HP 5500 Ei 5500 Si Switch Series Configuration Guide
Have a look at the manual HP 5500 Ei 5500 Si Switch Series Configuration Guide online for free. It’s possible to download the document as PDF or print. UserManuals.tech offer 1114 HP manuals and user’s guides for free. Share the user manual or guide on Facebook, Twitter or Google+.
302 [SwitchC] interface vlan-interface 300 [SwitchC-Vlan-interface300] ospfv3 2 area 2 [SwitchC-Vlan-interface300] quit [SwitchC] interface vlan-interface 400 [SwitchC-Vlan-interface400] ospfv3 2 area 2 [SwitchC-Vlan-interface400] quit # Display the routing table of Switch C. [SwitchC] display ipv6 routing-table Routing Table : Destinations : 6 Routes : 6 Destination: ::1/128 Protocol : Dir\ ect NextHop : ::1 Preference: 0 Interface : InLoop0 Cost : 0 Destination: 3::/64 Protocol : Dir\ ect NextHop : 3::2 Preference: 0 Interface : Vlan300 Cost : 0 Destination: 3::2/128 Protocol : Dir\ ect NextHop : ::1 Preference: 0 Interface : InLoop0 Cost : 0 Destination: 4::/64 Protocol : Dir\ ect NextHop : 4::1 Preference: 0 Interface : Vlan400 Cost : 0 Destination: 4::1/128 Protocol : Dir\ ect NextHop : ::1 Preference: 0 Interface : InLoop0 Cost : 0 Destination: FE80::/10 Protocol : Dir\ ect NextHop : :: Preference: 0 Interface : NULL0 Cost : 0 3. Configure OSPFv3 route redistribution: # Configure OSPFv3 process 2 to re distribute direct routes and the routes from OSPFv3 process 1 on Switch B. [SwitchB] ospfv3 2 [SwitchB-ospfv3-2] default cost 3 [SwitchB-ospfv3-2] import-route ospfv3 1 [SwitchB-ospfv3-2] import-route direct [SwitchB-ospfv3-2] quit # Display the routing table of Switch C. [SwitchC] display ipv6 routing-table Routing Table : Destinations : 8 Routes : 8 Destination: ::1/128 Protocol : Dir\ ect
303 NextHop : ::1 Preference: 0 Interface : InLoop0 Cost : 0 Destination: 1::/64 Protocol : OSP\ Fv3 NextHop : FE80::200:CFF:FE01:1C03 Preference: 150\ Interface : Vlan300 Cost : 3 Destination: 2::/64 Protocol : OSP\ Fv3 NextHop : FE80::200:CFF:FE01:1C03 Preference: 150\ Interface : Vlan300 Cost : 3 Destination: 3::/64 Protocol : Dir\ ect NextHop : 3::2 Preference: 0 Interface : Vlan300 Cost : 0 Destination: 3::2/128 Protocol : Dir\ ect NextHop : ::1 Preference: 0 Interface : InLoop0 Cost : 0 Destination: 4::/64 Protocol : Dir\ ect NextHop : 4::1 Preference: 0 Interface : Vlan400 Cost : 0 Destination: 4::1/128 Protocol : Dir\ ect NextHop : ::1 Preference: 0 Interface : InLoop0 Cost : 0 Destination: FE80::/10 Protocol : Dir\ ect NextHop : :: Preference: 0 Interface : NULL0 Cost : 0 Configuring OSPFv3 GR Network requirements As shown in Figure 110, S witch A, Switch B, and Switch C that belong to the same AS and the same OSPFv3 routing domain are GR capable. Switch A acts as the GR Restarter. Switch B and Switch C are the GR Helpers and synchronize their LSDBs with Switch A through out-of-band (OOB) communication of GR.
304 Figure 110 Network diagram Configuration procedure 1. Configure IPv6 addresses for inte rfaces. (Details not shown.) 2. Configure OSPFv3 basic functions: # On Switch A, enable OSPFv3 process 1, en able GR, and set the router ID to 1.1.1.1. system-view [SwitchA] ipv6 [SwitchA] ospfv3 1 [SwitchA-ospfv3-1] router-id 1.1.1.1 [SwitchA-ospfv3-1] graceful-restart enable [SwitchA-ospfv3-1] quit [SwitchA] interface vlan-interface 100 [SwitchA-Vlan-interface100] ospfv3 1 area 1 [SwitchA-Vlan-interface100] quit # Enable OSPFv3 on Switch B and set the router ID to 2.2.2.2. (By default, GR helper is enabled on Switch B). system-view [SwitchB] ipv6 [SwitchB] ospfv3 1 [SwitchB-ospfv3-1] router-id 2.2.2.2 [SwitchB-ospfv3-1] quit [SwitchB] interface vlan-interface 100 [SwitchB-Vlan-interface100] ospfv3 1 area 1 [SwitchB-Vlan-interface100] quit # Enable OSPFv3 on Switch C and set the router ID to 3.3.3.3. (By default, GR helper is enabled on Switch C). system-view [SwitchC] ipv6 [SwitchC] ospfv3 1 [SwitchC-ospfv3-1] router-id 3.3.3.3 [SwitchC-ospfv3-1] quit [SwitchC] interface vlan-interface 100 [SwitchC-Vlan-interface100] ospfv3 1 area 1 [SwitchC-Vlan-interface100] quit 3. Verify the configuration:
305 After all switches function properly, perform a master/slave switchover on Switch A to trigger an OSPFv3 GR operation. Configuring BFD for OSPFv3 Network requirements In Figure 1 11, configure OSPFv3 on Switch A, Switch B and Switch C and configure BFD over the link Switch AL2 SwitchSwitch B. After the link Switch AL2 SwitchSwitch B fails, BFD can quickly detect the failure and notify OSPFv3 of the failure. Then Switch A and Switch B communicate through Switch C. Figure 111 Network diagram Device Interface IPv6 address Device Interface IPv6 address Switch A Vlan-int10 2001::1/64 Switch B Vlan-int10 2001::2/64 Vlan-int11 2001:2::1/64 Vlan-int13 2001:3::2/64 Switch C Vlan-int11 2001:2::2/64 Vlan-int13 2001:3::1/64 Configuration procedure 1. Configure IP addresses for the inte rfaces. (Details not shown.) 2. Configure OSPF basic functions: # Configure Switch A. Enable OSPFv3 and configure the router ID as 1.1.1.1. system-view [SwitchA] ipv6 [SwitchA] ospfv3 [SwitchA-ospfv3-1] router-id 1.1.1.1 [SwitchA-ospfv3-1] quit [SwitchA] interface vlan-interface 10 [SwitchA-Vlan-interface10] ospfv3 1 area 0 [SwitchA-Vlan-interface10] quit [SwitchA] interface vlan-interface 11 [SwitchA-Vlan-interface11] ospfv3 1 area 0 [SwitchA-Vlan-interface11] quit # Configure Switch B. Enable OSPFv3 and configure the router ID as 2.2.2.2. system-view [SwitchB] ipv6
306 [SwitchB] ospfv3 [SwitchB-ospf-1] router-id 2.2.2.2 [SwitchB-ospf-1] quit [SwitchB] interface vlan-interface 10 [SwitchB-Vlan-interface10] ospfv3 1 area 0 [SwitchB-Vlan-interface10] quit [SwitchB] interface vlan-interface 13 [SwitchB-Vlan-interface13] ospfv3 1 area 0 [SwitchB-Vlan-interface13] quit # Configure Switch C. Enable OSPFv3 and configure the router ID as 3.3.3.3. system-view [SwitchC] ipv6 [SwitchC] ospfv3 [SwitchC-ospfv3-1] router-id 3.3.3.3 [SwitchC-ospfv3-1] quit [SwitchC] interface vlan-interface 11 [SwitchC-Vlan-interface11] ospfv3 1 area 0 [SwitchC-Vlan-interface11] quit [SwitchC] interface vlan-interface 13 [SwitchC-Vlan-interface13] ospfv3 1 area 0 [SwitchC-Vlan-interface13] quit 3. Configure BFD: # Enable BFD on Switch A and configure BFD parameters. [SwitchA] bfd session init-mode active [SwitchA] interface vlan-interface 10 [SwitchA-Vlan-interface10] ospfv3 bfd enable [SwitchA-Vlan-interface10] bfd min-transmit-interval 500 [SwitchA-Vlan-interface10] bfd min-receive-interval 500 [SwitchA-Vlan-interface10] bfd detect-multiplier 7 [SwitchA-Vlan-interface10] return # Enable BFD on Switch B and configure BFD parameters. [SwitchB] bfd session init-mode active [SwitchB] interface vlan-interface 10 [SwitchB-Vlan-interface10] ospfv3 bfd enable [SwitchB-Vlan-interface10] bfd min-transmit-interval 500 [SwitchB-Vlan-interface10] bfd min-receive-interval 500 [SwitchB-Vlan-interface10] bfd detect-multiplier 6 4. Verify the configuration: The following operations are performed on Switch A. The operations on Switch B are similar, and are not shown. # Display the BFD information of Switch A. display bfd session Total Session Num: 1 Init Mode: Active IPv6 Session Working Under Ctrl Mode: Local Discr: 1441 Remote Discr: 1450
307 Source IP: FE80::20F:FF:FE00:1202 (link-local address of VLAN-interface 10 on Switch A) Destination IP: FE80::20F:FF:FE00:1200 (link-local address of VLAN-interface 10 on Switch B) Session State: Up Interface: Vlan10 Hold Time: / # Display routes to 2001:4::0/64 on Switch A, and you can see that Switch A communicates with Switch B through the Layer 2 switch. display ipv6 routing-table 2001:4::0 64 verbose Routing Table : Summary Count : 2 Destination : 2001:4:: PrefixLength : 6\ 4 NextHop : 2001::2 Preference : 1\ 0 IpPrecedence : QosLcId : RelayNextHop : :: Tag : 0\ H Neighbor : :: ProcessID : 0\ Interface : Vlan-interface10 Protocol : O\ SPFv3 State : Active Adv Cost : 1\ Tunnel ID : 0x0 Label : N\ ULL Age : 4538sec Destination : 2001:4:: PrefixLength : 6\ 4 NextHop : 2001:2::2 Preference : 1\ 0 IpPrecedence : QosLcId : RelayNextHop : :: Tag : 0\ H Neighbor : :: ProcessID : 0\ Interface : Vlan-interface11 Protocol : O\ SPFv3 State : Invalid Adv Cost : 2\ Tunnel ID : 0x0 Label : N\ ULL Age : 4515sec # Enable BFD debugging on Switch A. debugging bfd scm debugging bfd event debugging ospfv3 event bfd terminal debugging # After the link between Switch B and the Layer 2 sw itch fails, Switch A quickly detects the change on Switch B. %Nov 5 11:37:43:062 2009 SwitchA BFD/5/BFD_CHANGE_FSM: Sess[FE80::20F:FF:FE00:1202/ FE80::20F:FF:FE00:1200,15/15,Vlan10,Ctrl], Sta: UP->DOWN, Diag: 1 %Nov 5 11:37:43:062 2009 SwitchA OSPFV3/5/OSPFv3_NBR_CHG: OSPFv3 1 Neig\ hbor 2.2.2.2(Vlan-interface10) from Full to Down. *Nov 5 11:37:43:062 2009 SwitchA RM/6/RMDEBUG: OSPFv3 OSPFv3-BFD: Message Type rcv BFD down, Connect Type direct-connect, Src IP Address FE80::20F:FF:FE00:1202, Dst IP Address FE80::20F:FF:FE00:1200. *Nov 5 11:37:43:062 2009 SwitchA RM/6/RMDEBUG: OSPFv3 OSPFv3-BFD: Messa\ ge Type delete session, Connect Type direct-connect, Src IP Address FE80::20F:FF:FE00:1202, Dst IP Address FE80::20F:FF:FE00:1200.
308 # Display the BFD information of Switch A. You can see that Switch A has removed its neighbor relationship with Switch B and therefore no information is output. display bfd session # Display routes to 2001:4::0/64 on Switch A, an d you can see that Switch A communicates with Switch B through Switch C. display ipv6 routing-table 2001:4::0 64 verbose Routing Table : Summary Count : 1 Destination : 2001:4:: PrefixLength : 6\ 4 NextHop : 2001:2::2 Preference : 1\ 0 IpPrecedence : QosLcId : RelayNextHop : :: Tag : 0\ H Neighbor : :: ProcessID : 0\ Interface : Vlan-interface11 Protocol : O\ SPFv3 State : Invalid Adv Cost : 2\ Tunnel ID : 0x0 Label : N\ ULL Age : 4610sec Configuring OSPFv3 IPsec policies Network requirements As shown in Figure 112: • C onfigure OSPFv3 on the switches. The AS is divided into two areas. • Configure IPsec policies on the switches to authenticate and encrypt protocol packets. Figure 112 Network diagram Configuration procedure 1. Configure IPv6 addresses for inte rfaces. (Details not shown.) 2. Configure OSPFv3 basic functions: # Configure Switch A: enable OSPFv3 and configure the router ID as 1.1.1.1. system-view [SwitchA] ipv6 [SwitchA] ospfv3 1 [SwitchA-ospfv3-1] router-id 1.1.1.1
309 [SwitchA-ospfv3-1] quit [SwitchA] interface vlan-interface 200 [SwitchA-Vlan-interface200] ospfv3 1 area 1 [SwitchA-Vlan-interface200] quit # Configure Switch B: enable OSPFv3 and configure the router ID as 2.2.2.2. system-view [SwitchB] ipv6 [SwitchB] ospfv3 1 [SwitchB-ospfv3-1] router-id 2.2.2.2 [SwitchB-ospfv3-1] quit [SwitchB] interface vlan-interface 100 [SwitchB-Vlan-interface100] ospfv3 1 area 0 [SwitchB-Vlan-interface100] quit [SwitchB] interface vlan-interface 200 [SwitchB-Vlan-interface200] ospfv3 1 area 1 [SwitchB-Vlan-interface200] quit # Configure Switch C: enable OSPFv3 and configure the router ID as 3.3.3.3. system-view [SwitchC] ipv6 [SwitchC] ospfv3 1 [SwitchC-ospfv3-1] router-id 3.3.3.3 [SwitchC-ospfv3-1] quit [SwitchC] interface vlan-interface 100 [SwitchC-Vlan-interface100] ospfv3 1 area 0 [SwitchC-Vlan-interface100] quit 3. Configure OSPFv3 IPsec policies: # On Switch A, create an IPsec proposal named tran1, and set the encapsulation mode to transport mode, the security protocol to ESP, the encryption algorithm to DES, and authentication algorithm to SHA1; create an IPsec policy named policy001, specify the manual mode for it, reference IPsec proposal tran1, set the SPIs of the inbound and outbound SAs to 12345, and the keys for the inbound and outbound SAs using ESP to abcdefg. [SwitchA] ipsec proposal tran1 [SwitchA-ipsec-proposal-tran1] encapsulation-mode transport [SwitchA-ipsec-proposal-tran1] transform esp [SwitchA-ipsec-proposal-tran1] esp encryption-algorithm des [SwitchA-ipsec-proposal-tran1] esp authentication-algorithm sha1 [SwitchA-ipsec-proposal-tran1] quit [SwitchA] ipsec policy policy001 10 manual [SwitchA-ipsec-policy-manual-policy001-10] proposal tran1 [SwitchA-ipsec-policy-manual-policy001-10] sa spi outbound esp 12345 [SwitchA-ipsec-policy-manual-policy001-10] sa spi inbound esp 12345 [SwitchA-ipsec-policy-manual-policy001-10] sa string-key outbound esp ab\ cdefg [SwitchA-ipsec-policy-manual-policy001-10] sa string-key inbound esp abc\ defg [SwitchA-ipsec-policy-manual-policy001-10] quit # On Switch B, create an IPsec proposal named tran1, and set the encapsulation mode to transport mode, the security protocol to ESP, the encryption algorithm to DES, and authentication algorithm to SHA1; create an IPsec policy named policy001, specify the manual mode for it, reference IPsec proposal tran1, set the SPIs of the inbound and outbound SAs to 12345, and the
310 keys for the inbound and outbound SAs using ESP to abcdefg; create an IPsec proposal named tran2, and set the encapsulation mode to transpor t mode, the security protocol to ESP, the encryption algorithm to DES, and authentication algorithm to SHA1; create an IPsec policy named policy002 , specify the manual mode for it, reference IPsec proposal tran2 , set the SPIs of the inbound and outbound SAs to 54321, and the keys for the inbound and outbound SAs using ESP to gfedcba. [SwitchB] ipsec proposal tran1 [SwitchB-ipsec-proposal-tran1] encapsulation-mode transport [SwitchB-ipsec-proposal-tran1] transform esp [SwitchB-ipsec-proposal-tran1] esp encryption-algorithm des [SwitchB-ipsec-proposal-tran1] esp authentication-algorithm sha1 [SwitchB-ipsec-proposal-tran1] quit [SwitchB] ipsec policy policy001 10 manual [SwitchB-ipsec-policy-manual-policy001-10] proposal tran1 [SwitchB-ipsec-policy-manual-policy001-10] sa spi outbound esp 12345 [SwitchB-ipsec-policy-manual-policy001-10] sa spi inbound esp 12345 [SwitchB-ipsec-policy-manual-policy001-10] sa string-key outbound esp ab\ cdefg [SwitchB-ipsec-policy-manual-policy001-10] sa string-key inbound esp abc\ defg [SwitchB-ipsec-policy-manual-policy001-10] quit [SwitchB] ipsec proposal tran2 [SwitchB-ipsec-proposal-tran2] encapsulation-mode transport [SwitchB-ipsec-proposal-tran2] transform esp [SwitchB-ipsec-proposal-tran2] esp encryption-algorithm des [SwitchB-ipsec-proposal-tran2] esp authentication-algorithm sha1 [SwitchB-ipsec-proposal-tran2] quit [SwitchB] ipsec policy policy002 10 manual [SwitchB-ipsec-policy-manual-policy002-10] proposal tran2 [SwitchB-ipsec-policy-manual-policy002-10] sa spi outbound esp 54321 [SwitchB-ipsec-policy-manual-policy002-10] sa spi inbound esp 54321 [SwitchB-ipsec-policy-manual-policy002-10] sa string-key outbound esp gf\ edcba [SwitchB-ipsec-policy-manual-policy002-10] sa string-key inbound esp gfe\ dcba [SwitchB-ipsec-policy-manual-policy002-10] quit # On Switch C, create an IPsec proposal named tran2, and set the encapsulation mode to transport mode, the security protocol to ESP, the encryption algorithm to DES, and authentication algorithm to SHA1; create an IPsec policy named policy002, specify the manual mode for it, reference IPsec proposal tran2, set the SPIs of the inbound and outbound SAs to 54321, and the keys for the inbound and outbou nd SAs using ESP to gfedcba. [SwitchC] ipsec proposal tran2 [SwitchC-ipsec-proposal-tran2] encapsulation-mode transport [SwitchC-ipsec-proposal-tran2] transform esp [SwitchC-ipsec-proposal-tran2] esp encryption-algorithm des [SwitchC-ipsec-proposal-tran2] esp authentication-algorithm sha1 [SwitchC-ipsec-proposal-tran2] quit [SwitchC] ipsec policy policy002 10 manual [SwitchC-ipsec-policy-manual-policy002-10] proposal tran2 [SwitchC-ipsec-policy-manual-policy002-10] sa spi outbound esp 54321 [SwitchC-ipsec-policy-manual-policy002-10] sa spi inbound esp 54321 [SwitchC-ipsec-policy-manual-policy002-10] sa string-key outbound esp gf\ edcba [SwitchC-ipsec-policy-manual-policy002-10] sa string-key inbound esp gfe\ dcba
311 [SwitchC-ipsec-policy-manual-policy002-10] quit 4. Apply the IPsec policies in areas: # Configure Switch A. [SwitchA] ospfv3 1 [SwitchA-ospfv3-1] area 1 [SwitchA-ospfv3-1-area-0.0.0.1] enable ipsec-policy policy001 [SwitchA-ospfv3-1-area-0.0.0.1] quit [SwitchA-ospfv3-1] quit # Configure Switch B. [SwitchB] ospfv3 1 [SwitchB-ospfv3-1] area 0 [SwitchB-ospfv3-1-area-0.0.0.0] enable ipsec-policy policy002 [SwitchB-ospfv3-1-area-0.0.0.0] quit [SwitchB-ospfv3-1] area 1 [SwitchB-ospfv3-1-area-0.0.0.1] enable ipsec-policy policy001 [SwitchB-ospfv3-1-area-0.0.0.1] quit [SwitchB-ospfv3-1] quit # Configure Switch C. [SwitchC] ospfv3 1 [SwitchC-ospfv3-1] area 0 [SwitchC-ospfv3-1-area-0.0.0.0] enable ipsec-policy policy002 [SwitchC-ospfv3-1-area-0.0.0.0] quit [SwitchC-ospfv3-1] quit 5. Verify the configuration: OSPFv3 traffic between Switches A, B, and C is protected by IPsec. Troubleshooting OSPFv3 configuration No OSPFv3 neighbor relationship established Symptom No OSPF neighbor relationship can be established. Analysis If the physical link and lower protocol function properly, check OSPF parameters configured on interfaces. The two neighboring interfaces must have the same parameters, such as the area ID, network segment and mask, and network type. If the network type is broadcast, at least one interface must have a DR priority higher than 0. Process steps 1. Display neighbor information using the display ospfv3 peer command. 2. Display OSPFv3 interface information using the display ospfv3 interface command. 3. Ping the neighbor router’s IP address to check connectivity. 4. Check OSPF timers. The dead interval on an interface must be at least four times the hello interval. 5. On a broadcast network, at le ast one interface must have a DR priority higher than 0.