Nortel Secure Router 2330/4134 Configuration Layer 2 Ethernet. Release: 10.2 Document Revision: NN

Transcription

1 Configuration Layer 2 Ethernet Release: 10.2 Document Revision: NN

2 . Release: 10.2 Publication: NN Document release date: 7 September 2009 While the information in this document is believed to be accurate and reliable, except as otherwise expressly agreed to in writing NORTEL PROVIDES THIS DOCUMENT "AS IS" WITHOUT WARRANTY OR CONDITION OF ANY KIND, EITHER EXPRESS OR IMPLIED. The information and/or products described in this document are subject to change without notice. Nortel, Nortel Networks, the Nortel logo, and the Globemark are trademarks of Nortel Networks. THE SOFTWARE DESCRIBED IN THIS DOCUMENT IS FURNISHED UNDER A LICENSE AGREEMENT AND MAY BE USED ONLY IN ACCORDANCE WITH THE TERMS OF THAT LICENSE. Cisco is a trademark of Cisco Systems Inc. All other trademarks are the property of their respective owners.

3 . Contents 3 New in this release 11 Features 11 Selectable range of ports 11 Enhanced show interface ethernet command 11 Expanded definition parameter for interfaces 11 Introduction 13 Navigation 13 Secure Router 2330/4134 Ethernet interface fundamentals 15 Ethernet interface fundamentals 15 FE and FE/PoE Medium Modules 15 GbE Medium Module 17 GbE Large Module 18 Chassis Ethernet ports 18 Ethernet Connectivity Fault Management 21 Maintenance Domain 22 Maintenance End Point 23 Maintenance Intermediate Point 27 Connectivity Fault Management messages 28 Connectivity Fault Management modes 29 Connectivity Fault Management errors and statistics 29 Layer 2 fundamentals 31 Navigation 31 Layer 2 switching and bridging 32 MAC bridging 32 VLANs 32 Independent VLAN learning 34 Static multicast MAC filtering 34 VLAN classification 35 VLAN stacking 36 Spanning Tree Protocol 36 Multiple Spanning Tree Protocol 37 MSTP regions 37

4 4 Common Spanning Tree 39 MSTP instance 39 Rapid transitions 40 IGMP Snooping 42 IGMP proxy 43 IGMP querier 43 Query interval 43 Last member query interval 44 Maximum response time 44 Fast-leave processing 44 Multicast router ports 45 GVRP 45 Link aggregation 46 LACP 46 Port mirroring 46 Selectable range of ports 47 Configuring Power over Ethernet 49 Configuring the PoE port mode 49 Configuring PoE port power 50 Configuring PoE port priority commands 51 Configuring PoE device detection 52 Configuring PoE port power limits 53 Viewing PoE information 54 Configuring Ethernet Connectivity Fault Management 57 Accessing the CFM tools 57 Configuring the number of path trace cache entries 58 Configuring the CFM frame ethertype 58 Enabling CFM event messages 59 Creating a Maintenance Domain 60 Configuring a Maintenance Association 61 Configuring a Maintenance End Point 62 Deleting a Maintenance End Point 63 Configuring a remote Maintenance End Point 64 Deleting a remote Maintenance End Point 65 Configuring a Maintenance Intermediate Point 65 Deleting a Maintenance Intermediate Point 66 Configuring Continuity Check Messages 67 Removing an auto-detected remote Maintenance End Point 68 Issuing CFM loopback tests 69 Verifying the path to a remote MEP 69 Verifying the path to a remote MIP 70 Issuing CFM linktrace tests 71 Tracing the path to a remote MEP 71

5 5 Tracing the path to a remote MIP 72 Example of configuring Ethernet Connectivity Fault Management 73 Displaying Ethernet CFM information 78 Displaying information related to Maintenance Domains 78 Displaying information related to Maintenance Associations 78 Displaying information related to MEPs and MIPs 79 Displaying information related to continuity checks 80 Displaying information related to CFM errors 80 Displaying information related to CFM stats 81 Displaying information related to path trace cache entries 82 Displaying CFM global configuration 83 Clearing Ethernet CFM information 83 Configuring Secure Router 2330/4134 Ethernet interfaces 85 Configuring Maximum Transmission Unit size 85 Configuring jumbo frames 86 Adding comments to an interface 86 Adding comments at the beginning of a configuration file 87 Adding comments at the end of a configuration file 87 Adding a description to an interface 88 Configuring the speed of an interface 89 Configuring the traffic class table 89 Configuring user priority 90 Layer 2 configuration 91 Prerequisites to Layer 2 configuration 91 Layer 2 configuration procedures 91 Layer 2 configuration navigation 92 Configuring interface modes 95 Configuring trunking on Ethernet interfaces 95 Enabling trunking on an Ethernet port 95 Specifying VLANs to trunk 96 Disabling trunking 97 Verifying trunks 98 Example of configuring trunking on a chassis Ethernet interface 98 Configuring trunking on a WAN interface 99 Enabling trunking on WAN interfaces 99 Adding all VLANs to a trunk link 100 Removing all VLANs from a trunk link 100 Adding a specified VLAN to a trunk link 101 Removing a specified VLAN from a trunk link 101 Disabling trunking 101 Verifying trunks 102 Example of configuring trunking on a WAN interface 102

6 6 Configuring a hybrid link on an Ethernet interface 103 Associating VLANs with hybrid links 103 Disabling a hybrid link 106 Verifying a hybrid link 106 Example of configuring a hybrid link on a chassis Ethernet interface 107 Configuring a hybrid link on a WAN interface 107 Enabling a hybrid link on a WAN interface 107 Adding all VLANs to a hybrid link 108 Removing all VLANs from a hybrid link 108 Adding a specified VLAN to a hybrid link 109 Removing a specified VLAN from a link 109 Disabling a hybrid link 110 Verifying a hybrid link 110 Example of configuring a hybrid link on a WAN interface 110 Configuring an access port on an Ethernet interface 111 Enabling an access link on an Ethernet port 111 Associating VLANs with access links 112 Disabling an access port 112 Verifying an access port 112 Configuring an access port on a WAN interface 113 Enabling an access link on a WAN interface 113 Changing the VLAN on an access port 114 Disabling an access port 114 Verifying an access port 115 Example of configuring an access port on a WAN interface 115 Configuring link aggregation 117 Configuring LACP 117 Configuring static mode 117 Configuring passive mode 118 Configuring active mode 118 Changing the channel group 119 Example of changing the channel group number to reconfigure an interface 119 Removing LACP configuration 120 Configuring the LACP timeout 120 Configuring LACP system priority 121 Restoring the default LACP system priority 121 Configuring a LAG interface 122 Prerequisites 122 Example of configuring a LAG interface 122 Verifying the successful configuration of a LAG 123 Viewing channel-group information 123 Viewing aggregator member information 123

7 7 Viewing LACP dynamic information 123 Viewing LAG interface information 124 Example of configuring LACP 124 Configuration on SWITCH_1 124 Configuration on SWITCH_2 125 Configuring VLANs 127 Creating a VLAN 127 Removing a VLAN 127 Verifying VLANs 128 Shutting down a VLAN interface 128 Example of creating VLANs and binding each VLAN to an interface 129 Example of creating VLANs 129 Example of binding a bundle access interface to a VLAN 129 Example of binding a LAG trunk port to VLANs 130 Example of binding an Ethernet hybrid port to VLANs 130 Configuring VLAN classification 131 Creating VLAN classification rules 131 Configuring an IPv4 subnet-based VLAN classification rule 131 Configuring a protocol-based VLAN classification rule 132 Deleting VLAN classification rules 132 Verifying VLAN classification rules 133 Creating VLAN classification rules on an interface 133 Creating protocol VLAN classification rules 133 Creating IPv4 VLAN classification rules 134 Deleting VLAN classification rules from an interface 134 Deleting protocol rules from an interface 134 Deleting IPv4 rules from an interface 135 Example of configuring VLAN classification rules 135 Configuring VLAN stacking 137 Enabling VLAN stacking 137 Prerequisites 137 Disabling VLAN stacking 137 Verifying VLAN stacking configuration 138 Example of configuring VLAN stacking 138 Configuration of the Secure Router 2330/4134 on interface A 140 Configuration of the Secure Router 2330/4134 on interface B 140 Configuration of the Secure Router 2330/4134 on interface C 141 Configuring port mirroring 143 Enabling port mirroring 143 Disabling port mirroring 144 Verifying port mirroring configuration 144 Example of configuring port mirroring 144

8 8 Configuring MAC entries 147 Adding static MAC address entries to the MAC address table 147 Deleting a static MAC address entry 147 Verifying static MAC address entries 148 Example of configuring static MAC address entries 148 Configuring MAC address aging time 149 Restoring the default MAC address aging time 149 Verifying the MAC address aging time 150 Example of configuring MAC address aging time 150 Configuring Multiple Spanning Tree Protocol 151 Configuring the region name and revision number 151 Resetting the revision number 152 Configuring Common Spanning Tree 152 Configuring bridge priority 152 Configuring hop count 153 Configuring link path cost and priority 155 Configuring PortFast 158 Configuring PortFast BPDU Guard 160 Configuring PortFast BPDU Filter 161 Configuring MSTP timers 162 Configuring forward delay 164 Configuring maximum age time 166 Configuring link types 167 Configuring an MSTP instance 169 Creating an MSTP instance 169 Associating a VLAN with an instance 170 Configuring priority for an instance 171 Configuring link path cost and priority for an instance 173 Configuring the Spanning Tree version on a port 176 Restoring the default Spanning Tree version 176 Verifying MSTP operation 177 Viewing information for MSTP Common Spanning Tree 177 Viewing information for MSTP instances 178 Viewing bridge information for an instance 178 Viewing interface information 178 Viewing VLAN information for all instances 179 Viewing VLAN information for a specified instance 179 Configuring GVRP 181 Enabling GVRP globally 181 Disabling GVRP globally 181 Enabling GVRP on ports and configuring port registration state 182 Prerequisites 182

9 9 Disabling GVRP on an interface 183 Configuring GVRP for dynamic VLAN creation 184 Disabling dynamic VLAN creation 184 Configuring GVRP timers 185 Resetting GVRP timers 186 Verifying GVRP configuration 187 Clearing GVRP command options 187 Example of configuring GVRP 188 Example of configuring SWITCH_1 189 Configuring IGMP Snooping 191 Enabling and disabling IGMP Snooping globally 191 Enabling IGMP Snooping globally 191 Disabling IGMP Snooping globally 191 Enabling and disabling IGMP Snooping on a VLAN 192 Enabling IGMP Snooping on a VLAN 192 Disabling IGMP Snooping on a VLAN 192 Configuring a multicast router port 193 Configuring an mrouter port on a VLAN 193 Removing a multicast router port from a VLAN 194 Configuring the Secure Router 2330/4134 as a proxy 195 Enabling IGMP proxy 195 Disabling IGMP proxy 195 Example of configuring the Secure Router 2330/4134 as a proxy 196 Configuring the Secure Router 2330/4134 as querier 198 Enabling the IGMP querier globally 198 Disabling the IGMP querier globally 198 Enabling the IGMP querier on a VLAN 199 Disabling the IGMP querier on a VLAN 199 Configuring the query interval on a VLAN 200 Configuring the last member query interval on a VLAN 201 Configuring the maximum response time on a VLAN 202 Configuring fast-leave processing 203 Enabling fast-leave processing on a VLAN 203 Disabling fast leave processing on a VLAN 203 Specifying the IGMP version 204 Configuring the IGMP version on a VLAN 204 Configuring the IGMP version on a port 205 Viewing IGMP Snooping information 206 Verifying the IGMP Snooping state 206 Viewing detailed information about IGMP Snooping 206 Viewing information about IGMP Snooping groups 206 Viewing information about the multicast router port 208 Viewing IGMP Snooping statistics 208

10 10 Clearing IGMP Snooping options 208 Clearing IGMP Snooping groups 208 Clearing the IGMP Snooping multicast router information 210 Clearing IGMP Snooping statistics 210

11 . New in this release 11 The following section details what s new in Nortel Secure Router 2330/4134 (NN ) for Release ATTENTION In this document, the term Secure Router 2000 is used interchangeably to refer to the Secure Router Features See the following sections for information about feature changes: Selectable range of ports With Release 10.2 and later, you can specify a range of Ethernet ports to configure at the same time. To do so, you must use the interface range ethernet command. Enhanced show interface ethernet command With Release 10.2 and later, the show interface ethernet command displays the highest supported capability for each interface: FE for Fast Ethernet and GE for Gigabit Ethernet. Expanded definition parameter for interfaces With Release 10.2 and later, the interface description string can be up to 76 characters. See Adding a description to an interface (page 88).

12 12 New in this release

13 . Introduction 13 This document provides information you need to configure Ethernet interfaces and Layer 2 features. Navigation Secure Router 2330/4134 Ethernet interface fundamentals (page 15) Ethernet Connectivity Fault Management (page 21) Layer 2 fundamentals (page 31) Configuring Power over Ethernet (page 49) Configuring Ethernet Connectivity Fault Management (page 57) Configuring Secure Router 2330/4134 Ethernet interfaces (page 85) Layer 2 configuration (page 91) Configuring interface modes (page 95) Configuring link aggregation (page 117) Configuring VLANs (page 127) Configuring VLAN classification (page 131) Configuring VLAN stacking (page 137) Configuring port mirroring (page 143) Configuring MAC entries (page 147) Configuring Multiple Spanning Tree Protocol (page 151) Configuring GVRP (page 181) Configuring IGMP Snooping (page 191)

14 14 Introduction

15 . Secure Router 2330/4134 Ethernet interface fundamentals 15 Ethernet interface fundamentals Secure Router 2330/4134 supports the following Ethernet interface modules: 24-port FE Medium Module 24-port FE/PoE Medium Module 10-port GbE Medium Module 44-port GbE Large Module For detailed information about the interface modules that the Secure Router 2330/4134 supports, see Installation Hardware Components (NN ). FE and FE/PoE Medium Modules The 24-port Fast Ethernet (FE) and Fast Ethernet/Power over Ethernet (FE/PoE) Medium Modules each provide 24 Ethernet ports that support 10 Mbps and 100 Mbps operation over unshielded twisted pair (UTP) wiring. The module is non-blocking. The 24-port FE and FE/PoE Medium Modules provide both Layer 2 switching and Layer 3 routing functionality. The 24-port PoE Medium Module supports only Alternative (or mode) A as defined in IEEE 802.3af. Power is fed over pins 1,2 and 3,6. ATTENTION You must install the Secure Router 2330/4134 PoE power supply to take advantage of the PoE capabilities. Power over Ethernet You can install up to two PoE power supply modules in the Secure Router 2330/4134. Each PoE power supply can provide 400 watts. There is a total allocation of 384 watts for each PoE card to support all 24 ports (with

16 16 Secure Router 2330/4134 Ethernet interface fundamentals Table 1 PoE power distribution Number of installed PoE interface modules One PoE interface module (any slot) Two PoE interface modules (any slots) Three PoE interface modules (any slots) maximum power limit for each port is 16 watts). This section describes the PoE power distribution scenarios available on the Secure Router 2330/4134, as well as the commands you use to configure PoE. The following table describes power distribution for PoE interface modules. One PoE power supply module installed 410 W allocated for the slot Each slot receives 200 W Slot 5 and 6 each receive 200 W. There is no power for slot 7. Two PoE power supply modules installed 410 W allocated for the slot Each slot receives 410 W Slot 5 receives 410 W. Slots 6 and 7 receive 200 W each. Port state All ports are shut down (no power state) until you configure the poe portpower or poe portmode command All ports are shut down (no power state) until you configure the poe portpower or poe portmode command All ports are shut down (no power state) until you configure the poe portpower or poe portmode command The number of powered devices that the Secure Router 2330/4134 supports is based on available power, the number of cards present in the chassis, and the actual power consumption of the powered devices connected to the PoE module. The power available with one PoE power supply module installed is 400 watts. The power available with two PoE power supply modules installed is 800 watts. If you use a redundant PoE power supply module setup (that is, you have two PoE power supply modules installed), the Secure Router 2330/4134 provides a failover feature that ensures that the Secure Router 2330/4134 keeps running, even in situations where you must remove one power supply module. The second PoE power supply module can provide enough power for the system to operate without fail (a function of the PoE power provisioning on the Secure Router 2330/4134). The following table shows the number of powered devices supported based on the number of interface modules installed in the Secure Router 2330/4134.

17 Ethernet interface fundamentals 17 Table 2 Number of ports and PDs supported Number of installed PoE interface modules One PoE power supply module installed 1 24 ports are supported irrespective of the class of powered devices ports are supported on each interface module with the combination of class 1 and class 2 powered devices. For any other combinations of powered devices, the number of ports supported is based on the actual power consumption of the powered devices connected to the modules ports are supported on each interface module in slot 5 and slot 6 with the combination of class 1 and class 2 powered devices. For any other combination of powered devices, the number of ports supported is based on the actual power consumption of the powered devices connected to the modules. Two PoE power supply modules installed 24 ports are supported irrespective of the class of powered devices. 24 ports are supported on each interface module irrespective of the class of powered devices. 24 ports are supported on the interface module in slot 5 irrespective of the powered device class, and 24 ports are supported on each interface module in slot 6 and slot 7 with the combination of class 1 and class 2 powered devices (that is, support for a total of 72 ports). For any other combination of powered devices, the number of ports supported is based on the actual power consumption of the powered devices connected to the interface module in slot 6 and slot 7. GbE Medium Module The 10-port 10/100/1000 Ethernet Advanced Layer 2/Layer 3 Medium Module provides ten autonegotiating 10/100/1000 Mbps copper Ethernet ports and two Small form-factor Pluggable (SFP) Gigabit Ethernet (GbE) ports (full duplex). Up to ten ports can be in use at one time. The module is non-blocking. The 10-port GbE Medium Module provides both Layer 2 switching and Layer 3 routing functionality.

18 18 Secure Router 2330/4134 Ethernet interface fundamentals To use a GbE Medium Module, you must insert the SFP before you configure modular Ethernet. The Secure Router 2330/4134 performs a system check for an installed SFP. If no SFP is detected, the system defaults to copper only. If an SFP is detected, the system defaults to fiber only. GbE Large Module The 44-port 10/100/1000 Large Module provides 44 Ethernet ports that each support 10/100/1000 Mbps operation over unshielded twisted pair (UTP) wiring, as well as two SFP optical ports. Up to 44 ports can be in use at one time. The 44-port GbE Large Module provides both Layer 2 switching and Layer 3 routing functionality. The total available bandwidth at all of the ports (44 Gbps) is four times the available routing bandwidth. There are three groups on the module: one group has 12 ports, and two groups have 16 ports each. For Layer 2 switching within each group, packets can be switched at full bandwidth. However, for Layer 2 switching between groups and for all packets that are routed (Layer 3), all external ports must share a limited number of links on the module. There are three links available within the group of 12 ports, and there are four links available within each group of 16 ports. There is, therefore, a 12:3 (4:1) or 16:4 (4:1) contention for the internal links. Chassis Ethernet ports In addition to the module Ethernet ports available for the Secure Router 2330/4134, the router has four chassis Ethernet ports on the front panel: GE 0/1 and GE 0/2 ports 10/100/1000 Base-T ports GE 0/3 and GE 0/4 SFP ports The following figure shows the location of the chassis Ethernet ports.

19 Ethernet interface fundamentals 19 Figure 1 Secure Router 2330/4134 chassis Ethernet ports All Ethernet ports on the Secure Router 2330/4134 (chassis and interface module Ethernet ports) support MDI and MDI-X. Ethernet interfaces on the Secure Router 2330/4134 are routed interfaces, by default. To configure them as Layer 2 interfaces, you use the switchport command.

20 20 Secure Router 2330/4134 Ethernet interface fundamentals

21 . Ethernet Connectivity Fault Management 21 Secure Router 2330/4134 supports the 802.1ag protocol, which provides operation, administration, maintenance (OAM) functionality for Ethernet. Specifically, IEEE 802.1ag Connectivity Fault Management (CFM) provides OAM tools for the service layer, which allows you to monitor and troubleshoot an end-to-end Ethernet service instance. Ethernet CFM enables the service provider to know if an Ethernet Virtual Circuit (EVC) fails, and if so, provides the tools to rapidly isolate the failure. The end-to-end service can be provider edge (PE) to PE device or customer edge (CE) to CE device. The customer VLAN tag defines a service instance. Based on the customer VLAN, the customer receives service as defined in their customer agreement. When you initiate CFM frames from the Secure Router 2330/4134, the frames are tagged with the C-VLAN only. CFM is not supported on an interface that uses stacked VLANs. Ethernet CFM is the standard for Layer 2 ping, Layer 2 traceroute, and the end-to-end connectivity check of the Ethernet network. Nortel supports Ethernet CFM on chassis Gigabit Ethernet (GbE) ports only. The 802.1ag feature divides or separates a network into administrative domains called Maintenance Domains (MD). Each MD includes the following attributes: Maintenance Associations (MA) Maintenance End Points (MEP) Maintenance Intermediate Points (MIP)

22 22 Ethernet Connectivity Fault Management Maintenance Domain A Maintenance Domain (MD) is the part of a network that is controlled by a single administrator. For example, a customer can engage the services of a service provider, who, in turn, can engage the services of several operators. In this scenario, there can be one MD associated with the customer, one MD associated with the service provider, and one MD associated with each of the operators. The Secure Router 2330/4134 supports up to 64 MDs. You assign one of the following eight levels to the MD: 0 2 (operator levels) 3 4 (provider levels) 5 7 (customer levels) The levels separate MDs from each other and provide different areas of functionality to different devices using the network. An MD is characterized by a level and an MD name (optional). A single MD can contain several MAs. Each MA is defined by a set of Maintenance Points (MP). An MP is a demarcation point on an interface that participates in CFM within an MD. There are two types of MP: Maintenance End Point (MEP) Maintenance Intermediate Point (MIP) The following figure shows the MD level assignments.

23 Maintenance Domain 23 Figure 2 Maintenance Domain levels Maintenance End Point MEPs are points at the edge of the MD. They define a boundary and confine connectivity fault management messages within this boundary. An MEP acts based on the relationship between the level assigned to the connectivity fault management frame received and the level assigned to the MEP. The possible MEP actions are the following: Drop frames that have a lower level Transparently forward all connectivity fault management frames that have a higher level For connectivity fault management frames that have the same level as the MEP, the MEP does one of the following (based on the type of MEP): A Down MEP is one residing in a bridge that transmits connectivity fault management messages towards, and receives them from, the direction of the physical medium. For example, see Figure 2

24 24 Ethernet Connectivity Fault Management "Maintenance Domain levels" (page 23). The interface at point a in the Figure is a Down MEP. A Down MEP does the following: processes frames received from the wire side drops frames received from the relay side An Up MEP is one residing in a bridge that transmits connectivity fault management messages towards, and receives them from, the direction of the bridge relay entity. For example, see Figure 2 "Maintenance Domain levels" (page 23). The interface at point b in the Figure is an Up MEP. An Up MEP does the following: drops frames received from the wire side processes frames received from the relay side ATTENTION Secure Router 2330/4134 Release 10.1 supports Down MEPs only. A MEP provides the following functions: fault detection fault verification fault isolation path discovery fault notification Fault detection Fault detection is achieved through the use of Continuity Check Messages (CCM). Failure to receive three consecutive CCM indicates a fault. Each MEP periodically transmits multicast CCM. A CCM traverses all the bridges until it reaches an MEP with the same (or, in an error situation, lower) MD level as the sending MEP. Each MEP maintains a list of its peers and expects to receive CCM from each of its peers periodically. Each MEP maintains a list of validity or lifetime timers. There is one timer for each peer (remote) MEP. All MEPs in a singe MA share one CCM transmit period (that is, you configure the CCM timer only once for each MA). The IEEE 802.1ag standard defines the "validity" or "lifetime" timer value as 3.5 times greater than the CCM transmit period of a MEP. Receiving MEPs declare connectivity failures after missing three consecutive CCM from a peer. Additionally, transmitting MEPs encode the transmit period in the CCM interval field of the CCM, which enables the receiving MEP to identify configuration errors and raise an appropriate alarm. The transmission

25 Maintenance Domain 25 Figure 3 An MEP transmitting CCM period is configurable for each MA. Use the cc-interval command to define the transmission period (see Configuring Continuity Check Messages (page 67)). The following figure shows an MEP sending multicast CCM. Note that all MEPs transmit CCM, not only the MEP for which the CCM path is shown. Fault verification and isolation You can use Loopback Messages (LBM) for fault verification and fault isolation. The LBM is a unicast message you can trigger with a command. LBM can be addressed to either an MEP or an MIP, but only an MEP can initiate the LBM. You can address a destination MEP with either its MAC address or its MEP ID, however you can address an MIP only by its MAC address. Addressing with the MEP ID is only possible if the MAC address of the remote MEP has previously been learned. If you use the MEP ID as the address, and the MAC address of the remote MEP is unavailable, the command fails. You must repeat the command using the MAC address of the remote MEP.

26 26 Ethernet Connectivity Fault Management Figure 4 Loopback message and reply The destination MP responds with a Loopback Reply (LBR). When you issue the command to send an LBM, the command becomes unavailable until the LBR is received or a timeout occurs. You use LBM to discover if the target MP is reachable. LBM does not provide hop-by-hop discovery of a path. For hop-by-hop discovery of a path, see Path discovery (page 26). The following figure shows the LBM and LBR. Path discovery You use Linktrace Messages (LTM) for path discovery. An LTM is a multicast message that an MEP generates. An LTM frame contains the MAC address of the target MP. The LTM is intercepted by all MPs that are at the same level as the MEP initiating the LTM to the destination MP (an LTM can be addressed to either an MEP or an MIP). Each MP that intercepts the LTM looks at the target address. If the MP determines that it is not the target, the MP performs the following three actions: decrements the Time To Live (TTL) field in the LTM frame sends a Linktrace Reply (LTR) forwards the original LTM to the destination The LTR is a unicast message addressed to the originating MEP. The LTR is sent only after a random time delay in the range of 0 to 1 second (as defined in the IEEE 802.1ag protocol). The LTM is forwarded until it reaches its destination or the TTL value is decremented to 0.

27 Maintenance Domain 27 Figure 5 Linktrace message and reply The following figure shows the LTM and LTR. You initiate the LTM with a command. When you issue the LTM command, the CLI gives the session ID for that test and exits. The LTRs are appended to this session in the Linktrace cache based on the transaction ID. Use the show cfm linktrace-cache <session-id> command to view results. Fault notification The Secure Router 2330/4134 provides fault notification through CLI event messages and error logs. Maintenance Intermediate Point MIPs are internal to an MD (that is, MIPs are never at the boundary of an MD). MIPs respond to connectivity fault management frames only when triggered by linktrace and loopback messages. MIPs are associated with an MD, and not with any specific MA. An MIP can participate in connectivity fault management of one service instance, or an MIP can participate in CFM of many service instances that have the same MD level as the MIP.

28 28 Ethernet Connectivity Fault Management MIPs do not initiate any connectivity fault management messages. MIPs passively receive connectivity fault management messages, process the messages received, and respond to the originating MEP. By responding to received connectivity fault management messages, MIPs help you to discover the hop-by-hop path between MEPs, which allows you to isolate connection failures to smaller segments of the network and to discover the location of faults along the paths. You can create, enable, and disable MIPs independently of MEPs. An MIP acts based on the relationship between the level assigned to the connectivity fault management frame received and the level assigned to the MIP. The possible MIP actions are the following: transparently forwards all connectivity fault management frames that have a higher or lower MD level than the MIP processes frames that have the same MD level as the MIP Connectivity Fault Management messages CFM uses standard Ethernet frames distinguished by EtherType or (for multicast messages) by MAC address. All connectivity fault management messages are confined to an MD. Secure Router 2330/4134 supports the following connectivity fault management messages: CCM multicast heartbeat messages that MEPs periodically initiate. CCM provide the following services: allow MEPs to discover other MEPs within an MA of a domain allow MIPs to discover MEPs You configure CCM for an MA within a domain, or you configure CCM for a VLAN. Loopback messages unicast frames transmitted by an MEP. Loopback messages are similar to an Internet Control Message Protocol (ICMP) ping message. You initiate a loopback message to verify connectivity to a particular MP, which indicates if a destination is reachable. Linktrace messages multicast frames transmitted by an MEP. CFM linktrace messages are similar to User Datagram Protocol (UDP) linktrace messages. The administrator initiates a linktrace message to track the path (hop-by-hop) to a destination MEP.

29 Connectivity Fault Management errors and statistics 29 Connectivity Fault Management modes The Secure Router 2330/4134 supports the following CFM modes: Routed mode, in which Secure Router 2330/4134 sends and receives untagged CFM frames. Switched mode, which is, more specifically, one of the following: Access mode Secure Router 2330/4134 can receive both VLAN tagged and untagged CFM frames, but can send only untagged CFM frames. Hybrid mode Secure Router 2330/4134 can receive both VLAN tagged and untagged CFM frames. There are two options for sending CFM frames: Egress tagged sends VLAN tagged CFM frames Egress untagged sends untagged CFM frames Trunk mode Secure Router 2330/4134 can receive and send only VLAN tagged CFM frames. Connectivity Fault Management errors and statistics The heartbeat mechanism of CFM (using periodic CCM) makes it possible to detect a number of errors and accumulate data for statistical purposes. Inconsistent configuration of the devices in an MD or an MA, or inconsistent configuration of the MEPs, remote MEPs, and so on in different nodes of the network can result in configuration errors. The Secure Router 2330/4134 stores configuration errors in a database. You use the show commands to view the information stored in the databases. The databases contain data for each MEP in the Secure Router 2330/4134.

30 30 Ethernet Connectivity Fault Management

31 . Layer 2 fundamentals 31 Ethernet is one of the most widely deployed Layer 2 Local Area Network (LAN) transport technologies today. A LAN is a data communications network connecting terminals, computers, and printers within a building or other geographically limited area. Advantages of Ethernet include: Ability to scale in bandwidth and speed Ethernet switches support high port densities and forwarding rates in the millions of packets per second Support of Class of Service (CoS) that allows up to eight classes of service to be defined Ease of deploying multipoint communications The Secure Router 2330/4134 Ethernet Layer 2 features support VLAN MAC bridging of traffic within the LAN, and between LAN to WAN for traffic in and out of the carrier network. The Secure Router 2330/4134 platform uses both the hardware network processor and software forwarding logic for Ethernet Layer 2 switching. The network processor handles LAN switching. Software forwarding works with the network processor to achieve LAN to WAN (and WAN to LAN) data switching. The Secure Router 2330/4134 also supports termination of Layer 3 traffic on a VLAN to achieve routing using the Layer 3 engine. Navigation Layer 2 switching and bridging (page 32) MAC bridging (page 32) VLANs (page 32) Spanning Tree Protocol (page 36) IGMP Snooping (page 42) GVRP (page 45) Link aggregation (page 46) Port mirroring (page 46)

32 32 Layer 2 fundamentals Layer 2 switching and bridging Local Area Network (LAN) is a data communications network connecting terminals, computers and printers within a building or other geographically limited areas. These devices could be connected through wired cables or wireless links. Ethernet and Token Ring are examples of standard LAN technologies. LAN switching involves examining physical network addresses that uniquely identify a device in the network. LAN bridging offers an extension of the LAN by supporting the connection of multiple LAN segments. MAC addresses of the datagram that flow through bridges are examined to build a table of known destinations. If the destination of a datagram is on the same segment as the source of the datagram, the bridge drops the datagram because forwarding is not required. However, if the destination is on another segment, the bridge transmits the datagram on that segment only. If the bridge does not know the destination segment, it transmits the datagram on all segments except the source segment (a technique known as flooding). MAC bridging MAC Bridging allows multiple LANs to be connected together. Transparent bridging involves the creation of MAC address tables, and limits the Ethernet collision domain by filtering data sent between LAN segments. This reduces network congestion and allows networks to be partitioned for administrative purposes. VLANs A Virtual LAN (VLAN) is a switched network that is logically segmented on an organizational basis, by functions, project teams, or applications rather than on a physical or geographical basis. VLAN segments the physical local-area network (LAN) infrastructure into different subnets so that packets are switched only between ports within the same VLAN. Devices on a VLAN are configured so that they can communicate as if they were attached to the same physical wire, when in fact they are located on a number of different LAN segments. With VLAN partitioning, traffic stays within the appropriate groups, minimizing wasteful broadcasts. A VLAN is made up of a group of ports that define a logical broadcast domain. These ports can belong to a single device, or they can be spread across multiple devices. In a VLAN-aware device, every frame received on a port is classified as belonging to one and only one VLAN. Whenever a broadcast, multicast, or unknown destination frame must be flooded by a VLAN-aware device, the frame is sent out only through all the other active ports that are members of this VLAN. The default device configuration groups all ports into the port-based default VLAN 1. This VLAN cannot be deleted from the system.

33 VLANs 33 The Secure Router 2330/4134 supports port-based and protocol-based VLANs. A port-based VLAN is a VLAN whose ports are explicitly configured as members. In port-based VLANs, all ports are always static members. When creating a port-based VLAN, you assign a VLAN identification number (VID) and specify which ports belong to the VLAN. The VID is used to coordinate VLANs across multiple devices. Protocol-based VLANs are an effective way to segment your network into broadcast domains according to the network protocols in use. Traffic generated by any network protocol can be automatically confined to its own VLAN. VLAN tagging is a MAC option. A VLAN-tagged frame is a basic MAC data frame that has had a 4-byte VLAN header inserted between the SA and Length/Type fields. The VLAN header consists of the following fields: A reserved 2-byte type value, indicating that the frame is a VLAN frame Tag Protocol Identifier (TPID) - defined value of 8100 in hex. When a frame has the EtherType equal to 8100, this frame carries the tag IEEE 802.1Q/802.1P. TCI - Tag Control Information field including user priority, Canonical format indicator and VLAN ID. VLAN tagging can be enabled or disabled on each interface. The Secure Router 2330/4134 uses IEEE 802.1Q tagging of frames and coordinates VLANs across multiple devices. The following figure shows the additional 4-octet (tag) header that is inserted into a frame after the source address and before the frame type. The tag contains the VLAN ID associated with the frame. Figure 6 VLAN tagging In the Secure Router 2330/4134, your port level configuration determines whether tagged frames are sent and received. Tagging is set as true or false for the port and is applied to all VLANs on that port.

34 34 Layer 2 fundamentals The Secure Router 2330/4134 associates a frame with a VLAN based on the data content of the frame and the configuration of the destination port. Whether the frame is tagged or untagged dictates how that frame is treated. A Secure Router 2330/4134 port with tagging enabled sends frames explicitly tagged with a VLAN ID. Tagged ports are typically used to multiplex traffic belonging to multiple VLANs to other IEEE-802.1Q-compliant devices. If tagging is disabled on a Secure Router 2330/4134 port, it does not send tagged frames. An untagged port connects a Secure Router 2330/4134 to devices that do not support IEEE 802.1Q tagging. If a tagged frame is forwarded out a port on which tagging is set to false, the device removes the tag from the frame before sending it out the port. If a tagged frame is received on a tagged port, with a VLAN ID specified in the tag, the Secure Router directs it to that VLAN, if it is present. For untagged frames, VLAN membership is implied from the content of the frame itself. For untagged frames received on a tagged port, you can configure the port to either discard or accept the frame. If you configure a tagged port to accept untagged frames, the port must be assigned to a port-based VLAN. Independent VLAN learning In the Secure Router 2330/4134, each VLAN has its own, independent, forwarding database. That is, the same MAC address can be learned in different VLANs; and, based on the VLAN receiving traffic for this address, the device is able to forward to this MAC address without any confusion. This means that before the device can look up the source or destination MAC address in a received frame, or before it can decide whether to bridge or to route a frame, it must first determine to which VLAN the frame belongs. Independent VLAN learning mode is used to learn MAC addresses in the context of the VLAN to which they belong. Static multicast MAC filtering Some network applications, such as mirroring, rely on a Layer 2 multicast MAC mechanism to send a frame to multiple hosts for processing. Multicast MAC filtering lets you direct MAC multicast flooding to a specific set of ports. In Layer 2, a multicast MAC address generally floods to all ports in the VLAN. With multicast MAC filtering, you can define a separate flooding domain for a given multicast MAC address, which is a subset of the ports on a VLAN.

35 VLANs 35 To perform multicast MAC filtering, you create the VLAN normally and then manually define a flooding domain (that is, MAC address and port list) for a specific multicast address. When specifying the multicast MAC flooding domain, indicate which ports or link aggregation groups are to be considered for multicast traffic. The actual flooding is then based on whether the specified ports are active members in the VLAN. VLAN classification Each frame received by a VLAN bridge is classified as belonging to exactly one VLAN by associating a VID value with the received frame. The classification is achieved as follows: 1. If the vlan_identifier parameter carried in a received data indication is the null VLAN ID (VID), and no VLAN classification rules are configured, then the VID for the frame is the unique Port VLAN ID (PVID) associated with the port through which the frame was received. Otherwise: 2. If the vlan_identifier parameter carried in a received data indication is the null VLAN ID and there are VLAN classification rules configured, then the VID for the frame is selected from the VID set of the port through which the frame was received. The VID selected is the member of the VID set for which the associated Protocol Group Identifier (PGI) is equal to the PGI of the frame. If no matches are found, then the VID for the frame is the PVID associated with the port. Otherwise: 3. The VID for the frame is the vlan_identifier parameter value. ATTENTION The vlan_identifier parameter carries the null VLAN ID if the frame was not VLAN tagged. There are two cases: either the frame was untagged, or the frame was tagged and the tag header carried a VID value equal to the null VLAN ID (that is, a priority-tagged frame). Supported protocols for protocol-based VLAN classification rules The following table lists the protocols that the Secure Router 2330/4134 supports for VLAN classification rules. Table 3 Supported protocols for VLAN classification rules Classification rule parameter ipv4 ipv6 mpls Description IPv4 IPv6 MPLS

36 36 Layer 2 fundamentals Table 3 Supported protocols for VLAN classification rules (cont d.) Classification rule parameter arp rarp vlan-tagged appletalk ipx pppoe-disc pppoe-session Description ARP Reverse ARP 802.1q VLAN tag Appletalk IPX PPPoE discovery PPPoE session The supported encapsulations for protocol-based VLAN classification rules are: Ethernet Type II LLC SNAP LLC only VLAN stacking VLAN stacking refers to the encapsulation of one VLAN within another VLAN. A stacked VLAN transparently tunnels packets through the stacked VLAN domain by adding an additional 4-byte header to each packet. Stacked VLANs offer the following features: VLAN transparency for IEEE 802.1Q tagged or untagged traffic through a service provider core network A solution to VLAN scalability issues you can summarize customer VLANs into core stacked VLANs Uses a layered architecture to improve scalability Spanning Tree Protocol The operation of the Spanning Tree Protocol (STP) is defined in the IEEE Standard 802.1D. The STP detects and eliminates logical loops in a bridged or switched network. When multiple paths exist, the spanning tree algorithm configures the network so that a bridge or switch uses only the most efficient path. If that path fails, the protocol automatically reconfigures the network to make another path active. The process maintains network operations. You can control path redundancy for VLANs by implementing STP.

37 Spanning Tree Protocol 37 Multiple Spanning Tree Protocol The Secure Router 2330/4134 supports Multiple Spanning Tree Protocol (MSTP), and it is enabled by default. MSTP on the Secure Router 2330/4134 is backward-compatible with STP and Rapid Spanning Tree Protocol (RSTP). STP and RSTP can be implemented on a per-port basis on the Secure Router 2330/4134. MSTP defines an extension to RSTP that further develops the usefulness of VLANs. This "per-vlan" MSTP configures a separate Spanning Tree for each VLAN group and blocks the links that are redundant within each Spanning Tree. If there is only one VLAN in the network, single (traditional) STP works appropriately. If the network contains more than one VLAN, the logical network configured by single STP would work, but it is possible to make better use of the redundant links available by using an alternate spanning tree for different (groups of) VLANs. MSTP allows the formation of MST regions that can run multiple MST instances (MSTI). Multiple regions and other STP bridges are interconnected using one single common spanning tree (CST). MSTP on the Secure Router 2330/4134 interoperates with Cisco s implementation of MSTP. The Cisco equipment must have IOS v12.2 (25), or newer, installed. MSTP regions All devices are said to be in the same region if the following three elements are the same on all the devices: region name (32 bytes) revision number (2 bytes) configuration digest (the numerical value derived from VLAN to instance mapping) The following figure shows a single MSTP region.

38 38 Layer 2 fundamentals Figure 7 Single MSTP region Figure 8 Multiple MSTP regions Within a region, there can be multiple spanning trees running for an instance. All the bridges within a region appear as a single bridge to other regions. Bridges that are outside the region always have a single point of contact to the region. The following figure shows the relationship amongst multiple MSTP regions.

39 Spanning Tree Protocol 39 Common Spanning Tree With Common Spanning Tree (CST) there is only one instance of spanning tree for all VLANs. As shown in the following figure, the traffic for all VLANs (2 100) must travel from Switch B to Switch A, while the path between Switch C and Switch A is unused. Figure 9 Common Spanning Tree MSTP instance With MSTP instances, traffic can be load-balanced between all the links. Within a region, each instance has its own independent spanning tree. It can have its own root bridge. Each bridge can have a different priority for each instance, so that the bridge can be selected as root in one instance and non-root in another instance. In the following figure, Switch B is root in Instance #1. Switch C is the root bridge in Instance #2. In CST, Switch A is the root.

40 40 Layer 2 fundamentals Figure 10 Network with multiple instances configured VLANs can be assigned arbitrarily to any instance. Any VLAN can be part of one and only one instance. The VLAN traffic inside the MSTP region takes the path determined by the Spanning Tree associated with that particular instance. For example, if VLANs 2 50 are associated with Instance #1 and VLANs are associated with Instance #2, the VLAN traffic (VLAN ID 2 50) never takes the link AC path until and unless the link AB or BC fails. Similarly, the VLAN traffic (VLAN ID ) never takes the link AB path until and unless link CB or CA fails. Rapid transitions On a port connected to no other bridge, Spanning Tree PortFast brings the port up more quickly following device initialization or a spanning tree change. For example, in the following figure, ports A1, B1, B2 are connected to end stations. These ports do not participate in the Spanning Tree port selection. These ports can, therefore, go directly to the spanning tree forwarding state (skipping the listening and learning states).

41 Spanning Tree Protocol 41 Figure 11 Enabling rapid transitions in a network ATTENTION Enabling PortFast does not disable spanning tree on an interface. See PortFast BPDU Filter (page 42) for more information. PortFast is intended for access ports where only one device is connected to the router or switch (as in workstations with no other spanning tree devices). If you configure PortFast on a port that is connected to another bridge, there is the possibility of forming a loop. This can be prevented with the help of the Bridge Protocol Data Unit (BPDU) Guard feature. PortFast BPDU Guard The PortFast BPDU Guard feature prevents loops by moving a port into an "error disable" state when that port receives a BPDU. When you enable the BPDU guard feature on the port, Spanning Tree shuts down PortFast-configured interfaces that receive BPDUs, rather than putting them into the Spanning Tree blocking state. In a valid configuration, PortFast-configured interfaces do not receive BPDUs. If a PortFast-configured interface receives a BPDU, an invalid configuration exists, such as the connection of an unauthorized device.

42 42 Layer 2 fundamentals PortFast BPDU Filter By default, MSTP sends BPDU packets on all ports regardless of whether or not you have enabled PortFast. Enabling PortFast BPDU filter on a port results in the following: stops sending BPDU packets stops processing of incoming BPDU packets sets the port to forwarding always The purpose of the PortFast BPDU Filter command is to filter all incoming BPDUs on an interface, which effectively disables spanning tree on an interface. You can apply the feature on ports that connect to an end station or to routers. Although spanning tree is disabled, all Layer 2 forwarding rules remain the same (in terms of packet flooding within a VLAN domain, or in terms of supporting VLAN termination) to allow routing of Layer 2 packets. IGMP Snooping The Internet Group Management Protocol (IGMP) is a Layer 3 protocol used by IP hosts to report multicast information to neighboring multicast routers. IGMP Snooping allows a Layer 2 device to read (snoop) IGMP packets transferred between IP multicast routers and IP multicast hosts to learn the IP multicast group membership. IGMP Snooping allows the Layer 2 device to forward group-specific multicast traffic only to ports that are members of that group. IGMP Snooping dynamically determines to which ports to send specific multicast group traffic. Without IGMP Snooping, multicast traffic is forwarded to all ports. IGMP Snooping drops all but one of the host "join" messages for each multicast group and forwards only this one "join" message to the multicast router when proxy is enabled, which reduces the number of IGMP messages exchanged between IP multicast routers and hosts. The Secure Router 2330/4134 IGMP Snooping feature supports both IGMPv1 and IGMPv2. IGMPv3 packets are silently discarded. Nortel recommends that in a network where IGMPv3 and IGMPv2 hosts co-exist, you configure the multicast router to send IGMPv2 messages so that all hosts communicate using IGMPv2. If IGMP Snooping is disabled, the Secure Router 2330/4134 handles IP multicast traffic in the same manner as broadcast traffic (forwards frames received on one interface to all other interfaces). Without IGMP Snooping, there is excessive traffic on the network, which negatively impacts network