[j-nsp] OSPF Sham link question

Doug Marschke doug at ipath.net
Fri Dec 7 15:45:06 EST 2007


Hello David,

I have admittedly not looked at all your output but sham links should
show up as normal point to Point links in OSPF.  A few points:

-Routes learned over sham links must still be learned over bgp as PE
routers user only BGP routes for forwarding
-Must ensure that the sham-link end points (unique loopback unit) is
also advertised via bgp to the remote PE

For example:
[edit routing-instances vpn-a]
lab at PBR# show 
instance-type vrf;
interface fe-0/0/0.0;
interface lo0.1;
vrf-target {
    import target:65412:100;
    export target:65412:100;
}
protocols {
    ospf {
        sham-link local 10.1.1.1;
        area 0.0.0.0 {
            sham-link-remote 10.2.2.2 metric 1;
            interface fe-0/0/0.0;
            interface lo0.1;
        }
    }
}

[edit interfaces]
lab at PBR# show 
lo0 {
    unit 1 {
        family inet {
            address 10.1.1.1/32;
        }
    }
}

Then you should see the sham-link in your ospf commands:

lab at PBR> show ospf interface instance vpn-a 
Interface              State     Area            DR ID           BDR ID
Nbrs
fe-0/0/0.0             BDR      0.0.0.0         192.168.20.1    10.1.1.1
1
lo0.1                  DR       0.0.0.0         10.1.1.1        0.0.0.0
0
shamlink.0             PtToPt   0.0.0.0         0.0.0.0         0.0.0.0
1

lab at PBR show ospf neighbor instance vpn-a     
  Address         Interface             State      ID              Pri
Dead
10.0.21.2        fe-0/0/0.0             Full      192.168.20.1     128
35  
10.2.2.2         shamlink.0             Full      10.2.2.2           0
31  

lab at PBR> show ospf database instance vpn-a 

    OSPF link state database, area 0.0.0.0
 Type       ID               Adv Rtr           Seq      Age  Opt  Cksum
Len 
Router  *10.1.1.1         10.1.1.1         0x80000081   631  0x2  0xa0f6
72
Router   10.2.2.2         10.2.2.2         0x80000084   630  0x2  0x6918
72
Router   192.168.20.1     192.168.20.1     0x800000ae   632  0x2  0x9641
48
Router   192.168.28.1     192.168.28.1     0x800000b2   629  0x2  0x5754
48
Network  10.0.21.2        192.168.20.1     0x800000ab   632  0x2  0xed96
32
Network  10.0.29.2        192.168.28.1     0x800000ae   629  0x2  0xc69f
32
-----Original Message-----
From: juniper-nsp-bounces at puck.nether.net
[mailto:juniper-nsp-bounces at puck.nether.net] On Behalf Of David Ball
Sent: Friday, December 07, 2007 8:14 AM
To: Sergio D.
Cc: juniper-nsp at puck.nether.net; davidball at gmail.com
Subject: Re: [j-nsp] OSPF Sham link question

  Sergio,

   In your tests, what indication did you see that the sham link was
up and working as expected?  Did it appear as an OSPF neighbor in 'sh
ospf neigh instance <name>' ?  did something specific occur in your
log file (if you enabled one) that indicated 'sham link up!'.  I
suppose one of the difficulties I'm having is that I don't know what I
should expect to see from the sham link, nor can I tell if it's up or
down.

David


On 07/12/2007, Sergio D. <sdanelli at gmail.com> wrote:
> If this becomes an inter-area type-3 LSA, the remote PE-CE will always
> prefer the on-demand back-up link. If this is correct, then I don't
see the
> point of a sham-link.
> >From my tests this has worked as designed, if all routers are
configured
> with the same area with a sham-link between PE-PE then the LSA stays
as a
> type-1.
>
>
http://www.juniper.net/techpubs/software/junos/junos84/swconfig84-vpns/i
d-10939238.html#id-10939238
>
> On Dec 7, 2007 3:13 AM, Daniel Lete <daniel.lete at heanet.ie> wrote:
>
> > Hello Sergio,
> > In the PE where the CE is connected to, LSA Type-1 from CE should be
seen
> > as
> > LSA Type-1
> >
> > In the remote PE, LSA Type-1 from that same CE should be seen as LSA
> > Type-3
> > (inter-area)
> >
> > Daniel
> >
> > Sergio D. wrote:
> > > But you should at least be learning the loopbacks from each side
as  a
> > > type-1 LSA.
> > > How are these routes showing on the PEs "show route protocol ospf
table
> > > sham-link-test"  ? I think I missed that output or sorry if it was
> > already
> > > mentioned.
> > >
> > >
> > >
> > > Message: 4
> > > Date: Thu, 06 Dec 2007 15:04:03 +0000
> > > From: Daniel Lete <daniel.lete at heanet.ie>
> > > Subject: Re: [j-nsp] OSPF Sham link question
> > > To: David Ball <davidtball at gmail.com>
> > > Cc: juniper-nsp at puck.nether.net
> > > Message-ID: <47580F63.10905 at heanet.ie>
> > > Content-Type: text/plain; charset=ISO-8859-1; format=flowed
> > >
> > > Hello David,
> > > Your comment below:
> > >  > (NB: is it normal that the routes PE2 is learning from the m10
are
> > > 'Extern' ?)
> > >
> > > may not be related at all with sham links or even with
rfc2547/rfc4364.
> > If
> > > you
> > > are injecting prefixes into OSPF (redistribute in Cisco or export
in
> > > Juniper)
> > > in your CE, then those prefixes will appear as LSA Type-5
(external if
> > you
> > > want).
> > >
> > > Daniel
> > >
> > >
> > >
> > > David Ball wrote:
> > >>   Should have mentioned earlier (in case it's relevant), the
reason
> > >> for sham-link requirement is that there 'will' be a slow backup
link
> > >> between the cisco and the m10, but it'll be direct, so the cisco
and
> > >> m10 will think that's the better link (due to intra-area).  So,
was
> > >> hoping to use sham-link across T640s to bring things closer to
'par'
> > >> and have those routes appear as intra-area and ultimately prefer
the
> > >> sham-link.
> > >>   I was, but am no longer, explicitly exporting routes from BGP
into
> > >> OSPF on the PEs.  As requested, more configs and show cmd output
> > >> included.  I appreciate the feedback so far by the way....thanks
> > >> again.
> > >>
> > >> m10's loopback is 172.16.0.3
> > >> cisco's loopback is 172.16.0.4
> > >>
> > >> Pertinent configs from PE1 (T640 facing Cisco):
> > >> lo0 {
> > >>     unit 800 {
> > >>         description "sham-link testing";
> > >>         family inet {
> > >>             filter {
> > >>                 input secure-router-shamlink-test;
> > >>             }
> > >>             address 172.16.0.2/32;
> > >>         }
> > >>     }
> > >> }
> > >>
> > >> ge-7/0/0 {  <---- int facing Cisco
> > >>     unit 0 {
> > >>         family inet {
> > >>             address 172.16.2.1/30;
> > >>         }
> > >>     }
> > >> }
> > >>
> > >> sham-link-test {
> > >>     instance-type vrf;
> > >>     interface ge-7/0/0.0;
> > >>     interface lo0.800;
> > >>     vrf-target target:25983:800;
> > >>     vrf-table-label;
> > >>     protocols {
> > >>         ospf {
> > >>             sham-link local 172.16.0.2;
> > >>             area 0.0.0.0 {
> > >>                 sham-link-remote 172.16.0.1 metric 1;
> > >>                 interface ge-7/0/0.0 {
> > >>                     metric 1;
> > >>                 }
> > >>             }
> > >>         }
> > >>     }
> > >> }
> > >>
> > >>
> > >> Pertinent configs from PE2 (T640 facing M10):
> > >>
> > >> lo0 {
> > >>     unit 800 {
> > >>         description "sham-link test";
> > >>         family inet {
> > >>             filter {
> > >>                 input secure-router-shamlink-test;
> > >>             }
> > >>             address 172.16.0.1/32;
> > >>         }
> > >>     }
> > >> }
> > >>
> > >> ge-7/2/1 {      <--------facing m10
> > >>     unit 0 {
> > >>         family inet {
> > >>             address 172.16.1.1/30;
> > >>         }
> > >>     }
> > >> }
> > >>
> > >> sham-link-test {
> > >>     instance-type vrf;
> > >>     interface ge-7/2/1.0;
> > >>     interface lo0.800;
> > >>     vrf-target target:25983:800;
> > >>     vrf-table-label;
> > >>     protocols {
> > >>         ospf {
> > >>             sham-link local 172.16.0.1;
> > >>             area 0.0.0.0 {
> > >>                 sham-link-remote 172.16.0.2 metric 1;
> > >>                 interface ge-7/2/1.0 {
> > >>                     metric 1;
> > >>                 }
> > >>             }
> > >>         }
> > >>     }
> > >> }
> > >>
> > >> OSPF neighbors as seen from PE1:
> > >>> show ospf neighbor instance sham-link-test
> > >>   Address         Interface             State      ID
Pri
> > >  Dead
> > >> 172.16.2.2       ge-7/0/0.0             Full      172.16.0.4
1
> > >  36
> > >> OSPF neighbors as seen from PE2:
> > >>> show ospf neighbor instance sham-link-test
> > >> Address          Interface              State     ID
Pri
> > >  Dead
> > >> 172.16.1.2       ge-7/2/1.0             Full      172.16.0.3
128
> > >  31
> > >> Proof that PE1 is learning PE2's loopback via BGP:
> > >>> show route table sham-link-test
> > >> sham-link-test.inet.0: 9 destinations, 9 routes (9 active, 0
holddown,
> > 0
> > > hidden)
> > >> + = Active Route, - = Last Active, * = Both
> > >>
> > >> 172.16.0.1/32      *[BGP/170] 12:43:03, localpref 100, from
1.7.1.43
> > >>                       AS path: I
> > >>                     > to 1.7.2.18 via ge-0/2/0.0,
label-switched-path
> > >> NCP-LSP-00819-005-043
> > >>                       to 1.7.2.1 via ge-0/0/0.0,
label-switched-path
> > >> NCP-LSP-00819-005-043
> > >> 172.16.0.2/32      *[Direct/0] 20:29:55
> > >>                     > via lo0.800
> > >>
> > >> Proof that PE2 is learning PE1's loopback via BGP:
> > >>> show route table sham-link-test
> > >> sham-link-test.inet.0: 9 destinations, 9 routes (9 active, 0
holddown,
> > 0
> > > hidden)
> > >> + = Active Route, - = Last Active, * = Both
> > >>
> > >> 172.16.0.1/32      *[Direct/0] 21:04:41
> > >>                     > via lo0.800
> > >> 172.16.0.2/32      *[BGP/170] 18:50:17, localpref 100, from
1.7.1.5
> > >>                       AS path: I
> > >>                     > to 1.7.2.17 via ge-0/2/0.0,
label-switched-path
> > >> NCP-LSP-00829-043-005
> > >>                       to 1.7.2.5 via ge-0/0/0.0,
label-switched-path
> > >> NCP-LSP-00829-043-005
> > >>
> > >> OSPF database according to PE1 (Cisco isn't sending
much/anything...my
> > >> current goal is for the Cisco to learn what the m10 sends, then
I'll
> > >> move on):
> > >>> show ospf database instance sham-link-test
> > >>     OSPF link state database, Area 0.0.0.0
> > >>  Type       ID               Adv Rtr           Seq      Age  Opt
Cksum
> > >  Len
> > >> Router  *172.16.0.2       172.16.0.2       0x80000037   876  0x22
> > 0xfdff
> > >  36
> > >> Router   172.16.0.4       172.16.0.4       0x80000029  1111  0x22
> > 0xa757
> > >  36
> > >> Network  172.16.2.2       172.16.0.4       0x80000022  1372  0x22
> > 0x9a80
> > >  32
> > >>
> > >> OSPF database according to PE2:
> > >>> show ospf database instance sham-link-test
> > >>     OSPF link state database, Area 0.0.0.0
> > >>  Type       ID               Adv Rtr           Seq      Age  Opt
Cksum
> > >  Len
> > >> Router  *172.16.0.1       172.16.0.1       0x80000024  1912  0x22
> > 0x1ef6
> > >  36
> > >> Router   172.16.0.3       172.16.0.3       0x80000425   735  0x22
> > 0xc475
> > >  48
> > >> Network  172.16.1.2       172.16.0.3       0x8000002e   435  0x22
> > 0x7b97
> > >  32
> > >> OpaqArea 1.0.0.1          172.16.0.3       0x80000413  1335  0x22
> > 0xaeea
> > >  28
> > >>     OSPF AS SCOPE link state database
> > >>  Type       ID               Adv Rtr           Seq      Age  Opt
Cksum
> > >  Len
> > >> Extern   172.16.16.0      172.16.0.3       0x80000034  1035  0x22
> > 0xbf33
> > >  36
> > >> Extern   192.168.101.0    172.16.0.3       0x80000036   135  0x22
> > 0xe40a
> > >  36
> > >> (NB: is it normal that the routes PE2 is learning from the m10
are
> > > 'Extern' ?)
> > >> Here is Cisco's current routing table (learning nothing via
OSPF):
> > >> lab-2651#sho ip route
> > >> Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
> > >>        D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter
area
> > >>        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external
type 2
> > >>        E1 - OSPF external type 1, E2 - OSPF external type 2
> > >>        i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 -
IS-IS
> > > level-2
> > >>        ia - IS-IS inter area, * - candidate default, U - per-user
> > static
> > > route
> > >>        o - ODR, P - periodic downloaded static route
> > >>
> > >> Gateway of last resort is not set
> > >>
> > >> C    172.17.0.0/16 is directly connected, FastEthernet0/1
> > >>      172.16.0.0/30 is subnetted, 1 subnets
> > >> C       172.16.2.0 is directly connected, FastEthernet0/0
> > >> C    208.98.239.0/24 is directly connected, FastEthernet0/1
> > >> lab-2651#
> > >>
> > >>
> > >> Here is M10's inet.0 routing table:
> > >>> show route
> > >> inet.0: 10 destinations, 10 routes (10 active, 0 holddown, 0
hidden)
> > >> Restart Complete
> > >> + = Active Route, - = Last Active, * = Both
> > >>
> > >> 0.0.0.0/0          *[Static/5] 5w4d 23:37:59
> > >>                       Reject
> > >> 172.16.0.3/32      *[Direct/0] 2w0d 19:06:21
> > >>                     > via lo0.0
> > >> 172.16.1.0/30      *[Direct/0] 21:05:30
> > >>                     > via ge-0/1/0.0
> > >> 172.16.1.2/32      *[Local/0] 21:05:30
> > >>                       Local via ge-0/1/0.0
> > >> 172.16.16.0/24     *[Static/5] 21:02:54
> > >>                       Discard
> > >> 192.168.8.0/24     *[Static/5] 5w4d 23:37:59
> > >>                     > to 192.168.101.252 via fxp0.0
> > >> 192.168.9.0/24     *[Static/5] 5w4d 23:37:59
> > >>                     > to 192.168.101.252 via fxp0.0
> > >> 192.168.101.0/24   *[Direct/0] 5w4d 23:37:59
> > >>                     > via fxp0.0
> > >> 192.168.101.33/32  *[Local/0] 5w4d 23:37:59
> > >>                       Local via fxp0.0
> > >> 224.0.0.5/32       *[OSPF/10] 5w4d 23:38:00, metric 1
> > >>                       MultiRecv
> > >>
> > >>
> > >>
> > >> On 05/12/2007, Peter E. Fry <pfry-lists at redsword.com> wrote:
> > >>> ----- Original Message -----
> > >>> From: Daniel Lete <daniel.lete at heanet.ie>
> > >>>
> > >>> [...]
> > >>>> In relation to your sham-link. You need a loopback IP
> > >>>> within your VRF to act as  source/destination of the sham
> > >>>> link and these loopbacks are NOT to be announced  to your
> > >>>> CE.
> > >>>  I was going to make that point -- that is, I would not
> > >>> expect to see:
> > >>>
> > >>>> O IA    172.16.0.3/32 [110/11] via 172.16.2.1, 04:31:29,
> > >>> FastEthernet0/0
> > >>>
> > >>> ...(although I could be wrong -- I don't get many looks into
> > >>> CPE).  Also, I'd expect the sham-link neighbor to show up on
> > >>> the PE.  You can see them on Cisco PEs, for instance:
> > >>>
> > >>> CiscoPE#show ip ospf [process] neighbor
> > >>>
> > >>> Neighbor ID     Pri   State           Dead Time   Address
> > >>>     Interface
> > >>> [...]
> > >>> [Remote ID IP]    0   FULL/  -           -        [Remote LB
> > >>> IP]  OSPF_SLn
> > >>> [...]
> > >>> CiscoPE#
> > >>>
> > >>> ...so there's no confusion as to the state of the sham link.
> > >>>  I don't have a Juniper L3 VPN PE or a Cisco CE handy.
> > >>>
> > >>> Peter E. Fry
> > >>>
> > >>>
> > >>>
> > >>> _______________________________________________
> > >>> juniper-nsp mailing list juniper-nsp at puck.nether.net
> > >>> https://puck.nether.net/mailman/listinfo/juniper-nsp
> > >>>
> > >> _______________________________________________
> > >> juniper-nsp mailing list juniper-nsp at puck.nether.net
> > >> https://puck.nether.net/mailman/listinfo/juniper-nsp
> > >>
> > >
> > > --
> > > Daniel Lete Murugarren
> > > HEAnet Limited, Ireland's Education and Research Network
> > > 1st Floor, 5 George's Dock, IFSC, Dublin 1
> > > Registered in Ireland, no 275301  tel: +353-1-660 9040  fax:
+353-1-660
> > 3666
> > > web: http://www.heanet.ie/
> > >
> > >
> >
> > --
> > Daniel Lete Murugarren
> > HEAnet Limited, Ireland's Education and Research Network
> > 1st Floor, 5 George's Dock, IFSC, Dublin 1
> > Registered in Ireland, no 275301  tel: +353-1-660 9040  fax:
+353-1-660
> > 3666
> > web: http://www.heanet.ie/
> >
>
>
>
> --
> Sergio Danelli
> JNCIE #170
> _______________________________________________
> juniper-nsp mailing list juniper-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/juniper-nsp
>
_______________________________________________
juniper-nsp mailing list juniper-nsp at puck.nether.net
https://puck.nether.net/mailman/listinfo/juniper-nsp



More information about the juniper-nsp mailing list