ASA版本9.2.1 OSPF增强功能配置示例

下载选项

PDF (283.2 KB)
在各种设备上使用 Adobe Reader 查看
ePub (100.1 KB)
在 iPhone、iPad、Android、Sony Reader 或 Windows Phone 上使用各种应用查看
Mobi (Kindle) (101.5 KB)
在 Kindle 设备上查看或在多个设备上使用 Kindle 应用查看

已更新: 2014 年 9 月 4 日

文档 ID:118098

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍自适应安全设备(ASA)软件版本9.2.1中引入的与开放最短路径优先(OSPF)协议相关的新功能和命令。

先决条件

要求

本文档没有任何特定的要求。

使用的组件

本文档中的信息基于运行Cisco ASA软件版本9.2.(1)及更高版本的Cisco ASA 5500-X系列防火墙。

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您使用的是真实网络，请确保您已经了解所有命令的潜在影响。

配置

注意：使用命令查找工具（仅限注册用户）可获取有关本部分所使用命令的详细信息。

网络图

配置

OSPF 支持快速 Hello 包

OSPF hello数据包是OSPF进程发送给其OSPF邻居以保持与这些邻居的连接的数据包。这些hello数据包以可配置的间隔（以秒为单位）发送。以太网链路的默认值为10秒，非广播链路的默认值为30秒。Hello数据包包括在Dead间隔内收到Hello数据包的所有邻居的列表。dead间隔也是可配置的间隔（以秒为单位），默认为hello间隔值的四倍。网络中所有hello间隔的值必须相同。同样，网络中所有停顿间隔的值必须相同。

OSPF快速Hello数据包是指以小于1秒的间隔发送的Hello数据包。要启用OSPF快速hello数据包，请输入ospf dead-interval命令。对于次秒Hello，Dead间隔设置为1秒或最小,Hello乘数值设置为要在该1秒内发送的Hello数据包数。例如，如果dead间隔设置为1秒，hello乘数设置为4，则每0.25秒发送一次hello。

当接口上配置了快速Hello数据包时，在从此接口发送的Hello数据包中通告的Hello间隔设置为0。忽略通过此接口接收的Hello数据包中的Hello间隔。必须注意的是，死区间必须在数据段上保持一致。无论是设置为1秒（对于快速hello数据包）还是设置为任何其他值，它都必须在该网段的邻居之间保持一致。只要在停顿间隔内发送至少一个hello数据包，整个网段的hello乘数就不必相同。

要启用4的倍数的快速问询，请在适当的接口配置下输入ospf dead-interval minimal hello-multiplier 4命令。

 interface GigabitEthernet0/0
 nameif inside
 security-level 100
 ip address 198.51.100.1 255.255.255.0
 ospf dead-interval minimal hello-multiplier 4

router ospf 1
 network 198.51.100.0 255.255.255.0 area 0

使用show ospf interface命令进行验证。

asa(config)# show ospf interface

inside is up, line protocol is up
  Internet Address 198.51.100.1 mask 255.255.255.0, Area 0
  Process ID 928, Router ID 198.51.100.1, Network Type BROADCAST, Cost: 10
  Transmit Delay is 1 sec, State DR, Priority 1
  Designated Router (ID) 198.51.100.1, Interface address 198.51.100.1
  No backup designated router on this network
  Timer intervals configured, Hello 250 msec, Dead 1, Wait 1, Retransmit 5
    Hello due in 48 msec
  Index 1/1, flood queue length 0
  Next 0x0(0)/0x0(0)
  Last flood scan length is 0, maximum is 0
  Last flood scan time is 0 msec, maximum is 0 msec
  Neighbor Count is 0, Adjacent neighbor count is 0
  Suppress hello for 0 neighbor(s)

用于链路状态通告和SPF限制的新OSPF计时器命令

ASA 9.2.1版及更高版本中引入了以下命令：作为OSPF路由器配置的一部分，timers lsa arrival、timers pacing、timers throttle lsa 和timers throttle spf 。

asa(config-router)# timers ?

router mode commands/options:
  lsa       OSPF LSA timers
  pacing    OSPF pacing timers
  throttle  OSPF throttle timers

已删除以下命令：timers spf 和timers lsa-grouping-pacing。

有关链路状态通告(LSA)和最短路径优先(SPF)限制优势的详细信息，请参阅以下文档：

使用ACL过滤OSPF路由

现在支持使用访问控制列表(ACL)进行路由过滤。这是通过使用distribute-list命令过滤路由实现的。

例如，为了过滤10.20.20.0/24的路由，配置如下所示：

access-list ospf standard deny host 10.20.20.0
access-list ospf standard permit any4
!
router ospf 1
 network 198.51.100.0 255.255.255.0 area 0
 log-adj-changes
 distribute-list ospf in interface inside

当检查关联的ACL时，它表示其命中计数增加：

asa(config)# show access-list ospf
access-list ospf; 2 elements; name hash: 0xb5dd06eb
access-list ospf line 1 standard deny host 10.20.20.0 (hitcnt=1) 0xe29503b8
access-list ospf line 2 standard permit any4 (hitcnt=2) 0x51ff4e67

此外，您还可以检查ASA上的路由信息库(RIB)以进一步验证功能。输入show ospf rib detail命令，以便向后报告OSPF路由器进程的完整路由信息数据库。与每条路由关联的“标志”表示它是否已安装在RIB中。

asa(config)# show ospf rib detail

            OSPF Router with ID (198.51.100.10) (Process ID 1)
OSPF local RIB
Codes: * - Best, > - Installed in global RIB

*>  172.18.124.0/32, Intra, cost 11, area 0
     SPF Instance 13, age 0:13:59
     Flags: RIB, HiPrio
      via 198.51.100.2, inside, flags: RIB 
       LSA: 1/198.51.100.2/198.51.100.2
*   10.20.20.0/32, Intra, cost 11, area 0
     SPF Instance 13, age 0:13:59
     Flags: HiPrio
      via 198.51.100.2, inside, flags: none 
       LSA: 1/198.51.100.2/198.51.100.2
*>  192.168.10.0/32, Intra, cost 11, area 0
     SPF Instance 13, age 0:13:59
     Flags: RIB, HiPrio
      via 198.51.100.2, inside, flags: RIB 
       LSA: 1/198.51.100.2/198.51.100.2
*   198.51.100.0/24, Intra, cost 10, area 0
     SPF Instance 13, age 0:52:52
     Flags: Connected
      via 198.51.100.10, inside, flags: Connected
       LSA: 2/198.51.100.2/192.151.100.10

在上述输出中，已安装带有标志“RIB”的路由器，但尚未安装带有标志“none”的路由。这也应反映在全局路由表中。使用show route命令检查。

asa(config)# show route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route

Gateway of last resort is 10.106.44.1 to network 0.0.0.0

S*    0.0.0.0 0.0.0.0 [1/0] via 10.106.44.1, tftp
O        172.18.124.0 255.255.255.0 [110/11] via 198.51.100.2, 00:00:03, inside
O        192.168.10.0 255.255.255.0 [110/11] via 198.51.100.2, 00:00:03, inside
O        10.20.20.0 255.255.255.0 [110/11] via 198.51.100.2, 00:00:03, inside
S        10.76.76.160 255.255.255.255 [1/0] via 10.106.44.1, tftp
C        10.86.195.0 255.255.255.0 is directly connected, management
L        10.86.195.1 255.255.255.255 is directly connected, management

OSPF监控增强功能

引入这些命令是为了帮助监控和观察OSPF路由器进程。这些命令的输出示例可供参考。

show ospf interface brief

输入show ospf interface brief命令，以快速获取此ASA上存在的邻接关系的快照。

asa(config)# show ospf interface brief

Interface    PID   Area            IP Address/Mask    Cost  State Nbrs F/C
inside          1     0               198.51.100.2/255.255.255.0    10    DR 1/1

show ospf statistics [Detail]

show ospf statistics detail命令提供有关SPF上次运行时间和运行次数的简要说明。它还指示有多少个新LSA添加到数据库。

asa(config)# show ospf statistics detail


            OSPF Router with ID (198.51.100.10) (Process ID 1)

  Area 0: SPF algorithm executed 12 times

SPF 3 executed 00:32:56 ago, SPF type Full
  SPF calculation time (in msec):
  SPT    Intra  D-Intr Summ   D-Summ Ext7   D-Ext7 Total
        0      0      0      0      0      0      00
  LSIDs processed R:2 N:1 Stub:1 SN:0 SA:0 X7:0
  Change record 0x0
  LSIDs changed 1
  Changed LSAs. Recorded is LS ID and LS type:
  198.51.100.2(R)

SPF 4 executed 00:28:16 ago, SPF type Full
  SPF calculation time (in msec):
  SPT    Intra  D-Intr Summ   D-Summ Ext7   D-Ext7 Total
        0      0      0      0      0      0      00
  LSIDs processed R:1 N:1 Stub:0 SN:0 SA:0 X7:0
  Change record 0x0
  LSIDs changed 2
  Changed LSAs. Recorded is LS ID and LS type:
  198.51.100.2(R) 198.51.100.10(R)

SPF 5 executed 00:28:06 ago, SPF type Full
  SPF calculation time (in msec):
  SPT    Intra  D-Intr Summ   D-Summ Ext7   D-Ext7 Total
        0      0      0      0      0      0      00
  LSIDs processed R:2 N:1 Stub:1 SN:0 SA:0 X7:0
  Change record 0x0
  LSIDs changed 1
  Changed LSAs. Recorded is LS ID and LS type:
  198.51.100.2(R)

SPF 6 executed 00:26:40 ago, SPF type Full
  SPF calculation time (in msec):
  SPT    Intra  D-Intr Summ   D-Summ Ext7   D-Ext7 Total
        0      0      0      0      0      0      00
  LSIDs processed R:1 N:1 Stub:0 SN:0 SA:0 X7:0
  Change record 0x0
  LSIDs changed 2
  Changed LSAs. Recorded is LS ID and LS type:
  198.51.100.2(R) 198.51.100.10(R)

show ospf events neighbor

这是检查OSPF邻居状态的有用命令，特别是在OSPF抖动时。它提供每个邻居的事件和状态转换列表以及这些事件的时间戳。在本示例中，邻居10.10.40.1通过状态从DOWN转换为FULL。

asa(config)# show ospf events neighbor


            OSPF Router with ID (198.51.100.10) (Process ID 1)

 279 May 15 13:07:31.737: Neighbor 198.51.100.2, Interface inside state changes from
 LOADING to FULL
 280 May 15 13:07:31.737: Neighbor 198.51.100.2, Interface inside state changes from
 EXCHANGE to LOADING
 281 May 15 13:07:31.737: Neighbor 198.51.100.2, Interface inside state changes from
 EXSTART to EXCHANGE
 290 May 15 13:07:31.737: Neighbor 198.51.100.2, Interface inside state changes from
 2WAY to EXSTART
 296 May 15 13:07:31.738: Neighbor 198.51.100.2, Interface inside state changes from
 INIT to 2WAY
 297 May 15 13:07:31.728: Neighbor 198.51.100.2, Interface inside state changes from
 DOWN to INIT

show ospf events lsa

此命令可用于检查已生成和接收的所有LSA。在链路抖动和LSA泛洪时，这些功能非常有用。

asa(config)# show ospf events lsa


            OSPF Router with ID (198.51.100.10) (Process ID 1)

 253 May 15 13:07:49.167: Rcv Changed Type-1 LSA, LSID 198.51.100.2,
 Adv-Rtr 198.51.100.2, Seq# 80000002, Age 1, Area 0
 271 May 15 13:07:32.237: Generate New Type-2 LSA, LSID 198.51.100.1,
 Seq# 80000001, Age 0, Area 0
 275 May 15 13:07:32.238: Generate Changed Type-1 LSA, LSID 198.51.100.10,
 Seq# 80000002, Age 0, Area 0
 276 May 15 13:07:32.228: Rcv New Type-1 LSA, LSID 198.51.100.2,
 Adv-Rtr 198.51.100.2, Seq# 80000001, Age 1, Area 0

show ospf events neighbor rib

此命令提供有关添加到RIB中的路由和安装的路由类型(Intra/Inter)的信息。

asa(config)# show ospf events neighbor rib

 255 May 15 13:07:54.168: RIB Update, dest 172.18.124.0, mask 255.255.255.255,
  gw 198.51.100.2, via inside, source 198.51.100.2, type Intra
 287 May 15 13:07:31.738: Neighbor 198.51.100.2, Interface inside state changes from
  LOADING to FULL
 288 May 15 13:07:31.738: Neighbor 198.51.100.2, Interface inside state changes from
  EXCHANGE to LOADING
 289 May 15 13:07:31.738: Neighbor 198.51.100.2, Interface inside state changes from
  EXSTART to EXCHANGE
 298 May 15 13:07:31.738: Neighbor 198.51.100.2, Interface inside state changes from
  2WAY to EXSTART
 304 May 15 13:07:31.738: Neighbor 198.51.100.2, Interface inside state changes from
  INIT to 2WAY
 305 May 15 13:07:31.728: Neighbor 198.51.100.2, Interface inside state changes from
  DOWN to INIT

show ospf events spf

运行SPF计算时，生成的运行时间和LSA机会记录在SPF事件列表中。

 asa(config)# show ospf events spf 
 235 May 15 13:07:54.167: End of SPF, SPF time 0ms, next wait-interval 10000ms
 240 May 15 13:07:54.167: Starting External processing in area 0
 241 May 15 13:07:54.167: Starting External processing
 244 May 15 13:07:54.167: Starting summary processing, Area 0
 250 May 15 13:07:54.167: Starting Intra-Area SPF, Area 0, spf_type Full
 251 May 15 13:07:54.167: Starting SPF, wait-interval 5000ms
 254 May 15 13:07:49.167: Schedule SPF, Area 0, spf-type Full, Change in LSA
 Type RLSID 198.51.100.2, Adv-Rtr 198.51.100.2
 255 May 15 13:07:37.227: End of SPF, SPF time 0ms, next wait-interval 10000ms
 260 May 15 13:07:37.228: Starting External processing in area 0
 261 May 15 13:07:37.228: Starting External processing
 264 May 15 13:07:37.228: Starting summary processing, Area 0
 268 May 15 13:07:37.228: Starting Intra-Area SPF, Area 0, spf_type Full
 269 May 15 13:07:37.228: Starting SPF, wait-interval 5000ms
 272 May 15 13:07:32.238: Schedule SPF, Area 0, spf-type Full, Change in LSA
 Type NLSID 198.51.100.1, Adv-Rtr 198.51.100.10
 274 May 15 13:07:32.238: Schedule SPF, Area 0, spf-type Full, Change in LSA
 Type RLSID 198.51.100.10, Adv-Rtr 198.51.100.10
 277 May 15 13:07:32.228: Schedule SPF, Area 0, spf-type Full, Change in LSA
 Type RLSID 198.51.100.2, Adv-Rtr 198.51.100.2

show ospf events generic

此输出包含一般的进程范围事件，如指定路由器(DR)选举和邻接关系更改。

asa(config)# show ospf events generic
 236 May 15 13:07:54.167: Generic:  ospf_external_route_sync0x0
 237 May 15 13:07:54.167: Generic:  ospf_external_route_sync0x0
 238 May 15 13:07:54.167: Generic:  ospf_external_route_sync0x0
 239 May 15 13:07:54.168: Generic:  ospf_external_route_sync0x0
 242 May 15 13:07:54.168: Generic:  ospf_inter_route_sync0x0
 243 May 15 13:07:54.168: Generic:  ospf_inter_route_sync0x0
 245 May 15 13:07:54.168: Generic:  post_spf_intra0x0
 246 May 15 13:07:54.168: Generic:  ospf_intra_route_sync0x0
 248 May 15 13:07:54.168: Generic:  ospf_intra_route_sync0x0
 249 May 15 13:07:54.168: DB add:  172.18.124.00x987668 204
 252 May 15 13:07:51.668: Timer Exp:  if_ack_delayed0xcb97dfe0
 256 May 15 13:07:37.228: Generic:  ospf_external_route_sync0x0
 257 May 15 13:07:37.228: Generic:  ospf_external_route_sync0x0
 258 May 15 13:07:37.228: Generic:  ospf_external_route_sync0x0
 259 May 15 13:07:37.228: Generic:  ospf_external_route_sync0x0
 262 May 15 13:07:37.228: Generic:  ospf_inter_route_sync0x0
 263 May 15 13:07:37.228: Generic:  ospf_inter_route_sync0x0
 265 May 15 13:07:37.228: Generic:  post_spf_intra0x0
 266 May 15 13:07:37.228: Generic:  ospf_intra_route_sync0x0
 267 May 15 13:07:37.228: Generic:  ospf_intra_route_sync0x0
 270 May 15 13:07:34.728: Timer Exp:  if_ack_delayed0xcb97dfe0
 273 May 15 13:07:32.238: DB add:  198.51.100.100x987848 206
 278 May 15 13:07:32.228: DB add:  198.51.100.20x987938 205
 283 May 15 13:07:31.738: Elect DR:  inside198.51.100.10
 284 May 15 13:07:31.738: Elect BDR:  inside198.51.100.2
 285 May 15 13:07:31.736: i/f state nbr chg:  inside0x5
 287 May 15 13:07:31.736: Elect DR:  inside198.51.100.10
 288 May 15 13:07:31.736: Elect BDR:  inside198.51.100.2
 289 May 15 13:07:31.736: i/f state nbr chg:  inside0x5
 291 May 15 13:07:31.736: nbr state adjok:  198.51.100.20x3
 293 May 15 13:07:31.736: Elect DR:  inside198.51.100.10
 294 May 15 13:07:31.736: Elect BDR:  inside198.51.100.2
 295 May 15 13:07:31.736: i/f state nbr chg:  inside0x5

show ospf rib detail

如前所述，此命令允许管理员查看从对等体获知的路由以及这些路由是否已安装到RIB中。由于路由过滤（以前列出），路由可能未安装在RIB中。

asa(config)# show ospf rib detail

            OSPF Router with ID (198.51.100.1) (Process ID 1)
OSPF local RIB
Codes: * - Best, > - Installed in global RIB

*>  172.18.124.0/32, Intra, cost 11, area 0
     SPF Instance 13, age 0:13:59
     Flags: RIB, HiPrio
      via 198.51.100.2, inside, flags: RIB 
       LSA: 1/198.51.100.2/198.51.100.2
*   10.20.20.0/32, Intra, cost 11, area 0
     SPF Instance 13, age 0:13:59
     Flags: HiPrio
      via 198.51.100.2, inside, flags: none 
       LSA: 1/198.51.100.2/198.51.100.2
*>  192.168.10.0/32, Intra, cost 11, area 0
     SPF Instance 13, age 0:13:59
     Flags: RIB, HiPrio
      via 198.51.100.2, inside, flags: RIB 
       LSA: 1/198.51.100.2/198.51.100.2
*   198.51.100.0/24, Intra, cost 10, area 0
     SPF Instance 13, age 0:52:52
     Flags: Connected
      via 198.51.100.10, inside, flags: Connected
       LSA: 2/198.51.100.2/192.151.100.10

show ospf neighbor detail

show ospf neighbor detail命令可用于详细说明OSPF邻接关系的状态。

 asa(config)# show ospf neighbor detail

 Neighbor 198.51.100.2, interface address 198.51.100.2
    In the area 0 via interface ISP
    Neighbor priority is 1, State is FULL, 6 state changes
    DR is 198.51.100.10 BDR is 198.51.100.2
    Options is 0x12 in Hello (E-bit, L-bit)
    Options is 0x52 in DBD (E-bit, L-bit, O-bit)
    Dead timer due in 0:00:16
    Neighbor is up for 00:02:45
    Index 1/1, retransmission queue length 0, number of retransmission 0
    First 0x0(0)/0x0(0) Next 0x0(0)/0x0(0)
    Last retransmission scan length is 0, maximum is 0
    Last retransmission scan time is 0 msec, maximum is 0 msec

OSPF重分布BGP

为了支持边界网关协议(BGP)在其他路由协议中和从其他路由协议中重分发，redistribute bgp命令已引入到OSPF路由器配置中。输入此命令以将通过BGP获知的路由重分发到运行的OSPF进程。

asa(config)# router ospf 1
asa(config-router)# redistribute bgp ?
  router mode commands/options:
  100  Autonomous system number
ASA-1(config-router)# redistribute bgp 100

验证

当前没有可用于此配置的验证过程。

故障排除

目前没有针对此配置的故障排除信息。

由思科工程师提供

Magnus Mortensen and Dinkar Sharma
Cisco TAC Engineers.