TEMAT: wykorzystujących przełączniki Cisco Catalyst 29xx/3xx0. Łukasz Bromirski _

Transkrypt

1 1

2 TEMAT: Rozwiązywanie problemów w sieciach wykorzystujących przełączniki Cisco Catalyst 29xx/3xx0 Łukasz Bromirski _

3 Agenda Interfejsy, moduły ł optyczne i problemy fizyczne Przekazywanie pakietów i routing IP Multicasty Filtrowanie ruchu QoS Mechanizm VRF-lite Inne 3

5 Gdzie szukać problemu? Błędy na interfejsach uszkodzony port, GBIC/SFP, okablowanie, nadsubskrypcja Błąd w konfiguracji ACL, VLAN, trunk, channel, prędkość/duplex ę p itp. Wpisy L2 MAC / L3 IP/ARP Spanning tree, protokoły routingu, inne funkcjonalności Problemy poza przełącznikiemł topologia, nieprzemyślany i nieskalowalny projekt Sprzętowy switching (ASIC)/CPU 5

6 show interface [...] 3550# show interface status Port Name Status Vlan Duplex Speed Type Fa0/1 Server B1 notconnect 2 full BaseTX Fa0/2 notconnect routed half BaseTX Fa0/3 connected 1 a full a BaseTX 3550# show interfaces counters Port InOctets InUcastPkts InMcastPkts InBcastPkts Fa0/ Fa0/ [...] Port OutOctets OutUcastPkts OutMcastPkts OutBcastPkts Fa0/ Fa0/ Podstawowe informacje konfiguracja, autonegocjacja, aktualny tryb działania Liczniki ruchu 0 oznacza zwykle problem 6

7 show interface [...] 3550# show interface status Port Name Status Vlan Duplex Speed Type Fa0/1 Server B1 notconnect 2 full BaseTX Fa0/2 VLAN16 NIE UZYWAC! notconnect routed half BaseTX Fa0/3 Do_DMZ connected 1 a full a BaseTX 3550# show interfaces counters Port InOctets InUcastPkts InMcastPkts InBcastPkts Fa0/ Fa0/ [...] Port OutOctets OutUcastPkts OutMcastPkts OutBcastPkts Fa0/ Fa0/ # show interfaces counters errors Port Align Err FCS Err Xmit Err Rcv Err UnderSize Fa0/ Port Single Col Multi Col Late Col Excess Col Carri Sen Runts Giants Fa0/ Fa0/

8 show interface [...] 3550# show interface fastethernet 0/1 FastEthernet0/1 is up, line protocol is up Hardware is Fast Ethernet, address is b (bia b4.8981) Description: 7206 ge0/1 pvc0/35 MTU 1500 bytes, BW Kbit, DLY 100 usec, [...] Auto duplex, Auto speed, media type is 10/100BaseTX input flow control is off, output flow control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 5d22h, output 5d22h, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 [...] 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec packets input, bytes, 0 no buffer Received 1192 broadcasts (0 multicast) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 1141 multicast, 0 pause input 0 input packets with dribble condition detected packets output, bytes, 0 underruns 0 output errors, 0 collisions, 1 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers swapped out 8

9 show controller ethernet-controller 3750# show controllers ethernet controller gig 0/1 3750# sh controllers ethernet controller?transmit GigabitEthernet0/1 Receive FastEthernet FastEthernet IEEE GigabitEthernet GigabitEthernet IEEE 802.3z phy show PHY registers port asic Show Port ASIC info com/warp/public/ 473/164.html#show_controllers Bytes Bytes Unicast frames Unicast frames Multicast frames Multicast frames 2618 Broadcast frames 111 Broadcast frames 0 Discarded frames 9028 No dest, unicast 0 Too old frames 38 No dest, multicast t 0 Deferred frames 0 No dest, broadcast 0 1 collision frames 0 2 collision frames 0 FCS errors 0 3 collision frames 0 Oversize frames 0 4 collision frames 0 Undersize frames 0 5 collision frames 0 Collision fragments 0 6 collision frames 0 7 collision frames Minimum size frames 0 8 collision frames to 127 byte frames 0 9 collision frames to 255 byte frames 0 10 collision frames to 511 byte frames 0 11 collision frames to 1023 byte frames 0 12 collision frames to 1518 byte frames 0 13 collision frames 0 14 collision frames 0 Flooded frames 0 15 collision frames 0 Overrun frames 0 Excessive collisions i 1 VLAN filtered frames 0 Late collisions 0 Source routed frames 0 Good (1 coll) frames 0 Valid oversize frames 0 Good(>1 coll) frames 0 Pause frames 0 Pause frames 0 Symbol error frames 0 VLAN discard frames 0 Invalid frames, too large 0 Excess defer frames 0 Valid frames, too large 0 Too large frames 0 Invalid frames, too small byte frames 0 Valid frames, too small byte frames 9

10 show interface [...] capabilities 3550# show interfaces gigabitethernet0/1 capabilities GigabitEthernet0/1 Model: WS C PWR Type: 1000BaseSX Speed: 1000 Duplex: full Trunk encap. type: 802.1Q,ISL Trunk mode: on,off,desirable,nonegotiate Channel: yes Broadcast suppression: percentage(0 100) Flowcontrol: rx (off,on,desired),tx (off,on,desired) Fast Start: yes QOS scheduling: rx (1q0t),tx (4q2t),tx (1p3q2t) CoS rewrite: yes ToS rewrite: yes UDLD: yes Inline power: no SPAN: source/destination PortSecure: yes Dot1x: yes 10

11 Port nie uruchamia się natychmiastowo Pełne podniesienie interfejsu zajmuje normalnie około sekund Rzeczy o których należy pamiętać: porty domyślnie negocjują rodzaj (trunk/access) - DTP proces STP określa tryb pracy portu c3560(config)# interface range fastethernet 0/1 24 c3560(config if)# switchport host switchport mode will be set to access spanning tree portfast will be enabled channel group will be disabled 11

12 Funkcjonalność UDLD Unidirectional Link Detection Za co odpowiada d UDLD? Wykrywa połączenia jednokierunkowe TX RX Pracuje w oparciu o warstwę drugą Tryb normalny: Uszkodzony SFP? Źle wykonana instalacja? RX TX wykrywa źle połączone RX/TX na łączach optycznych Tryb agresywny: wykrywa źle połączone RX/TX na łączach h optycznych oraz połączenia jednokierunkowe C3750 6# sh int ge6/1 GigabitEthernet6/1 is up, line protocol is up 12

13 Funkcjonalność UDLD Uruchomienie na portach optycznych UDLD włączamy globalnie po obu stronach! Opcjonalnie per-interfejs możliwość włączenia ą trybu agresywnego i ustalenia zwłoki w ramkach hello (config)# udld enable (config)# interface gigabitethernet 6/ (config if)# udld aggressive (config if)# udld message time 1 13

14 Funkcjonalność UDLD Czy UDLD pracuje prawidłowo? c3750 a# sh udld gigabitethernet 1/1 Interface Gi1/1 Port enable administrative configuration setting: Enabled / in aggressive mode Port enable operational state: Enabled / in aggressive mode Current bidirectional state: Bidirectional Current operational state: Advertisement Single neighbor detected Message interval: 15 Time out interval: 5 Entry 1 Expiration time: 35 Device ID: 1 Current neighbor state: Bidirectional Device name: SAL06090FCJ Port ID: Gi1/1 Neighbor echo 1 device: SAD044204Y8 Neighbor echo 1 port: Gi1/1 Message interval: 5 CDP Device name: c3750 b 14

15 Funkcjonalność TDR Time Domain Reflector (Catalyst 3750/3560/2970/2960) Wykrywa problemy fizyczne z okablowaniem Jeśli jedna z par jest przerwana, TDR może określić odległość, na jakiej pojawiła się ta przerwa Obsługiwane tylko na miedzianych portach Ethernet 10/100/ # test cable diagnostics tdr interface gigabitethernet 2/0/3 TDR test started on interface Gi2/0/3 A TDR test can take a few seconds to run on an interface Use 'show cable diagnostics tdr' to read the TDR results. 3750# show cable diagnostics tdr interface gigabitethernet 2/0/3 TDR test last run on: April 02 05:55:20 Interface Speed Local pair Pair length Remote pair Pair status Gi2/0/3 1000M Pair A 4 +/ 10 meters Pair A Normal Pair B 5 +/ 10 meters Pair B Normal Pair C 4 +/ 10 meters Pair D Normal Pair D 5 +/ 10 meters Pair C Normal 15

16 Switchporty i Trunking 2970# show int gig 0/3 switchport 2950# show interfaces fastethernet 0/1 trunk Name: Gi0/3 Switchport: Enabled Port Mode Encapsulation Status Native Administrative Mode: dynamic auto vlan Operational Mode: static access Fa0/1 desirable 802.1q trunking 1 Administrative Trunking Encapsulation: negotiate Operational Trunking Encapsulation: native Port Vlans allowed on trunk Negotiation of Trunking: On Fa0/ Access Mode VLAN: 1 (default) Trunking Native Mode VLAN: 1 (default) Port Vlans allowed and active in management domain Administrative Native VLAN tagging: enabled Fa0/1 1 2 Voice VLAN: none Administrative private vlan host association: Port none Vlans in spanning tree forwarding state and not pruned Administrative private vlan mapping: none Fa0/1 1 2 Administrative private vlan trunk native VLAN: none Administrative private vlan trunk Native VLAN tagging: enabled Administrative private vlan vlan trunk encapsulation: dot1q Administrative private vlan trunk normal VLANs: none Administrative private vlan trunk private VLANs: none Operational private vlan: none Trunking VLANs Enabled: ALL Pruning VLANs Enabled: Capture Mode Disabled Capture VLANs Allowed: ALL Protected: false Unknown unicast blocked: disabled Unknown multicast blocked: disabled Appliance trust: none 16

17 Wzorce TCAM 2960/2970, 3550/3560/ # show sdm prefer The current template is the default template. The selected template optimizes the resources in the switch to support this level of features for 16 routed interfaces and 1K VLANs. Ile obecnie zajęte w ramach limitu? number of unicast mac addresses: 6K show mac address table count number of igmp groups: 6K show mac address table multicast count number of qos aces: 2K show tcam qos [tcam #] statistics number of security aces: 2K show tcam [inacl outacl] [tcam #] statistics number of unicast routes: 12K show ip cef summary number of multicast routes: 6K show ip mroute count 3750# show sdm prefer The current template is "desktop default" template. The selected template optimizes the resources in the switch to support this level of features for 8 routed interfaces and 1024 VLANs. Ile obecnie zajęte w ramach limitu? number of unicast mac addresses: 6K show mac address table count number of igmp groups + multicast routes: 1K show ip 1gmp snooping multicast count show ip mroute count number of unicast routes: 8K show ip route summary number of directly connected hosts: 6K number of indirect routes: 2K number of policy based routing aces: 0 show access lists number of qos aces: 512 show access lists number of security aces: 1K show platform acl usage [port asic #] 3550(config)# sdm prefer access Changes to the running SDM preferences have been stored, but cannot take effect until the next reload. Use 'show sdm prefer' to see what SDM preference is currently active. 17

18 Wzorce TCAM Niezgodność konfiguracji SDM w stosie S skonfigurowany jako master stosu Slave nie dołączą się do stosu zgłaszając niezgodność wzorca SDM Należy zmienić wzorzec SDM na S na desktop s# show switch Switch# Role Mac Address Priority State *2 Master 000a.fdfd Ready 4 Member 0003.fd63.9c00 5 SDM Mismatch %STACKMGR 6 SWITCH_ADDED_SDM:Switch 2 has been ADDED to the stack (SDM_MISMATCH) %SDM 6 MISMATCH_ADVISE:System (#2) is incompatible with the SDM %SDM 6 MISMATCH_ADVISE:template currently running on the stack and %SDM 6 MISMATCH MISMATCH_ADVISE:will ADVISE:will not function unless the stack is %SDM 6 MISMATCH_ADVISE:downgraded. Issuing the following commands %SDM 6 MISMATCH_ADVISE:will downgrade the stack to use a smaller %SDM 6 MISMATCH_ADVISE:compatible desktop SDM template: %SDM 6 MISMATCH_ADVISE: "sdm prefer vlan desktop" %SDM 6 MISMATCH_ADVISE: "reload" 18

19 Wzorce TCAM Rodzina 2960 ToyCAM 2960 obsługuje dwa wzorce: domyślny i QoS Należy przeładować przełącznik by nowe ustawienia weszły w życiey Brak wsparcia dla wzorców Routing i VLAN Funkcjonalność Default QoS Default Ilość adresów MAC 8K 8K 6K Ilość grup IGMP K ACE w ACL bezpieczeństwa K ACE w ACL QoS

21 show mac address-table 2950# show mac address table dynamic Mac Address Table Vlan Mac Address Type Ports 2950# show mac address table count c DYNAMIC Gi0/1 Mac Entries for Vlan c45.41a0 DYNAMIC Gi0/1 2: ed DYNAMIC Gi0/1 Dynamic Address Count : b DYNAMIC Gi0/1 Static Address Count : c0 DYNAMIC Gi0/1 Total Mac Addresses : d9 0.63d DYNAMIC Gi0/ a7.bb00 DYNAMIC Gi0/ b81.f66d DYNAMIC Gi0/ b DYNAMIC Gi0/ d9 DYNAMIC Gi0/ a7.bb00 DYNAMIC Gi0/1 Total Mac Addresses for this criterion: 11 Mac Entries for Vlan 1: <output omitted> Total Mac Address Space Available: # sh mac address table address c Mac Address Table Vlan Mac Address Type Ports c DYNAMIC Gi0/1 Total Mac Addresses for this criterion: # show mac address table aging time Vlan Aging Time

22 Gdzie przekażemy ramkę Ethernet? Catalyst 3550 sprzętowa PC be.10c0 VLAN1 FE0/3 FE0/1 Jak ramka z PC1 do PC zostałaby przekazana przez sprzęt w 3550? PC2 000c.30ae.4f01 VLAN # show mac address table dynamic Mac Address Table Vlan Mac Address Type Ports be.10c0 DYNAMIC Fa0/ be.10c2 DYNAMIC Fa0/ c.30ae.4f01 DYNAMIC Fa0/1 Total Mac Addresses for this criterion: 3 In port SA mac DA mac # show forward fast 0/ be.10c0 000c.30ae.4f01 got vlan 1, vlaninfo 9001 <output omitted> Egress q 0 using default sig_control_info 0x A signature: , comparison ind: 16, control info: A control map: vlan: 1, vlanid entry: 000E C FastEthernet0/1 vlan 1, dst 000c.30ae.4f01 src be.10c0, cos 0x0, dscp 0x 22

23 Gdzie przekażemy ramkę Ethernet? Catalyst 3750/3560/2960/2950 sprzętowa Gi1/0/2 Gi2/0/ be.10c0 VLAN1 000d.283d.7381 VLAN1 3750# show switch Current Switch# Role Mac Address Priority State 1 Slave 000c.30ae.4f00 9 Ready *2 Master 000d.bd5c Ready 3 Slave 000c Ready 3750# show mac address table dynamic Mac Address Table Vlan Mac Address Type Ports be.10c0 DYNAMIC Gi1/0/ be.10c1 DYNAMIC Gi1/0/ d.283d.7381 DYNAMIC Gi2/0/2 Total Mac Addresses for this criterion: 3 In port SA mac DA mac 3750# session # show platform forward gi1/0/ be.10c0 000d.283d.7381 <output omitted> Switch : 1 : Egress: Asic 2, switch 2 Lookup Key Used Index Hit A Data OutptACL 30_ D_283D _ _52BE10C D FFC Port Vlan SrcMac DstMac Cos Dscpv Gi2/0/ BE.10C0 000D.283D

24 Gdzie przekażemy ramkę Ethernet? L2 traceroute VLAN2 Fa0/23 Fa0/ b.3fff VLAN # traceroute mac ip detail Translating IP to mac => 000d.283d.73c => b.3fff Z tabeli ARP Gig1/0/ VLAN Source 000d.283d.73c1 found on 3750[WS C3750G 16TD] ( ) / WS C3750G 16TD / : Gi2/0/3 [auto, auto] => Gi1/0/4 [auto, auto] / WS C PWR / : Fa0/3 [auto, auto] => Fa0/23 [auto, auto] Destination b.3fff found on 3550[WS C PWR] ( ) Layer 2 trace completed. Gig2/0/3 VLAN d.283d.73c1 Przełączniki obsługujące L2 traceroute muszą mieć uruchomione CDP Obsługiwany jest traceroute tylko dla adresów unicast Adresy muszą być w tej samej podsieci/vlanie 3750# traceroute mac 000d.283d.73c b.3fff detail Maksymalna trasa może mieć 10 hopów Source 000d.283d.73c1 found on 3750[WS C3750G 16TD] ( ) / WS C3750G 16TD / : Gi2/0/3 [auto, auto] => Gi1/0/4 [auto, auto] / WS C PWR / : Fa0/3 [auto, auto] => Fa0/23 [auto, auto] Destination b.3fff found on 3550[WS C PWR] ( ) Layer 2 trace completed. 24

25 Czy działa routing IP? (czyli, czy działa CEF) Oczywiście zakładamy wprowadzenie ip routing (nie jest domyślna!) c3560 dc# sh ip cef tree VRF Default tree information: MTRIE/RTREE storing IPv4 addresses 9 entries (9/0 fwd/non fwd) Forwarding tree: Forwarding lookup routine: IPv4 mtrie optimized 9 inserts, 0 deletes stride pattern short mask protection enabled for <= 4 bits without process suspension 9 leaves (252 bytes), 12 nodes (12480 bytes) total bytes leaf ops: 9 inserts, 0 deletes leaf ops with short mask protection: 1 insert, 0 deletes per prefix prefix length stats: lookup off, insert off, delete off refcounts: 806 leaf, 795 node node pools: pool[c/8 bits]: 12 allocated (0 failed), bytes Non Forwarding tree: 9 inserts, 9 deletes 0 leaves (0 bytes), 0 nodes (0 bytes) 0 total bytes 25

26 Problem z routingiem IP Cisco Catalyst 3750/3560/3550 część programowa # show ip route Software copy of the Routing entry for /24 9 0/24 Routing and ARP tables Known via "eigrp 1", distance 90, metric , type internal Redistributing via eigrp 1 Last update from on GigabitEthernet0/12, 00:01:42 ago Routing Descriptor Blocks: * , from , 00:01:42 ago, via GigabitEthernet0/ # show ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet ARPA GigabitEthernet0/ # show ip cef detail Software copy of the /24, version 19, epoch 0, cached adjacency FIB and Adjacency tables 0 packets, 0 bytes via , GigabitEthernet0/12, 0 dependencies next hop , GigabitEthernet0/12 FE1/0/0 FE2/0/0 Gig0/ valid cached adjacency # show adjacency gigabitethernet 0/12 detail Protocol Interface Address IP GigabitEthernet0/ (7) 0 packets, 0 bytes DDC ARP 03:49:45 Epoch: # show interface gig 0/12 GigabitEthernet0/12 is up, line protocol is up (connected) Hardware is Gigabit Ethernet, address is 0005.ddc (bia 0005.ddc5.8300) Internet address is /24 IP: Mac: ddc

27 Problem z routingiem IP Cisco Catalyst 3750/3560 część sprzętowa Jak port Gig1/0/3 obsłuży przychodzący pakiet IP z adresu do adresu ? ? FE0/ FE0/2 Gig2/0/ Gig1/0/ IP: Mac: 000b.462e.6f80 000d.bd5c.16c6 000d.bd5c.16c a7.bb00 In port SA mac DA mac SA IP DA IP protocol 3750# session # show platform forward gig 1/0/ a7.bb0 000d.bd5c.16c1 1 ip Global Port Number: 3, Asic Number: 1 Src Real Vlan Id: 1006, Mapped Vlan Id: 18 <output omitted> # show platform pm if numbers Egress: Asic 2, switch 2 Interface gid gpn lpn port slot unit slun Output Packets: Gi1/0/ / Packet 1 Lookup Key Used Index Hit A Data OutptACL 50_AC010302_AC _ _0000FF00 01FFE Port Vlan SrcMac DstMac Cos Dscpv Gi2/0/ XXXX.XXXX.02C6 000B.462E.6F # show vlan internal usage VLAN Usage 1006 GigabitEthernet1/0/ GigabitEthernet2/0/1 3750# show switch Current Switch# Role Mac Address Priority State 1 Slave 000c.30ae.4f00 9 Ready *2 Master 000d.bd5c Ready 27

28 Problem z routingiem IP Cisco Catalyst 3750/3560 część sprzętowa Jak przełącznik #1 w stosie 3750 obsłuży pakiet wysłany do ? 1 2? FE0/ FE0/2 Gig2/0/ Gig1/0/ IP: Mac: 000b.462e.6f d.bd5c.16c d.bd5c.16c a7.bb # session # show platform ip unicast route Fib /24 Fibflag:0x0 Bucket:0 Path(0)AdjIP: Vl: b.462e.6f80 AdjFl:0x00 OI:0x1 HL3UFlags:0x0 SFT Entry:hdl:0x5A HwFL:0x # show platform ip unicast adjacency Vlan:1009 Mac:000B:462E:6F80 OI:3 PDFlags:0x10 MAD:0x146DF6C(RWI:3) Ref:0 COMPLETE PIFlags:0x0 MAD OK MADProg OK Stn OK Mvid OK MvidLock VlLock:1009 HLFM_hdl: 0x172AAC4, Stn:0x # show vlan internal usage VLAN Usage 1006 GigabitEthernet1/0/ GigabitEthernet2/0/1 28

29 Problem z routingiem IP Cisco Catalyst 3550 część sprzętowa Jak port GE0/10 na przełączniku obsłuży przychodzący pakiet IP z adresu pod adres ? 9 21? FE1/0/ FE2/0/0 Gig0/ Gig0/ IP: Mac: ddc ddc a7.bb00 Port wejściowy Źródłowy y MAC Docelowy MAC Źródłowe IP Docelowe IP Nr. protokół # show forward gig 0/ a7.bb ddc ip got vlan 1025, vlaninfo 8401 signature: , comparison ind: 10, control info: A control map: vlan: 1025, vlanid entry: adjacency: ptr: 0x8 hash: 0 addr: 0xE898 data: E <output omitted> lookup key bk adata rawoff secoff sec route 42AC1054C8D10A GigabitEthernet0/12 vlan 1025, dst src 0005.ddc5.8300, cos 0x0, dscp 0x # show vlan internal usage VLAN Usage 1025 GigabitEthernet0/12 Informacje powyżej używane są do wykonania hermetyzacji pakietu otrzymanego z portu GE0/10 i wysyłanego do IP przez

31 IP Multicast w przełącznikach Catalyst Pełen multicastowy routing IP 3750, 3560 i 3550 tylko w EMI/IP Services IGMP snooping wszystkie Serwer CGMP 3750, 3560 i 3550 tylko w EMI/IP Services MVR (Multicast t VLAN Registration) ti wszystkie IGMP Querier 3750, i 2970 od 12.2(25)SEA 31

32 Problemy z multicastowym routingiem IP Cisco Catalyst 3750/3560/3550 część programowa Multicast Source SA GDA Gig0/ Gig0/11 FE/0/ FE0/3 FE0/24 FE0/2 FE0/ XL FE0/23 VLAN2 VLAN3 ( e-0a-0a-0a) # show ip mroute (*, ), 01:00:56/stopped, RP , flags: DC Incoming interface: Null, RPF nbr Outgoing interface list: Vlan3, Forward/Dense, 00:00:20/00:00:00 Vlan2, Forward/Dense, 00:00:55/00:00:00 ( , ), 00:55:25/00:02:58, flags: T Incoming interface: GigabitEthernet0/12, RPF nbr Outgoing interface list: Vlan3, Forward/Dense, 00:00:20/00:00:00, H Vlan2, Forward/Dense, 00:00:55/00:00:00, H # show ip igmp group IGMP Connected Group Membership Group Address Interface Uptime Expires Last Reporter Vlan2 02:52:47 00:02: Vlan3 00:00: :02: Vlan2 01:25:52 00:02: # show ip igmp interface vlan 3 Vlan3 is up, line protocol is up Internet t address is /241 1/24 IGMP is enabled on interface Current IGMP host version is 2 Current IGMP router version is 2 CGMP is enabled on interface IGMP query interval is 60 seconds IGMP querier timeout is 120 seconds IGMP max query response time is 10 seconds Last member query response interval is 1000 ms Inbound IGMP access group is not set IGMP activity: 10 joins, 9 leaves Multicast routing is enabled on interface Multicast TTL threshold is 0 Multicast designated router (DR) is (this system) IGMP querying router is (this system) No multicast groups joined # debug ip igmp > queries/reports, joins/leaves 32

33 Problemy z multicastowym routingiem IP Cisco Catalyst 3750/3560 część sprzętowa Gig1/0/ Gig2/0/2 Gig0/ Gig0/2 FE0/1 Multicast Source Gig0/3 SA GDA VLAN2 VLAN3 ( e-0a-0a-0a) In port SA mac DA mac SA IP DA IP protocol 3750# session # show platform forward gig g 1/0/3 / e0a.0a0a ip Global Port Number: 3, Asic Number: 1 Src Real Vlan Id: 1006, Mapped Vlan Id: 19 <output omitted> Egress: Asic 2, switch 2 Port Vlan SrcMac DstMac Cos Dscpv Gi2/0/ XXXX.XXXX.02C E0A.0A0A Gi2/0/ XXXX.XXXX.02C E0A.0A0A 3750# show vlan internal usage VLAN Usage 1006 GigabitEthernet1/0/3 3750# show platform pm if numbers interface gid gpn lpn port slot unit slun port type Gi1/0/ / remote 3750# show int vlan 2 Hardware is EtherSVI, address is 000d.bd5c.16c7 (bia 000d.bd5c.16c7) 3750# show int vlan 3 Hardware is EtherSVI, address is 000d.bd5c.16c8 (bia 000d.bd5c.16c8) 2950 FE0/2 33

34 Problemy z multicastowym routingiem IP Cisco Catalyst 3550 część sprzętowa Multicast Source SA GDA Gig0/ Gig0/11 FE/0/ FE0/3 FE0/24 FE0/2 FE0/ XL FE0/23 VLAN2 VLAN3 ( e-0a-0a-0a) In port SA mac DA mac SA IP DA IP protocol # show forward gig g 0/ e0a.0a0a ip got vlan 1025, vlaninfo 8401 <output omitted> GigabitEthernet0/11 vlan 3, dst e0a.0a0a src 0005.ddc5.8300, cos 0x0, dscp 0x0 GigabitEthernet0/11 vlan 2, dst e0a.0a0a src 0005.ddc5.8300, cos 0x0, dscp 0x # show vlan internal usage VLAN Usage 1025 GigabitEthernet0/ # show interfaces vlan 2 Vlan2 is up, line protocol is up Hardware is EtherSVI, address is 0005.ddc (bia 0005.ddc5.8300) # show interfaces vlan 3 Vlan3 is up, line protocol is up Hardware is EtherSVI, address is 0005.ddc (bia 0005.ddc5.8300) 34

35 Problemy z multicastami Cisco Catalyst 2970/2960 część programowa Gig1/0/ Gig2/0/2 Gig0/ Gig0/2 FE0/1 Multicast Source SA GDA ( e-0a-0a-0a) VLAN Gig0/3 VLAN FE0/2 2970# show ip igmp snooping <output omited> Vlan 2: IGMP snooping : Enabled Immediate leave : Disabled Multicast router learning mode : pim dvmrpp Source only learning age timer : 10 CGMP interoperability mode : IGMP_ONLY 2970# show ip igmp snooping mrouter Vlan ports 2 Gi0/1(dynamic) 3 Gi0/1(dynamic) 2970# show ip igmp snooping multicast dynamic Vlan Group Address Type Version Port List Vlan 3: IGMP v2 Gi0/1, Gi0/3 IGMP snooping : Enabled IGMP v2 Gi0/1, Gi0/2 Immediate leave : Disabled Multicast router learning mode : pim dvmrp Source only learning age timer : 10 CGMP interoperability mode : IGMP_ONLY 2970# show ip igmp snooping multicast count <output omited> Total number of multicast groups: 2 35

36 Problemy z multicastami Cisco Catalyst 2970/2960 część sprzętowa Gig1/0/ Gig2/0/2 Gig0/ Gig0/2 FE0/1 Multicast Source SA GDA ( e-0a-0a-0a) VLAN Gig0/3 VLAN # show platform ip igmp snooping hardware Vlan Group Address di atm sdi Switches x1AC7 0x20C4 0x009B x1AC5 0x20C2 0x FE0/2 2970# show platform port asic dest map index 0x1ac7 Ports: Gi0/3 Gi0/1 2970# show platform port asic dest map index 0x1ac5 Ports: Gi0/2 Gi0/1 In port In vlan SA mac DA mac SA IP DA IP protocol 2970#sh plat forward gig 0/1 vlan 2 000d.bd5c e0a.0a0a ip <output omited> Lookup Key Used Index Hit A Data OutptACL 50_EF0A0A0A_0A010A0A 0A010A0A 00_ _0000FF FF00 01FFE Port Vlan SrcMac DstMac Cos Dscpv Gi0/ D.BD5C E0A.0A0A 36

37 Problemy z multicastami Cisco Catalyst 2950 Gig0/ Gig0/11 FE/0/ FE0/3 FE0/ Multicast Source SA GDA ( e-0a-0a-0a) VLAN FE0/2 VLAN FE0/ # show ip igmp snooping <output omited> vlan 2 IGMP snooping is globally enabled IGMP snooping is enabled on this Vlan IGMP snooping immediate leave is enabled on this Vlan IGMP snooping mrouter learn mode is pim dvmrp on this Vlan IGMP snooping is running in IGMP_ONLY mode on this Vlan vlan 3 IGMP snooping is globally enabled IGMP snooping is enabled on this Vlan IGMP snooping immediate leave is disabled on this Vlan IGMP snooping mrouter learn mode is pim dvmrp on this Vlan IGMP snooping is running in IGMP_CGMP mode on this Vlan <output omited> 2950# show ip igmp snooping mrouter Vlan ports 2 Fa0/1(dynamic) 3 Fa0/1(dynamic) 2950# show mac address table multicast Vlan Mac Address Type Ports e0a.0a0a IGMP Fa0/1, Fa0/ e0a.0a0a IGMP Fa0/1, Fa0/3 2950# show mac address table multicast count Vlan Mac Address Type Ports Total Number of Multicast Addresses: 2 37

38 Problemy z multicastami Cisco Catalyst 2950 Gig0/ Gig0/11 FE/0/ FE0/3 FE0/ XL Multicast Source SA GDA ( e-0a-0a-0a) VLAN FE0/2 VLAN FE0/23 Host opuszcza grupę # debug ip igmp snooping group group debugging is on 21:20:23: IGMPSN: group: Leave for group received on Vlan 2, port Fa0/2 21:20:23: IGMPSN: group: Deleting port 1 from group on Vlan 2 21:20:23: IGMPSN: group: Deleting group :20:23: IGMPSN: group: Sending Leave for group on Vlan 2 do routera multicastowego :20:23: IGMPSN: group: Deleting gce e0a.0a0a # show mac address table multicast Vlan Mac Address Type Ports e0a.0a0a IGMP Fa0/1, Fa0/ # show ip mroute (można użyć debug ip igmp by obejrzeć ( , ), 03:32:17/00:02:59, flags: T proces usuwania/uzupełniania tablicy Incoming interface: GigabitEthernet0/12, RPF nbr na 3550) Outgoing interface list: Vlan3, Forward/Dense, 00:00:07/00:00:00, H 38

39 IGMP Querier Catalyst 3750/3560/3550/2970/2960) Switch# show ip igmp snooping querier vlan 2 detail Vlan IP Address IGMP Version Port Wprowadzony w 12.2(25)SEA2(25)SEA v2 Switch (dowolny feature-set) Global IGMP switch querier status Funkcjonalność IGMP Snooping pracuje w admin state t : Enabled konkretnym VLANie bez admin version : 2 obecności routera source IP address : multicastowego query interval (sec) : 60 max response time (sec) : 10 Wybieramy przełącznik L2 z querier timeout (sec) : 120 najniższym adresem IP jako tcn query count : 2 IGMP Querier tcn query interval (sec) : 10 Vlan 2: IGMP switch querier status IGMP Querier generuje IGMP General Query w regularnych odstępach czasu i w elected querier is (this switch is querier) admin state : Enabled admin version : 2 source IP address : query interval (sec) : 60 max response time (sec) : 10 querier timeout (sec) : 120 tcn query count : 2 tcn query interval (sec) : 10 operational state : Querier operational version : 2 tcn query pending count : 0 odpowiedzi na pakiet IGMP Global Leave Parametry dla VLANu brane są pod uwagę przed parametrami globalnymi l Należy włączyć IGMP snooping Switch# debug condition vlan 2 Switch# debug ip igmp snooping querier 39

41 Problemy z ACL Słowo kluczowe log : Kopia pakietu jest wysyłana ł do CPU (!) Użyj `no ip unreachables by zapobiec wysyłaniu pakietów do CPU Jeśli platforma sprzętowa osiągnie limit upakowania konfiguracji ACL, cała ACL będzie obsługiwana programowo (przez CPU) informacja w logach zaczynająca się od FM 3 UNLOADING: Na platformie 2940/2950 ACL filtrujące MAC dotyczą całego ruchu (IP i nie-ip), na pozostałych platformach tylko ruchu nie-ip Port ACLe przypisujemy do interfejsów fizycznych (L2) by filtrować ruch wchodzący do przełącznika (segmentu/vlanu) lub wychodzący (na platformach 2960/3560/3750) VLAN mapy nie mają kierunku, dotyczą wszystkich pakietów zarówno w ramach segmentu jak i wymienianych pomiędzy VLANami 41

42 Catalyst 3550 Skojarzenie interfejs<>tcam Model Ilość podsystemów TCAM Uwagi Catalyst Wszystkie interfejsy używają TCAM #1 Catalyst TCAM #1 odpowiada za FE0/1 0/360/36 TCAM #2 odpowiada za FE0/37-48 i GE0/1-02 TCAM #1 GE0/1-4 Catalyst T 3 TCAM #2 GE0/5-0/8 Catalyst G 3 TCAM #3 GE0/9-12 TCAM #1 GE0/1-4 TCAM #2 GE0/5-0/8 TCAM #3 GE0/9-12 Cztery ASICi obsługujące porty per TCAM Jeden ASIC przypada na jeden port GE lub 12 portów 10/100 FE 42

43 Catalyst 3550 Rozwiązywanie problemów z ACLami # show access list Extended d IP access list 102 permit tcp host host eq www deny ip any any (config)# interface gig 0/ (config if)# ip access group 102 in # show fm interface gig0/10 Input Port Label: T: TCAM #3 obsługuje gig 0/ = AC C8 (hex) = D1.0A (hex) # show tcam inacl 3 port labels 1 /32 host masks = FFFFFFFF (hex) Label Value : 4097(port label 1) Src port any = 0 Number of entries : 9 Entry List Dst port www(80) = 50 (hex) [...] Mask Index : 5 F5 FF FF FF FF FF FF FF FF FF C FF FF Entry Index : 33 Timestamp: 4 94 AC C8 D1 0A As Data(hex) :

44 Catalyst 3550 Rozwiązywanie problemów z ACLami T: TCAM #3 obsługuje port gig 0/ # show tcam inacl 3 size Ingress ACL TCAM Size: 3328 Entries # show tcam inacl 3 statistics Ingress ACL TCAM#3: Number of active labels: 5 Ingress ACL TCAM#3: Number of masks allocated: 17, available: 399 Ingress ACL TCAM#3: Number of entries allocated: 35, available: # show access lists hardware counters Input Drops: matches ( bytes) Output Drops: 0 matches (0 bytes) Input Forwarded: matches ( bytes) Output Forwarded: matches ( bytes) Input Bridge Only: 0 matches (0 bytes) Bridge and Route in CPU: 0 matches (0 bytes) Route in CPU: 7890 matches ( bytes) 44

45 Catalyst 3550 ACL nie mieści się w TCAM c3550(config)# int vlan 3 c3550(config if)# ip access group 191 in 00:37:51: %FM 3 UNLOADING: Unloading input vlan label 1 feature from all TCAMs c3550# show tcam inacl 1 statistics Ingress ACL TCAM#1: Number of active labels: 6 Ingress ACL TCAM#1: Number of masks allocated: 14, available: 402 Ingress ACL TCAM#1: Number of entries allocated: 43, available: 3285 c3550# show fm vlan 3 Input VLAN Label: 1 Output VLAN Label: 0 (default) Priority: normal c3550# show tcam inacl 1 vlan labels 1 Label Value : 8193(vlan label 1) Number of entries : 0 45

46 Catalyst 3750/3560/2960 Skojarzenie interfejs-asic 3750# show platform pm if numbers interface gid gpn lpn port slot unit slun port type lpn idb gpn idb Gi1/0/ / local Yes Yes Gi1/0/ / local Yes Yes Gi1/0/ / local Yes Yes Gi1/0/ / local Yes Yes Gi1/0/ / local Yes Yes Gi1/0/ / local Yes Yes Gi1/0/ / local Yes Yes Gi1/0/ / local Yes Yes [...] Każdy z ASICów pracuje w jednym z dwóch trybów w zależności od modelu: Dwa porty GE + 24 porty 10/100 Cztery porty GE Każdy z ASICów ma swój TCAM (za wyjątkiem 3750G-12S, który ma dwa TCAMy na ASIC) 46

47 Problemy z ACL Catalyst 3750/3560/2970/ # show access lists Extended IP access list (config)# int gig 2/0/1 permit tcp host host eq www 3750(config if)#ip access group 101 in deny ip any any Gig2/0/1 należy do mastera w stosie, sprawdzamy tablicę sprzętową ponieważ on obsługiwać będzie wejściową ACLkę 3750# show platform tcam table acl ===================================================== ACL Cam Table (#entries: 8192, startindex: 13696) Index ACL CAM Table ACL <output omitted> mask > F8_FFFFFFFF_FFFFFFFF FF_CC00FFFF_ _AC010102_AC _ _ L3 Input 3750# show platform acl interface gig 2/0/1 Input Label: 1 Output Label: Priority: normal = AC (hex) = AC (hex) /32 host masks = FFFFFFFF (hex) Src port any = 0 Dst port www(80) = 50 (hex) 3750# show platform tcam table acl index 49 detail <some output omitted> l3caminputacldescriptor Value Mask l3destination: AC FF.FF.FF.FF l3source: AC FF.FF.FF.FF l4destination: 50 FFFF l4source:

48 Problemy z ACL Catalyst 3750/3560/2970/2960 Port ASIC # 3750# show platform acl statistics 2 L2 ACL INPUT Statistics Drop: frame count: 1 Drop: bytes count: 64 Bridge Only: frame count: 8701 Bridge Only: bytes count: Forwarding To CPU: frame count: 1452 Forwarding To CPU: bytes count: ACL dotykające ruchu wyjściowego przetwarzane są przez wyjściowy port (i ASIC) w odróżnieniu od 3550, w którym wejściowy ASIC obsługuje wszystko Kopia pakietu trafiającego w regułę deny jest wysyłana do CPU z rate-limitem 20 p/s (nie wiemy na wyjściowym ASICu czy wejściowy miał ip unreachables ) L3 ACL INPUT Statistics Drop: frame count: Drop: bytes count: Bridge Only: frame count: 0 Bridge Only: bytes count: 0 Forwarding To CPU: frame count: 0 Forwarding To CPU: bytes count: 0 Forwarded: frame count: Port ASIC # Forwarded: bytes count: etc # show platform acl usage 2 ACL Type Label Entries Used 3750# show plat acl label 1 Input Op Select Index 255: Output Op Select Index 255: Input Features: Interfaces or VLANs: Gi2/0/1 Priority: normal Vlan Map: (none), 0 VMRs. Access Group: 101, 10 VMRs. Multicast Boundary: (none), 0 VMRs. etc... L2INPUT L3INPUT Used Available Total Mask Value

49 Problemy z VLAN mapą Catalyst 3750/3560/2970/ (config)#ip access list extended http 2970(config ext nacl)#permit nacl)#permit tcp host host eq www 2970(config)#vlan access map map (config access map)#match ip address http 2970(config access map)#action drop 2970(config)#ip access list extended match_all 2970(config ext nacl)#permit ip any any 2970(config)#vlan access map map (config access map)#match ip address match_all 2970(config access map)#action i forward 2970(config)# vlan filter map2 vlan # show platform tcam table acl ==================================================================== mask > F8_FFFFFFFF_FFFFFFFF FF_CC00FFFF_ _0A010122_0A _ _ L3 Input mask > F8_FFFFFFFF_FFFFFFFF FF_CC00FFFF_ _0A010122_0A _ _ L3 Output 2970# show platform acl interface gig 0/2 Input Label: 1 Output t Label: 1 Priority: normal 2970# show interface gig 0/2 switchport Switchport: Enabled Access Mode VLAN: 1 (default) 49

50 ACL na 2960 ACL i QoS obsługiwane są sprzętowo Brak ograniczeń na IMASK/IPORT znanych z 2950 Te same funkcjonalności jak na 3560 z następującymi różnicami: Funkcjonalność PACL Tak Tak VACL Nie Tak RACL Nie Tak Dynamiczne ACLe Nie Tak Dokładność wejściowego rate-limitu 1Mbit/s 8kbit/s Policing per ASIC per VLAN Nie Tak Policing per VLAN Nie Tak 50

52 Problemy z QoS Catalyst 2950 ruch wejściowy 2950# show mls qos int fast 0/4 FastEthernet0/4 trust state: trust dscp trust mode: trust dscp COS override: dis default COS: 0 pass through: none trust device: none DSCP 0 and 40 IP Traffic dot1q FE0/ Trust DSCP Policer IPin dot1q FE0/1 Map CoS = 5 to Expedite Queue 2950# show mls qos int fast 0/4 policers FastEthernet0/4 policymap=ipin 2950# show policy map Policy Map IPin class ipclass1 police exceed action drop 2950# show class map Class Map match any class default (id 0) Match any Class Map match all ipclass1 (id 2) Match access group # show access lists Extended IP access list 101 permit ip any any 2950# show running config! class map match all ipclass1 match access group 101!! policy map IPin class ipclass1 police exceed action drop! interface FastEthernet0/4 switchport mode trunk service policy input IPin mls qos trust dscp! access list 101 permit ip any any 52

53 Problemy z QoS Catalyst 2950 ruch wyjściowy Expedite 2950# show running config Queue #4! wrr queue bandwidth wrr queue cos map wrr queue cos map wrr queue cos map 3 4 wrr queue cos map Queue # DSCP 0 and 40 IP Traffic dot1q FE0/ Trust DSCP Policer IPin dot1q FE0/1 Map CoS = 5 to Expedite Queue 2950# show mls qos maps dscp cos cos Bez policera: Dscp cos map: dscp: # show interface counters Port InOctets InUcastPkts InMcastPkts InBcastPkts cos: Fa0/ Port OutOctets OutUcastPkts OutMcastPkts OutBcastPkts Fa0/ # show wrr queue cos map CoS Value : Priority Queue : # show wrr queue bandwidth WRR Queue : Bandwidth : Z policerem: 2950# show interface counters Port InOctets InUcastPkts InMcastPkts InBcastPkts Fa0/ Port OutOctets OutUcastPkts OutMcastPkts OutBcastPkts Fa0/

54 Problemy z QoS Catalyst 3550 ruch wejściowy 3550# show running config mls qos access list 1 permit access list 2 permit any mls qos aggregate police 48kpolicer exceed action policed dscp transmit mls qos map policed dscp to 0 dot1q 3550 GEO/12 Trust/Mark Ruch DSCP 0 z Agg Policer i ruch oznaczony DSCP 40 dot1q GE 0/11 Mapuj CoS = 5 na kolejkę expedite class map ipclass1 match access group 1 class map ipclass2 match access group 2 policy map ingress1 class ipclass1 set ip dscp 24 police aggregate 48kpolicer class ipclass2 trust ip precedence police aggregate 48kpolicer interface GigabitEthernet0/12 switchport trunk encapsulation dot1q switchport mode trunk flowcontrol send off mls qos monitor dscp service policy input ingress1 Uwaga: Ustawienie trust w policy-mapie nadpisuje ustawienie interfejsu 3550# show mls qos interface gig0/12 policers GigabitEthernet0/12 policymap=ingress1 type=shared, id=0 name=48kpolicer 3550# show mls qos interface gig 0/12 statistics GigabitEthernet0/12 Ingress dscp: incoming no_change classified policed dropped bytes 0 : : : Others: <egress output t omitted> Ruch z miał DSCP = 0, co zreklasyfikowano na DSCP 24 (CoS = 3) Zarówno ruch z zaufanego DSCP 40 (CoS = 5) iruch poddany reklasyfikacj do DSCP 24 zostały następnie przycięte do 48kbit/s 54

55 Problemy z QoS Catalyst 3550 ruch wyjściowy 3550# show mls qos interface gig0/11 queueing GigabitEthernet0/11 Egress expedite queue: ena queue #4 wrr bandwidth weights: qid weights 1 75 jak często obsługujemy kolejke (współczynnik dla wrr) when expedite queue is disabled <output omitted> Cos queue map: Cos qid 5 4 CoS 5 zamapowano do kolejki #4 DSCP 0 Traffic Sourced from and DSCP 40 Traffic Map CoS =5 to expedite queue dot1q 3550 GEO/12 Trust/Mark Agg Policer dot1q GEO/11 Map CoS = 5 to Expedite Queue 3550(config if)# int gig 0/11 wrr queue cos map wrr queue bandwidth priority queue out mls qos monitor dscp # show mls qos interface gig 0/11 statistics GigabitEthernet0/11 <ingress output omitted> Egress dscp: incoming no_change classified policed dropped (in bytes) 0 : n/a n/a 0 0 Ingress Policed DSCP 24 and 40 marked 24: 576 n/a n/a 0 0 down to DSCP 0 40: 8448 n/a n/a 0 0 DSCP 24 and 40 traffic that t did not Others: 240 n/a n/a 0 0 exceed the ingress policed rate and WRED drop counts: so was not policed down to DSCP 0 qid thresh1 thresh2 FreeQ 1 : : : :

56 Wynik wejściowego policera 3550# show mls qos interface gig 0/12 statistics GigabitEthernet0/12 Ingress dscp: incoming no_change classified policed dropped (in bytes) 0 : : : Others: Interfejs z włączonym policingiem ruchu wejściowego Łącznie bajtów otrzymanych: 960, ,000 (z powyższego) = 1,600,000 bytes Wymagany czas by otrzymać ten ruch: 1,600,000 bajtów/64 bajty (rozmiar pakietów) = 25,000 pakietów/148, p/s (ruch ze źródła) = sekundy Część ogólnej ilości bajtów pasujących do rate-limitera (nie obciętych) : 48,000 b/s (ustawiony policer rate) x sekundy = 8064 bitów/8 = 1008 bajtów bajtów (dozwolony burst) = 9008 bajtów (1) Ruch przekraczający ustawiony limit: it 959, ,552 (z powyżej) ż = 1,590, bajtów (2) 3550# show mls qos interface gig 0/11 statistics GigabitEthernet0/11 <ingress output omitted> Egress dscp: incoming no_change classified policed dropped (in bytes) 0 : n/a n/a : 576 n/a n/a : 8448 n/a n/a 0 0 Others: 240 n/a n/a 0 0 Interfejs wyjściowy Ruch z DSCP 0 ( ) jest bliski wartości (2), ruch nie obcięty z DSCP 24 i 40 ( = 9024) jest bliski wartości (1) 56

57 Problemy z QoS Catalyst 3750/3560/2970/2960 ruch wejściowy 3750(config)# mls qos 3750(config)# int gig 1/0/3 3750(config if)# mls qos trust dscp Kolejka (config)# mls qos srr queue input threshold mls qos srr queue input dscp map queue 1 threshold 2 24 DSCP0, DSCP24, & DSCP40 Traffic 3750 Gig1/0/3 Trust DSCP Map DSCP40 to Expedite Queue Gig2/0/2 Shape/Share Map DSCP40 to Expedite Queue 3750# show mls qos input queue Queue : 1 2 buffers : bandwidth : 4 4 priority : 0 10 threshold1: threshold2: SRR obsługuje najpierw Q2 do skonfigurowanego limitu 10% w ramach pasma priority it SRR dzieli następnie pozostałe 90% równo pomiędzy Q1 i Q2 zgodnie z współczynnikiem 4:4 bandwidth przyznając każdej z kolejek 45% domyślny % rozmiar kolejki priorytetowej jest mniejszy (mniej ruchu, obsługiwane częściej) domyślnie kolejki obsługiwane przez SRR po obsłużeniu kolejki priorytetowej domyślnie kolejka 2 jest kolejką ą priorytetową ą stąd ą więcej ę jpasma/większa ę waga ndwidth weight domyślnie DSCP0 używa Q1, DSCP40 używa Q2/T1. DSCP24 skonfigurowano by używać Q1/T2 3750# show mls qos maps dscp input q Dscp inputq threshold map: d1 :d : : : : : : :

58 Problemy z QoS Catalyst 3750/3560/2970/2960 ruch wejściowy DSCP0, DSCP24, & DSCP40 Traffic 3750# clear mls qos int gig 1/0/3 statistics 3750# show mls qos int gig 1/0/3 statistics GigabitEthernet1/0/3 dscp: incoming 3750 Gig1/0/3 Trust DSCP Map DSCP40 to Expedite Queue 0 4 : <output omitted : <output omitted> : : dscp: outgoing <output omitted> cos: incoming 0 4 : : cos: outgoing 0 4 : : Policer: Inprofile: 0 OutofProfile: 0 Gig2/0/2 Shape/Share Map DSCP40 to Expedite Queue 58

59 Problemy z QoS Catalyst 3750/3560/2970/2960 ruch wejściowy DSCP0, DSCP24, & DSCP40 Traffic 3750 Gig1/0/3 Trust DSCP Map DSCP40 to Expedite Queue Gig2/0/2 Shape/Share Map DSCP40 to Expedite Queue 3750# show platform pm if numbers interface gid gpn lpn port slot unit slun port type Gi1/0/ / remote 3750# session # show plat port asic stats enqueue port 0 asic 1 <output omitted> RxQueue Enqueue Statistics Queue 0 Weight 0 Frames 0 Weight 1 Frames 8 Weight 2 Frames 0 Queue 1 Weight 0 Frames 0 Weight 1 Frames 0 Weight 2 Frames 0 Queue 2 Weight 0 Frames 1000 Weight 1 Frames 3000 Weight 2 Frames 39 Queue 3 Weight 0 Frames 2000 Weight 1 Frames 0 Weight 2 Frames 0 Pierwsze dwie kolejki są wewnętrzne Q1 Q2 (Expedite) # show plat port asic stats drop port 0 asic 1 <output omitted> RxQueue Drop Statistics Queue 0 Weight 0 Frames: 0 Weight 1 Frames: 0 Weight 2 Frames: 0 Queue 1 Weight 0 Frames: 0 Weight 1 Frames: 0 Weight 2 Frames: 0 Queue 2 Weight 0 Frames: 0 Weight 1 Frames: 0 Weight 2 Frames: 0 Queue 3 Weight 0 Frames: 0 Weight 1 Frames: 0 Weight 2 Frames: 0 59

60 Problemy z QoS Catalyst 3750/3560/2970/2960 ruch wyjściowy 3750(config)# int gig g 2/0/ (config if)# priority queue out 3750# show mls qos int gig 2/0/2 queueing GigabitEthernet2/0/2 Egress Priority Queue : enabled Shaped queue weights (absolute) : Shared queue weights : The port bandwidth limit : 100 The port is mapped to qset : 1 DSCP0, DSCP24, & DSCP40 Traffic Gig1/0/3 Trust DSCP Map DSCP40 to Expedite Queue Gig2/0/2 Shape/Share Map DSCP40 to Expedite Queue Q1 jest kolejką priorytetową: ustawienia shaping/sharing nie są brane pod uwagę Q1 ma gwarantowane 25% pasma i limitujemy ją do tego pułapu domyślnie wszystkie cztery kolejki obsługiwane są przez SRR domyślnie nie ograniczamy pasma PRIORITY-QUEUE OUT jeśli kolejka jest priorytetowa, ani shaping ani sharing nie będzie jej dotyczył SRR-QUEUE BANDWIDTH SHAPE jeśli kolejka nie jest priorytetowa, używamy ustawień dla shapingu SRR-QUEUE BANDWIDTH SHARE jeśli kolejka nie jest ani priorytetowa ani nie podlega shapingowi, jest w trybie współdzielenia pasma 3750# show mls qos maps dscp output q Dscp outputq threshold threshold map: d1 :d : : : : : : : DSCP40 = Q1/T1, DSCP0 = Q2/T1, DSCP24 = Q3/T1 (domyślnie) 60

Pokazać jeszcze