Configuring Dynamic Neighbors

When neighbors are not adjacent, normal Cisco SAF peering mechanisms cannot be used to exchange SAF information over the networking cloud. The neighbors are often multiple hops away, and separated by dark nets (devices not running SAF).

To support this type of network, SAF provides the neighbor command, which allows remote neighbors to be configured and sessions established through unicast packet transmission. However, as the number of Forwarders needing to exchange SAF information over the networking cloud increases, unicast SAF neighbor definitions may become cumbersome to manage. Each neighbor must be manually configured, resulting in increased operational costs.

To better accommodate deployment of these topologies, ease configuration management, and reduce operational costs, the Dynamic Neighbors feature provides support for the dynamic discovery of remote unicast and multicast neighbors (referred to as "remote neighbors"). Remote neighbor support allows Cisco SAF peering to one or more remote neighbors, which may not be known at the time the device is configured, thus reducing configuration management.

When using remote unicast-listen or remote multicast-group neighbor configurations, SAF neighbor IP addresses are not predefined, and neighbors may be many hops away. A device with this configuration could peer with any device that sends a valid HELLO packet. Because of security considerations, this open aspect requires policy capabilities to limit peering to valid devices and to restrict the number of neighbors in order to limit resource consumption. This capability is accomplished using the following manually configured parameters, and takes effect immediately.

• Neighbor Filter List
• Maximum Remote Neighbors
• Configuration Changes for the Neighbor Filter List and Maximum Number of Remote Neighbors

The following terms are used when describing neighbor types:

• local neighbor--A neighbor that is adjacent on a shared subnet (or common subnet) and uses a link-local multicast address for packet exchange. This is the default type of neighbor in Cisco SAF.
• static neighbor--Any neighbor that uses unicast to communicate, is one hop away, is on a common subnet, and whose IP address has been specified using the neighbor ip-address command.
• remote neighbor--Any neighbor that is multiple hops away, including Remote Static Neighbors.
• remote static neighbor--Any neighbor that uses unicast to communicate, is multiple hops away, and whose IP address has been specified using the neighbor ip-address command.
• remote multicast-group--Any neighbor that is multiple hops away, but does not have its IP address manually configured using the neighbor ip-address command, and uses a configured multicast group address for packet exchange.
• remote unicast-listen (or simply unicast-listen)--Any neighbor that uses unicast to communicate, is multiple hops away, and whose IP address has not been configured using the neighbor ip-address command.

For configurations in which multiple remote neighbors peer with a single hub (point-to-point), the hub can be configured for remote unicast-listen peering using the remote-neighbors command to allow the remote neighbors to peer with the hub without having to manually configure the remote neighbor IP addresses on the hub.

When configured with this command, the hub device:

• Uses its interface IP address as the source IP address for any unicast transmissions. This IP address must be routable.
• Requires neighbors that peer with the hub to be configured using the neighbor ip-address loopback loopback-interface-number remote maximum-hops command where ip-address is the unicast address of the local device interface.
• Listens for unicast HELLO packets on the interface specified in the remote-neighbor command.
• Accepts a unicast HELLO packet if it is in the IP address range configured using the allow-list keyword, or any unicast HELLO packet if an allow list is not defined.
• Rejects multicast HELLO packets from any neighbor that is also sending unicast HELLO packets and is permitted by the unicast allow list (or all neighbors if an allow list is not defined).
• Begins normal neighbor establishment using the IP addresses of the remote neighbors for packet transmission once the neighbor relationship is established.

Multicast can be used to provide an efficient transport between multiple Cisco SAF neighbors. A single multicast-group address can be used for multiple Cisco SAF neighbors to exchange information within the same multicast group. To configure multipoint-to-multipoint configurations, use the multicast-group keyword available in the remote neighbors command.

When configured with this command, the device:

• Uses the interface IP address as the source IP address for any unicast transmissions. This IP address must be routable.
• Uses the configured multicast-group address for all multicast packets sent and received.
• Requires all forwarders and routers, which form the multipoint-to-multipoint neighbor relationships, to be configured using the same multicast-group IP address.
• Requires multicast forwarding for the defined multicast-group address to be configured and functional for packet delivery.

Static neighbors configured with the neighbor ip-address or the neighbor ip-address remote commands take precedence over the remote neighbors that are created as a result of the remote-neighbors command. If the remote IP address of an incoming unicast Cisco SAF connection matches both a static neighbor and the remote unicast-listen neighbor access list, the static neighbor is used and no remote unicast-listen neighbor is created. If you configure a new static neighbor while a remote neighbor for the same remote IP address already exists, Cisco SAF automatically removes the remote unicast-listen neighbor.

Remote unicast-listen neighbors take precedence over remote multicast-group neighbors. If Cisco SAF is receiving both unicast and multicast HELLOs from the same remote IP address targeted at the same local interface, the neighbor will be treated as unicast (unicast-listen) rather than multicast (multicast-group) for packet exchange.

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    remote-neighbors source interface {unicast-listen | multicast-group group-address } [allow-list access-list-name ] [max-neighbors max-remote-peers ]

6.    exit-service-family