본 제품에 대한 문서 세트는 편견 없는 언어를 사용하기 위해 노력합니다. 본 설명서 세트의 목적상, 편견 없는 언어는 나이, 장애, 성별, 인종 정체성, 민족 정체성, 성적 지향성, 사회 경제적 지위 및 교차성에 기초한 차별을 의미하지 않는 언어로 정의됩니다. 제품 소프트웨어의 사용자 인터페이스에서 하드코딩된 언어, RFP 설명서에 기초한 언어 또는 참조된 서드파티 제품에서 사용하는 언어로 인해 설명서에 예외가 있을 수 있습니다. 시스코에서 어떤 방식으로 포용적인 언어를 사용하고 있는지 자세히 알아보세요.
Cisco는 전 세계 사용자에게 다양한 언어로 지원 콘텐츠를 제공하기 위해 기계 번역 기술과 수작업 번역을 병행하여 이 문서를 번역했습니다. 아무리 품질이 높은 기계 번역이라도 전문 번역가의 번역 결과물만큼 정확하지는 않습니다. Cisco Systems, Inc.는 이 같은 번역에 대해 어떠한 책임도 지지 않으며 항상 원본 영문 문서(링크 제공됨)를 참조할 것을 권장합니다.
이 문서에서는 ASR1K에서 BGP(Border Gateway Protocol) IPv6 Flowspec을 구성하는 방법에 대해 설명합니다.
Cisco에서는 이 주제에 대해 알고 있는 것이 좋습니다.
이 문서의 정보는 다음 소프트웨어 및 하드웨어 버전을 기반으로 합니다.
이 문서의 정보는 특정 랩 환경의 디바이스를 토대로 작성되었습니다.이 문서에 사용된 모든 디바이스는 초기화된(기본) 컨피그레이션으로 시작되었습니다.네트워크가 작동 중인 경우 모든 명령의 잠재적인 영향을 이해해야 합니다.
Flowspec은 BGP를 통해 플로우 사양 규칙의 분포를 위한 절차를 지정하며, 모든 애플리케이션에서 사용할 수 있는 BGP NLRI(Border Gateway Protocol Network Layer Reachability Information)로 흐름 사양 규칙을 인코딩하는 절차를 정의합니다.또한 서비스 거부 공격을 완화(분산)하기 위해 패킷 필터링을 목적으로 애플리케이션을 정의합니다.
컨피그레이션의 제한 사항은 다음과 같습니다.
이 예에서는 ASR9K를 컨트롤러로 구성하고 ASR1K를 PE, RR 및 Flowspec 클라이언트로 구성했습니다.
이는 IPv6 Flowspec이 작동하는 데 필요한 최소 컨피그레이션입니다.
On controller to push the policy to PE/client: class-map type traffic match-all FLOWSPEC match destination-address ipv6 2001:db8::/32 <<<<< Match destination address/subnet. end-class-map ! policy-map type pbr FS_P class type traffic FLOWSPEC <<<<< Apply class-map under policy-map. drop ! flowspec address-family ipv4 service-policy type pbr FSP_V4 ! address-family ipv6 service-policy type pbr FS_P <<<<< Apply policy-map inside Flowspec under AF. ! On PE/client is to enable IPv6 flowspec AF under BGP. address-family ipv6 flowspec <<<<< Under ipv6 flowspec AF, activate the neighbor. neighbor 10.192.202.5 activate neighbor 10.192.202.5 validation off To apply the flowspec policy on interface, "local-install interface-all" command is must under flowspec. flowspec local-install interface-all <<<<< Push the policy on interface.
+----------------+ +-----------------+ +------------------+ +-----------------+ | | | | | | | | | Controller +--------------+ PE/RR1 +------------+ PE/RR2 +-------------+ End-PE | | ASR9K | | CRR01 | | CRR02 | | DCPR01 | +----------------+ +-----------------+ +------------------+ +-----------------+
이 컨피그레이션은 네트워크 다이어그램을 기반으로 하며, 이는 설정과 동일합니다.
Controller: RP/0/RSP0/CPU0:Controller# show running-config Mon Apr 8 16:33:36.578 UTC Building configuration... !! IOS XR Configuration 5.3.4 !! Last configuration change at Wed Apr 3 17:34:59 2019 by admin ! hostname Controller cdp cdp advertise v1 ! class-map type traffic match-all FLOWSPEC match destination-address ipv6 2001:db8::/32 end-class-map ! class-map type traffic match-all V4_FLOWSPEC match source-address ipv4 102.102.102.102 255.255.255.255 end-class-map ! policy-map type pbr FS_P class type traffic FLOWSPEC drop ! class type traffic class-default ! end-policy-map ! policy-map type pbr FSP_V4 class type traffic V4_FLOWSPEC set dscp ef ! class type traffic class-default ! end-policy-map ! interface Loopback0 ipv4 address 10.192.202.5 255.255.255.255 ! interface Loopback100 ipv4 address 102.102.102.102 255.255.255.255 ipv6 address 2001:db8::1/32 ! interface TenGigE0/0/0/0 ipv4 address 10.10.12.1 255.255.255.0 ipv6 address 2001:10:10:12::1/64 ! route-policy ALL pass end-policy ! router static address-family ipv4 unicast 203.202.143.33/32 TenGigE0/0/0/0 ! address-family ipv6 unicast 2003::/64 2001:10:10:12::2 ! ! router ospfv3 1 area 0 interface TenGigE0/0/0/0 network point-to-point ! ! ! router bgp 64696 bgp router-id 10.192.202.5 address-family ipv4 unicast network 102.102.102.102/32 ! address-family vpnv4 unicast ! address-family ipv4 flowspec ! address-family ipv6 flowspec ! neighbor 203.202.143.33 remote-as 7474 ebgp-multihop 10 update-source Loopback0 address-family ipv4 unicast route-policy ALL in route-policy ALL out ! address-family vpnv4 unicast ! address-family ipv4 flowspec route-policy ALL in route-policy ALL out ! address-family ipv6 flowspec route-policy ALL in route-policy ALL out ! ! ! flowspec local-install interface-all address-family ipv4 service-policy type pbr FSP_V4 ! address-family ipv6 service-policy type pbr FS_P ! ! end
PE/RR1: CRR01#show running-config Building configuration... ! ipv6 unicast-routing mpls label protocol ldp ! spanning-tree extend system-id flowspec local-install interface-all diagnostic bootup level minimal ! interface Loopback0 ip address 203.202.143.33 255.255.255.255 ip ospf 1 area 0 ! interface Loopback1010 no ip address ipv6 address 2001:DB8::10/32 ! interface TenGigabitEthernet0/0/0 ip address 10.10.12.2 255.255.255.0 ip ospf network point-to-point cdp enable ipv6 address 2001:10:10:12::2/64 ! interface TenGigabitEthernet0/0/3 ip address 10.10.23.2 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ipv6 address 2003::1/64 mpls ip ! router ospf 1 mpls ldp autoconfig ! router bgp 7474 bgp router-id 203.202.143.33 bgp log-neighbor-changes neighbor 10.192.202.5 remote-as 64696 neighbor 10.192.202.5 ebgp-multihop 10 neighbor 10.192.202.5 update-source Loopback0 neighbor 2001:10:10:12::1 remote-as 64696 neighbor 203.202.143.44 remote-as 7474 neighbor 203.202.143.44 update-source Loopback0 ! address-family ipv4 neighbor 10.192.202.5 activate no neighbor 2001:10:10:12::1 activate neighbor 203.202.143.44 activate neighbor 203.202.143.44 route-reflector-client exit-address-family ! address-family ipv4 flowspec neighbor 10.192.202.5 activate neighbor 203.202.143.44 activate neighbor 203.202.143.44 send-community both neighbor 203.202.143.44 route-reflector-client exit-address-family ! address-family ipv6 neighbor 10.192.202.5 activate neighbor 203.202.143.44 activate neighbor 203.202.143.44 route-reflector-client neighbor 203.202.143.44 send-label exit-address-family ! address-family ipv6 flowspec neighbor 10.192.202.5 activate neighbor 10.192.202.5 validation off neighbor 203.202.143.44 activate neighbor 203.202.143.44 send-community both neighbor 203.202.143.44 route-reflector-client neighbor 203.202.143.44 next-hop-self exit-address-family ! ip route 10.192.202.5 255.255.255.255 10.10.12.1 ! ! ipv6 route 2001:DB8::1/128 2001:10:10:12::1 ! end
PE/RR2: CRR02#show running-config Building configuration... Current configuration : 7227 bytes ! ! Last configuration change at 18:21:29 UTC Mon Apr 8 2019 ! hostname CRR02 ! boot-start-marker boot system flash bootflash:asr1000rpx86-universalk9.16.10.01a.SPA.bin boot-end-marker ! ipv6 unicast-routing multilink bundle-name authenticated ! spanning-tree extend system-id flowspec diagnostic bootup level minimal ! interface Loopback0 ip address 203.202.143.44 255.255.255.255 ip ospf 1 area 0 ! interface TenGigabitEthernet1/0/0 ip address 10.10.23.3 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ipv6 address 2003::2/64 mpls ip ! interface TenGigabitEthernet1/0/1 ip address 10.10.34.3 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ! router ospf 1 mpls ldp autoconfig ! router bgp 7474 bgp router-id 203.202.143.44 bgp log-neighbor-changes neighbor 203.202.143.33 remote-as 7474 neighbor 203.202.143.33 update-source Loopback0 neighbor 203.202.143.45 remote-as 7474 neighbor 203.202.143.45 update-source Loopback0 ! address-family ipv4 neighbor 203.202.143.33 activate neighbor 203.202.143.45 activate exit-address-family ! address-family ipv4 flowspec neighbor 203.202.143.33 activate neighbor 203.202.143.45 activate neighbor 203.202.143.45 send-community both neighbor 203.202.143.45 route-reflector-client exit-address-family ! address-family ipv6 neighbor 203.202.143.33 activate neighbor 203.202.143.33 send-label exit-address-family ! address-family ipv6 flowspec neighbor 203.202.143.33 activate neighbor 203.202.143.33 validation off neighbor 203.202.143.45 activate neighbor 203.202.143.45 send-community both neighbor 203.202.143.45 route-reflector-client exit-address-family ! ipv6 route 2001:10:10:12::/64 2003::1 ipv6 route 2001:DB8::1/128 2003::1 ! end
End-PE: DCPR01#show running-config Building configuration... ! hostname DCPR01 ! subscriber templating ! ipv6 unicast-routing ! flowspec diagnostic bootup level minimal ! interface Loopback0 ip address 203.202.143.45 255.255.255.255 ip ospf 1 area 0 ! interface TenGigabitEthernet1/3/0 ip address 10.10.34.4 255.255.255.0 ip ospf network point-to-point ip ospf 1 area 0 cdp enable ipv6 address 2001::1/64 ! router ospf 1 mpls ldp autoconfig ! router bgp 7474 bgp router-id 203.202.143.45 bgp log-neighbor-changes neighbor 203.202.143.44 remote-as 7474 neighbor 203.202.143.44 update-source Loopback0 ! address-family ipv4 flowspec neighbor 203.202.143.44 activate exit-address-family ! address-family ipv6 flowspec neighbor 203.202.143.44 activate neighbor 203.202.143.44 validation off exit-address-family ! ipv6 route ::/0 TenGigabitEthernet1/3/0 ! end
PE/RR2: CRR02#ping 2001:db8::1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 2001:DB8::1, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) CRR02#
Controller: RP/0/RSP0/CPU0:Controller#show bgp ipv6 flowspec Mon Apr 8 17:55:17.041 UTC BGP router identifier 10.192.202.5, local AS number 64696 BGP generic scan interval 60 secs Non-stop routing is enabled BGP table state: Active Table ID: 0x0 RD version: 20 BGP main routing table version 20 BGP NSR Initial initsync version 0 (Reached) BGP NSR/ISSU Sync-Group versions 0/0 BGP scan interval 60 secs Status codes: s suppressed, d damped, h history, * valid, > best i - internal, r RIB-failure, S stale, N Nexthop-discard Origin codes: i - IGP, e - EGP, ? - incomplete Network Next Hop Metric LocPrf Weight Path *> Dest:2001:db8::/0-32/56 :: 0 i Processed 1 prefixes, 1 paths RP/0/RSP0/CPU0:Controller#show flowspec ipv6 detail Mon Apr 8 17:55:36.786 UTC AFI: IPv6 Flow :Dest:2001:db8::/0-32 Actions :Traffic-rate: 0 bps (policy.1.FS_P.FLOWSPEC) Statistics (packets/bytes) Matched : 14/1652 Dropped : 14/1652 RP/0/RSP0/CPU0:BGL14.1.J.05-ASR-9000-1#
PE/RR1: CRR01#show bgp ipv6 flowspec BGP table version is 2, local router ID is 203.202.143.33 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, t secondary path, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric LocPrf Weight Path *> Dest:2001:DB8::/0-32 :: 0 64696 i CRR01# CRR01#show flowspec ipv6 detail AFI: IPv6 Flow :Dest:2001:DB8::/0-32 Actions :Traffic-rate: 0 bps (bgp.1) Statistics (packets/bytes) Matched : 4/456 Dropped : 4/456 CRR01#
현재 이 컨피그레이션에 사용할 수 있는 특정 문제 해결 정보가 없습니다.
팁:3.16.5S를 사용하여 케이스를 열고 CSCva5510 버그 ID를 누른 경우. 아직 버그에 문서화되지 않았지만 IPv6에 적용됩니다. 이는 ASR1K BGP BU에서 확인되고 검증됩니다. 다른 버그 CSCvp18767 는 이 릴리스를 사용하는 것이 더 나은 16.12.1에서 수정된 show 명령에 대해서도 제기됩니다.그러나 IPv6 flowspec은 모든 16.x 릴리스에서 작동할 수 있습니다.