在Nexus 9000交換機上配置和驗證BFD
簡介
本文描述如何在基於Cisco Nexus NXOS®的交換機上配置和驗證雙向轉發檢測(BFD)會話。
必要條件
需求
思科建議您瞭解以下主題：
- 雙向轉送偵測(BFD)
- Nexus NX-OS軟體。
- 路由協定：開放最短路徑優先(OSPF)、邊界網關協定(BGP)、增強型內部網關路由協定(EIGRP)。
採用元件
本檔案中的資訊是根據搭載NXOS版本10.3(4a)。M的Cisco Nexus 9000。
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。
設定
網路圖表
設定
配置BFD的目的是檢測和瞭解各種路由協定配置之間的差異。
步驟 1:在介面和協定上配置BFD之前，必須啟用BFD功能。
| 交換機1 | 交換機2 |
|
|
步驟 2:配置全域性BFD
| 交換機1 | 交換機2 |
|
|
附註：min_tx和msec範圍是從50到999毫秒，預設值為50。乘數範圍是從1到50。乘數預設值為3。
步驟 3:在介面上配置BFD
附註：您可以為介面上的所有BFD會話配置BFD會話引數。
警告：確保在啟用BFD的介面上禁用網際網路控制消息協定(ICMP)重定向消息。在介面上使用no ip redirects命令或no ipv6 redirects。
| 交換機1 | 交換機2 |
|
|
BFD非同步模式就像兩台裝置之間的握手，以保持它們的連線強度。您可以在兩台裝置上設定它，一旦開啟，它們就會開始在設定的時間互相傳送特殊消息。這些消息有一些重要的設定，例如傳送頻率，以及一台裝置響應另一台裝置的速度。還有一個設定決定一台裝置實現連線可能存在問題所需的丟失消息數量。
BFD回應功能將測試資料包傳送到鄰居，然後讓這些資料包發回以檢查問題，而無需讓鄰居參與資料包轉發。它可以使用較慢的計時器來減少控制資料包流量，並在鄰居系統上測試轉發路徑，而不會影響鄰居，從而使檢測速度更快。如果兩個鄰居都使用回聲功能，則不存在不對稱。
系統日誌BFD關閉原因
- Path Down:這表示兩個BFD鄰居之間的轉發路徑不再運行，可能是因為網路擁塞、硬體故障或其他問題。
2024 Apr 11 22:07:07 SW2 %BFD-5-SESSION_STATE_DOWN: BFD session 1090519062 to neighbor 172.16.1.1 on interface Vlan20 has gone down. Reason: Path Down. - 回應要求功能失敗：回顯函式失敗，這是BFD的一項功能，在此功能中傳送和接收回顯資料包以驗證連通性。如果這些資料包未能成功傳輸或接收，則表明存在問題。
2024 Apr 11 22:17:45 SW2 %BFD-5-SESSION_STATE_DOWN: BFD session 1090519174 to neighbor 10.10.10.1 on interface Vlan10 has gone down. Reason: Echo Function Failed. - 鄰居發訊號會話關閉：鄰居裝置發出訊號，表示BFD會話已關閉，通常是因為檢測到連線結束時出現問題。
2024 Apr 11 22:03:48 SW2 %BFD-5-SESSION_STATE_DOWN: BFD session 1090519058 to neighbor 172.16.1.1 on interface Vlan20 has gone down. Reason: Neighbor Signaled Session Down. - 控制檢測時間已過期：當控制檢測計時器在收到來自鄰居的預期響應之前超時時（指示連線存在潛在問題），會發生這種情況。
2024 Apr 11 22:19:31 SW2 %BFD-5-SESSION_STATE_DOWN: BFD session 1090519061 to neighbor 192.168.2.1 on interface Lo30 has gone down. Reason: Control Detection Time Expired. - 管理性關閉：管理員有意關閉BFD會話，原因可能是出於維護目的，也可能是由於配置更改。
2024 Apr 11 22:13:15 SW2 %BFD-5-SESSION_STATE_DOWN: BFD session 1090519064 to neighbor 10.10.10.1 on interface Vlan10 has gone down. Reason: Administratively Down.
在路由協定上配置BFD
在OSPF上配置BFD
提示：在OSPF下啟用BFD後，它對於使用OSPF的所有介面都變為活動狀態。介面採用全域性配置值。如需調整這些值，請參閱步驟3「介面上的BFD配置」。
| 交換機1 | 交換機2 |
|
|
它還可以使用命令在OSPF介面下啟用BFDip ospf bfd
| 交換機1 | 交換機2 |
|
|
OSPF上的BFD配置示例
SW1# show running-config ospf
!Command: show running-config ospf
!Running configuration last done at: Wed Apr 10 21:06:31 2024
!Time: Wed Apr 10 21:09:45 2024
version 10.3(4a) Bios:version 01.07
feature ospf
router ospf 1
bfd
interface Vlan10
ip router ospf 1 area 0.0.0.0
ip ospf bfd在EIGRP上配置BFD
SW1(config)# interface vlan 20
SW1(config-if)# ip eigrp 2 bfd提示：在EIGRP下啟用BFD後，它對於使用EIGRP的所有介面都會變為活動狀態。介面採用全域性配置值。如需調整這些值，請參閱步驟3「介面上的BFD配置」。
| 交換機1 | 交換機2 |
|
|
它還可以使用命令在EIGRP介面下啟用BFDip eigrp instance-tag bfd
| 交換機1 | 交換機2 |
|
|
EIGRP上的BFD配置示例
SW1# show running-config eigrp
!Command: show running-config eigrp
!Running configuration last done at: Wed Apr 10 21:24:29 2024
!Time: Wed Apr 10 21:53:08 2024
version 10.3(4a) Bios:version 01.07
feature eigrp
router eigrp 2
address-family ipv4 unicast
bfd
interface Vlan20
ip router eigrp 2
ip eigrp 2 bfd在BGP上配置BFD
附註：更新源功能可促進BGP會話在與鄰居建立BGP會話期間，將指定介面的主IP地址用作本地地址。此外，它還使BGP能夠向BFD註冊為客戶端。
附註：在裝置上配置BFD會話時，指定「multihop」或「singlehop」將確定會話型別。如果未提供關鍵字，則當對等體直接連線時，會話型別預設為「singlehop」。如果對等點未連線，則會話型別預設為「multihop」。
| 交換機1 | 交換機2 |
|
|
BGP上BFD的配置示例
SW1# show running-config bgp
!Command: show running-config bgp
!Running configuration last done at: Thu Apr 11 04:47:53 2024
!Time: Thu Apr 11 06:48:43 2024
version 10.3(4a) Bios:version 01.07
feature bgp
router bgp 65001
address-family ipv4 unicast
neighbor 192.168.3.1
bfd multihop
remote-as 65002
update-source loopback30
ebgp-multihop 5
address-family ipv4 unicast
驗證
配置BFD並將其與OSPF、EIGRP或BGP等協定關聯後，必須自動標識BFD鄰居。要確認這一點，請使用命令：
show bfd neighbors在交換機1上
SW1# show bfd neighbors
OurAddr NeighAddr LD/RD RH/RS Holdown(mult) State Int Vrf Type BSID
172.16.1.1 172.16.1.2 1090519059/1090519058 Up 5219(3) Up Vlan20 default SH N/A
10.10.10.1 10.10.10.2 1090519060/1090519059 Up 5219(3) Up Vlan10 default SH N/A
192.168.2.1 192.168.3.1 1090519062/1090519061 Up 728(3) Up Lo30 default MH N/A
SW1# 在交換機2上
SW2# show bfd neighbors
OurAddr NeighAddr LD/RD RH/RS Holdown(mult) State Int Vrf Type BSID
172.16.1.2 172.16.1.1 1090519058/1090519059 Up 5053(3) Up Vlan20 default SH N/A
10.10.10.2 10.10.10.1 1090519059/1090519060 Up 5053(3) Up Vlan10 default SH N/A
192.168.3.1 192.168.2.1 1090519061/1090519062 Up 745(3) Up Lo30 default MH N/A 要確認這一點並獲得詳細的輸出，請使用命令：
SW1# show bfd neighbors interface lo30 details
OurAddr NeighAddr LD/RD RH/RS Holdown(mult) State Int Vrf Type BSID
192.168.2.1 192.168.3.1 1090519062/1090519061 Up 676(3) Up Lo30 default MH N/A
Session state is Up and not using echo function
Session type: Multihop
Local Diag: 0, Demand mode: 0, Poll bit: 0, Authentication: None
MinTxInt: 250000 us, MinRxInt: 250000 us, Multiplier: 3
Received MinRxInt: 250000 us, Received Multiplier: 3
Holdown (hits): 750 ms (0), Hello (hits): 250 ms (82590)
Rx Count: 82588, Rx Interval (ms) min/max/avg: 207/1764/219 last: 73 ms ago
Tx Count: 82590, Tx Interval (ms) min/max/avg: 219/219/219 last: 67 ms ago
Registered protocols: bgp
Uptime: 0 days 5 hrs 2 mins 2 secs, Upcount: 1
Last packet: Version: 1 - Diagnostic: 0
State bit: Up - Demand bit: 0
Poll bit: 0 - Final bit: 0
Multiplier: 3 - Length: 24
My Discr.: 1090519061 - Your Discr.: 1090519062
Min tx interval: 250000 - Min rx interval: 250000
Min Echo interval: 0 - Authentication bit: 0
Hosting LC: 1, Down reason: None, Reason not-hosted: NoneSW2# show bfd neighbors interface vlan 20 details
OurAddr NeighAddr LD/RD RH/RS Holdown(mult) State Int Vrf Type BSID
172.16.1.2 172.16.1.1 1090519058/1090519059 Up 4979(3) Up Vlan20 default SH N/A
Session state is Up and using echo function with 500 ms interval
Session type: Singlehop
Local Diag: 0, Demand mode: 0, Poll bit: 0, Authentication: None
MinTxInt: 500000 us, MinRxInt: 2000000 us, Multiplier: 3
Received MinRxInt: 2000000 us, Received Multiplier: 3
Holdown (hits): 6000 ms (0), Hello (hits): 2000 ms (12454)
Rx Count: 12444, Rx Interval (ms) min/max/avg: 109/1919/1908 last: 1020 ms ago
Tx Count: 12454, Tx Interval (ms) min/max/avg: 1906/1906/1906 last: 856 ms ago
Registered protocols: eigrp
Uptime: 0 days 6 hrs 35 mins 10 secs, Upcount: 2
Last packet: Version: 1 - Diagnostic: 0
State bit: Up - Demand bit: 0
Poll bit: 0 - Final bit: 0
Multiplier: 3 - Length: 24
My Discr.: 1090519059 - Your Discr.: 1090519058
Min tx interval: 500000 - Min rx interval: 2000000
Min Echo interval: 500000 - Authentication bit: 0
Hosting LC: 1, Down reason: None, Reason not-hosted: None使用會話詳細資訊進行驗證
SW1# sh bfd clients
Client : Number of sessions
bgp : 1
ospf : 1
eigrp : 1
SW1# show system internal bfd sess-store interface vlan 10
No of sessions: 1 >>>>> Check Number of sessions
0x4100001b - 0x41000019 Hosting LC: 1 10.10.10.1 -> 10.10.10.2 bsid 0 >>>>> Check IP addresses
BFD_SESS_ST_SESSION_UP for 0 days 0:6:22 594 >>>>> Check uptime
Vlan10 [2 0x901000a:0x43 0:10 0x1000c 0x1000c]
SMAC: 4464.3c81.ddd7 DMAC: 4464.3c81.cdb7
Local TX/RX/ST(ms): 500/500/2000000 Mult: 3 EchoRx: 50000 Ver:1 Flags(0x0):
Echo Auth Interop (Disabled) Auth(0 0 0) Group id 0x0
Active TX/RX/ST(ms): 2000/2000/2000000 Mult: 3 State: 3 Diag: 0x0 Flags: 0xc
0000 Auth(0 0 0)
Spray DIs: 0
Port-Lcs:
Module 1 has 2 links - ACL not programmed
Applications:
(1) ospf [0x1:0x41000119 flags 0x0]
App Data : [c0a80301000]
Description: 10.10.10.2
MTS Dest 0xfe000001:0x140
No-Host reason: 0x0(SUCCESS)
Counters: >>>>>>>> Check the counters below
Retries: LC remove(0), ACL Inst/Rem(0/0), Redisc(0)
No. of ACLs Added(1)
Flap counters:
Ctrl Detect timer expired(0), Echo failed(0), Neigh Signaled down(0), Admin d
own(0),
Forwarding plane reset(0), Path down(0), Concat path down(0), Rev Concat path
down(0)
Last ACL added time: 58781 usecs after Thu Apr 11 22:18:19 2024
Last ACL response time: 81830 usecs after Thu Apr 11 22:18:19 2024
Last session install time: 58285 usecs after Thu Apr 11 22:18:19 2024
Last session install response time: 58717 usecs after Thu Apr 11 22:18:19 2024
使用Access-list驗證
SW2# show system internal access-list vlan 10 input statistics
slot 1
=======
INSTANCE 0x0
---------------
Tcam 12 resource usage:
----------------------
LBL M = 0x1
Bank 0
------
IPv4 Class
Policies: BFD() [Merged]
Netflow profile: 0
Netflow deny profile: 0
Entries:
[Index] Entry [Stats]
---------------------
[0x0000:0x0003:0x0c0d] permit udp 0.0.0.0/0 0.0.0.0/0 range 3784 3785 encap 0x0 [205340] >>>>> This counter needs to increase
SW2# show system internal access-list sup-redirect-stats | i i bfd
3085 BFD 12217 >>>>> This counter need to increase
3121 BFDC TCLASS PACKET 0
3146 BFDC v4 PACKET 15
3148 BFDC TCLASS V6 PACKET 0
3156 BFDC v6 PACKET 0
3158 BFDC v6 LL Ucast PACKET 0
3209 BFDC v4 multihop PACKET 383697 >>>>> This counter need to increase in multihop case
3121 BFDC TCLASS PACKET 0
3146 BFDC v4 PACKET 0
3148 BFDC TCLASS V6 PACKET 0
3156 BFDC v6 PACKET 0
3158 BFDC v6 LL Ucast PACKET 0
3209 BFDC v4 multihop PACKET 0使用Ethanalyzer驗證
另一種方法是執行資料包捕獲，具體針對UDP埠3785進行過濾。
SW1# ethanalyzer local interface inband display-filter "udp.port==3785" limit-captured-frames 0
Capturing on 'ps-inb'
5 2024-04-11 05:26:37.294596186 10.10.10.1 → 10.10.10.1 BFD Echo 70 Originator specific content
6 2024-04-11 05:26:37.294623155 10.10.10.1 → 10.10.10.1 BFD Echo 70 Originator specific content
7 2024-04-11 05:26:37.294635837 172.16.1.1 → 172.16.1.1 BFD Echo 70 Originator specific content
8 2024-04-11 05:26:37.294653159 172.16.1.1 → 172.16.1.1 BFD Echo 70 Originator specific content
4 18 2024-04-11 05:26:37.780441619 10.10.10.1 → 10.10.10.1 BFD Echo 70 Originator specific content
19 2024-04-11 05:26:37.780461351 172.16.1.1 → 172.16.1.1 BFD Echo 70 Originator specific content
20 2024-04-11 05:26:37.780467533 10.10.10.1 → 10.10.10.1 BFD Echo 70 Originator specific content
21 2024-04-11 05:26:37.780481315 172.16.1.1 → 172.16.1.1 BFD Echo 70 Originator specific content
30 2024-04-11 05:26:38.266365493 10.10.10.1 → 10.10.10.1 BFD Echo 70 Originator specific content
31 2024-04-11 05:26:38.266392766 10.10.10.1 → 10.10.10.1 BFD Echo 70 Originator specific content從BFD回應協定捕獲的資料包中預計存在相同的源和目標IP地址，因為這些回應資料包源自本地交換機本身。
附註：如果介面下沒有「no bfd echo」陳述式，擷取會顯示具有本機來源IP位址和鄰近目的地IP位址的封包，並會觀察BFD控制
SW2# ethanalyzer local interface inband display-filter "ip.addr==192.168.2.1" limit-captured-frames 0
Capturing on 'ps-inb'
1 2024-04-11 05:38:21.155483591 192.168.2.1 → 192.168.3.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
2 2024-04-11 05:38:21.182606602 192.168.3.1 → 192.168.2.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
11 2024-04-11 05:38:21.375187034 192.168.2.1 → 192.168.3.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
12 2024-04-11 05:38:21.402295701 192.168.3.1 → 192.168.2.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
4 14 2024-04-11 05:38:21.594612491 192.168.2.1 → 192.168.3.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
15 2024-04-11 05:38:21.621742431 192.168.3.1 → 192.168.2.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
20 2024-04-11 05:38:21.813971234 192.168.2.1 → 192.168.3.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
8 21 2024-04-11 05:38:21.841086554 192.168.3.1 → 192.168.2.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
22 2024-04-11 05:38:22.033395440 192.168.2.1 → 192.168.3.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
23 2024-04-11 05:38:22.060526055 192.168.3.1 → 192.168.2.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
28 2024-04-11 05:38:22.252709432 192.168.2.1 → 192.168.3.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00
29 2024-04-11 05:38:22.279810427 192.168.3.1 → 192.168.2.1 BFD Control 66 Diag: No Diagnostic, State: Up, Flags: 0x00修訂記錄
| 修訂 | 發佈日期 | 意見 |
|---|---|---|
1.0 |
25-Apr-2024
|
初始版本 |
意見