本產品的文件集力求使用無偏見用語。針對本文件集的目的,無偏見係定義為未根據年齡、身心障礙、性別、種族身分、民族身分、性別傾向、社會經濟地位及交織性表示歧視的用語。由於本產品軟體使用者介面中硬式編碼的語言、根據 RFP 文件使用的語言,或引用第三方產品的語言,因此本文件中可能會出現例外狀況。深入瞭解思科如何使用包容性用語。
思科已使用電腦和人工技術翻譯本文件,讓全世界的使用者能夠以自己的語言理解支援內容。請注意,即使是最佳機器翻譯,也不如專業譯者翻譯的內容準確。Cisco Systems, Inc. 對這些翻譯的準確度概不負責,並建議一律查看原始英文文件(提供連結)。
本文說明如何對重疊管理協定(OMP)路由進行故障排除,並說明vSmart路由選擇操作的順序。
思科建議您瞭解思科軟體定義廣域網(SDWAN)解決方案。
本檔案所述內容不限於硬體平台。 本文描述在使用20.6.3版vSmart和17.6.3版cEdge路由器的實驗室中發現的問題,但在其他軟體版本中也可看到問題。
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除(預設)的組態來啟動。如果您的網路運作中,請確保您瞭解任何指令可能造成的影響。
本文檔中描述的場景顯示,兩個站點向vSmart通告預設路由。vSmart會選擇最佳路徑,並將其通告給邊緣裝置。在這種情況下,選擇AMER_DC是由於控制策略阻止了遠端邊緣(雲邊緣)的EMEAR_DC預設路由。vSmart僅在具有AMER_DC邊緣的企業Internet上擁有控制連線。 當AMER_DC企業Internet發生中斷時,所有控制連線都將丟失,vSmart會將從AMER_DC獲知的所有路由置於「過時」狀態。 這會導致vSmart不將這些路徑視為最佳路徑。
此時,vSmart通常會選擇EMEA_DC作為最佳路徑並通告它。 但是,控制策略會阻止來自EMEA_DC的預設路由,並且此策略應用於雲邊緣。 如果沒有send-backup-paths的OMP配置,vSmart不會傳送過時路由,因為這些路由是控制策略不拒絕的唯一預設路由。 還需要在vSmart OMP配置中增加send-path-limit,以便傳送超過非陳舊路由的數量。
為了更好地瞭解問題,以下是一個描述設定的簡單拓撲圖:
配置的簡短摘要:
主機名 | site-id | system-ip |
EMEA_DC1 | 2016 | 10.4.4.1 |
EMEA_DC2 | 2016 | 10.4.4.6 |
AMER_DC1 | 2034 | 10.5.5.3 |
AMER_DC2 | 2034 | 10.5.5.4 |
雲端 | 202 | 10.10.20.2 |
vSmart | 10 | 10.3.3.1 |
vSmart使用預設OMP配置進行配置。
vsmart1# show running-config omp omp no shutdown graceful-restart ! vsmart1# show running-config omp | details omp no shutdown send-path-limit 4 no send-backup-paths no discard-rejected graceful-restart timers holdtime 60 advertisement-interval 1 graceful-restart-timer 43200 eor-timer 300 exit
!
提示:要檢視完整配置(預設和非預設),請包括 | show running-config命令末尾的詳細信息。
vSmart配置了集中控制策略。 該控制策略應用於雲站點,並為來自EMEA_DC站點的預設路由配置操作拒絕。
以下是原則組態:
policy control-policy Rej_Remote_Default sequence 1 match route site-list EMEA_DC prefix-list default_route ! action reject ! ! default-action accept ! lists prefix-list default_route ip-prefix 0.0.0.0/0 ! site-list Cloud site-id 202 ! site-list EMEA_DC site-id 2016 ! ! ! apply-policy site-list Cloud control-policy Rej_Remote_Default out ! !
在正常操作條件下,雲站點將接收來自AMER_DC站點的預設路由。 這可使用show sdwan omp routes vpn 1 0.0.0.0/0指令驗證。如果您的服務vpn不是vpn 1,請將編號1替換為服務vpn編號。
Cloud#show sdwan omp routes vpn 1 0.0.0.0/0
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
PATH PSEUDO
FROM PEER ID LABEL STATUS KEY TLOC IP COLOR ENCAP PREFERENCE
--------------------------------------------------------------------------------------------------------
10.3.3.1 81 1003 C,I,R 1 10.5.5.3 biz-internet ipsec -
10.3.3.1 97 1003 C,I,R 1 10.5.5.3 private1 ipsec -
10.3.3.1 98 1003 C,I,R 1 10.5.5.3 private2 ipsec -
10.3.3.1 99 1003 C,I,R 1 10.5.5.4 biz-internet ipsec -
vSmart在所有4個DC路由器的3個TLOC上收到預設路由。vSmart共有12條路由。
vsmart1# show omp routes vpn 1 0.0.0.0/0 received | tab
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
PATH ATTRIBUTE
FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE
-----------------------------------------------------------------------------------------------------------
10.4.4.1 68 1002 C,R installed 10.4.4.1 biz-internet ipsec -
10.4.4.1 81 1002 C,R installed 10.4.4.1 private1 ipsec -
10.4.4.1 82 1002 C,R installed 10.4.4.1 private2 ipsec -
10.4.4.6 68 1003 C,R installed 10.4.4.6 biz-internet ipsec -
10.4.4.6 81 1003 C,R installed 10.4.4.6 private1 ipsec -
10.4.4.6 82 1003 C,R installed 10.4.4.6 private2 ipsec -
10.5.5.3 68 1003 C,R installed 10.5.5.3 biz-internet ipsec -
10.5.5.3 81 1003 C,R installed 10.5.5.3 private1 ipsec -
10.5.5.3 82 1003 C,R installed 10.5.5.3 private2 ipsec -
10.5.5.4 68 1003 C,R installed 10.5.5.4 biz-internet ipsec -
10.5.5.4 81 1003 C,R installed 10.5.5.4 private1 ipsec -
10.5.5.4 82 1003 C,R installed 10.5.5.4 private2 ipsec -
在AMER_DC站點的biz-internet電路中斷時,雲邊緣裝置不再接收預設路由。 您預計它會丟失biz-internet路由,但會保留private1和private2路由。 可以使用show sdwan omp routes vpn 1 0.0.0.0/0 和show sdwan omp routes vpn 1命令驗證這一點。
註:如果裝置未收到字首,則show sdwan omp routes命令會顯示CLI命令錯誤,如下所示。
Cloud#show sdwan omp routes vpn 1 0.0.0.0/0
Generating output, this might take time, please wait ...
show omp best-match-route family ipv4 entries vpn 1 0.0.0.0 | tab
show omp best-match-route family ipv4 entries vpn
syntax error: unknown argument
Error executing command: CLI command error -
Cloud#show sdwan omp routes
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
PATH ATTRIBUTE
VPN PREFIX FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE
--------------------------------------------------------------------------------------------------------------------------------------
1 10.5.100.0/24 10.3.3.1 72 1003 Inv,U installed 10.5.5.3 biz-internet ipsec -
10.3.3.1 73 1003 C,I,R installed 10.5.5.3 private1 ipsec -
10.3.3.1 74 1003 C,I,R installed 10.5.5.3 private2 ipsec -
使用AMER_DC邊緣裝置時,vSmart進入平穩重啟狀態,可從show omp peers命令中看到。
vsmart1# show omp peers
R -> routes received
I -> routes installed
S -> routes sent
DOMAIN OVERLAY SITE
PEER TYPE ID ID ID STATE UPTIME R/I/S
------------------------------------------------------------------------------------------
172.16.4.1 vedge 1 1 101 up 0:13:13:02 9/0/22
172.16.5.1 vedge 1 1 104 up 0:13:13:03 3/0/28
10.4.4.1 vedge 1 1 2016 up 0:01:45:10 6/0/27
10.4.4.6 vedge 1 1 2016 up 0:02:13:27 6/0/27
10.5.5.3 vedge 1 1 2034 down-in-gr 6/0/0 10.5.5.4 vedge 1 1 2034 down-in-gr 6/0/0
10.10.20.2 vedge 1 1 202 up 0:12:40:09 3/0/24
vSmart繼續接收所有12條路由,每個DC裝置3條。這可以通過收到的show omp routes vpn 1 0.0.0.0/0進行驗證 | tab指令。 來自AMER_DC站點的路由顯示為陳舊狀態。
提示:若要以使用者友好的表格格式檢視輸出,請包括 | 選項卡。 如果沒有它,命令的輸出將採用不同的格式。
vsmart1# show omp routes vpn 1 0.0.0.0/0 received | tab
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
PATH ATTRIBUTE
FROM PEER ID LABEL STATUS TYPE TLOC IP COLOR ENCAP PREFERENCE
-----------------------------------------------------------------------------------------------------------
10.4.4.1 68 1002 C,R installed 10.4.4.1 biz-internet ipsec -
10.4.4.1 81 1002 C,R installed 10.4.4.1 private1 ipsec -
10.4.4.1 82 1002 C,R installed 10.4.4.1 private2 ipsec -
10.4.4.6 68 1003 C,R installed 10.4.4.6 biz-internet ipsec -
10.4.4.6 81 1003 C,R installed 10.4.4.6 private1 ipsec -
10.4.4.6 82 1003 C,R installed 10.4.4.6 private2 ipsec -
10.5.5.3 68 1003 R,S installed 10.5.5.3 biz-internet ipsec -
10.5.5.3 81 1003 R,S installed 10.5.5.3 private1 ipsec -
10.5.5.3 82 1003 R,S installed 10.5.5.3 private2 ipsec -
10.5.5.4 68 1003 R,S installed 10.5.5.4 biz-internet ipsec -
10.5.5.4 81 1003 R,S installed 10.5.5.4 private1 ipsec -
10.5.5.4 82 1003 R,S installed 10.5.5.4 private2 ipsec -
為了驗證vSmart傳送到邊緣裝置的路由,您可以運行命令 show omp routes vpn 1 0.0.0.0/0 advertised detail | tab.
從輸出中需要注意幾點:
vsmart1# show omp routes vpn 1 0.0.0.0/0 advertised detail | tab
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
ULTIMATE
PATH UNKNOWN TLOC
TO PEER ADVERTISE ID ID LABEL TLOC IP COLOR ENCAP PROTOCOL METRIC DOMAIN ID SITE ID PREFERENCE TAG ATTRIBUTE LEN ORIGINATOR TLOC IP COLOR ENCAP ACTION OVERLAY ID AS PATH COMMUNITY
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
172.16.4.1 67 50 1003 10.4.4.6 biz-internet ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
78 56 1002 10.4.4.1 biz-internet ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
79 57 1002 10.4.4.1 private2 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
81 61 1002 10.4.4.1 private1 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
172.16.5.1 67 56 1003 10.4.4.6 biz-internet ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
78 62 1002 10.4.4.1 biz-internet ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
79 63 1002 10.4.4.1 private2 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
81 67 1002 10.4.4.1 private1 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
10.4.4.1 67 53 1003 10.4.4.6 biz-internet ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
68 54 1003 10.4.4.6 private1 ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
69 55 1003 10.4.4.6 private2 ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
10.4.4.6 78 97 1002 10.4.4.1 biz-internet ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
79 98 1002 10.4.4.1 private2 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
81 102 1002 10.4.4.1 private1 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
這是給定此環境中的當前配置的預期行為。 發生這種情況的原因是vSmart上的OMP路由選擇的操作順序。
要更正此問題,需要修改vSmart OMP配置以傳送超過4個路由和超過最佳路由。
vsmart1# show running-config omp
omp
no shutdown
send-path-limit 16
send-backup-paths
graceful-restart
!
為了驗證vSmart OMP配置更改是否產生了預期的效果,可以運行命令 show omp routes vpn 1 0.0.0.0/0 advertised detail | tab.
從輸出中需要注意幾點:
vsmart1# show omp routes vpn 1 0.0.0.0/0 advertised detail | tab
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
ULTIMATE
PATH UNKNOWN TLOC
TO PEER ADVERTISE ID ID LABEL TLOC IP COLOR ENCAP PROTOCOL METRIC DOMAIN ID SITE ID PREFERENCE TAG ATTRIBUTE LEN ORIGINATOR TLOC IP COLOR ENCAP ACTION OVERLAY ID AS PATH COMMUNITY
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
172.16.4.1 22 64 1003 10.5.5.3 biz-internet ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
23 65 1003 10.5.5.3 private1 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
24 66 1003 10.5.5.3 private2 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
28 67 1003 10.5.5.4 biz-internet ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
29 68 1003 10.5.5.4 private1 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
30 69 1003 10.5.5.4 private2 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
67 50 1003 10.4.4.6 biz-internet ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
68 62 1003 10.4.4.6 private1 ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
69 63 1003 10.4.4.6 private2 ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
78 56 1002 10.4.4.1 biz-internet ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
79 57 1002 10.4.4.1 private2 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
81 61 1002 10.4.4.1 private1 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
172.16.5.1 22 70 1003 10.5.5.3 biz-internet ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
23 71 1003 10.5.5.3 private1 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
24 72 1003 10.5.5.3 private2 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
28 73 1003 10.5.5.4 biz-internet ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
29 74 1003 10.5.5.4 private1 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
30 75 1003 10.5.5.4 private2 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
67 56 1003 10.4.4.6 biz-internet ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
68 68 1003 10.4.4.6 private1 ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
69 69 1003 10.4.4.6 private2 ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
78 62 1002 10.4.4.1 biz-internet ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
79 63 1002 10.4.4.1 private2 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
81 67 1002 10.4.4.1 private1 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
10.4.4.1 22 57 1003 10.5.5.3 biz-internet ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
23 58 1003 10.5.5.3 private1 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
24 59 1003 10.5.5.3 private2 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
28 60 1003 10.5.5.4 biz-internet ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
29 61 1003 10.5.5.4 private1 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
30 62 1003 10.5.5.4 private2 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
67 53 1003 10.4.4.6 biz-internet ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
68 54 1003 10.4.4.6 private1 ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
69 55 1003 10.4.4.6 private2 ipsec static 0 - 2016 - - - 10.4.4.6 - - - - 1 - -
10.4.4.6 22 103 1003 10.5.5.3 biz-internet ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
23 104 1003 10.5.5.3 private1 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
24 105 1003 10.5.5.3 private2 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - -
28 106 1003 10.5.5.4 biz-internet ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
29 107 1003 10.5.5.4 private1 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
30 108 1003 10.5.5.4 private2 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
78 97 1002 10.4.4.1 biz-internet ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
79 98 1002 10.4.4.1 private2 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
81 102 1002 10.4.4.1 private1 ipsec static 0 - 2016 - - - 10.4.4.1 - - - - 1 - -
10.10.20.2 22 112 1003 10.5.5.3 biz-internet ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - - 23 113 1003 10.5.5.3 private1 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - - 24 114 1003 10.5.5.3 private2 ipsec static 0 - 2034 - - - 10.5.5.3 - - - - 1 - - 28 115 1003 10.5.5.4 biz-internet ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - - 29 116 1003 10.5.5.4 private1 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - - 30 117 1003 10.5.5.4 private2 ipsec static 0 - 2034 - - - 10.5.5.4 - - - - 1 - -
雲邊緣路由器從AMER_DC站點接收預設路由。 這可使用show sdwan omp routes vpn 1 0.0.0.0/0命令驗證。biz-internet路由處於Inv、U狀態,因為電路在AMER_DC站點遇到停機。
Cloud#show sdwan omp routes vpn 1 0.0.0.0/0
Generating output, this might take time, please wait ...
Code:
C -> chosen
I -> installed
Red -> redistributed
Rej -> rejected
L -> looped
R -> resolved
S -> stale
Ext -> extranet
Inv -> invalid
Stg -> staged
IA -> On-demand inactive
U -> TLOC unresolved
PATH PSEUDO
FROM PEER ID LABEL STATUS KEY TLOC IP COLOR ENCAP PREFERENCE
--------------------------------------------------------------------------------------------------------
10.3.3.1 112 1003 Inv,U 1 10.5.5.3 biz-internet ipsec -
10.3.3.1 113 1003 C,I,R 1 10.5.5.3 private1 ipsec -
10.3.3.1 114 1003 C,I,R 1 10.5.5.3 private2 ipsec -
10.3.3.1 115 1003 Inv,U 1 10.5.5.4 biz-internet ipsec -
10.3.3.1 116 1003 C,I,R 1 10.5.5.4 private1 ipsec -
10.3.3.1 117 1003 C,I,R 1 10.5.5.4 private2 ipsec -
路由表中只安裝了private1和private2,因為它們處於C、I、R狀態。 根據show ip route vrf 1 0.0.0.0命令的輸出將路由安裝到表中。
註:在show sdwan omp命令中,vpn關鍵字用於檢視服務端路由器。 在show ip route命令中,vrf關鍵字用於檢視服務端路由器。
Cloud# show ip route vrf 1 0.0.0.0
Routing Table: 1
Routing entry for 0.0.0.0/0, supernet
Known via "omp", distance 251, metric 0, candidate default path, type omp
Last update from 10.5.5.4 on Sdwan-system-intf, 00:17:07 ago
Routing Descriptor Blocks:
10.5.5.4 (default), from 10.5.5.4, 00:17:07 ago, via Sdwan-system-intf
Route metric is 0, traffic share count is 1
* 10.5.5.3 (default), from 10.5.5.3, 00:17:07 ago, via Sdwan-system-intf
Route metric is 0, traffic share count is 1
修訂 | 發佈日期 | 意見 |
---|---|---|
2.0 |
30-Aug-2022 |
初始版本 |
1.0 |
24-Aug-2022 |
初始版本 |