FRR with BFD for route failover via different paths on HP 5820 (Comware5)

HP 5820 (running Comware5 OS) does support fast reroute (FRR) & bidirectional forwarding detection (BFD) feature like Cisco, Juniper and others. Recently I have implemented FRR & BFD with static routes to get route protection/detour to a destination network via different paths on HP5820.

Before come across FRR & BFD – I was looking for a solution that could do tracking of next-hop address in-case of primary link failure and detour the same route through an alternative path using static routes. As the network got multi-vendor devices – a good IGP protocols might not work properly over IPsec VPN tunnel (few latest products does support this although); that’s why I was looking to get this done through static routes. A lot of documents mentioned FRR as a feature of MPLS – this works fine on non-MPLS environment as well.

The next-hope address tracking was done by using BFD (bidirectional forwarding detection) – this is a super fast compared to IGP hello intervals. Default BFD check interval is 50ms. However, BFD is not suitable for slow speed & higher latency network.

Here is the network topology –

FRR-Topology

In this topology –

a. Primary connectivity between Site-A and Site-B is dark optical fiber link – which provides full wire speed.

b. In case optical fiber fail – the Site-A and Site-B connectivity must go through site to site IPsec VPN over the Internet.

The configurations are following –

a. Site-to-site IPsec VPN been established (omitted)

b. IP address configurations have been done on vlan interfaces on both Site-A & Site-B switches (omitted).

c. Configurations on Site-A HP5820-SW01-

#configure BFD (bidirectional forwarding detection) source to track next-hop IP address
bfd echo-source-ip 172.16.10.1

##define the primary route to Site-B via optical fiber – static route
ip route-static 2.2.2.0 255.255.255.0 Vlan-interface10 172.16.10.2

##define Site-B network prefix to be used in the route policy
ip ip-prefix site-b-prefix 10 permit 2.2.2.0 24

##define route-policy to route to Site-B via IPsec VPN as backup route
route-policy site-a-frr permit node 10
   if-match ip-prefix site-b-prefix
   apply fast-reroute backup-interface Vlan-interface20 backup-nexthop 172.16.20.2

##configure the backup next hop static route
ip route-static fast-reroute route-policy site-a-frr

d. Configurations on Site-B HP5820-SW02-

#enable BFD (bidirectional forwarding detection) source to track next-hop IP address
 bfd echo-source-ip 172.16.10.2

##define the primary route to Site-A via optical fiber
ip route-static 1.1.1.0 255.255.255.0 Vlan-interface10 172.16.10.1

##define Site-B network prefix to be used in route policy
ip ip-prefix site-a-prefix 10 permit 1.1.1.0 24

##define route-policy to route to Site-B via IPsec VPN as backup route
route-policy site-b-frr permit node 10
   if-match ip-prefix site-a-prefix
   apply fast-reroute backup-interface Vlan-interface30 backup-nexthop 172.16.30.2

##configure the backup next hop static route
ip route-static fast-reroute route-policy site-b-frr

That’s all for the configurations!

Let’s verify the configuration –
#display bfd session      ;this will display tracking of next-hop

If the state is DOWN – “backup next-hop” will become the active route

BFD-Sessions

#display ip routing-table 2.2.2.0 verbose                             ;on HP5820-SW01

#display ip routing-table 1.1.1.0 verbose                             ;on HP5820-SW02

FRR-RoutingTable

This will display both NextHop and BackupNextHop for the same destination.

Enable SSH on HP ProCurve 6600 series switch

HP ProCurve 6600 runs “ProVision” network operating system. ProVision command syntaxes are pretty much similar to Cisco IOS commands.

Following are commands to enable SSH on a ProCurve 6600 series –

First create local user account on the switch; command is –

#password manager user-name admin; this will prompt to enter password

Generate crypto keys for SSH server; command is –

#crypto key generate ssh

Enable SSH service; command is –

#ip ssh

To check SSH service status, enter the following command –

#show ip ssh

hp-6600-ssh

To restrict access to SSH (or local services on the switch), configure authorised manager IP address; command is –

#ip authorized-managers IP_Address

That’s all.

Inter-VRFs routing on the same router (VRF-lite route leak) with MP-BGP – HP 5820 (Comware5)

I was trying to implement inter-VRFs routing in a multi VRF-lite environment – there was a requirement to implement routing between two VRFs on the same router. This time the routers are HP 5820 series Layer-3 switches running Comware5 network Operating System (HP 5820 is a 24 port 10GB SFT+ Layer3 device). I have done the same on Cisco IOS (check my previous post on this).

I couldn’t find any specific recommendation on HP documentation regarding inter-VRFs routing on the “same device”. Also HP docs say when you configure BGP you need to specify BGP neighbor (I was thinking the same – without a neighbor BGP is incomplete!).

However, Cisco already published a recommendation on this – so I took Cisco’s recommendation and configured BGP without neighbor on Comware5 and found its working fine! Cisco recommendation specify two items (i) vrf route-target import (ii)BGP redistribution but no neighbor required.

“You can not configure two static routes to advertise each prefix between the VRFs, because this method is not supported—packets will not be routed by the router. To achieve route leaking between VRFs, you must use the import functionality of route-target and enable Border Gateway Protocol (BGP) on the router. No BGP neighbor is required. http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/multiprotocol-label-switching-vpns-mpls-vpns/47807-routeleaking.html

Here is the topology –

inter-vrfs-BGP

Routing/connectivity requirements are –

Within same router inter-VRF routing:

Source Network Destination Network Site Number
A-1-network-web A-1-network-app Site 1
A-2-network-web A-2-network-app Site 2

Inter-site VRFs routing:

1. Single source to > multiple destinations

Source Network Destination Network
A-1-network-web A-2-network-web
A-1-network-web A-2-network-app
A-1-network-app A-2-network-app
A-1-network-app A-2-networl-web

2. Single source to > single destination

Source Network Destination Network
A-1-network-iscsi A-2-network-scsi
B-1-network-appserver B-2-network-app

Based on above mentioned scenario –

  1. VRFs routing between Site 1 and Site 2 – static route or any dynamic routing protocol such as EIGRP, OSPF are suitable.
  2. VRFs routing within the same router at each site (routing for web & app on the same site) need to be done through multiprotocol BGP and route-target import – which is a recommendation by Cisco.

In this example –

Site-1 (source) networks are-

-Customer A webserver network is – 192.168.101.0/24 (VLAN101); default route is 192.168.101.254

-Customer A appserver network is – 192.168.102.0/24 (VLAN102); default route is 192.168.102.254

-Customer A iscsi network is – 192.168.103.0/24 (VLAN103)

-Customer B appserver network is – 192.168.104/24 (VLAN104)

Site-2 (destination) networks are-

-Customer A webserver network is – 192.168.201.0/24 (VLAN201); default route is 192.168.201.254

-Customer A appserver network is – 192.168.202.0/24 (VLAN202); default route is 192.168.202.254

-Customer A iscsi network is – 192.168.203.0/24 (VLAN203)

-Customer B appserver network is – 192.168.204/24 (VLAN204)

Interconnect network between Site-1 & Site-2 are (both sites are connected through dark fibre which is Layer 2 connectivity)-

-“A-1-Web” to “A-2-Web” interconnect is 172.16.101.0/24 (VLAN 171)

-“A-1-App” to “A-2-App” interconnect is 172.16.102.0/24 (VLAN 172)

-“A-1-iSCSI” to “A-2-iSCSI” interconnect is 172.168.103.0/24 (VLAN 173)

-“B-1-App” to “B-2-App” interconnect is 172.168.104.0/24 (VLAN 174)

I will show here two things –

  1. Inter-VRFs routing on the same site through BGP and vpn-target export-import.
  2. SITE-1 and SITE-2 inter- VRFs routing through static routing (dynamic can be done as well).

Following are configuration commands on SITE-1-Router-01,

01. Define VRFs and route-target export & import as following:

#
ip vpn-instance a-1-webserver
 route-distinguisher 65111:101
 vpn-target 65111:101 export-extcommunity
 vpn-target 65111:101 65111:102 import-extcommunity ;import “a-1-network-appserver”
#
ip vpn-instance a-1-appserver
 route-distinguisher 65111:102
 vpn-target 65111:102 export-extcommunity
 vpn-target 65111:101 65111:102 import-extcommunity ;import “a-1-network-webserver”
#
ip vpn-instance a-1-iscsi
 route-distinguisher 65111:103 ;no import-export required
#
ip vpn-instance b-1-appserver
 route-distinguisher 65111:104 ;no import-export required
#

2. Apply VRFs to interfaces and also configure interface IP address

#
interface Vlan-interface101
 description A-1-Web Servers
 ip binding vpn-instance a-1-webserver
 ip address 192.168.101.254 255.255.255.0
#
interface Vlan-interface102
 description A-1-App Servers
 ip binding vpn-instance a-1-appserver
 ip address 192.168.102.254 255.255.255.0
#
interface Vlan-interface103
 description A-1-iSCSI
 ip binding vpn-instance a-1-iscsi
 ip address 192.168.103.254 255.255.255.0
#
interface Vlan-interface701
 description A-1-web to A-2-web interconnect
 ip binding vpn-instance a-1-webserver
 ip address 172.16.101.254 255.255.255.0
#
interface Vlan-interface702
 description A-1-app to A-2-app interconnect
 ip binding vpn-instance a-1-appserver
 ip address 172.16.102.254 255.255.255.0
#
interface Vlan-interface703
 description A-1-iscsi to A-2-iscsi interconnect
 ip binding vpn-instance a-1-iscsi
 ip address 172.16.103.254 255.255.255.0
#
interface Vlan-interface704
 description B-1-app to B-2-App interconnect
 ip binding vpn-instance b-1-appserver
 ip address 172.16.104.254 255.255.255.0
#

3. Configure BGP without neighbor with the VPN instances name as following:

(we need routing between webserver & appserver on the same router)

#
bgp 65111
 router-id 1.1.1.1
 undo synchronization
 #
 ipv4-family vpn-instance a-1-webserver
  import-route direct
 #
 ipv4-family vpn-instance a-1-appserver
  import-route direct!
#

Once the BGP is done – you should be able to ping between “a-1-webserver” and “a-1-appserver” networks.

Its time check routing table for the VRFs – you will find BGP is doing the routing for the same switch inter-VRFs.

#display ip routing-table vpn-instance a-1-webserver
#display ip routing-table vpn-instance a-1-appserver
#display bgp vpnv4 vpn-instance a-1-webserver routing-table
#display bgp vpnv4 vpn-instance a-1-appserver routing-table

####rest of the configurations are for inter site (site-1 & site-2) communication####

4. Following are routing between SITE-1 and SITE-2 VRFs via static routing:

(static routes to be added to SITE-1-Router-01)

#
ip route-static vpn-instance a-1-webserver 0.0.0.0 0.0.0.0 192.168.101.254
ip route-static vpn-instance a-1-webserver 192.168.201.0 255.255.255.0 172.16.101.2; (A-1 web to A-2 web)
ip route-static vpn-instance a-1-webserver 192.168.202.0 255.255.255.0 172.16.101.2; (A-1 web to A-2 app)
ip route-static vpn-instance a-1-appserver 0.0.0.0 0.0.0.0 192.168.102.254
ip route-static vpn-instance a-1-appserver 192.168.202.0 255.255.255.0 172.16.102.2; (A-1-app to A-2-app)
ip route-static vpn-instance a-1-appserver 192.168.201.0 255.255.255.0 172.16.102.2; (A-1-app to A-2-web app)
ip route-static vpn-instance a-1-iscsi 192.168.203.0 255.255.255.0 172.16.103.2; (A-1 iscsi to A-2 iscsi)
ip route-static vpn-instance b-1-iscsi 192.168.204.0 255.255.255.0 172.16.104.2; (B-1 app to B-2 app)
#

Configure the SITE-2-Router-02 same way (change the source and destination networks).

At this stage routing between both the site-1 and site-2 VRFs should be fine.

Check routing table for all the VRFs –
#display ip routing-table vpn-instance vrf_name

Do ping test as well; command is –
#ping -vpn-instance vrf_name IP_address

HP 5820 LACP (802.3ad) with non-HP (Cisco, F5 and others)

HP 5820-24XG-SFP+ is a 24 port 10GB SFP+ Layer 3 enterprise and carrier grade Ethernet switch. This is running Comware5 network operating system. This switch is actually manufactured by H3C.

HP 5820 series LACP (802.3ad) link aggregation is called “Bridge-Aggregation” interface. The configuration is pretty much similar to Cisco EtherChannel.

I will discuss two things here–

(a). how to configure link-aggregation between HP and non-HP (Cisco, F5, Juniper) devices.

(b). how to configure link-aggregation between HP and HP (HP ProCurve ProVision, Comware5/7, HP SAN).

Following are configuration commands to create LACP between HP and non-HP devices –

(a). Enter the following command on the HP switch to create bridge-aggregation interface

(trunk/tagged vlan interface example)

interface Bridge-Aggregation1
 description “LACP Trunk goes to a non-HP device”
 port link-type trunk
 port trunk permit vlan all ;this can be limited to user define VLANs only 
 link-aggregation mode dynamic  ;for non-HP mode dynamic is require

(access port example)

interface Bridge-Aggregation2
 description “LACP access goes to a non-HP device”
 port access vlan 100
 link-aggregation mode dynamic  ;for non-HP mode dynamic is require

After define bridge aggregation interface – you need to add physical interfaces to it. Physical interface should inherit all the parameters configured on the bridge-aggregation interface.

Make sure physical interfaces are configured with “default” settings only before put them to a bridge-aggregation group to get settings auto inherited. Otherwise you need to specify “link-type” and “permit vlan” parameters once again on all the member physical interfaces.

interface Ten-GigabitEthernet1/0/22
   port link-mode bridge
   description “this interface is a member of bridge-aggregation 1”
   port link-type trunk
   port trunk permit vlan all
   port link-aggregation group 1

interface Ten-GigabitEthernet2/0/22
   port link-mode bridge
   description “this interface is a member of bridge-aggregation 1”
   port link-type trunk
   port trunk permit vlan all
   port link-aggregation group 1

Once done – you should be able to see aggregated bandwidth on the “Bridge-Interface”.

Do a “#display interface Bridge-Aggregation 1

Screenshot of a two 10Gbps LACP interface (20Gbps aggregated) –

5820-LACP

(b). For LACP between HP and HP devices enter all the above commands except “link-aggregation mode dynamic”.

HP ProCurve 6600 series firmware upgrades using USB flash drive

Firmware upgrade on a HP ProCurve 6600 series (24g-4xg or 48g-4xg or 24xg) can be done in several ways, here I will cover upgrading firmware using USB stick.

HP 6600 series always keep two boot images on the flash – (i)primary boot image and (ii)secondary boot image; by default switch boot from the primary. During new firmware upgrade the system automatically take a backup of primary image and copy this to the secondary – so no worry; if you messed up with firmware upgrade you can tell the system to boot from secondary (which is you current good one in fact).

Also firmware upgrade process will keep a backup of your “configurations” in the switch – however it is recommended you should take copy of the same before start upgrade process.

1. Download the latest firmware from HP My Networking site – https://h10145.www1.hp.com/downloads/ProductsList.aspx?lang=&cc=&prodSeriesId=

The latest firmware as of today (June 2014) is K.15.13.0005. The firmware file is a “.swi” extension file. Copy this file onto a USB flash drive (do not put this in a sub directory). Before the upgrade make sure which version is you are currently running; the command is “#show flash” – screenshot –

HP-6600-firmware-1

2. Insert the USB stick to the switch; the switch will automatically mount the USB. Do a “#show flash” to see the firmware file visible on the switch.

3. Once you see the firmware file on the switch – let’s start firmware upgrade process. Copy the firmware file to primary flash. The command and screenshot following –

#copy usb flash K_15_13_0005.swi primary

HP-6600-firmware-2

4. Once the copy is finish make sure your primary flash is showing the latest version; the command is “#show flash” again –

HP-6600-firmware-3

(now primary and secondary version are different)

5. Optional – you might need to tell the switch to boot from the primary image; command is “#boot system flash primary” – screenshot following –

HP-6600-firmware-4

The switch will reboot during firmware upgrade.

Once all above are done – do a “#show flash” to confirm the switch is running with the latest firmware.