Configuración de BGP IPv6 Flowspec
Contenido
Introducción
Este documento describe cómo configurar el flujo IPv6 del protocolo de gateway fronterizo (BGP) en ASR1K.
Prerequisites
Requirements
Cisco le recomienda que tenga conocimiento acerca de este tema:
- Independiente de la plataforma
Componentes Utilizados
La información que contiene este documento se basa en las siguientes versiones de software y hardware.
- IOS-XE
- ASR 1000
- ASR9K
- ASR1K
- BGP
- Flujo
- IPv6
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. Si tiene una red en vivo, asegúrese de entender el posible impacto de cualquier comando.
Antecedentes
Flowspec especifica los procedimientos para la distribución de las reglas de especificación de flujo a través de BGP y define el procedimiento para codificar las reglas de especificación de flujo como Border Gateway Protocol Network Layer Reachability Information (BGP NLRI) que se puede utilizar en cualquier aplicación. También define la aplicación para el propósito del filtrado de paquetes con el fin de mitigar (distribuido) los ataques de denegación de servicio.
Limitaciones
Estas son las limitaciones para la configuración:
- No se permite una combinación de familias de direcciones en las reglas de flowspec.
- En el escenario de coincidencia múltiple, sólo se aplica la primera regla de flowspec coincidente.
- Se admite un máximo de 3000 reglas de flowspec por sistema.
Configurar
En este ejemplo, hemos configurado ASR9K como controlador y ASR1K como cliente PE, RR y Flowspec.
Esta es la configuración mínima necesaria para que funcione IPv6 Flowspec.
On controller to push the policy to PE/client: class-map type traffic match-all FLOWSPEC match destination-address ipv6 2001:db8::/32 <<<<< Match destination address/subnet. end-class-map ! policy-map type pbr FS_P class type traffic FLOWSPEC <<<<< Apply class-map under policy-map. drop ! flowspec address-family ipv4 service-policy type pbr FSP_V4 ! address-family ipv6 service-policy type pbr FS_P <<<<< Apply policy-map inside Flowspec under AF. ! On PE/client is to enable IPv6 flowspec AF under BGP. address-family ipv6 flowspec <<<<< Under ipv6 flowspec AF, activate the neighbor. neighbor 10.192.202.5 activate neighbor 10.192.202.5 validation off To apply the flowspec policy on interface, "local-install interface-all" command is must under flowspec. flowspec local-install interface-all <<<<< Push the policy on interface.
- Según la configuración del controlador, cualquier tráfico destinado a 2001:db8::/32 debe ser descartado según la política.
- Mantenga la validación desactivada para el vecino en ipv6 address-family para que ASR1K no verifique el salto siguiente.
- Idealmente, si la política está en acción, el contador se ve en el controlador pero en el caso de que desee verlo en cualquier otro dispositivo, instale la política flowspec en todas las interfaces de usuario para las cuales se requiere el comando local-install interface-all bajo flowspec.
Retos durante la resolución de problemas
- Si la red subyacente es IPv4 y la flowspec BGP se ejecuta para IPv6, entonces hay un problema de verificación de validación en cada salto y causa un problema para la política de Flowspec IPv6. Por lo tanto, mantenga la validación desactivada para que el vecino no realice la verificación de validación.
- Aparte de un controlador, no puede ver el contador de coincidencia/acción de la política de flowspec. Para verificar los contadores, local-install interface-all se debe en Flowspec (bajo AF). Este comando envía la configuración de política de especificación de flujo a todas las interfaces de un dispositivo para las familias de direcciones IPv4 e IPv6, y a las interfaces dentro de una instancia VRF.
Diagrama de la red
+----------------+ +-----------------+ +------------------+ +-----------------+ | | | | | | | | | Controller +--------------+ PE/RR1 +------------+ PE/RR2 +-------------+ End-PE | | ASR9K | | CRR01 | | CRR02 | | DCPR01 | +----------------+ +-----------------+ +------------------+ +-----------------+
Configuraciones
Esta configuración se basa en el diagrama de red, del mismo modo que la configuración.
Controller: RP/0/RSP0/CPU0:Controller# show running-config Mon Apr 8 16:33:36.578 UTC Building configuration... !! IOS XR Configuration 5.3.4 !! Last configuration change at Wed Apr 3 17:34:59 2019 by admin ! hostname Controller cdp cdp advertise v1 ! class-map type traffic match-all FLOWSPEC match destination-address ipv6 2001:db8::/32 end-class-map ! class-map type traffic match-all V4_FLOWSPEC match source-address ipv4 102.102.102.102 255.255.255.255 end-class-map ! policy-map type pbr FS_P class type traffic FLOWSPEC drop ! class type traffic class-default ! end-policy-map ! policy-map type pbr FSP_V4 class type traffic V4_FLOWSPEC set dscp ef ! class type traffic class-default ! end-policy-map ! interface Loopback0 ipv4 address 10.192.202.5 255.255.255.255 ! interface Loopback100 ipv4 address 102.102.102.102 255.255.255.255 ipv6 address 2001:db8::1/32 ! interface TenGigE0/0/0/0 ipv4 address 10.10.12.1 255.255.255.0 ipv6 address 2001:10:10:12::1/64 ! route-policy ALL pass end-policy ! router static address-family ipv4 unicast 203.202.143.33/32 TenGigE0/0/0/0 ! address-family ipv6 unicast 2003::/64 2001:10:10:12::2 ! ! router ospfv3 1 area 0 interface TenGigE0/0/0/0 network point-to-point ! ! ! router bgp 64696 bgp router-id 10.192.202.5 address-family ipv4 unicast network 102.102.102.102/32 ! address-family vpnv4 unicast ! address-family ipv4 flowspec ! address-family ipv6 flowspec ! neighbor 203.202.143.33 remote-as 7474 ebgp-multihop 10 update-source Loopback0 address-family ipv4 unicast route-policy ALL in route-policy ALL out ! address-family vpnv4 unicast ! address-family ipv4 flowspec route-policy ALL in route-policy ALL out ! address-family ipv6 flowspec route-policy ALL in route-policy ALL out ! ! ! flowspec local-install interface-all address-family ipv4 service-policy type pbr FSP_V4 ! address-family ipv6 service-policy type pbr FS_P ! ! end
PE/RR1: CRR01#show running-config Building configuration... ! ipv6 unicast-routing mpls label protocol ldp ! spanning-tree extend system-id flowspec local-install interface-all diagnostic bootup level minimal ! interface Loopback0 ip address 203.202.143.33 255.255.255.255 ip ospf 1 area 0 ! interface Loopback1010 no ip address ipv6 address 2001:DB8::10/32 ! interface TenGigabitEthernet0/0/0 ip address 10.10.12.2 255.255.255.0 ip ospf network point-to-point cdp enable ipv6 address 2001:10:10:12::2/64 ! interface TenGigabitEthernet0/0/3 ip address 10.10.23.2 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ipv6 address 2003::1/64 mpls ip ! router ospf 1 mpls ldp autoconfig ! router bgp 7474 bgp router-id 203.202.143.33 bgp log-neighbor-changes neighbor 10.192.202.5 remote-as 64696 neighbor 10.192.202.5 ebgp-multihop 10 neighbor 10.192.202.5 update-source Loopback0 neighbor 2001:10:10:12::1 remote-as 64696 neighbor 203.202.143.44 remote-as 7474 neighbor 203.202.143.44 update-source Loopback0 ! address-family ipv4 neighbor 10.192.202.5 activate no neighbor 2001:10:10:12::1 activate neighbor 203.202.143.44 activate neighbor 203.202.143.44 route-reflector-client exit-address-family ! address-family ipv4 flowspec neighbor 10.192.202.5 activate neighbor 203.202.143.44 activate neighbor 203.202.143.44 send-community both neighbor 203.202.143.44 route-reflector-client exit-address-family ! address-family ipv6 neighbor 10.192.202.5 activate neighbor 203.202.143.44 activate neighbor 203.202.143.44 route-reflector-client neighbor 203.202.143.44 send-label exit-address-family ! address-family ipv6 flowspec neighbor 10.192.202.5 activate neighbor 10.192.202.5 validation off neighbor 203.202.143.44 activate neighbor 203.202.143.44 send-community both neighbor 203.202.143.44 route-reflector-client neighbor 203.202.143.44 next-hop-self exit-address-family ! ip route 10.192.202.5 255.255.255.255 10.10.12.1 ! ! ipv6 route 2001:DB8::1/128 2001:10:10:12::1 ! end
PE/RR2: CRR02#show running-config Building configuration... Current configuration : 7227 bytes ! ! Last configuration change at 18:21:29 UTC Mon Apr 8 2019 ! hostname CRR02 ! boot-start-marker boot system flash bootflash:asr1000rpx86-universalk9.16.10.01a.SPA.bin boot-end-marker ! ipv6 unicast-routing multilink bundle-name authenticated ! spanning-tree extend system-id flowspec diagnostic bootup level minimal ! interface Loopback0 ip address 203.202.143.44 255.255.255.255 ip ospf 1 area 0 ! interface TenGigabitEthernet1/0/0 ip address 10.10.23.3 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ipv6 address 2003::2/64 mpls ip ! interface TenGigabitEthernet1/0/1 ip address 10.10.34.3 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ! router ospf 1 mpls ldp autoconfig ! router bgp 7474 bgp router-id 203.202.143.44 bgp log-neighbor-changes neighbor 203.202.143.33 remote-as 7474 neighbor 203.202.143.33 update-source Loopback0 neighbor 203.202.143.45 remote-as 7474 neighbor 203.202.143.45 update-source Loopback0 ! address-family ipv4 neighbor 203.202.143.33 activate neighbor 203.202.143.45 activate exit-address-family ! address-family ipv4 flowspec neighbor 203.202.143.33 activate neighbor 203.202.143.45 activate neighbor 203.202.143.45 send-community both neighbor 203.202.143.45 route-reflector-client exit-address-family ! address-family ipv6 neighbor 203.202.143.33 activate neighbor 203.202.143.33 send-label exit-address-family ! address-family ipv6 flowspec neighbor 203.202.143.33 activate neighbor 203.202.143.33 validation off neighbor 203.202.143.45 activate neighbor 203.202.143.45 send-community both neighbor 203.202.143.45 route-reflector-client exit-address-family ! ipv6 route 2001:10:10:12::/64 2003::1 ipv6 route 2001:DB8::1/128 2003::1 ! end
End-PE: DCPR01#show running-config Building configuration... ! hostname DCPR01 ! subscriber templating ! ipv6 unicast-routing ! flowspec diagnostic bootup level minimal ! interface Loopback0 ip address 203.202.143.45 255.255.255.255 ip ospf 1 area 0 ! interface TenGigabitEthernet1/3/0 ip address 10.10.34.4 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ipv6 address 2001::1/64 ! router ospf 1 mpls ldp autoconfig ! router bgp 7474 bgp router-id 203.202.143.45 bgp log-neighbor-changes neighbor 203.202.143.44 remote-as 7474 neighbor 203.202.143.44 update-source Loopback0 ! address-family ipv4 flowspec neighbor 203.202.143.44 activate exit-address-family ! address-family ipv6 flowspec neighbor 203.202.143.44 activate neighbor 203.202.143.44 validation off exit-address-family ! ipv6 route ::/0 TenGigabitEthernet1/3/0 ! end
Verificación
PE/RR2: CRR02#ping 2001:db8::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8::1, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) CRR02#
Controller:
RP/0/RSP0/CPU0:Controller#show bgp ipv6 flowspec
Mon Apr 8 17:55:17.041 UTC
BGP router identifier 10.192.202.5, local AS number 64696
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0x0 RD version: 20
BGP main routing table version 20
BGP NSR Initial initsync version 0 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs
Status codes: s suppressed, d damped, h history, * valid, > best
i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
Network Next Hop Metric LocPrf Weight Path
*> Dest:2001:db8::/0-32/56
:: 0 i
Processed 1 prefixes, 1 paths
RP/0/RSP0/CPU0:Controller#show flowspec ipv6 detail
Mon Apr 8 17:55:36.786 UTC
AFI: IPv6
Flow :Dest:2001:db8::/0-32
Actions :Traffic-rate: 0 bps (policy.1.FS_P.FLOWSPEC)
Statistics (packets/bytes)
Matched : 14/1652
Dropped : 14/1652
RP/0/RSP0/CPU0:BGL14.1.J.05-ASR-9000-1#
PE/RR1:
CRR01#show bgp ipv6 flowspec
BGP table version is 2, local router ID is 203.202.143.33
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
t secondary path,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found
Network Next Hop Metric LocPrf Weight Path
*> Dest:2001:DB8::/0-32
:: 0 64696 i
CRR01#
CRR01#show flowspec ipv6 detail
AFI: IPv6
Flow :Dest:2001:DB8::/0-32
Actions :Traffic-rate: 0 bps (bgp.1)
Statistics (packets/bytes)
Matched : 4/456
Dropped : 4/456
CRR01#
Troubleshoot
Actualmente, no hay información específica de troubleshooting disponible para esta configuración.
ComentariosContacte a Cisco
- Abrir un caso de soporte
- (Requiere un Cisco Service Contract)