Michael McNamara

technology, networking, virtualization and IP telephony

ERS 5500 Advanced Routing License

by

The Nortel ERS 5500 Series switches support Layer 3 switching (routing) but only with static routes. The Advanced Routing License is required to provide the following features;

  • OSPF (Open Shortest Path First) Routing
  • VRRP (Virtual Routing Redundancy Protocol)
  • ECMP (Equal Cost Multi-Path)
  • SMLT (Split Multilink Trunking)
  • IPFIX (IP Flow Information Export)

The license is based on a switch or stack – a single license will be required for a standalone switch or for a stack of up to eight units. A single license will enable all of the features described above.

I believe Nortel is selling the licenses in counts of 1, 10, 50 or 100. The licenses will be tied to the MAC address of the switch with some amount of flexibility should a switch fail or need to be replaced.

Did you know that there is a 30 day demo license available?

As of software release v5.1 there is a 30 day demo license available which you can load on the switch to evaluate the different features. I’m currently running two ERS 5500 series switches with the 30 day demo license testing the OSPF functionality.

The 30 day demo license can be found on Nortel website just below the v5.1 software release. Once you’ve retrieved the demo license (filename: 30daydemo.lic) you’ll need to place it on a TFTP server (or you could try a USB flash drive if your working with an ERS 5530 switch).

ERS5530>enable
ERS5530#copy tftp license 192.168.1.20 30daydemo.lic

Later versions of software have a slightly different syntax;

ERS5530>enable
ERS5530#copy tftp license address 192.168.1.20 filename bld_6_2_demo.lic

You would of course need to substitute your TFTP server IP address with 192.168.1.20 above. Once you’ve downloaded the license you’ll need to restart the switch to activate the license. After the switch has restarted you can use the following command to check the license;

ERS5530# show license all
Number of licenses:  1
---------------------------------------------------------
License 1
---------------------------------------------------------
version:         0
md5_key:         9f8d802b 1459576e 7d0b8951 af8e1751
md5_file:        8375fe89 ea7eb5e2 fa155e7a 181410c8
time_base:       2007/06/22 08:19:01
time_modify:     2007/06/22 08:19:01
time_expiration: 28 days, 05:05:00
num_unique_ids:  1
flags:           0x0000000d SINGLE EXPIRE EMERGENCY
memo:

*** This is a temporary  license valid for 30 days.  A valid license is ***
*** required  for uninterrupted operation  of the switch.  There may be ***
*** service impact if this temporary license is not removed in 30 days. ***

You can also delete the existing software licenses with the following command;

ERS5530# clear license all

Cheers!

Nortel VPN Router (Default Password)

by

The Nortel VPN (formerly Contivity) Routers are among some of the best in the industry. The majority of the product line came to Nortel (formerly Bay Networks) from the acquisition of New Oak back in 1999.

Since that time Nortel has added a few lower end SOHO solutions, Nortel VPN Router 200 series, to the product line which I believe are OEM’d from ZyXEL. I’m not very fond of the 200 series and I would NOT recommend them to anyone. I am, however, very fond of the 1100 series as it runs the same software that the larger models run.

Thankfully they all share the same default username and password. Unfortunately they don’t all share the same software or configuration interface.

The default username is “admin”.
The default password is “setup”.

With the traditional Nortel (Contivity Switches) VPN routers there are two internal IP addresses assigned to the one physical internal interface. One IP address is for management and the other for routing traffic. The default management IP address for these models (Nortel VPN Router 1000 Series, 2000 Series, 4000 Series, 5000 Series) is;

http://192.168.1.2

The actual traffic interface is 192.168.1.1 and the default DHCP address range should be between 192.168.1.3 – 192.168.1.254.

Cheers!

Nortel Ethernet Switch "Agent Not Found"

by

This post applies to the following models;

  • Nortel Business Policy Switch 2000
  • Nortel Ethernet Switch 300 Series
  • Nortel Ethernet Switch 460
  • Nortel Ethernet Switch 470
  • Nortel Ethernet Switch 2500 Series
  • Nortel Ethernet Switch 4500 Series
  • Nortel Ethernet Route Switch 5500 Series

It is possible that the switch agent image, that is stored in NVRAM on the switch, can become corrupt for some reason or another. In this case the switch will not boot up properly and will require some special intervention.

Diagnostic Version X.X.X.X
Press Control-C to Enter Diag

Test ROM Config - PASSED
Test FANs - PASSED
Test Internal Loopback - PASSED
Test ASIC1 Registers - PASSED
Test ASIC2 Registers - PASSED
Test PHY Registers - PASSED
Test USB Registers - PASSED
Agent code verification fails!

>> Break Recognized - Wait...
Press 'a' to run Agent code
Press 'd' to download Agent code
Press 'e' to display errors
Press 'c' to clear log message
Press 'i' to initialize config flash
Press 'p' to run POST tests...

You can use the boot diagnostic code to download the agent code to the switch using the “d” option. While the switch is booting using “Ctrl-C” to break the boot sequence and select “d” from the menu.

WARNING: the TFTP server needs to be physically connected to the switch in question

Download Agent Code

Enter Port Number [  ]:
Enter Speed: 10, 100, 1000 [  ]:
Enter Local IP Address [ 0.0.0.0 ]: 10.10.10.15 (IP given to Switch)
Enter Server IP Address [ 0.0.0.0 ]: 10.10.10.1 (IP of local TFTP server)
Enter Subnet Mask [ 255.255.255.0 ]:
Enter Filename: boss_1234.img
Wait..
TFTP: Sending Open: .aaaaa.a
TFTP: Open
...............................................................
.............................................................
Len= 0x20795E= 2128222. (@1200000)
Agent Version= 5.0.0.0 ModelMask= 0x1C
Program y/N [ N ]: y (Press y)
Erasing - Wait 56 sec..
Programming - Wait 96 sec..

Once the download is complete you’ll need to run the agent code by selecting “a”

Starting Agent Code..

Decompressing the image ...
Target Name: vxTarget
User: target
Attaching network interface idtip0... done.
Attaching network interface lo0... done.

Completing initialization...

At this point the switch should be booting up although it may take ~ 2 minutes for the switch to fully initialize the software and configuration.

Cheers!

ERS 8600 Access Policy

by

Protecting your network switches from un-authorized access should be high on everyone’s list these days. It’s clear that an insecure switch is a liability in any network topology. In the vast majority of cases this means at least changing the default username and passwords along with the SNMP community strings. In environments where you need additional access security you can use the Ethernet Routing Switch 8600 Access Policy to restrict administrative access to the switch. This allows you to easily define networks which should have access and what services they should have access to.

In the example below I’m allowing access from the network 10.1.1.0/24 for FTP, HTTP, SNMP(v3), SSH, TELNET and TFTP.

ERS-8610:5# config sys access-policy policy 10 create
ERS-8610:5# config sys access-policy policy 10 network 10.1.1.0/24
ERS-8610:5# config sys access-policy policy 10 service ftp enable
ERS-8610:5# config sys access-policy policy 10 service http enable
ERS-8610:5# config sys access-policy policy 10 service snmpv3 enable
ERS-8610:5# config sys access-policy policy 10 service ssh enable
ERS-8610:5# config sys access-policy policy 10 service telnet enable
ERS-8610:5# config sys access-policy policy 10 service tftp enable
ERS-8610:5# config sys access-policy policy 10 snmp-group-add admin snmpv1
ERS-8610:5# config sys access-policy policy 10 snmp-group-add admin snmpv2c
ERS-8610:5# config sys access-policy policy 10 snmp-group-add v1v2grp snmpv1
ERS-8610:5# config sys access-policy policy 10 snmp-group-add v1v2grp snmpv2c
ERS-8610:5# config sys access-policy policy 10 snmp-group-add readgrp snmpv1
ERS-8610:5# config sys access-policy policy 10 snmp-group-add readgrp snmpv2c
ERS-8610:5# config sys access-policy policy 10 enable

Just don’t forget to enable the access policy;

ERS-8610:5# config sys access-policy enable true

You could also use host masks as opposed to network masks if you wish to allow only specific management stations access to the switch.

Cheers!

ERS 8600 (ipNetToMediaIfIndex)

by

There was a recent comment about a Usenet positing I made back in 2002 in comp.protocols.snmp.

In the post I was responding to someone looking for information on how to decode the value returned from the ipNetToMediaIfIndex when querying an ERS 8600 switch. Thankfully Shane (Nortel) was able to help me come up with the forumla.

card = ( $value AND 62914560 ) / 4194304
port = (( $value AND 4128768) / 65536 ) + 1

With that formula you could now walk the ipNetToMediaTable and retreieve the entire ARP table providing you the card and port number, MAC address, and IP address for each entry in the table.

The next issue was how to deal with MultiLink Trunk interfaces. In this case (and with my current software code) I build a table of all the MLT interfaces prior to polling the ipNetToMediaTable. I still use Perl but it shouldn’t be very hard to convert to PHP.

# rcMltNumMlts
$nummlts = $sess->get("rcMltNumMlts.0");

for ($i = 1; $i <= $nummlts; $i++) {
  # rcMltName         
  $mltname[$i] = $sess->get("rcMltName.$i");
  # rcMltId
  $mltindex[$i] = $sess->get("rcMltId.$i");
  # rcMltIfIndex
  $mltifindex[$i] = $sess->get("rcMltIfIndex.$i");
  print "DEBUG: MltId = $i and MltName = $mltname[$i] and MltIndex = $mltindex[$i] and MltIfIndex = $mltifindex[$i]\n" if ($DEBUG);
};

Now that we have the rcMltTable in an array we can walk the ipNetToMediaTable and match up any entries. Here’s the code I use (again it’s Perl but you should be able to convert to PHP);

# Evaulate with bitwise operation
$card = (($vals[0] & 62914560) / 4194304);
$port = (($vals[0] & 4128768) / 65536) + 1;

# Evaulate to determine if port is a MLT
if ($card != 0) {
  $intf = (((64 * $card) + $port) - 1);
  print "DEBUG: $vals[1] address found on card $card port $port\n";
} else {
  $mlt = 1;
  print "DEBUG: $vals[1] address found on MLT $mltname[$port]\n";
} # end else

Hopefully that doesn’t look too complicated. The important piece here is that you need to merge the rcMltTable with the ipNetToMediaTable to get your results. If you name the MLT with something meaningful you can then return that string to the application that is making the query.

I wrote a Perl application that would search the ARP table of an Ethernet Routing Switch 8600 dynamically for a specific IP address entry. Here’s an example of the output;

Nortel Passport 8600 Gigabit Switch IP ARP Table Search

Initializing query for sw-ccr-8600.datacenter.acme.org for IP address 1.1.1.10...

sysDescr = ERS-8610 (4.1.3.0)
sysObjectID = .1.3.6.1.4.1.2272.30
sysUpTime = 169 Days 6 Hours 43 mins 11 secs
sysContact = Acme Network Infrastructure Team
sysName = sw-ccr-8600.datacenter.acme.org
sysLocation = USA

Please be patient it may take a while to complete the search...

DEVICE FOUND

1.1.1.10 (000AE4753FC9) address found on MLT SMLT-5500

We searched through 1183 forwarding records...

That's all folks!

I will look to publish the complete code on my website sometime in the near future.

Cheers!

Recent Posts

Categories

SUBSCRIBE BY EMAIL