Network requirements

Configuration procedure

Network requirements

As shown in Figure 1 - Network diagram for Multiple Spanning Tree Protocol (MSTP) configuration:

• All devices on the network are in the same MST region. Device A and Device B work on the distribution layer. Device C and Device D work on the access layer. 
• Configure MSTP so that packets of different VLANs are forwarded along different spanning trees: Packets of VLAN 10 are forwarded along MSTI 1, those of VLAN 30 are forwarded along MSTI 3, those of VLAN 40 are forwarded along MSTI 4, and those of VLAN 20 are forwarded along MSTI 0. 
• VLAN 10 and VLAN 30 are terminated on the distribution layer devices, and VLAN 40 is terminated on the access layer devices, so the root bridges of MSTI 1 and MSTI 3 are Device A and Device B, respectively, and the root bridge of MSTI 4 is Device C.

Figure 1: Network diagram for MSTP configuration:

top

Configuration procedure

Perform the following:

1. VLAN and VLAN member port configuration 
2. Create VLAN 10, VLAN 20, and VLAN 30 on Device A and Device B, respectively, create VLAN 10, VLAN 20, and VLAN 40 on Device C, and create VLAN 20, VLAN 30, and VLAN 40 on Device D. Configure the ports on these devices as trunk ports and assign them to related VLANs. The detailed configuration procedure is omitted.
3. Configuration on Device A
   # Enter MST region view, configure the MST region name as example, map VLAN 10, VLAN 30, and VLAN 40 to MSTI 1, MSTI 3, and MSTI 4, respectively, and configure the revision level of the MST region as 0.
   <DeviceA> system-view  

   [DeviceA] stp region-configuration  

   [DeviceA-mst-region] region-name example  

   [DeviceA-mst-region] instance 1 vlan 10  

   [DeviceA-mst-region] instance 3 vlan 30  

   [DeviceA-mst-region] instance 4 vlan 40  

   [DeviceA-mst-region] revision-level 0 
   # Activate MST region configuration.
   [DeviceA-mst-region] active region-configuration  

   [DeviceA-mst-region] quit  
   # Specify the current device as the root bridge of MSTI 1.
   [DeviceA] stp instance 1 root primary 
   # Enable MSTP globally.
   [DeviceA] stp enable 
4. Configuration on Device B #
   Enter MST region view, configure the MST region name as example, map VLAN 10, VLAN 30, and VLAN 40 to MSTI 1, MSTI 3, and MSTI 4, respectively, and configure the revision level of the MST region as 0.
   <DeviceB> system-view  

   [DeviceB] stp region-configuration  

   [DeviceB-mst-region] region-name example  

   [DeviceB-mst-region] instance 1 vlan 10  

   [DeviceB-mst-region] instance 3 vlan 30  

   [DeviceB-mst-region] instance 4 vlan 40  

   [DeviceB-mst-region] revision-level 0 
   # Activate MST region configuration.
   [DeviceB-mst-region] active region-configuration  

   [DeviceB-mst-region] quit 
   # Specify the current device as the root bridge of MSTI 3.
   [DeviceB] stp instance 3 root primary 
   # Enable MSTP globally.
   [DeviceB] stp enable 
5. Configuration on Device C.
   # Enter MST region view, configure the MST region name as example, map VLAN 10, VLAN 30, and VLAN 40 to MSTI 1, MSTI 3, and MSTI 4, respectively, and configure the revision level of the MST region as 0.
   <DeviceC> system-view  

   [DeviceC] stp region-configuration  

   [DeviceC-mst-region] region-name example  

   [DeviceC-mst-region] instance 1 vlan 10  

   [DeviceC-mst-region] instance 3 vlan 30  

   [DeviceC-mst-region] instance 4 vlan 40  

   [DeviceC-mst-region] revision-level 0 
   # Activate MST region configuration.
   [DeviceC-mst-region] active region-configuration  

   [DeviceC-mst-region] quit  
   # Specify the current device as the root bridge of MSTI 4.
   [DeviceC] stp instance 4 root primary 
   # Enable MSTP globally.
   [DeviceC] stp enable 
6. Configuration on Device D.
   # Enter MST region view, configure the MST region name as example, map VLAN 10, VLAN 30, and VLAN 40 to MSTI 1, MSTI 3, and MSTI 4, respectively, and configure the revision level of the MST region as 0.
   <DeviceD> system-view  

   [DeviceD] stp region-configuration  

   [DeviceD-mst-region] region-name example  

   [DeviceD-mst-region] instance 1 vlan 10  

   [DeviceD-mst-region] instance 3 vlan 30  

   [DeviceD-mst-region] instance 4 vlan 40  

   [DeviceD-mst-region] revision-level 0 
   # Activate MST region configuration.
   [DeviceD-mst-region] active region-configuration  

   [DeviceD-mst-region] quit 
   # Enable MSTP globally.
   [DeviceD] stp enable 
7. Verifying the configurations
   Use the display stp brief command to display brief spanning tree information on each device after the network is stable.
   # Display brief spanning tree information on Device A.
   [DeviceA] display stp brief  

    MSTID      Port                         Role  STP State     Protection  

      0        GigabitEthernet1/0/1         ALTE  DISCARDING    NONE  

      0        GigabitEthernet1/0/2         DESI  FORWARDING    NONE  

      0        GigabitEthernet1/0/3         ROOT  FORWARDING    NONE  

      1        GigabitEthernet1/0/1         DESI  FORWARDING    NONE  

      1        GigabitEthernet1/0/3         DESI  FORWARDING    NONE  

      3        GigabitEthernet1/0/2         DESI  FORWARDING    NONE  

      3        GigabitEthernet1/0/3         ROOT  FORWARDING    NONE 
   # Display brief spanning tree information on Device B.
   [DeviceB] display stp brief  

    MSTID      Port                         Role  STP State     Protection  

      0        GigabitEthernet1/0/1         DESI  FORWARDING    NONE  

      0        GigabitEthernet1/0/2         DESI  FORWARDING    NONE  

      0        GigabitEthernet1/0/3         DESI  FORWARDING    NONE  

      1        GigabitEthernet1/0/2         DESI  FORWARDING    NONE  

      1        GigabitEthernet1/0/3         ROOT  FORWARDING    NONE  

      3        GigabitEthernet1/0/1         DESI  FORWARDING    NONE  

      3        GigabitEthernet1/0/3         DESI  FORWARDING    NONE 
   # Display brief spanning tree information on Device C.
   [DeviceC] display stp brief  

    MSTID      Port                         Role  STP State     Protection  

      0        GigabitEthernet1/0/1         DESI  FORWARDING    NONE  

      0        GigabitEthernet1/0/2         ROOT  FORWARDING    NONE  

      0        GigabitEthernet1/0/3         DESI  FORWARDING    NONE  

      1        GigabitEthernet1/0/1         ROOT  FORWARDING    NONE  

      1        GigabitEthernet1/0/2         ALTE  DISCARDING    NONE  

      4        GigabitEthernet1/0/3         DESI  FORWARDING    NONE 
   # Display brief spanning tree information on Device D.
   [DeviceD] display stp brief  

    MSTID      Port                         Role  STP State     Protection  

      0        GigabitEthernet1/0/1         ROOT  FORWARDING    NONE  

      0        GigabitEthernet1/0/2         ALTE  DISCARDING    NONE  

      0        GigabitEthernet1/0/3         ALTE  DISCARDING    NONE  

      3        GigabitEthernet1/0/1         ROOT  FORWARDING    NONE  

      3        GigabitEthernet1/0/2         ALTE  DISCARDING    NONE  

      4        GigabitEthernet1/0/3         ROOT  FORWARDING    NONE 
   Based on the output, the user can draw the MSTI mapped to each VLAN, as shown in Figure 2 - MSTIs mapped to different VLANs.
   Figure 2: MSTIs mapped to different VLANs

   

Read More ...

We released another free utility yesterday called Flowalyzer. The Flowalyzer NetFlow & sFlow Tester is a free NetFlow and sFlow Tool Kit for testing and configuring hardware and software.

Flowalyzer can help you troubleshoot hardware from vendors like Cisco and Enterasys, as well as testing the NetFlow collector software, to ensure that both the hardware and software are configured correctly.

The Flowalyzer provides the following functions::

• Listener
• Generator
• Configurator
• Communicator

Listener

The Listener application can determine which flow exporting device(s) are sending the highest volume; can listen on multiple ports; display the packet count, version of NetFlow, and the UDP port that flows are coming in on; and also displays the IP address and DNS name.

Generator

The Generator application can generate NetFlow v5 and v9 flow packets to test your NetFlow collector application. You can test that your collector is accepting flows and also whether or not it is dropping flows by comparing what is sent from Flowalyzer to what is received by your collector.

Configurator

You can use the Configurator application as a configuration wizard to configure Cisco Routers or Enterasys switches for exporting NetFlow data. The Configurator uses SNMP to make OID sets, supporting SNMP v1, v2, and v3.

Communicator

This application gives you the ability to run a ping or a traceroute to any host with the communication responses in a very clear, highly readable response display. You can select to ping via ICMP, UDP, or TCP protocols.

The Flowalyzer downloads, runs and is fully functional in just a few seconds. Please take a few minutes now to check it out for yourself.

Read More ...

Ethernet link aggregation configuration task list

Task		Remarks
Configuring an aggregation group	Configuring a static aggregation group	Select either task
	Configuring a dynamic aggregation group
Configuring an aggregate interface	Configuring the description of an aggregate interface	Optional
	Enabling link state traps for an aggregate interface	Optional
	Setting the minimum number of selected ports for an aggregation group	Optional
	Shutting down an aggregate interface	Optional
	Restoring the default settings for an aggregate interface	Optional
Configuring load sharing for link aggregation groups	Configuring load sharing criteria for link aggregation groups	Optional
	Enabling local-first load sharing for link aggregation	Optional
Enabling link-aggregation traffic redirection		Optional

Enabling link-aggregation traffic redirection

CAUTION:

Removing an aggregate interface also removes th e corresponding aggregation group. At the same time, all member ports leave the aggregation group.

The user cannot assign a port to a Layer 2 aggregation group if any of the features listed below is configured on the port:

• RRPP
• MAC authentication
• Port security
• IP source guard
• 802.1X

If a port is used as a reflector port for port mirroring, do not assign it to any aggregation group.

To achieve better load sharing results for data traffic among the member ports of a link aggregation group, assign ports of the same type (such as all 100 Mb/s ports or all GE ports and so on) to the link aggregation group.

Configuring a static aggregation group

To guarantee a successful static aggregation, ensure that the ports at both ends of each link are in the same aggregation state.

Perform the following to configure a Layer 2 static aggregation group:

1. Enter system view
   system-view
2. Create a Layer 2 aggregate interface and enter the Layer 2 aggregate interface view
   interface bridge-aggregation interface-number
3. Exit to system view
   quit
4. Enter Layer 2 Ethernet interface view
   interface interface-type interface-number
5. Assign the Ethernet interface to the aggregation group
   port link-aggregation group number

Configuring a dynamic aggregation group

To guarantee a successful dynamic aggregation, make sure that the peer ports of the ports aggregated at one end are also aggregated. The two ends can negotiate the aggregation state of each member port automatically.

Perform the following to configure a Layer 2 dynamic aggregation group:

1. Enter system view
   system-view
2. Set the system LACP priority
   lacp system-priority system-priority

   NOTE:

   By default, the system LACP priority is 32,768. Changing the system LACP priority may affect the aggregation state of the ports in a dynamic aggregation group.

3. Create a Layer 2 aggregate interface and enter the Layer 2 aggregate interface view
   interface bridge-aggregation interface-number
4. Configure the aggregation group to work in dynamic aggregation mode
   link-aggregation mode dynamic
5. Exit to system view
   quit
6. Enter Layer 2 Ethernet interface view
   interface interface-type interface-number
7. Assign the Ethernet interface to the aggregation group
   port link number
8. Assign the port an LACP priority
   lacp port-priority port-priority
9. Set the LACP timeout interval on the port to the short timeout interval (1 second)
   lacp period short

Configuring an aggregate interface

Most configurations that can be performed on Layer 2 Ethernet interfaces can also be performed on Layer 2 aggregate interfaces.

Configuring the description of an aggregate interface:

Configure the description of an aggregate interface for administration purposes such as describing the purpose of the interface.

Perform the following to configure the description of an aggregate interface:

1. Enter system view
   system-view
2. Enter Layer 2 aggregate interface view
   interface bridge-aggregation interface-number
3. Configure the description of the aggregate interface
   description text

Enabling link state traps for an aggregate interface:

Configure an aggregate interface to generate linkUp trap messages when its link goes up and linkDown trap messages when its link goes down.

Perform the following to enable link state traps on an aggregate interface:

1. Enter system view
   system-view
2. Enable the trap function globally
   snmp-agent trap enable [ standard [ linkdown | linkup ] * ]
3. Enter Layer 2 interface view
   interface bridge-aggregation interface-number
4. Enable link state traps for the aggregate interface
   enable snmp trap updown

Setting the minimum number of selected ports for an aggregation group:

CAUTION:

If you set this minimum threshold for a static aggregation group, you must also make the same setting for its peer aggregation group to guarantee correct aggregation. Configuring the minimum number of selected ports required to bring up an aggregation group may cause all member ports in the current aggregation group to become unselected.

The bandwidth of an aggregate link increases along with the number of selected member ports. To avoid congestion caused by insufficient selected ports on an aggregate link, the user can set the minimum number of selected ports required for bringing up the specific aggregate interface.

This minimum threshold setting affects the aggregation state of both aggregation member ports and the aggregate interface in the following ways:

• All member ports change to the unselected state and the link of the aggregate interface goes down, when the number of member ports eligible for being selected is smaller than the minimum threshold.
• When the minimum threshold is reached, the eligible member ports change to the selected state, and the link of the aggregate interface goes up.

Perform the following steps to set the minimum number of select ed ports for an aggregation group:

1. Enter system view
   system-view
2. Enter Layer 2 aggregate interface view
   interface bridge-aggregation interface-number
3. interface bridge-aggregation interface-number
   link-aggregation selected-port minimum number

Shutting down an aggregate interface:

Shutting down or bringing up an aggregate interface affects the aggregation stat e and link state of ports in the corresponding aggregation group in the following ways:

• When an aggregate interface is shut down, all selected ports in the aggregation group become unselected and their link state becomes down.
• When an aggregate interface is brought up, the aggregation state of ports in the aggregation group is recalculated and their link state becomes up.

Perform the following steps to shut down an aggregate interface:

1. Enter system view
   system-view
2. Enter Layer 2 aggregate interface view
   interface bridge-aggregation interface-number
3. Shut down the aggregate interface
   shutdown

Restoring the default settings for an aggregate interface:

Perform the following steps to restore the default settings for an aggregate interface:

1. Enter system view
   system-view
2. Enter aggregate interface view
   interface bridge-aggregation interface-number
3. Restore the default settings for the aggregate interface
   default

Configuring load sharing for link aggregation groups

CAUTION:

By default, an aggregation group uses the global link-aggregation load sharing criterion or criteria. Configure the group-specific link-aggregation load sharing criteria to overwrite the global ones, except those specified with the destination-port , source-port , or ingress-port keywords.

Determine how traffic is load-shared across a link aggregation group by configuring load sharing criteria. The criteria can be service port numbers, IP addresses, MAC addresses, receiving ports, or any combination.

The switch supports configuring global and group-specific aggregation load sharing criteria. A link aggregation group preferentially uses group-specific load sharing criteria. If no group-specific load sharing criteria is available, the group uses the global load sharing criteria.

Configuring the global link-aggregation load sharing criteria:

Perform the following steps to configure global link-aggregation load sharing criteria:

1. Enter system view
   system-view
2. Configure the global link-aggregation load sharing criteria
   link-aggregation load-sharing mode { destination-ip | destination-mac | destination-port | ingress-port | source-ip | source-mac | source-port }

Set the following global aggregation load sharing criteria:

• Source IP address
• Destination IP address
• Source MAC address
• Destination MAC address
• Source IP address and destination IP address
• Source IP address and source port number
• Destination IP address and destination port number
• Any two or all three of these elements – ingress port number, source MAC address, and destination MAC address

Configuring group-specific load sharing criteria:

Perform the following steps to configure load sharing criteria for a link aggregation group:

1. Enter system view
   system-view
2. Enter aggregate interface view
   interface bridge-aggregation interface-number
3. Configure the load sharing criteria for the aggregation group
   link-aggregation load-sharing mode { destination-ip | destination-mac | source-ip | source-mac } *

Set the following group-specific load sharing criteria:

• Source IP address
• Destination IP address
• Source IP address and destination IP address
• Source MAC address
• Destination MAC address
• Destination MAC address and source MAC address

Enabling local-first load sharing for link aggregation:

Use the local-first load sharing mechanism in a cross-card or cross-switch link aggregation scenario to distribute traffic preferentially across all member ports on the ingress card or switch rather than all member ports.

When the user aggregates ports on different member switches in an IRF virtual device, use local-first load sharing to reduce traffic on IRF links, as shown in Figure 1 - Local-first link-aggregation load sharing.

Figure 1: Local-first link-aggregation load sharing

Perform the following steps to enable local-first load sharing for link aggregation:

1. Enter system view
   system-view
2. Enable local-first load-sharing for link aggregation
   Enable local-first load-sharing for link aggregation

Enabling link-aggregation traffic redirection

CAUTION:

Link-aggregation traffic redirection applies only to dynamic link aggregation groups. To prevent traffic interruption, enable link-aggregation traffic redirection on devices at both ends of the aggregate link. To prevent packet loss that might occur at a reboot, disable both MSTP and link-aggregation traffic redirection. In an IRF virtual device that adopts the ring connection, slight packet loss can occur when the IRF member device enabled with link-aggregation traffic redirection reboots. To prevent packet loss, you can enable local-first load-sharing for link aggregation on all IRF member devices The link-aggregation traffic redirection function is available on IRF member devices. It can redirect traffic between IRF member devices for a cross-device link aggregation group. Link-aggregation traffic redirection prevents traffic interruption when the user reboots an IRF member device that contains link aggregation member ports.Perform the following steps to enable link-aggregation traffic redirection: Enter system view system-view Enable link-aggregation traffic redirection link-aggregation lacp traffic-redirect-notification enable

Displaying and maintaining Ethernet link aggregation

Perform the following:

• Display information for an aggregate interface or multiple aggregate interfaces
  display interface bridge-aggregation [ brief [ down ] ] [ | { begin | exclude | include } regular-expression ]
  display interface bridge-aggregation interface-number [ brief ] [ | { begin | exclude | include } regular-expression ]
• Display the local system ID
  display lacp system-id [ | { begin | exclude | include } regular-expression ]
• Display the global or group-specific link-aggregation load sharing criteria
  display link-aggregation load-sharing mode [ interface [ bridge-aggregation interface-number ] ] [ | { begin | exclude | include } regular-expression ]
• Display detailed link aggregation information on link aggregation member ports
  display link-aggregation member-port [ interface-list ] [ | { begin | exclude | include } regular-expression ]
• Display the summary of all aggregation groups
  display link-aggregation summary [ | { begin | exclude | include } regular-expression ]
• Display detailed information about a specific or all aggregation groups
  display link-aggregation verbose [ bridge-aggregation [ interface-number ] ] [ | { begin | exclude | include } regular-expression ]
• Clear LACP statistics for a specific or all link aggregation member ports
  reset lacp statistics [ interface interface-list ]
• Clear statistics for a specific or all aggregate interfaces
  Clear statistics for a specific or all aggregate interfaces

Read More ...

Issue

A GRE over IPSec tunnel is established between two MSR routers and the user traffic between two sites is carried by the tunnel. During testing it is found only ping can work properly. When try to sync email with exchange server, browse Internet and RDP to remote desktop through the tunnel, the connectivity is very slow and even gets dropped.

The GRE over IPSec tunnel add quite a lot overhead to the original data packet. If the original TCP packet from the LAN is 1400-byte large, then both the GRE and IPSec add another 76 bytes (when running as transport mode) and 96 bytes (when running as tunnel mode). This makes the packet size out from the router WAN port to 1476 bytes or 1496 bytes, which almost reaches the 1500-byte TCP limit. It is very much possible that such a large packet gets dropped between two routers.

Solution

The easy way is to reduce the TCP packet before reaching the MSR LAN port: A command tcp mss applied to the LAN ports can suggest the client reduce the TCP packet sent. To reduce the TCP packet from client to 1200-byte large, then use the following command:

# interface e0/0  

    tcp mss 1200

This command changes the mss to 1200-byte in the TCP sync + ack packet out from the LAN port (sent to the client PC) so that when the PC client received the TCP sync + ack packet, it understands the other side (TCP peer) has set the TCP packet to 1200-byte maximum. As a result it will reduce its maximum TCP packet to 1200 as well. So once this command is applied to the LAN ports of both sides of MSR, both original TCP packet sent by client will be reduced to 1200. Therefore even with the GRE and IPSec overhead, the packet out of the WAN port will not be too large to get dropped.

Read More ...

Here is IPSec related config on Cisco 3800 uses dynamic crypto map approach, as we don't know which public IP, Service Provider uses for outside NAT:

crypto ipsec transform-set office esp-des esp-md5-hmac

crypto isakmp key XXXXXXXXXXXXXXXXXXXXXXX address 0.0.0.0 0.0.0.0

crypto dynamic-map DYNAMAP 5555
 set security-association lifetime seconds 28800
 set transform-set office
 set pfs group2
 match address test-gsm
 reverse-route
crypto map RETAIL 40000 ipsec-isakmp dynamic DYNAMAP

crypto isakmp policy 3
 hash md5
 authentication pre-share
 group 2
 lifetime 3600
!
ip access-list extended test-gsm
 permit ip any 10.109.51.96 0.0.0.31

interface GigabitEthernet0/1
 description Outbound
 ip address X.X.158.20 255.255.255.240
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip virtual-reassembly max-fragments 64
 ip policy route-map counters
 duplex auto
 speed auto
 media-type rj45
 no cdp enable
 crypto map RETAIL
 max-reserved-bandwidth 90
end

 MSR-900 config:

acl number 3001
 rule 0 permit ip source 10.109.51.96 0.0.0.31

ike proposal 1
 dh group2
 authentication-algorithm md5
 sa duration 3600

ike peer 1
 pre-shared-key cipher XXXXXXXXXXXXXXXXXXXXXXXXXXXX
 remote-address XXX.XXX.158.20

ipsec proposal office
#
ipsec policy vpn 1 isakmp
 security acl 3001
 pfs dh-group2
 ike-peer 1
 proposal office
 sa duration time-based 28800

interface Ethernet0/0
 port link-mode route
 ip address dhcp-alloc
 ipsec policy vpn

interface Loopback0
 ip address 10.109.51.126 255.255.255.255

Please see attached MSR-900 debug, it is too long to post it here, you can see that all security associations being established but NAT-T not detected however.

Crypto SA on MSR, please notice that NAT-T is not negotiated:

<Remote-Site> displ ipsec sa
===============================
Interface: Ethernet0/0
    path MTU: 1500
===============================

  -----------------------------
  IPsec policy name: "vpn"
  sequence number: 1
  mode: isakmp
  -----------------------------
    connection id: 3
    encapsulation mode: tunnel
    perfect forward secrecy: DH group 2
    tunnel:
        local  address: 192.168.1.201
        remote address: XX.XXX.158.20
    flow:
        sour addr: 10.109.51.96/255.255.255.224  port: 0  protocol: IP
        dest addr: 0.0.0.0/0.0.0.0  port: 0  protocol: IP

    [inbound ESP SAs]
      spi: 3957060744 (0xebdbf488)
      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5
  ---- More ----
                
      sa duration (kilobytes/sec): 1843200/28800
      sa remaining duration (kilobytes/sec): 1843200/28420
      max received sequence-number: 1
      anti-replay check enable: Y
      anti-replay window size: 32
      udp encapsulation used for nat traversal: N

    [outbound ESP SAs]
      spi: 3564383543 (0xd4742d37)
      proposal: ESP-ENCRYPT-DES ESP-AUTH-MD5
      sa duration (kilobytes/sec): 1843200/28800
      sa remaining duration (kilobytes/sec): 1843199/28420
      max received sequence-number: 5
      udp encapsulation used for nat traversal: N
<Remote-Site>displ ike sa
    total phase-1 SAs:  1
    connection-id  peer            flag        phase   doi
  ----------------------------------------------------------------
     5             XXX.XXX.158.20   RD|ST         1     IPSEC
     6             XXX.XXX.158.20   RD|ST         2     IPSEC

  flag meaning
  RD--READY ST--STAYALIVE RL--REPLACED FD--FADING TO--TIMEOUT
<Remote-Site>

We got IKE phase 2 and IPSec negotiated successfully on CIsco 3800 also, you can see ICMP packet being recevied and sent, but replies vanished somewhere on ISP NAT peers:

ru-msk-c3845-vpn#sh crypto sess remo X.X.8.193 de
Crypto session current status

Code: C - IKE Configuration mode, D - Dead Peer Detection     
K - Keepalives, N - NAT-traversal, T - cTCP encapsulation     
X - IKE Extended Authentication, F - IKE Fragmentation

Interface: GigabitEthernet0/1
Uptime: 00:00:51
Session status: UP-ACTIVE     
Peer: X.X.8.193 port 3324 fvrf: (none) ivrf: (none)
      Phase1_id: 192.168.1.201
      Desc: (none)
  IKE SA: local XXX.XXX.158.20/500 remote X.X.8.193/3324 Active 
          Capabilities:(none) connid:8976 lifetime:00:59:06
  IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 10.109.51.96/255.255.255.224 
        Active SAs: 2, origin: dynamic crypto map
        Inbound:  #pkts dec'ed 4 drop 0 life (KB/Sec) 1830689/28748
        Outbound: #pkts enc'ed 4 drop 0 life (KB/Sec) 1830689/28748

In addition to that, IKE aggressive mode should be enabled, because of dynamic IP of remote-site router.

ike peer 1
 nat traversal
 exchange-mode aggressive

Now it's working, thanks.

<Remote-Site>debug ipsec all
<Remote-Site>debug ike all
<Remote-Site>termi mon
Info: Current terminal monitor is on.

<Remote-Site>termi deb
Info: Current terminal debugging is on.

<Remote-Site>ping -a 10.109.51.126 10.111.2.20

Read More ...

Step 1: Setting GRE Tunnel between Cisco router and HP router
Diagram：

Cisco Router：851 or 3845

Configure Tunnel：

interface Tunnel0

 ip address 10.1.1.1 255.255.255.0

 tunnel source 12.1.1.2

 tunnel destination 23.1.1.2

!

router rip

 version 2

 network 10.0.0.0

 network 192.168.1.0

 no auto-summary

!

 HP or Huawei router：AR1220 or MSR900 series

Configure Tunnel：

interface Tunnel0/0/0

tunnel-protocol gre

source 23.1.1.2

destination 12.1.1.2

#

Routing：

rip 1

undo summary

version 2

network 172.16.0.0

netw 10.0.0.0

#

=========================================

Results after you completed tunnel ：

Ping successfully!

R1#ping 172.16.1.1 so loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
Packet sent with a source address of 192.168.1.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms

Step 2: Setting GRE Tunnel over IPSec between Cisco router and HP route


HP router：
#
acl number 3000
 rule 10 permit gre source 12.1.1.2 0 destination 23.1.1.2 0 
#
ipsec proposal trans
esp authentication-algorithm sha1
esp encryption-algorithm 3des
#
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
#
ike peer cisco     
pre-shared-key cisco
ike-proposal 1 
remote-address 23.1.1.2
#
ipsec policy map 1 isakmp
security acl 3000
ike-peer cisco
proposal trans
#
interface GigabitEthernet0/0/0
ip address 12.1.1.2 255.255.255.0
ipsec policy map
#
interface LoopBack0
ip address 192.168.1.1 255.255.255.0
#
interface Tunnel0/0/0
ip address 10.1.1.1 255.255.255.252
tunnel-protocol gre
source 12.1.1.2
destination 23.1.1.2
#
rip 1
undo summary
version 2
network 10.0.0.0
network 192.168.1.0
#
ip route-static 0.0.0.0 0.0.0.0 12.1.1.1
#
Return
================================================
Cisco router：
crypto isakmp policy 10
encr 3des
authentication pre-share
group 2
crypto isakmp key cisco address 12.1.1.2
!
!
crypto ipsec transform-set trans esp-3des esp-sha-hmac
!
crypto map map 1 ipsec-isakmp
set peer 12.1.1.2
set transform-set trans
match address 100
!
!
interface Tunnel0
ip address 10.1.1.2 255.255.255.252
tunnel source 23.1.1.2
tunnel destination 12.1.1.2
!
interface Loopback0
ip address 172.16.1.1 255.255.255.0
!
interface FastEthernet3
!
interface FastEthernet4
ip address 23.1.1.2 255.255.255.0
duplex auto
speed auto
crypto map map
router rip
version 2
network 10.0.0.0
network 172.16.1.0
no auto-summary
!
ip route 0.0.0.0 0.0.0.0 23.1.1.1
!
no ip http server
no ip http secure-server
!
access-list 100 permit gre host 23.1.1.2 host 12.1.1.2
!
End
==================================================
Results after completed configuration：
Cisco#sh cry isa sa
IPv4 Crypto ISAKMP SA
dst             src             state          conn-id    slot status
12.1.1.2        23.1.1.2        MM_NO_STATE          0    9
------------------------------------------------------------------------
[Huawei]dis ips sa
===============================
Interface: GigabitEthernet0/0/0
Path MTU: 1500
===============================
-----------------------------
IPSec policy name: "map"
Sequence number  : 1
Mode             : ISAKMP
-----------------------------
Connection ID     : 4
Encapsulation mode: Tunnel
    Tunnel local      : 12.1.1.2
    Tunnel remote     : 23.1.1.2
[Outbound ESP SAs]
SPI: 96254068 (0x5bcb874)
Proposal: ESP-ENCRYPT-3DES-192 ESP-AUTH-SHA1
SA remaining key duration (bytes/sec): 1887436164/3538
Max sent sequence-number: 6
UDP encapsulation used for NAT traversal: N
[Inbound ESP SAs]
SPI: 86227265 (0x523b941)
Proposal: ESP-ENCRYPT-3DES-192 ESP-AUTH-SHA1
SA remaining key duration (bytes/sec): 1887436068/3538
Max received sequence-number: 7
UDP encapsulation used for NAT traversal: N

Read More ...

This article provides instructions on VLAN configuration of HP ProCurve switches. The examples below are performed on a J9022A 48-port model, but the syntax should also work with other ProCurve models.

---

ProCurve VLAN Configuration

For those who are not familar with VLANs, please see basic VLAN configuration. The instructions below demonstrate how to configure (2) VLANs with a tag (trunk) port to pass the VLANs between each switch. The diagram below show the topology for this example:

As you can see, I have a device connected to a port on each switch in the same VLAN. The idea here is to have the same VLAN on both switches and allow both devices communicate over that VLAN. NOTE: when going from switch to switch a crossover cable is usually required. However, the HP Procurve perform auto MDI/MDI-X which eliminates the need for one. First, we will login via the console port to configure the switch. See below:

ProCurve Switch 2810-48G# conf t
ProCurve Switch 2810-48G(config)# vlan 100 name VLAN100
ProCurve Switch 2810-48G(config)# end
ProCurve Switch 2810-48G# show vlan
 Status and Counters - VLAN Information
  Maximum VLANs to support : 8
  Primary VLAN : DEFAULT_VLAN
  Management VLAN :
  802.1Q VLAN ID Name         Status       Voice Jumbo
  -------------- ------------ ------------ ----- -----
  1              DEFAULT_VLAN Port-based   No    No
  100            VLAN100      Port-based   No    No
ProCurve Switch 2810-48G# show run

Running configuration:
; J9022A Configuration Editor; Created on release #N.11.06
hostname "ProCurve Switch 2810-48G"
snmp-server community "public" Unrestricted
vlan 1
 name "DEFAULT_VLAN"
untagged 1-48
ip address dhcp-bootp
exit
vlan 100
name "VLAN100"
exit

As you can see, we created a VLAN with a VLAN name, displayed all the VLANs currently configured, and viewed the running configuration. This configuration will not be saved if the switch is rebooted until you issue a "wr mem" command.

Next, we will add a second VLAN and tag the arbitrary ports to trunk them through. Ports designated as "untagged" belong to a specific VLAN and will only be able to communicate with other ports on the same VLAN. Ports designated as "tagged" ports belong to multiple VLANs and will be able to communicate with multiple VLANs. See the configuration below:

ProCurve Switch 2810-48G# conf t
ProCurve Switch 2810-48G(config)# vlan  100
ProCurve Switch 2810-48G(vlan-100)# untagged 1-11
ProCurve Switch 2810-48G(vlan-100)# tagged 24
ProCurve Switch 2810-48G(vlan-100)# exit
ProCurve Switch 2810-48G(config)# conf  t
ProCurve Switch 2810-48G(config)# vlan 200 name "VLAN200"
ProCurve Switch 2810-48G(config)# vlan 200
ProCurve Switch 2810-48G(vlan-200)# untagged 13-16
ProCurve Switch 2810-48G(vlan-200)# tagged 24
ProCurve Switch 2810-48G(vlan-200)# exit
ProCurve Switch 2810-48G(config)# sh ru
ProCurve Switch 2810-48G# sh ru

Running configuration:
; J9022A Configuration Editor; Created on release #N.11.06
hostname "ProCurve Switch 2810-48G"
snmp-server community "public" Unrestricted
vlan 1
   name "DEFAULT_VLAN"
   untagged 12,17-48
   ip address dhcp-bootp
   no untagged 1-11,13-16
   exit
vlan 100
   name "VLAN100"
   untagged 1-11
   no ip address
   tagged 24
   exit
vlan 200
   name "VLAN200"
   untagged 13-16
   no ip address
   tagged 24
   exit
ProCurve Switch 2810-48G# wr mem
ProCurve Switch 2810-48G# sh vlan
 Status and Counters - VLAN Information
  Maximum VLANs to support : 8
  Primary VLAN : DEFAULT_VLAN
  Management VLAN :
  802.1Q VLAN ID Name         Status       Voice Jumbo
  -------------- ------------ ------------ ----- -----
  1              DEFAULT_VLAN Port-based   No    No
  100            VLAN100      Port-based   No    No
  200            VLAN200      Port-based   No    No

Remember, no IP addresses have been configured for the switch or any 
VLANs which reside on this switch.   The examples and configuration 
above allowed devices on port 16 of each switch (members of VLAN 200) to
 communicate.  By plugging into different VLANs (VLAN 100 and VLAN 200) 
the devices were unable to communicate.  A "wr mem" command was issued 
here to ensure the configuration was saved if the switch is rebooted.


To configure an IP address for VLANs 100 and 200, see below: 

 ProCurve Switch 2810-48G# conf t
ProCurve Switch 2810-48G(config)# vlan 100
ProCurve Switch 2810-48G(vlan-100)# ip address 10.15.15.200 255.255.255.0
ProCurve Switch 2810-48G(vlan-100)# exit
ProCurve Switch 2810-48G(config)# vlan 200
ProCurve Switch 2810-48G(vlan-200)# ip address 10.15.16.200 255.255.255.0
ProCurve Switch 2810-48G(vlan-200)# sh vlan
 Status and Counters - VLAN Information
  Maximum VLANs to support : 8
  Primary VLAN : DEFAULT_VLAN
  Management VLAN :
  802.1Q VLAN ID Name         Status       Voice Jumbo
  -------------- ------------ ------------ ----- -----
  1              DEFAULT_VLAN Port-based   No    No
  100            VLAN100      Port-based   No    No
  200            VLAN200      Port-based   No    No
ProCurve Switch 2810-48G(vlan-200)# sh ru
Running configuration:
; J9022A Configuration Editor; Created on release #N.11.06
hostname "ProCurve Switch 2810-48G"
snmp-server community "public" Unrestricted
vlan 1
   name "DEFAULT_VLAN"
   untagged 12,17-48
   ip address dhcp-bootp
   no untagged 1-11,13-16
   exit
vlan 100
   name "VLAN100"
   untagged 1-11
   ip address 10.15.15.200 255.255.255.0
   tagged 24
   exit
vlan 200
   name "VLAN200"
   untagged 13-16
   ip address 10.15.16.200 255.255.255.0
   tagged 24
   exit
ProCurve Switch 2810-48G(vlan-200)#

Once the IP addresses are set on each VLAN, devices in those VLANs will 
be able to ping the IP address of the VLAN as long as they have the same
 network and subnet scheme.

Read More ...