ISIS: TE

router isis
metric-style wide
mpls traffic-eng tunnel level-2
mpls traffic-eng tunnel router-id lo0

==> Side Effects
If there is a router somewhere else that you missed out configuring "metric-style wide" , ISIS adj will go down,

Ref: INE Workbook VOl2 V1.0 Lab 7 Task 5.4 ( Traffic Engineering)

############Alternative ####################################
configure the R3 router with foll
router isis
metric-style transition

Here is why

metric-style transition

To configure a router to generate and accept both old-style and new-style TLVs (TLV stands for type, length, and value object), use the metric-style transition command in router configuration mode.

metric-style transition {level-1 | level-2 | level-1-2}

Syntax Description

level-1	Enables this command on routing level 1.
level-2	Enables this command on routing level 2.
level-1-2	Enables this command on routing levels 1 and 2.

Defaults

IS-IS traffic engineering extensions include new-style TLVs with wider metric fields than old-style TLVs. By default, the MPLS traffic engineering image generates old-style TLVs only. To do MPLS traffic engineering, a router needs to generate new-style TLVs.

allowas-in v/s as-override

# allowas-in config needs to be done on CE
ON CE
router bgp 65001
network 10.7.7.0 mask 255.255.255.0
network 10.7.77.0 mask 255.255.255.0
network 10.7.27.0 mask 255.255.255.0

neighbor 10.7.27.2 remote-as 1234
neighbor 10.7.27.2 allowas-in 2

ON PE
router bgp 1234
address-family ipv4 vrf 65001
neighbor 10.7.27.7 remote-as 65001

Rack1R7#sh ip bgp
BGP table version is 10, local router ID is 10.7.7.7
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 10.7.7.0/24 0.0.0.0 0 32768 i
*> 10.7.8.0/24 10.7.27.2 0 1234 65001 i
*> 10.7.27.0/24 0.0.0.0 0 32768 i
*> 10.7.48.0/24 10.7.27.2 0 1234 65001 i
*> 10.7.77.0/24 0.0.0.0 0 32768 i
Rack1R7#


################################################################
as-override
# as-override needs to be done on PE under the address-family ipv4 vrf
ON CE
router bgp 65001
network 10.7.7.0 mask 255.255.255.0
network 10.7.77.0 mask 255.255.255.0
network 10.7.27.0 mask 255.255.255.0

neighbor 10.7.27.2 remote-as 1234
--> Remove this --->neighbor 10.7.27.2 allowas-in 2-->Unless u have a NON MPLS backdoor

ON PE
router bgp 1234
address-family ipv4 vrf 65001
neighbor 10.7.27.7 remote-as 65001
neighbor 10.7.27.7 as-override

Rack1R7#sh ip bgp
BGP table version is 14, local router ID is 10.7.7.7
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 10.7.7.0/24 0.0.0.0 0 32768 i
*> 10.7.8.0/24 10.7.27.2 0 1234 1234 i
*> 10.7.27.0/24 0.0.0.0 0 32768 i
*> 10.7.48.0/24 10.7.27.2 0 1234 1234 i
*> 10.7.77.0/24 0.0.0.0 0 32768 i
Rack1R7#

Conclusion
as-override means PE replaces all occurrences of CE ASN with its ASN

ISIS : The Pain

1) Authenticate with all interfaces in L2 ( or L1)
domain-password CISCO

2) The interface level
isis authentication mode text level-2
isis password CISCO

What do the above do ?
I read on IEOC forum that these only authenticate the Hello PDU

whereas the Authentication on the ISIS instance authenticates LSP, CSNP, and PSNP PDUs

Whatever ??? I will investigate further...

3) The new way , key-chain and stuff, like RIP

key chain ISIS_LEVEL2
key 1
key-string CISCO
!
router isis
authentication mode text level-2
authentication key-chain ISIS_LEVEL2 level-2

More information on the CCO link here

There are three types of passwords

1)

Interface x

isis password CISCO --> Used to Initialise the Link.

2)

router isis

area-password CISCO --> used to authenticate links in the given area ( 49.xxxx)

=> Caveat area-password cannot be used for L2 adj

"If directly connected routers have area-authentication configured on one side of a link, CLNS IS-IS adjacency is formed between the two routes. However, the router on which area-authentication is configured, does not accept L1 LSPs from the CLNS neighbor with no area-authentication configured. However, the neighbor with no area-authentication does continue to accept both L1 and L2 LSPs."

3)

router isis

domain-password CISCO --> Used to authenticate links in the given domain (49)

=>Caveat

"If you configure domain authentication on one router, it rejects the L2 LSPs from routers that do not have domain authentication configured. Routers that do not have authentication configured accept the LSPs from the router that does have authentication configured."

The Grand ACL

Allow only LDP
permit udp host eq 646 host 224.0.0.2 eq 646
permit tcp host host eq 646
permit tcp host host eq 646

address-family ipv4 multicast

AS per CCO

https://www.cisco.com/en/US/docs/ios/12_1/iproute/command/reference/1rdmbgp.pdf

TO enable Multicast BGP (MBGP)

router bgp 200
address-family ipv4 multicast
neighbor 20.6.26.2 activate
network 20.6.5.5 mask 255.255.255.255

How to verify
sh ip bgp ipv4 multicast

MSDP

ip msdp peer connect-source lo0
ip msdp default-peer

ip pim accept-rp

From CCO

http://www.cisco.com/en/US/docs/ios/12_2/ipmulti/command/reference/1rfmult2.html#wp1019380

ip pim accept-rp

To configure a router to accept join or prune messages destined for a specified rendezvous point (RP) and for a specific list of groups, use the ip pim accept-rp command in global configuration mode. To remove that check, use the no form of this command.

rp-address

RP address of the RP allowed to send join messages to groups in the range specified by the group access list.

OSPF sham-link

Rules:
1) Can belong to any area including area 0
2) Sham Link end points cannot be advertised by OSPF

steps on PE:
1) Create a New Loopback and put it in vrf
2) Advertise the loopback in MPBGP
3) Create a sham-link
4) Ensure the OPSF cost on the backdoor link is high so that traffic prefers MPLS link.

MPLS LDP password

mpls ldp router-id lo0
mpls ldp neighbor 20.6.1.1 password CISCO

network x.x.x.x mask y.y.y.y backdoor

http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800c95bb.shtml#bgpbackdoor

Ref Task 3.5 in IEWB vol 2 lab6

backdoor is used when you have some IGP advertising the same network also learnt via eBGP
Since the AD of eBGP is 20 lowest compared to all other IGPs

We are left with two choices
1) lower the AD of IGP to 19
2) use the backdoor.

Referring to the link above, I found out the backdoor cmd in bgp

What this does is make the network added to that router seem like it's LOCAL
At the same time, router doesnt advertise this route to any IBGP/eBGP peers.

So it treats this route as [200/x] (x is the metric)
==>IBGP learnt route.
Now any IGP advertising this route can instill this network into the routing table by the virtue of it having the lowest AD.

Ver 2: "Denied Boarding: Reason-Over Booking"

Friends sometime in 2008-Jan, I blogged about my free ticket to SA.
You can read it here

Eventually, I applied for a Business VISA to SA and also got the free ticket issued to travel to JNB sometime in Nov09.

However as destiny has it.....Despite I having everything, I didn't travel !!!!!

Why you may ask ?
Well I have the answer, but if I tell you , you will count me stupid.......So yes I let this free ticket lapse.
Suffice to say, I didn't travel due to personal reasons.

That's that about having things for free

IEWB Vol2 Lab5: IP Addressing: Hung Up on 10.x

IN IEWB vol2 lab 5 ( CCIE SP), they have intentionally mixed up IP addressing with 10.x and 20.x and this is causing me tremendous delays

I am spending way too much time deleting the wrong IP and applying the correct ones at L3 and in IGP.

THis is not acceptable.
I must
1) get good rest ... Havent done that over few days
2) get over this copy/paste from notepad error issue,


I have noticed, today, I tried to speed up on my skills on L2 and IP addressing, and ended up wasting way too much time fixing the copy/paste errors.

This is not acceptable.

Switching Fundamentals : Not Strong

R2 int f0/0.26 -> R7 int f1/1 (trunk)

R6 int e0/1 -> R8 int f1/6 (access)

R7 f1/13 --> R8 f1/13 (trunk)

One port on a R2 is a trunk to switch , other end the R6 port is access to the switch.
Yet it will work.
basic, but needed revisiting

Multicast VPN Troubleshooting

sh ip rpf
sh ip rpf
sh ip mroute count --> check to see if there are any 0/0/0/0 -->rpf failure
sh ip pim vrf interface --> on tu0 interface you should see neighbors
sh ip pim vrf rp mappings

sh ip pim rp mapping

Also when it doesn't work, shut down all TE tunnels and check, if that works, then turn on the TE tunnels and work out the RPF failures.

Finally sh tech multicast o/p can also be investigated.

If any of these links go down R4 should abandon .....

Some Serious Interpretation of English is called for ....Else you lose points and fail lab !

INE Vol2 Lab 5
Task 4.4 Traffic Engineering

"If any of these links go down R4 should abandon the traffic engineered path in favour of any alternate dynamically learned non-traffic engineered path"

I interpreted (hastily) this to mean that last path-option should be dynamic !

But it actually meant, fall back to IGP, not dynamic path.

But hey, apart from the English.... If you notice when it does fall back to dynamic, it indeed use IGP Best Path. ... So whats the deal ?

If you know better let me know.

I dont want to fail the lab for not interpreting the stupid English

sh mpls ldp neighbor

Rack1R1#sh mpls ldp neighbor
Peer TDP Ident: 124.5.2.2:0; Local TDP Ident 124.5.1.1:0
TCP connection: 124.5.2.2.11000 - 124.5.1.1.711
State: Oper; PIEs sent/rcvd: 4/4; Downstream
Up time: 00:00:40
TDP discovery sources:
ATM4/0.12, Src IP addr: 124.5.12.2
Addresses bound to peer TDP Ident:
124.5.24.2 124.5.23.2 124.5.12.2 124.5.19.2
124.5.2.2
Peer LDP Ident: 124.5.3.3:0; Local LDP Ident 124.5.1.1:0
TCP connection: 124.5.3.3.44185 - 124.5.1.1.646
State: Oper; Msgs sent/rcvd: 14/12; Downstream
Up time: 00:00:27
LDP discovery sources:
Serial2/1, Src IP addr: 124.5.13.3
Addresses bound to peer LDP Ident:
124.5.34.3 124.5.13.3 124.5.23.3 124.5.3.3
Rack1R1#

Cisco IOS folks pls change this command, it shows both LDP and TDP neighbors
Also there is no IOS command to display TDP neighbors
i.e sh mpls tdp neighbors

So the above command should be changed to reflect sh mpls neighbors

Difference between Inter AS VPN and CsC ?

In CsC the Provider Edge Router doesn't do ipv4 BGP with Customer Edge Router.

ACL to Allow only Odd Subnets in the first octect ?

ip access-list standard ODDNWK
permit 1.0.0.0 254.255.255.255

when applied in a route map with local-pref modifications

Rack1R7#sh ip bgp
BGP table version is 25, local router ID is 64.5.7.7
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete

Network Next Hop Metric LocPrf Weight Path
*> 28.119.16.0/24 204.12.1.254 0 150 0 54 i
*> 28.119.17.0/24 204.12.1.254 0 150 0 54 i
*> 112.0.0.0 204.12.1.254 150 0 54 50 60 i
*> 113.0.0.0 204.12.1.254 50 0 54 50 60 i
*> 114.0.0.0 204.12.1.254 150 0 54 i
*> 115.0.0.0 204.12.1.254 50 0 54 i
*> 116.0.0.0 204.12.1.254 150 0 54 i
*> 117.0.0.0 204.12.1.254 50 0 54 i
*> 118.0.0.0 204.12.1.254 150 0 54 i
*> 119.0.0.0 204.12.1.254 50 0 54 i
*>i192.10.1.0 64.5.8.8 0 100 0 ?
*>i205.90.31.0 192.10.1.254 7 100 0 ?
*>i220.20.3.0 192.10.1.254 7 100 0 ?
*>i222.22.2.0 192.10.1.254 7 100 0 ?
Rack1R7#

Koi Kaise Bataye Tanha hum kyon hai ! :-(

Friends,
Pls forgive me for not posting for a long long time..... I have been guilty as charged...Prcrastination has been my weakness..........But today I write to you to share my sadness.

Today We lost a dear friend at work to a road accident.
He was traveling on Mumbai-Pune Express Highway when one of his tyre burst and his car ran into opposite lane where a truck crashed into his car. :-( ..Death on Spot

We worked together on numerous projects for a large ISP. Countless, that now i close my eyes his face and our work flashes across.
We shared room together on one of the offsite functions. How much fun that was

The shock has still to sink in.
I am sad to the core. Tears aren't stopping.... I am quiet and sad

He (intentionally not naming him) recently switched job to a higher paying and better profile work at IBM !
He recently bought a Honda Accord
He recently bought a new house in Thane with a large home loan.
He was yet to be married.
He was the only son who had to take care of an ailing mom and yet to be married sister

Who will take care of his debts, home ? family ?

The thought is leaving me terrified...
Will his house be mortgaged ?
How much will his company pay for his death to his family ( twice the CTC) ??
Will that be enough to pay the mortgage ?

The loss has definitely left a mark on the way I now look towards life (insurance)
Will revise my status on debts and work towards reconciliation.

But today....I pray for his family's well being. God rest his soul in peace.

Shattered and Speechless....
Koi Kaise Bataye Tanha hum kyon hai ! :-(

Denied Boarding: Reason-Over Booking

First things first. I have been procrastinating way too much lately.
I apologise for not updating the blog.

Today I was denied boarding a Emirates Plane !
I had a CONFIRMED ticket from BOM to DXB to JNB and back for official work in Johannesburg.
So when I arrived at the airport, I already had done web checkin, so I proceeded towards immigration where my passport was stamped and then went past the Hand Baggage security towards the Boarding gates.

All well so far........ Until 2 mins before the gates Open.
I was standing right infront (impatiently, as I arrived airport 2 hrs early) waiting for my ZONE to be announced. But whilst I saw Business/First Class passengers board, there was the Emirates Supervisor approach me and ask me gently
Supervisor : "Sir where are you travelling? Are you on a connecting Flight ?"
I: Yes, To Johannesburg.....why you ask ?
Supervisor: (hesitantly) Sir are you travelling alone ?
I: Yes (raised eyebrow!) (hesitating !)
Supervisor: Sir I would let you have a FREE return ticket, from BOM to DXB to JNB and return valid for a year. If you voluntarily offload and take the next flight from BOM to DXB without missing your connection from DXB to JNB
I: What ???????
I: ????
I: Yes....
Supervisor: Calls on her cell for some junior to accompany me out all the way from the boarding gates right through the security check, through the Immigration and back to Check in counter.

In midst of all this, there were several issues, all trivial.
The Security Check Officer redirected me out through some different exit than through which i arrived. I looked like a criminal for a while being the only person going out of a door where as all were entering in.
The Immigration officer grilled the Emirates Chap accompanynig me asking why I need to offload ?
Junior Emirates Guy: Sir we over booked and this guy is being offered a free return ticket and he has voluantarily agreed to offload.
Immigration Officer: Get me a letter stating the same.

Junior Emirates Guy runs around a bit, makes frantic calls and eventually turns up with the letter. All this while I was made to sit in the customs cell, again nervously contemplating my decisions and running second thoughts.

Eventually my baggage is towed back from the plane and boarding pass detained.
My immigration stamp on the passport is also cancelled.

Then at the checkin I am provided with a Options Voucher which states that I can use it for blah blah....
And also one LIGHT REFRESHMENT coupoun which I could only encash at a pathetic "Celebrity Restaurant" behind the Immigration.

It seems I wasnt alone who voluantarily offloaded, there were in all SIX more passengers who opted for the same. Some were offered 1 night stay in 5 star hotel as they would need to come back to the airport tomorrow. Of the six, three were going to make their onward connections if they boarded the 2nd flight out from BOM to DXB, so no hotel for us :-(




Now Part II

At 6:30, The Check in begins for BOM to DXB EX550 flight
I am first one to run in.
It turns out that the counter I chose ran into several technical issues with the baggage tag printer. Ah......Spent almost 1 hr on it.
Later, I am not given my boarding pass for DXB to JNB ??????
Again, some shitty technical problem which even two level of senior escalations couldnt fix.
Ah, spent againt 1 hr waiting on it.
Eventually they managed to get the tags and the onward boarding pass printed and I am off to Immigration...........

Phew what a waste..........

By now I was at the airport for over 8hrs and already feeling tired, I slept for 45 mins on the chair at the celebrations lounge.......

Part III
More Misery to follow.................
It turns out that the boarding pass that I was given for DXB to JNB is for a window seat.....
I prefer Aisle and I originally webchecked in for Aisle only.......

I was told after all the turmoil that the best that Mumbai Emirates check in could do was that and I would need to speak up at the DXB Gates and REQUEST for alteration........

1:15 Dubai Time:
Every Cloud has a silver lining
I spoke to the Gate keeper at DXB. He checked my boarding pass and gave me the bad news
"Sir the flight is completely booked, Maybe you will have to request the passengers besides you and/or in front of you to swap"

That wasnt I was hoping for........but then, I was turning back to my waiting area when he called me again.

Sir your seat is a nice one, its in front of the Emergency Exit and you will have plenty of leg room. Moreover, you can walk out, without disturbing the other two seated besides you.

Moral Of the Story: I had plenty of heartburn, but then that is what I signed up for.......
At the end of the day, I have a FREE return ticket....
Count me foolish...
Count me Adventurous....
Count me street smart.......

I leave the decision to you !

1:25pm Dubai Time:
Boarding Announcement for DXB to JNB...... EK765, Gate 232, Terminal 3
Me off to boarding. Bye for now.

1:35Pm Dubai Time:
I have done the boarding formalities and made to wait downstairs from where a small ramp leads to the plane.
While I was boarding, the Junior Emirates Guy at the counter gave me another scare !!!!
The emirate guy tells me that, my baggage is not loaded!!!

Paramount Stress....
High BP.....
Trauma.........
More Anxiety.... I have it all

And then, he walks off to some senior person, two desks away, who checks the system and then gives him some bull shit....which he passes onto me

The agent comes back to me saying, (hesitantly) Sorry sir, now the system is updated.
Have a safe journey !!!!!
So now fingers crossed
Will need to find out what happens at the JNB arrival.
If I dont get my baggage, I am as per laws entitled to claim the rebate, I will probably be allowed to shop for a pair of clothes from JNB Duty Free for which they will reimburse.
I know my rights, I just hope I don't have to exercise them.
I am tired and have tons of work lined up than chase some stupid Emirates Guys for my misplaced Baggage.....
Fingers Crossed...