VSS Introduction

VSS stands for Virtual Switching System and is a technology for use on 6500 series switches.

It works in a similar way to stackwise on the 3750s, you have two physical devices that end up with a single logical management plane.


In a large Cisco-style network you would have two core/distribution devices for redundancy. The network topology will typically need an active/standby topology. With Spanning-tree, only one uplink is forwarding for a given VLAN. To avoid unicast flooding the network should then have HSRP/VRRP and the IGP configured so that all traffic for that VLAN is routed via the same distribution (or core) switch.

Traffic is load balanced by alternating VLANs between the two distribution switches.

This topology is shown below for a single VLAN:



The basic VSS topology is shown below, the access device still has redundant uplinks but traffic flows over all links in etherchannels:




This topology it produces is similar to a network built around Nortel kit and the Split Multi-Link Trunking (SMLT) technology. The difference being that SMLT still has two separate management planes but VSS only has one.

There are a few benefits to this system:

Simplified Network Architecture.

• Single logical device at the core/distribution layer.
• Behaves as a single unit for management purposes.
• No need to fudge STP, HSRP and IGP per VLAN.
• No need of first hop redundancy protocols (FHRP).

Simpler Routing

• Half as many IGP neighbors.
• Half as many IGP routes.
• No IGP load balancing/weighting required.

ISSU.

• Software upgrades carried out without risky failovers and associated downtimes during convergence.
• Easier to roll back.
  

Faster Convergence.

• No STP convergence delays.
• Loss of redundant switch does not change logical topology, avoiding convergence entirely.

Reduced function of Spanning-Tree.

• No blocked ports to distribution/core from access layer.
• Reduces greatly the chance of bridging loops.
• Can use portfast trunk on access device uplinks.
  

The Cisco VSS Design Guide is well worth a read for more detailed information.



Read more...

3750 Stackwise Upgrades

Upgrading a Cisco switch is very easy:

1. Copy IOS image to the flash drive on the switch.
2. Point the boot statement at the new image.
3. Reboot the switch.

The 3750 stack is made up of several physical devices with just a single logical management interface so Cisco has implemented the archive-sw command to make upgrading it easy. It doesn't quite work as well as it should and I wouldn't recommend using it. The method below is much easier and more reliable:

1. Copy IOS image to the flash drive on the switch
Use the same command as usual, but run it once for each switch in the stack. The flash drives are numbered flash1: flash2: flash3: etc.

copy tftp flash1:
copy tftp flash2:

Delete any old images or html files to clear space as necessary.

2. Point the boot statement at the new image
This can be done with a one liner (replace image.bin with whatever file you want to use):

boot system all flash:image.bin

3. Reboot the switch
The "reload" command will restart the entire stack.

So what's wrong with archive-sw?
The upgrade process is just the 3 simple steps above. Last time I used archive-sw I had about 45 minutes of instability while various individual processes restarted on the switch, routing went down but basic IP services stayed up so HSRP couldn't fail over and the network was unreachable until archive-sw had finished doing whatever it was doing. Maybe it was a bug in the archive-sw version I was using, maybe the config on that device triggered it, maybe it's just not very good.

Either way, I'm sticking to the old method of upgrades because it works and only causes an outage for the time it takes the switch to reboot (assuming it comes up again, which doesn't always happen with stacks!).


ISSU - In Service Software Upgrades
ISSU allows devices to be upgraded without outage. Unfortunately it is not available for 3750 stacks.
It may be possible to carry out the instructions above and then just reboot one switch at a time in the stack, if the old and new versions are similar enough then you might get away with it and the stack might re-form, allowing you to reboot the other switch while maintaining connectivity. Personally I wouldn't try it, if you want maximum uptime then you need two separate logical switches or to forget about upgrading them.


This method was worked out with our partners are Cacti Networks Ltd, network and security providers in the Ross-on-Wye area.

Read more...

Rapid Spanning Tree Notes

Just been reading a bit on RSTP, there are plenty of excellent detailed resources around. Here's my summary.




PDF version available here

Rapid Spanning Tree - 802.1w

Port Roles

Role	Description	Detailed
Root	Path to root bridge	The port that is closest to the root bridge in terms of path cost.
Designated	Forwarding to a segment	The port that sends the best BPDU on the segment to which it is connected.
Alternate	Alternative path to root	Alternate route to the root bridge. This port receives more useful BPDUs from another bridge. State blocked. Can be activated if the root port fails (RSTP equivalent to uplinkfast).
Backup	Redundant port	This port receives more useful BPDUs from the local bridge, therefore is redundant. State is blocked.
Disabled	Shutdown	Administratively shut down.

Port States

State	Description
Discarding	Combines the 802.1D disabled, blocking and listening states.
Learning	Drops frames but learns MAC addresses.
Forwarding	Sends frames

Port Types

Type	Description
Edge	End host, selected when portfast is enabled.
Root	Path to root bridge.
Point-to-point	Designated port to another switch. Selected when non-edge port is in full duplex mode.

• It is assumed that a non-edge port in half-duplex mode may connect to a shared medium with multiple peer switches. These ports will fall back to 802.1D compatibility mode.

• A non-edge port transitioning to forwarding will generate a TCN.

BPDUs

• All switches send BPDUs out of all ports.

• Loss of 3 BPDUs from a neighbour is taken to mean the neighbour is down. All information on that port is aged out.

• If an 802.1D BPDU is received then that port falls back to 802.1D mode from RSTP.

Read more...

DSL Firewalls and PPP Half Bridges

A PPP Half Bridge lets you extend the public IP address of your network into the LAN. This is useful if you have a firewall that doesn't have it's own DSL modem and want to do VPNs.

It's also known as DHCP spoofing.


Half bridging is a hack where your DSL modem makes the PPPoA connection to your ISP and is issued a public address, then advertises that same IP back on the LAN with a very short DHCP lease time. It then goes into bridging mode and forwards all traffic to the LAN host. The LAN host is effectively directly connected to the internet.

This is useful if you want to avoid NAT for any reason, e.g. to terminate VPNs.

The topology is shown below:



There's a big cost benefit to connect a firewall device to the DSL connection without requiring a built-in DSL modem.

Cisco's firewall line is the ASA which has no DSL module available so the only option is to use an external ADSL router. The low-end box is the 5505 which can be picked up from around £250 depending what software license you want.
They also have the 857W (~£300) and 877W for around £400 which include both wireless, VPN capability and DSL ports. However these are routers, not firewalls. They may be able to run the IOS firewall software but the performance of that is not likely to be great.

Juniper used to make a 5GT-ADSL with wireless that did the job nicely, but has now been replaced by the SSG 5 at around £650 with wireless but no DSL modem available. The only all-in-one option is to buy an SSG 20 (~£800) and an ADSL expansion card (~£500). The 5GT are still available from ebay for around £2-300 if you don't mind no support.

The home-brew solutions such as pfsense, Smoothwall and IPCop will also benefit from using the half-bridge option. Run it on something like a PC Engines mini system which cost under £100 and you'd have a very powerful little box.


Compatible Modems
Not all ADSL routers support half bridging, it's probably fair to assume that most don't. I use an old Origo 8400 which aren't available any more, I think that company is now called Safecom and they do pop up on ebuyer as the value range from time to time.

The Zyxel P-660R-D1 supports half bridging and is available from around £25 online.

According to certain forums the Linksys AM200 supports it as does the Netgear DG834G (but not GT). Some Draytek models also support it.

Read more...

OSPF Reference Bandwidth Table

Comparison of costs that are returned for various size links when the reference bandwidth is changed.

		OSPF Interface Cost
Ref Speed	Ref BW Value	10mbit link	100mbit link	1gbit link	10gbit link
100mbit	100	10	1	1	1
1gbit	1000	100	10	1	1
10gbit	10000	1000	100	10	1
20gbit	20000	2000	200	20	2
100gbit	100000	10000	1000	100	10

Read more...

PPPoA Password Retrieval on Netgear DG834

I wanted to install a new firewall on my home DSL connection recently, nothing against the Netgear as it works great, but I had a Juniper box that I wanted to try out. The UK uses PPPoA for home DSL connections so you need a username and password to get onto the network.


The DG834 has a web interface for management, Netgear's own FAQ has help with retrieving that password if you've lost it. Once on there, you can get the basic settings which looks as follows:



The password is starred out.

It's hidden using an HTML password field, which is meant to stop someone looking over your shoulder from seeing what password you type. However that is all it aims to protect against, it's then down to the individual web application as to whether it actually strips the password from the source code...and this Netgear doesn't.

You can use your browsers "view source" option (or "this frame" -> "view source") to read the PPPoA login from the HTML code:



Read more...

Fixing VirtualBox VRMMRO.r0 Error on Ubuntu

I'd just rebuilt my eeepc recently and decided to install Virtualbox. Unfortunately after installing it from the Ubuntu repository it didn't quite work, giving the error "Failed to load VMMR0.r0 (VERR_SYMBOL_NOT_FOUND)".


From googling around it quickly became apparent that there's an easy fix, to uncomment a single line in a Makefile and re-compile the Virtualbox kernel modules. Unfortunately the package on Ubuntu won't recompile due to a mismatch of paths from the package installer and the actual build script.

The suggested steps for a standard install are:

Edit src/vboxdrv*/Makefile and uncomment the line: # VBOX_USE_INSERT_PAGE = 1

Then run the script /etc/init.d/vboxdrv setup

You'll need some extra steps to create various paths that the build script expects on Ubuntu as follows:

Edit /usr/src/vboxdrv*/Makefile and uncomment the line: # VBOX_USE_INSERT_PAGE = 1

cd /usr/src
ln -s vboxdrv-2.1.4 vboxdrv
ln -s vboxnetflt-2.1.4 vboxnetflt
cd /usr/lib/virtualbox
ln -s /usr/src .

Run /etc/init.d/virtualbox-ose setup

You can work out which links are needed by looking at the startup file /etc/init.d/virtualbox-ose, locate the setup section:

setup()
{
    stop

    [snip]

    begin_msg "Recompiling VirtualBox kernel module"
    if ! $BUILDVBOXDRV \
        --save-module-symvers /tmp/vboxdrv-Module.symvers \
        --no-print-directory install > $LOG 2>&1; then
        failure "Look at $LOG to find out what went wrong"
    fi
    if ! $BUILDVBOXNETFLT \
        --use-module-symvers /tmp/vboxdrv-Module.symvers \
        --no-print-directory install >> $LOG 2>&1; then
        failure "Look at $LOG to find out what went wrong"
    fi
    rm -f /etc/vbox/module_not_compiled
    succ_msg
    start
}

BUILDVBOXNETDRV is a variable pointing to the actual build script, it is the install path in the config file /etc/vbox/vbox.cfg, the value ends up being: "/usr/lib/virtualbox/src/vboxdrv/build_in_tmp", which doesn't exist.

If you look in /usr/lib/virtualbox then there is no src path, so create one of those to /usr/src (or you could change the INSTALL_DIR in vbox.cfg but I'm not sure what else that breaks). Then look in /usr/src, no "vboxdrv" directory, so make a link to that. Later in the build you'll run into the same thing for vboxnetflt.



Footnote:
Virtualbox is a great piece of software from Sun, although ESX may be master of the type 1 hypervisor, Virtualbox is (in my opinion) the best type 2 hypervisor around, especially for networking labs. The ability to bind physical NICs to seperate VMs is very handy and being able to do it all from a straightforward GUI in a few minutes is great. It allows Linux and XP to run in parallel on my eeepc and still get 5+ hours battery life.

Read more...