Since on Sand platform, Ingress/Egress ipv4 ACL, Qos and PBR counters occupy the same counter engineer, so they will not be able to work together. You have to specify which counter could use this shared engineer.
yo411.mlagB.profA.11:49:40(config)#hardware counter feature ?
acl ACL counter feature
mpls MPLS LFIB counter feature
nexthop Nexthop counter feature
pdp PDP counter feature
subinterface Subinterface counter feature
traffic-class Traffic-class counter feature
vlan VLAN counter feature
8/28/2018
Arista/EOS, MLAG ipv6 partial traffic loss
Topology (a typical MLAG network):
[mlagA] ======= [mlagB]
\ /
+---[Leaf]---+
Symptom:
1) about 10% L3 ipv6 traffic, WE and SN
2) No L2 or L3 ipv4 traffic loss
Get one problem destination - 2000:120:4d:d::1
1) show ipv6 route is good,
bn303.mlagA.profA.16:17:04(config)#sh ipv6 route 2000:120:4d:d::1
C 2000:120:4d::/48 [0/1]
via Vlan2077, directly connected
bn302.mlagB.profA.16:17:03(config-if-Vl2199)#sh ipv6 route 2000:120:4d:d::1
C 2000:120:4d::/48 [0/1]
via Vlan2077, directly connected
2) show ipv6 route host is NOT right
bn303.mlagA.profA.16:18:20(config)#sh ipv6 route host | grep 2000:120:4d:d
A 2000:120:4d:d::1 on Vlan2077
A 2000:120:4d:d::3 on Vlan2077 <<<<<< missing ::2
A 2000:120:4d:d::4 on Vlan2077
bn302.mlagB.profA.16:18:20(config-if-Vl2199)#sh ipv6 route host | grep 2000:120:4d:d
A 2000:120:4d:d::2 on Vlan2077 <<<<<< missing ::1
A 2000:120:4d:d::3 on Vlan2077
A 2000:120:4d:d::4 on Vlan2077
Root cause:
missing configuration - "ip virtual-router mac-address mlag-peer"
[mlagA] ======= [mlagB]
\ /
+---[Leaf]---+
Symptom:
1) about 10% L3 ipv6 traffic, WE and SN
2) No L2 or L3 ipv4 traffic loss
Get one problem destination - 2000:120:4d:d::1
1) show ipv6 route is good,
bn303.mlagA.profA.16:17:04(config)#sh ipv6 route 2000:120:4d:d::1
C 2000:120:4d::/48 [0/1]
via Vlan2077, directly connected
bn302.mlagB.profA.16:17:03(config-if-Vl2199)#sh ipv6 route 2000:120:4d:d::1
C 2000:120:4d::/48 [0/1]
via Vlan2077, directly connected
2) show ipv6 route host is NOT right
bn303.mlagA.profA.16:18:20(config)#sh ipv6 route host | grep 2000:120:4d:d
A 2000:120:4d:d::1 on Vlan2077
A 2000:120:4d:d::3 on Vlan2077 <<<<<< missing ::2
A 2000:120:4d:d::4 on Vlan2077
bn302.mlagB.profA.16:18:20(config-if-Vl2199)#sh ipv6 route host | grep 2000:120:4d:d
A 2000:120:4d:d::2 on Vlan2077 <<<<<< missing ::1
A 2000:120:4d:d::3 on Vlan2077
A 2000:120:4d:d::4 on Vlan2077
Root cause:
missing configuration - "ip virtual-router mac-address mlag-peer"
Arista EOS Debug Tips on Traffic Loss
1. check what/how many pkts punted to CPU?
- "show cpu counter queue", this is the place we see the software drop
- output is by switch ASIC and cpu queues
- CpuQueueL3DstMiss: pkt destinated to unknown address, like unARP'ed host address
- CpuQueueL3LpmOverflow - ?
2. hardward drop
3. show platform fap interrup
4. Check drops on which interfaces
- show interface counter discard | nzArista EOS: %QOS-3-POLICY_HW_RESOURCE_FULL
When applying Qos policy under port-channel, the system doesn't accept it.
wa463.bug228215.16:12:21(config-if-Po20)#service-policy type qos input SPTest
% Error: Cannot apply service-policy to Port-Channel20 ()
And show logg displays an error msg:
Mar 8 16:01:25 wa463 SandAcl: %QOS-3-POLICY_HW_RESOURCE_FULL: Insufficient hardware resources to program the input policy-map SPTest.
It is because the TCAM is running out. One possible reason is PDP (per-port data policy) which uses up quite some TCAM. So try the EOS-Int image.
wa462.bug228215.16:17:04#sh platform jericho acl tcam summary
The total number of TCAM lines per Jericho bank is 2048
========================================================
Jericho0:
========================================================
Bank Used Used % Used By
0 2046 99 IP RACLs
1 1554 75 IP RACLs
2, 3 2048 100 IPv6 RACLs
4, 5 2048 100 IPv6 RACLs
6, 7 2048 100 IPv6 RACLs
8, 9 2046 99 IPv6 RACLs
10,11 210 10 IPv6 RACLs
14 79 61 Pdp IP, Pdp Tunnel, Pdp NonIp, Pdp IPv6, Pdp Mpls
Total Number of TCAM lines used is: 20479
After changing to INT image, this issue is gone.
wa462.bug228215.16:28:09(config)#int po20
wa462.bug228215.16:28:11(config-if-Po20)#service-policy type qos input SPTest
wa462.bug228215.16:28:13(config-if-Po20)#show ver
Arista DCS-7280CR-48-F
Hardware version: 11.01
Serial number: JPE16473148
System MAC address: 444c.a897.8c51
wa463.bug228215.16:12:21(config-if-Po20)#service-policy type qos input SPTest
% Error: Cannot apply service-policy to Port-Channel20 ()
And show logg displays an error msg:
Mar 8 16:01:25 wa463 SandAcl: %QOS-3-POLICY_HW_RESOURCE_FULL: Insufficient hardware resources to program the input policy-map SPTest.
It is because the TCAM is running out. One possible reason is PDP (per-port data policy) which uses up quite some TCAM. So try the EOS-Int image.
wa462.bug228215.16:17:04#sh platform jericho acl tcam summary
The total number of TCAM lines per Jericho bank is 2048
========================================================
Jericho0:
========================================================
Bank Used Used % Used By
0 2046 99 IP RACLs
1 1554 75 IP RACLs
2, 3 2048 100 IPv6 RACLs
4, 5 2048 100 IPv6 RACLs
6, 7 2048 100 IPv6 RACLs
8, 9 2046 99 IPv6 RACLs
10,11 210 10 IPv6 RACLs
14 79 61 Pdp IP, Pdp Tunnel, Pdp NonIp, Pdp IPv6, Pdp Mpls
Total Number of TCAM lines used is: 20479
After changing to INT image, this issue is gone.
wa462.bug228215.16:28:09(config)#int po20
wa462.bug228215.16:28:11(config-if-Po20)#service-policy type qos input SPTest
wa462.bug228215.16:28:13(config-if-Po20)#show ver
Arista DCS-7280CR-48-F
Hardware version: 11.01
Serial number: JPE16473148
System MAC address: 444c.a897.8c51
Software image version: 4.20.0F-INT-7767198.bloomingtonrel (engineering build)
8/24/2018
iptables in EOS
iptables is a Linux firewall utility program, which is leveraged by Arista EOS to control protocol control packets. For example:
Example: sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
-S : List the rules
-A : Append rule
-p : protocol
-j : jump = action
[admin@ck478 ~]$ sudo iptables -S
.....
-A INPUT -p tcp -m tcp --dport 4432 -m ttl --ttl-eq 255 -j SERVICE <<< MLAG control pkt
-A INPUT -p udp -m udp --dport 4432 -m ttl --ttl-eq 255 -j SERVICE
! add a bgp neighbor 1.1.1.1
ck478.17:51:26(config)#router bgp 65500
ck478.17:51:43(config-router-bgp)#nei 1.1.1.1 remote 65001
[admin@ck478 ~]$ sudo iptables -S | grep -i BGP | grep 1.1.1.1
-A BGP -s 1.1.1.1/32 -j ACCEPT <<< a new rule added for bgp nei 1.1.1.1
! configure bgp ttl security rule
ck478.17:51:51(config-router-bgp)#nei 1.1.1.1 ttl maximum-hops 2
[admin@ck478 ~]$ sudo iptables -S | grep -i BGP | grep 1.1.1.1
-A BGP -s 1.1.1.1/32 -m ttl --ttl-lt 253 -j DROP <<< all bgp pkts w/ ttl <253 droped!
-A BGP -s 1.1.1.1/32 -j ACCEPT
Example: sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
-S : List the rules
-A : Append rule
-p : protocol
-j : jump = action
[admin@ck478 ~]$ sudo iptables -S
.....
-A INPUT -p tcp -m tcp --dport 4432 -m ttl --ttl-eq 255 -j SERVICE <<< MLAG control pkt
-A INPUT -p udp -m udp --dport 4432 -m ttl --ttl-eq 255 -j SERVICE
! add a bgp neighbor 1.1.1.1
ck478.17:51:26(config)#router bgp 65500
ck478.17:51:43(config-router-bgp)#nei 1.1.1.1 remote 65001
[admin@ck478 ~]$ sudo iptables -S | grep -i BGP | grep 1.1.1.1
-A BGP -s 1.1.1.1/32 -j ACCEPT <<< a new rule added for bgp nei 1.1.1.1
! configure bgp ttl security rule
ck478.17:51:51(config-router-bgp)#nei 1.1.1.1 ttl maximum-hops 2
[admin@ck478 ~]$ sudo iptables -S | grep -i BGP | grep 1.1.1.1
-A BGP -s 1.1.1.1/32 -m ttl --ttl-lt 253 -j DROP <<< all bgp pkts w/ ttl <253 droped!
-A BGP -s 1.1.1.1/32 -j ACCEPT
strace in EOS
"strace" is a powerful linux debug command and it can be used on Arista EOS.
Some useful arguments:
-c -- count time and calls
-p pid -- trace process with pid#
-T -- print time spent
Example:
[admin@bn303 ~]$ ps -ef | grep Bgp
root 14926 2044 1 09:55 ? 00:00:09 Bgp
[admin@bn303 ~]$ sudo strace -c -p 14926
Process 14926 attached
^CProcess 14926 detached
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
-nan 0.000000 0 1 ioctl
-nan 0.000000 0 3 3 stat64
-nan 0.000000 0 46 epoll_ctl
-nan 0.000000 0 45 epoll_wait
-nan 0.000000 0 4 send
-nan 0.000000 0 1 sendmsg
-nan 0.000000 0 1 recvmsg
------ ----------- ----------- --------- --------- ----------------
100.00 0.000000 101 3 total
Some useful arguments:
-c -- count time and calls
-p pid -- trace process with pid#
-T -- print time spent
Example:
[admin@bn303 ~]$ ps -ef | grep Bgp
root 14926 2044 1 09:55 ? 00:00:09 Bgp
[admin@bn303 ~]$ sudo strace -c -p 14926
Process 14926 attached
^CProcess 14926 detached
% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
-nan 0.000000 0 1 ioctl
-nan 0.000000 0 3 3 stat64
-nan 0.000000 0 46 epoll_ctl
-nan 0.000000 0 45 epoll_wait
-nan 0.000000 0 4 send
-nan 0.000000 0 1 sendmsg
-nan 0.000000 0 1 recvmsg
------ ----------- ----------- --------- --------- ----------------
100.00 0.000000 101 3 total
8/20/2018
Arista EOS 4.21 : L2 subinterface
Topology:
[rtr3]
|
| et2
| eth1.1
[rtr1]==============[rtr2]
| eth1.2
| eth3
|
[rtr4]
Configuration
interface et1.100
encap dot1q vlan 100
vlan id 1000
interface et1.200
encap dot1q vlan 200
vlan id 1000
interface eth2
switch access vlan 1000
interface eth3
switch mode trunk
[rtr3]
|
| et2
| eth1.1
[rtr1]==============[rtr2]
| eth1.2
| eth3
|
[rtr4]
Configuration
interface et1.100
encap dot1q vlan 100
vlan id 1000
interface et1.200
encap dot1q vlan 200
vlan id 1000
interface eth2
switch access vlan 1000
interface eth3
switch mode trunk
L2 bridge domain
- Above configuration is to create a L2 bridge domain of 4 end points - et1.100, et1.200, eth2 (access), eth3 (trunk).
- 1 bcast from et1.100, will be flood to et1.200, et2, et3
- Vlan mapping is different, which is 1:1 relation. So no vlan 1000 on both et1.100 and et1.200
- et1 must be "no switch".
- Feature is supported from 4.21.*?
Arista Eos 4.21: BGP DSCP Configuration
By default, the BGP packets' DSCP value is 0x0. Now customer wants to have it configurable. A global value is enough. New configuration/change doesn't tear down existing sessions. This feature is started from 4.21.*?
The configuration is quite simple:
router bgp 1
bgp transport qos dscp 48
The configuration is quite simple:
router bgp 1
bgp transport qos dscp 48
Arista EOS CLIs
Platform Dependent
- Trident hw programming
- show platform trident counter | egrep 'card|drop' | nz
- show platform trident tcam detail | grep -i "LAG E" -A2
- show platform trident L3 shadow my-station
- Trident agent logs:
- qtcat strataL3.qt | grep <prefix>
- evpn:
- show l2rib input bgp
- System:
- show event-monitor mac
Software:
- CVP:
- management api http-commands
- no shutdown
- user cvpadmin privilege 15 role admin secret eosuper
8/15/2018
Ixia: Custom view of traffic
Custom view:
Filters:
select Traffic -》flow detective
Traffic Item Equals "Traffic Name"
Show 50 "Worst Performers"
Then select Stat
Filters:
select Traffic -》flow detective
Traffic Item Equals "Traffic Name"
Show 50 "Worst Performers"
Then select Stat
8/11/2018
"ip directed-broadcast" in VxLAN
1. What's the feature of "ip directed-broadcast" for?
2. Configuration and details
interface vlan 2001
ip directed-broadcast
Says the topology with Vxlan is like
vlan 1001
10.1.1.1/24 [host2]-----+
|
vlan 2001 |
20.1.1.1/24 [host1]---[l2vtep]---[l2vtep]---[gw of svi1001/2001]
* host1 sends pkts dstIp=10.1.1.255
* pkts follows vxlan to reach gw
* gw routes pkts back l2vtep as a ucast pkt
3. Caveats
- One application is Wake-on-Lan(WOL). A host device like PC can be powered on/resumed remotely.
- Need hw/BIOS support. When host receives a WOL magic packet, it turns on.
- Enable it in OS, linux - "sudo ethtool -s eth0 wol g"
- So server (20.1.1.1) sends a bcast packet destined to remote subnet like 10.1.1.255 to 10.1.1.0/24 network.
- With this feature enabled under SVI, this bcast pkt will be fwded to remote subnet like a ucast pkt.
- By default is disabled, because of the security concern.
- This is a legacy feature starting from 2011/12?
2. Configuration and details
interface vlan 2001
ip directed-broadcast
Says the topology with Vxlan is like
vlan 1001
10.1.1.1/24 [host2]-----+
|
vlan 2001 |
20.1.1.1/24 [host1]---[l2vtep]---[l2vtep]---[gw of svi1001/2001]
* host1 sends pkts dstIp=10.1.1.255
* pkts follows vxlan to reach gw
* gw routes pkts back l2vtep as a ucast pkt
3. Caveats
- Arista EOS has a bug - 217001, when the vlan is included vxlan interface, the directed-bcast traffic will be shaped by PDP.
yr252.23:14:18#sh pl trident l3 software host-table | beg 10.50.51.255
Entry: 0, HwEntry: 0x6002a50, Type: v4Uc, Vrf: 0, Host: 10.50.51.255/32
Bucket: 687, state: 0x00011
Subscribe to:
Posts (Atom)