Control Plane Policing

Here is our scenario.

Currently, when pinging any interface on Router2 with 50 packets 100bytes each from Router1, the result is 100%. Change it so the success rate is always 96%.

Assuming FastEthernet Interfaces.

Router1 - Router2

—Configure control plane policing on Router2

access-list 110 permit icmp host [Router1] host [Router2] echo

class-map ICMP

match access-group 110

policy-map ICMP

class ICMP

police rate 80 pps

control-plane

service-policy input ICMP

Then from Router1 do a ping:

ping 2.2.2.2 size 100 repeat 50

Sending 50, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:
!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!.!!
Success rate is 96 percent (48/50), round-trip min/avg/max = 1/3/9 ms

Enjoy!

Tags: , ,

Leave a Comment

OSPFv3: Cannot see ourself in hello from

I ran into a weird problem the other day where my IPv6 OSPF adjacency kept flapping every 40 sec(dead timer) and then reestablishing.

Before you go crazy trying to troubleshoot this problem, check this:

1. Check to see if there is a switch in between your IPv6 routers, make sure this switch supports IPv6! if there is a switch in between, try disabling mld snooping or ipv6 routing all together and see if it fixes the problem.

2. Setup the interfaces as non-broadcast and do neighbor statements to the link-local bypassing the Ipv6 multicast for OSPF.

3. If you changed the IPv6 OSPF router-id. Make sure you remove the OSPF process totally, clearing may not help. Then clear out the neighbor OSPF process so that neighbors accept new Router-id and do not have stale information. Check this by doing # show ipv6 ospf database

This is what I had to do to maintain stability.

Cheers!

Tags: ,

Leave a Comment

Inject default route into IGP based on IP SLA response

Here’s a little trick I learned on how to inject a default route into the network only if the IP SLA probe comes back with a success response. IP SLA is a way to check reachability for a given router or layer 3 device.

Network Topology:

RouterA - RouterB - RouterC

First lets lets create an IP SLA to monitor RouterC from RouterA.

# ip sla monitor 1
# type echo protocol ipIcmpEcho 3.3.3.3
# timeout 2000
# frequency 5
# ip sla monitor schedule 1 life forever start-time now

Lets setup tracking for this IP SLA

# track 1 rtr 1

Now lets create a dummy route and make sure it is entered into the routing table if the IP SLA succeeds.

# ip route 12.12.12.12 255.255.255.255 null0 track 1

Lets create a prefix-list that matches this route

# ip prefix-list PR_CHECK_STATIC permit 12.12.12.12/32

Next we create a Route-map that looks for this static route in the routing table.

# route-map RM_CHECK_STATIC

# match ip address prefix-list PR_CHECK_STATIC

Lastly we apply it to our IGP Router process and originate a default route

# default-information originate route-map RM_CHECK_STATIC

Done!

Basically, if the IP SLA fails, then the route is never entered into the routing tables which causes the route-map to fail with the prefix lookup and the end result being that no default route is advertised into the network.

Tags: , ,

Leave a Comment