Booches.nl

XS4ALL, Cisco 877 and IPv6

A while ago my ISP XS4ALL started with the distribution of IPv6 prefixes to their customers. So as a network engineer I wanted to have my own /48 prefix. Sadly I didn’t had time to start testing at the beginning of the IPv6 “launch”.

Last week I found some time to start my testing. I started by configuring my external DSL interface to run in dual-stack mode. The IPv4 configuration is straightforward and isn’t part of this article.

Below you see the basic configuration of the Dialer interface to enable IPv6. The commands configure the Dialer interface as DHCP client (autoconfiguration on the interface) and the prefix delegation name is “my_prefix”.

interface Dialer1
ipv6 address autoconfig
ipv6 enable
ipv6 dhcp client pd my_prefix rapid-commit
end

You can check the allocation of the IPv6 address prefix with the following command:

C877W#show ipv6 general-prefix
IPv6 Prefix prefix_ipv6, acquired via DHCP PD
2001:980:3441::/48 Valid lifetime , preferred lifetime
BVI1 (Address command)

More information about the allocation can also be obtained with the following command:

C877W#show ipv6 dhcp interface
Dialer1 is in client mode
State is OPEN
Renew will be sent in 00:11:48
List of known servers:
Reachable via address: FE80::90:1A00:1A1:88E6
DUID: 000200000A4C453332302F373435414333334558322F01
Preference: 0
Configuration parameters:
IA PD: IA ID 0×00100001, T1 3600, T2 5760
Prefix: 2001:980:3441::/48
preferred lifetime 7200, valid lifetime 7200
expires at Jan 31 2011 12:24 PM (4310 seconds)
DNS server: 2001:888:0:6::66
DNS server: 2001:888:0:9::99
Information refresh time: 0
Prefix name: my_prefix
Rapid-Commit: enabled

Now you need to configure IPv6 routing, especially the default route and enabling unicast-routing, with the following commands:

ipv6 unicast-routing

ipv6 route ::/0 Dialer1

The next step involves the configuration of the LAN interface to support IPv6. RFC 3177 recommends the delegation of /48 prefixes to home network subscribers, small and large organizations. It looks like my ISP follows that recommendation. The same RFC states that a /64 prefix should be assigned to different host subnets. So I can configure 2^16 host subnets and each subnet can contain 2^64 IPv6 addresses. Seems enough for my home environment.

The inside interface (a Bridged Virtual Interface in my scenario) is configured with the following /64 prefix.

ipv6 address my_prefix 0:0:0:1::/64 eui-64

You can use the following command to look at the IPv6 configuration of the different interfaces.

C877W#show ipv6 interface brief
BVI1                       [up/up]
FE80::21A:6DFF:FE7D:B684
2001:980:3441:1::FFFF
Dialer1                    [up/up]
FE80::21A:6DFF:FE7D:B684

The basic IPv6 configuration is done. The next step is testing IPv6 connectivity via an IPv6 ping to ipv6.google.com

C877W#ping ipv6 2a00:1450:8005::68 source bvi1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2A00:1450:8005::68, timeout is 2 seconds:
Packet sent with a source address of 2001:980:3441:1::FFFF
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 24/25/28 ms

Ping can reply with different characters. The characters are listed below.

Prefix Delegation (PD) in IPv6 is very useful when deploying IPv6 in the network. The deployment of IPv6 to hosts also involves the distribution of additional parameters, like IPv6 DNS servers. The next step involves the configuration of Router Advertisement (RA) messages on the Bridged Virtual Interface.

I configured an DHCPv6 pool and configured the BVI interface as DHCP server interface with the following commands:

ipv6 dhcp pool ipv6_inside
dns-server 2001:888:0:6::66
domain-name booches.nl
!
interface BVI1
ipv6 address my_prefix 0:0:0:1::/64 eui-64
ipv6 nd other-config-flag
ipv6 dhcp server ipv6_inside rapid-commit
end

The other-config-flag sets the O-bit in IPv6 RA messages to inform hosts that they can use autoconfiguration for their IPv6 configuration. This results in DHCPv6 INFORMATION-REQUEST messages from the hosts to the DHCPv6 server. The router will reply to these message, because it is configured as DHCP server for the prefix.

I started testing, but my hosts didn’t receive any IPv6 address and debugging IPv6 on the router didn’t output any useful information. Of course the hosts couldn’t receive any IPv6 address, because of the well-known bug CSCej50923 (CCO ID required) on BVI interface routing, which does not work for IPv6 addressing. I didn’t want to upgrade my router directly, so I created another VLAN with the appropriate Switched Virtual Interface. I configured the same commands as under the BVI interface, but this time with prefix 0:0:0:2::/64. Now I have 3 interfaces enabled for IPv6 addressing, like shown below:

C877W#show ipv6 interface brief
BVI1                       [up/up]
FE80::21A:6DFF:FE7D:B684
2001:980:3441:1:21A:6DFF:FE7D:B684
Dialer1                    [up/up]
FE80::21A:6DFF:FE7D:B684
Vlan2                      [up/up]
FE80::21A:6DFF:FE7D:B684
2001:980:3441:2:21A:6DFF:FE7D:B684

You can see the difference in the prefix between BVI1 and Vlan2. I issued a ipconfig /release6 and ipconfig /renew6 on the hosts and IPv6 is working like a perfectly.

The complete output of the ipconfig /all and a ping to ipv6.google.com can be found below.

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix  . : booches.nl
Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
Physical Address. . . . . . . . . : 00-25-64-F6-1C-D7
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:980:3441:2:c527:8966:a47f:55d2(Preferred)
Temporary IPv6 Address. . . . . . : 2001:980:3441:2:cd4d:b38b:e861:f43(Preferred)
Link-local IPv6 Address . . . . . : fe80::c527:8966:a47f:55d2%11(Preferred)
IPv4 Address. . . . . . . . . . . : 10.10.2.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, January 31, 2011 4:02:01 PM
Lease Expires . . . . . . . . . . : Thursday, February 03, 2011 4:02:00 PM
Default Gateway . . . . . . . . . : fe80::21a:6dff:fe7d:b684%11
10.10.2.1
DHCP Server . . . . . . . . . . . : 10.10.2.1
DHCPv6 IAID . . . . . . . . . . . : 234890596
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-65-AE-74-00-25-64-F6-1C-D7

DNS Servers . . . . . . . . . . . : 2001:888:0:6::66
10.10.2.1
NetBIOS over Tcpip. . . . . . . . : Enabled
Connection-specific DNS Suffix Search List :
booches.nl

C:\Users\RJN>ping ipv6.google.com

Pinging ipv6.l.google.com [2a00:1450:8005::68] with 32 bytes of data:
Reply from 2a00:1450:8005::68: time=29ms
Reply from 2a00:1450:8005::68: time=25ms
Reply from 2a00:1450:8005::68: time=25ms
Reply from 2a00:1450:8005::68: time=26ms

Ping statistics for 2a00:1450:8005::68:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 25ms, Maximum = 28ms, Average = 26ms

Cisco ASA NPE image

I got complains from a customer who wasn’t able to configure 3DES or AES encryption for a VPN tunnel. Sounds familiar with a problem I had a couple of weeks ago. So I gave the customer the advice to upgrade and activate the VPN-3DES-AES feature. He tried but that didn’t solve this problem.

I remotely logged in and checked the software he was using. I noticed he was using the image asa832-npe-k8.bin. Problem found!!!

NPE stands for No Payload Encryption. For export to some countries, payload encryption cannot be enabled on the Cisco ASA 5500 series. For version 8.3(2), you can now install a No Payload Encryption image (asa832-npe-k8.bin).

Features that are disabled in the No Payload Encryption image include:

• Unified Communications;
• Strong encryption for VPN (DES encryption is still available for VPN);
• VPN load balancing (note that the CLI is still present; the feature will not function, however)
• Downloading of the dynamic database for the Botnet Traffic Filer (Static black and whitelists are still supported. Note that the CLI is still present; the feature will not function, however);
• Management protocols requiring strong encryption, including SSL, SSHv2, and SNMPv3. You can, however, use SSL or SNMPv3 using base encryption (DES). Also, SSHv1 and SNMPv1 and v2 are still available;

If you attempt to install a Strong Encryption (3DES/AES) license, you see the following warning:

WARNING: Strong encryption types have been disabled in this image; the VPN-3DES-AES license option has been ignored.

I replaced the software image with the regular image and the problem was solved.

XenServer and Multicast with IGMP support

Today I tried to add a virtual Terminal Server within a XenServer to a NLB cluster. The current NLB cluster contained only physical servers. When adding the virtual server to the NLB cluster with the NLB manager, the server lost all IP communication. It isn’t possible to connect to or from the server. Together with the system administrator, we searched multiple forums and we found the solution to the problem.

It looks like XenServer doesn’t support multicast by default, because of the bridge design of the network interfaces. We found an interesting article on the internet to enable multicast on the virtual interface.

In the end we took the following steps to enable multicast support on the virtual interface of the XenServer.

1. 1. Install the XenServer tools on the virtual server;
2. 2. Execute the ifconfig command, like shown below, to enable multicast on the virtual interface;

# Retrieve the DOMID of the virtual server
xe vm-list name-label=<VMNAME> params=dom-id

# Enable multicast on the virtual interface of the virtual server
ifconfig vif<DOMID>.0 multicast

We restarted the virtual server and the DOMID changed, but multicast with IGMP support was still working and the server was still part of the NLB cluster. The system administrator will do some more testing and he will try to add another virtual server to the NLB cluster.

Upgrading Cisco switch stack

I always upgrade a switch stack with one single command. Last week I received a call from a customer with the question about the upgrade procedure for a switch stack. The customer wanted to upload the image separately to every single switch. I told him that he could upgrade all switches at once.

Since I am “playing” with a Cisco switch stack of 9 Catalyst 3750X switches today I will describe the upgrade procedure.

1. 1. You need to download the correct .tar image file;
2. 2. Copy it to the root of your FTP or TFTP server;
3. 3. Upload, extract and install the .tar file to the switches (I always use the /imageonly option, because I don’t need the html files for management);
4. 4. Reload the switch stack;

The command to upload and extract the .tar file can be found below:

sw-stack#archive download-sw /imageonly /overwrite /allow-feature-upgrade ftp://user:password@<IP address FTP server>/image-file.tar

Loading c3750e-universalk9-tar.122-55.SE1.tar !!!!!!!
[OK - 17745920/4096 bytes]

Loading c3750e-universalk9-tar.122-55.SE1.tar !!!!!!!
examining image…
extracting info (110 bytes)
extracting c3750e-universalk9-mz.122-55.SE1/info (444 bytes)
extracting info (110 bytes)

Stacking Version Number: 1.45

System Type:             0×00000002
Ios Image File Size:   0x00DE8200
Total Image File Size: 0x010ECA00
Minimum Dram required: 0×08000000
Image Suffix:          universalk9-122-55.SE1
Image Directory:       c3750e-universalk9-mz.122-55.SE1
Image Name:            c3750e-universalk9-mz.122-55.SE1.bin
Image Feature:         IP|LAYER_3|PLUS|SSH|3DES|MIN_DRAM_MEG=128

Old image for switch 1: flash:/c3750e-universalk9-mz.122-53.SE2
Old image will be deleted after download.
Old image for switch 2: flash2:/c3750e-universalk9-mz.122-53.SE2
Old image will be deleted after download.
Old image for switch 3: flash3:/c3750e-universalk9-mz.122-53.SE2
Old image will be deleted after download.
Old image for switch 4: flash4:/c3750e-universalk9-mz.122-53.SE2
Old image will be deleted after download.
Old image for switch 5: flash5:/c3750e-universalk9-mz.122-53.SE2
Old image will be deleted after download.
Old image for switch 6: flash6:/c3750e-universalk9-mz.122-53.SE2
Old image will be deleted after download.
Old image for switch 7: flash7:/c3750e-universalk9-mz.122-53.SE2
Old image will be deleted after download.
Old image for switch 8: flash8:/c3750e-universalk9-mz.122-53.SE2
Old image will be deleted after download.
Old image for switch 9: flash9:/c3750e-universalk9-mz.122-53.SE2
Old image will be deleted after download.

Extracting images from archive into flash…
Extracting images from archive into flash on switch 2…
Extracting images from archive into flash on switch 3…
Extracting images from archive into flash on switch 4…
Extracting images from archive into flash on switch 5…
Extracting images from archive into flash on switch 6…
Extracting images from archive into flash on switch 7…
Extracting images from archive into flash on switch 8…
Extracting images from archive into flash on switch 9…

extracting c3750e-universalk9-mz.122-55.SE1/c3750e-universalk9-mz.122-55.SE1.bin (14570585 bytes)
extracting c3750e-universalk9-mz.122-55.SE1/info (444 bytes)
extracting info (110 bytes)

<..>

Installing (renaming): `flash:update/c3750e-universalk9-mz.122-55.SE1′ ->
`flash:/c3750e-universalk9-mz.122-55.SE1′
New software image installed in flash:/c3750e-universalk9-mz.122-55.SE1

<..>

Removing old image: flash:/c3750e-universalk9-mz.122-53.SE2
Removing old image: flash2:/c3750e-universalk9-mz.122-53.SE2
Removing old image: flash3:/c3750e-universalk9-mz.122-53.SE2
Removing old image: flash4:/c3750e-universalk9-mz.122-53.SE2

<..>

All software images installed.

The boot parameters are automatically changed to the new IOS firmware. You can check the boot parameters with the show boot command.

Cisco stack: version mismatch

When adding a new switch to an existing stack, the new switch should have the same software image as the existing stack member switches. If the new switch has different software, the switch isn’t capable of joining the stack.

Switch/Stack Mac Address : 588d.0918.3100
H/W   Current
Switch#  Role   Mac Address     Priority Version  State
———————————————————-
*1       Master 588d.0918.3100     15     1       Ready
2       Member c471.fe99.b580     1      2       Version Mismatch

There are different ways to upgrade the new switch to the correct software image. The hard way is unplugging the new switch from the stack, upgrade the switch separately and add the switch to the stack again. A more easy way is using the archive copy-sw command. This command allows you to copy the software from a specific member switch to the new switch.

The example below copies the software from switch 1 to the destiniation switch 2.

sw-stack#archive copy-sw /destination-system 2 1
System software to be uploaded:
System Type:             0×00000002
archiving c3750e-universalk9-mz.122-53.SE2 (directory)
Stacking Version Number: 1.43

System Type:             0×00000002
Ios Image File Size:   0x00DA7200
Total Image File Size: 0×01076600
Minimum Dram required: 0×08000000
Image Suffix:          universalk9-122-53.SE2
Image Directory:       c3750e-universalk9-mz.122-53.SE2
Image Name:            c3750e-universalk9-mz.122-53.SE2.bin
Image Feature:         IP|LAYER_3|PLUS|SSH|3DES|MIN_DRAM_MEG=128

Old image for switch 2: flash2:/c3750e-universalk9-mz.122-53.SE1
Old image will be deleted after download.

Extracting images from archive into flash on switch 2…

Installing (renaming): `flash2:/update/c3750e-universalk9-mz.122-53.SE2′ –> flash2:/c3750e-universalk9-mz.122-53.SE2′
New software image installed in flash2:/c3750e-universalk9-mz.122-53.SE2
Removing old image: flash2:/c3750e-universalk9-mz.122-53.SE

All software images installed.

sw-stack#reload slot 2

This is by far the easiest way to upgrade the new switch to the correct software image. Another method is using the copy command.

sw-stack#copy image-file.bin flash2:

sw-stack#config t

sw-stack(config)#boot system switch 2 flash:/image-file.bin

sw-stack(config)#exit

sw-stack#wr mem

sw-stack#reload slot 2

This method is very useful if you are using an image without the html web features.