Changes between Version 28 and Version 29 of Internal/OpenFlow/Notes


Ignore:
Timestamp:
Jan 4, 2010, 10:59:08 PM (15 years ago)
Author:
akoshibe
Comment:

Legend:

Unmodified
Added
Removed
Modified
  • Internal/OpenFlow/Notes

    v28 v29  
    396396moral of the story: double check configuration changes. 
    397397
     398== 12/31-Top switch configs. ==
     399
     400VLAN 50 is the only real exposed VLAN - 4 ports (DMZ, 2 planet lab, firewall out)
     4011001-1005 - Cisco associated (ignore)
     4029,10- not used
     403
     404ports can be divided up into 3 groups
     405
     406 1. Infrastructure - Not really visible to user - Aruba, Internal, Instrumental ect - VLANs 1-6 
     407 2. Experimental - Pertains to Grid, outdoor, Sandboxes - VLANs 7,8,11-38
     408 3. Public - Visible from outside - VLAN 50
     409
     410We want to combine the internal, firewall feed, and top switch port configs onto one NEC IP8800. The ports that comprise this  setup are:
     411
     412 1. 4 VLAN 50 ports (ports 1-4)
     413 1. 4 firewall ports (only 3 actually needed to go into ASA)
     414 1. 10 Internal (VLAN 2) Ports
     415 1. 16 Top switch ports (Assorted, originally 20 including 4 VLAN 50 ports)
     416
     417 
     418refrences (these are in Japanese):
     419
     420 * port config parameter specs: http://www.nec.co.jp/ip88n/s36_sw/html/cfref/cfref-chap1-4.html
     421 * interface vlan context specs: http://www.nec.co.jp/ip88n/s36_sw/html/cfref/cfref-chap11-03.html
     422 * vlan context specs: http://www.nec.co.jp/ip88n/s36_sw/html/cfref/cfref-chap11-22.html
     423
     424=== Creating VLANs ===
     425
     426Step 1 of switch configs always start off with creating vlans. you can create a single VLAN using the command [[BR]]
     427`interface vlan <vlan-number>`
     428
     429However, VLAN creation cannot be done in groups using the command [[BR]]
     430`interface range vlan <vlan-range>`
     431
     432Like in group configs of ports. This will return an error
     433{{{
     434(config)# interface range vlan 7-38
     435interface : Not found VLAN-ID <7>.
     436}}}
     437
     438Hence, when you need to make ranges of VLANs you must specify the range of VLANs to create using the command [[BR]]
     439`vlan <vlan-range>`
     440
     441making the commands to create the vlans necessary for this switch into these lines on the CLI:
     442{{{
     443(config)# vlan 1-8
     444!(config-vlan)# vlan 11-48
     445!(config-vlan)# vlan 50
     446!(config-vlan)# save
     447(config-vlan)#
     448}}}
     449
     450----
     451<side-tracking!>
     452
     453Then, you may ask, why have the "interface vlan" context?. To be able to understand this, you need to know that the "interface vlan" context lets you treat a VLAN as an abstraction layer that allows access to both Layer 2 and 3 information for a specific group of hosts. This means using the "interface vlan" context allows you to actually specify IP layer characteristics for groups of hosts based on which vlans they belong in. This is, as you may guess, quite useful. 
     454
     455The `interface range vlan` context can be used to configure groups of already existing vlans. So given that you have a group of vlans, you can configure them all at once like this:
     456
     457{{{
     458(config)# #this switch already has vlans 1-6 on it
     459(config)# interface range vlan 1-5
     460(config-if-range)# sh
     461interface vlan 1
     462!
     463interface vlan 2
     464!
     465interface vlan 3
     466!
     467interface vlan 4
     468!
     469interface vlan 5
     470!
     471}}}
     472
     473In this case, you can see that you enter the proper (config-if-range)# mode. doing a `show` in this mode lets you see which vlans you are configuring together. 
     474
     475</side-tracking!>
     476----
     477=== Naming VLANs ===
     478
     479Once all VLANs are created, you'd want to name them. this is done through the `vlan` context.
     480
     481{{{
     482(config-vlan)# vlan 2
     483(config-vlan)# name "Internal"
     484}}}
     485
     486rinse and repeat this process. A table of the vlans coming up soon.
     487
     488=== Associating VLANs with ports ===
     489
     490Now that you have properly named VLANs, you can associate them with ports.
     491
     492<<here will be the diagram of the switchports layout of the configs.>>
     493
     494first, the 4 publically visible VLAN 50 ports:
     495{{{
     496(config)# int range gi 0/1-4
     497(config-if-range)# switchport access vlan 50
     498}}}
     499
     500Then, the firewall ports feeding the VLANs into the ASA; These are specialized trunk ports:
     501
     502 * geth0/7 - VLAN 50
     503 * geth0/8 - VLANs 1-6
     504 * geth0/9 - VLANs 7,8
     505 * geth0/10 - VLANs 11-38
     506
     507The commands to make this happen are the following. First make four ports into trunk ports using the 'interface range' context:
     508{{{
     509(config)# int ran gi 0/7-10
     510(config-if-range)# sw mo tru
     511!(config-if-range)#
     512}}}
     513
     514Then, specify allowed VLANs for each port. This is according to the list above.
     515{{{
     516!(config-if-range)# ##geth0/7 - VLAN 50##
     517!(config-if-range)# interface gigabitethernet 0/7
     518!(config-if)# swi trunk allowed vlan 50
     519!(config-if)# ##geth0/8 - VLANs 1-6##
     520!(config-if)# interface gi 0/8
     521!(config-if)# swi trunk allow vlan 1-6
     522!(config-if)# ##geth0/9 - VLANs 7,8##
     523!(config-if)# interface gi 0/9
     524!(config-if)# swi tru all vl 7,8
     525!(config-if)# ##geth0/10 - VLANs 11-37##
     526!(config-if)# interface gi 0/10
     527!(config-if)# swi tru all vl 11-38
     528!(config-if)# save
     529(config-if)# exit
     530}}}
     531
     532the configuration results:
     533{{{
     534(config)# int ran gi 0/7-10
     535(config-if-range)# sh
     536interface gigabitethernet 0/7
     537  switchport mode trunk
     538  switchport trunk allowed vlan 50
     539!
     540interface gigabitethernet 0/8
     541  switchport mode trunk
     542  switchport trunk allowed vlan 1-6
     543!
     544interface gigabitethernet 0/9
     545  switchport mode trunk
     546  switchport trunk allowed vlan 7-8
     547!
     548interface gigabitethernet 0/10
     549  switchport mode trunk
     550  switchport trunk allowed vlan 11-38
     551!
     552}}}
     553
     554Next, the 10 Internal ports; These are regular switchports all associated to VLAN 2.
     555{{{
     556(config)# int ran gi 0/13-22
     557(config-if-range)# sw mo dot1q-tunnel
     558!(config-if-range)# sw acc vlan 2
     559}}}
     560
     561Finally, the sw_top configurations; This is perhaps the most complicated part. the ports will be configured from 0/48 to leave ample space between the Internal ports and these ports, which are all specialized trunk ports (we won't want people to accidentally be able to plug into them!). 
     562
     563
     564organizing them:
     565
     566 Infrastructure VLANs                                   
     567 ||port ||VLANs         ||Description                   ||
     568 ||0/29 ||1,2           ||Internal (1)                  ||
     569 ||0/30 ||1,2           ||Internal (2)                  ||
     570 ||0/31 ||1,3           ||CM                            ||
     571 ||0/32 ||1,4,5         ||Aruba, Instrumental           ||
     572 ||0/33 ||1,6           ||DMZ                           ||
     573 ||0/34 ||1-6           ||Main Subnets                  ||
     574 
     575 Testbed VLANs                                 
     576 ||0/37 ||1,3,29,30     ||CM, Outdoor Data and Ctrl     ||
     577 ||0/38 ||1,7,31:2:37   ||Grid and VGrid Ctrl           ||
     578 ||0/39 ||1,8           ||Grid Data                     ||
     579 ||0/40 ||7,8           ||Grid Data and Ctrl            ||
     580 ||0/41 ||1,6-8         ||DMZ, Grid Data and Ctrl       ||
     581 ||0/42 ||11-48         ||??                            ||
     582 ||0/43 ||1,11-38       ||Testbed Data and Ctrl         ||
     583 ||0/44 ||1,3,11-38     ||CM, Testbed Data and Ctrl     ||
     584 
     585 Master Trunk                                           
     586 ||0/47 ||1             ||Access Net                    ||
     587 ||0/48 ||1-38          ||Master Trunk                  ||
     588----
     589<side-tracking!>
     590
     591The error messages are quite...verbose.
     592
     593{{{
     594!(config-if)# sw tru all vlan 10-48
     595interface : Can't set switchport trunk allowed vlan which is not configured to use vlan vlan 10.
     596}}}
     597
     598This simply means you are trying to add a nonexistent vlan to the list of allowed VLANs for a trunk. Make sure the VLAN exists before trying to add it!
     599
     600</side-tracking!>
     601----
     602
     603=== killing Spanning Tree ===
     604Spanning Tree Protocol should be disabled. Both PVST and PVST+ count as spanning tree.
     605
     606{{{
     607!(config)# no spanning-tree vlan 3,7,8,11-38
     608!(config)# save
     609}}}
     610
     611
    398612
    399613[[BR]]