

36 36 IPv6 routing fundamentals Overview In an OSPF network, each router maintains a link-state database that describes the topology of the autonomous system (AS). The database contains the local state for each router in the AS, including usable interfaces and reachable neighbors. If the router detects any changes, it shares them by flooding link-state advertisements (LSAs) throughout the AS. Routers synchronize topological databases based on the sharing of information from LSAs. From the topological database, each router constructs a shortest-path tree, with itself as the root. The shortest-path tree gives the optimal route to each destination in the AS. Routing information from outside the AS appears on the tree as leaves. OSPF routes IP traffic based solely on the destination IP address and the prefix contained in the IP packet header. OSPFv3 is supported in IPv6 routing. OSPFv3 runs on a per-link basis, rather than a per-subnet basis. Multiple instances are possible on a single link. OSPFv3 does not support the OSPFv2 authentication feature. Benefits In large networks, OSPF offers the following benefits: Fast convergence: in the event of topological changes, OSPF recalculates routes quickly. Minimal routing protocol traffic Load sharing: OSPF provides support for equal-cost multipath routing. If several equal-cost routes to a destination exist, traffic is distributed equally among them. Type of Service: separate routes can be calculated for each IP Type of Service. Neighbors In an OSPF network, any two routers with an interface to the same network are neighbors. Routers use the Hello Protocol to discover their neighbors and maintain neighbor relationships. On a broadcast or point-to-point network, the Hello Protocol dynamically discovers neighbors. On a non broadcast multiaccess network (NBMA), you must manually configure neighbors for the network.

37 OSPFv3 37 The Hello Protocol provides bi directional communication between neighbors. Periodically, OSPF routers send out hello packets over all interfaces. These hello packets include the following information: the priority the Hello Timer and Dead Timer values a list of routers that sent hello packets on the interface the choice between designated router (DR) and backup designated router (BDR) Routers establish bidirectional communication when one router discovers itself listed in the neighbor router hello packet. OSPFv3 This section is an overview of the differences between Open Shortest Path First (OSPF)v3 protocol, developed for IPv6, and OSPFv2, used in IPv4. This information is compiled from RFC The IPV4 terms subnet and network are replaced in IPv6 by link. An IPv6 link is a communication medium between nodes at the link layer. You can assign multiple IP subnets (prefixes) to a link. Two IPv6 nodes with common or different prefixes can communicate over a single link. OSPF for IPv6 operates on a per-link basis, rather than per-ip-subnet, as in IPv4. IPv6 makes the following changes to how packets are received and to the contents of Network-LSAs and hello packets: The OSPF packet contains no IPv6 addresses. LSA payloads carried in Link State Update packets contain IPv6 addresses. The following IDs remain at 32-bits and are not assigned IPv6 addresses: Area IDs, LSA Link State IDs, and OSPFRouter IDs. Router IDs identify neighboring routers, identified by an IP address on broadcast and NBMA networks in OSPFv2.

38 38 IPv6 routing fundamentals Flooding scope LSA flooding scope is generalized in OSPFv3 and coded in the LS type field of the LSA. The following three flooding scopes are available for LSAs: Link-local scope: The LSA is not flooded beyond the local link. Area scope: The LSA is flooded in a single OSPF area. Area scope is used in Router-LSAs, Network-LSAs, Inter-Area-Prefix-LSAs, Inter-Area-Router-LSAs, and Intra-Area-Prefix-LSAs. AS scope: The LSA is flooded through the routing domain. AS scope is used for AS-external-LSAs. Multiple instances per link OSPFv3 supports multiple OSPF protocol instances on a single link. For example, you can configure a single link in two or more OSPF areas. An Instance ID in the OSPF packet header and the OSPF interface structures allow multiple protocol instances on a single link. Link-local addresses In IPv6, link-local addresses are used on a single link. Link-local addresses facilitate features such as neighbor discovery and auto-configuration. Datagrams with link-local sources are not forwarded. Instead, routers assign link-local unicast addresses from the IPv6 address range. OSPF for IPv6 assigns link-local unicast addresses to physical segments attached to a router. The source for all OSPF packets sent on OSPF physical interfaces is the associated link-local unicast address. Routers learn link-local addresses for all other nodes on their links. The learned addresses are included in next-hop information during packet forwarding. For OSPF protocol packets, global scope or site-local IP addresses must be used as the source for packets. Link-LSA is the only OSPF LSA type that allows you to include link-local addresses. Link-local addresses must not be advertised in other LSA types. Authentication OSPF for IPv6 requires the IP Authentication Header and the IP Encapsulating Security Payload for authentication and security. OSPFv3 does not support the Authentication feature from OSPFv2. The IPv6 16-bit one s complement checksum protects against accidental data corruption.