Michael McNamara

technology, networking, virtualization and IP telephony

Avaya Technical Configuration Guide for BGP

by

I use BGP extensively to provide dynamic routing between a number of vendors, business partners and affiliated organizations with whom I’m multi-homed to. I recently had to determine if Nortel/Avaya supported eBGP MultiHop on the Ethernet Routing Switch 8600 software release 5.x (they do). Thankfully I was able to peer with a Cisco 6500 switch that was sitting behind a Cisco firewall module from an Ethernet Routing Switch 8600 without any significant issues,.

If you are looking for a great resource on BGP I would highly recommend O’Reilly’s book titled BGP.

If you are looking for Avaya/Nortel specific information concerning their BGP implement then you are in luck. Avaya has a technical configuration guide for the ERS 8600 that focuses on BGP. While this is an older document (November 2007) it still does a great job of providing a number of configuration examples and explaining the basics.

In the near future I might need to use an ERS 8606 as an Internet router. I’ll need to peer with the ISP since I’m multi-home to independent Internet Service Providers, although I’m not sure if the 8692SF can handle a full BGP routing table. Has anyone ever tried to feeding a full (or partial) BGP routing table from the Internet to an ERS 8800/8600 switch?

Cheers!

Avaya USB Headset Adapter humming

by

I use the Nortel/Avaya Mobile USB headset with my laptop and 2050 softphone. On occasion I’ll use it on my 1140E desktop phone and have noticed a humming from time to time.

After digging through the net and all my documentation I came up with the following reference in one of the UNIStim release notes.

A constant humming noise is sometime heard through the headset when either the Enhanced USB Headset Adapter or the Mobile USB Headset Adapter is connected to the 1120E, 1140E, 1150E or 1165E IP Deskphone. The humming noise heard within the headset can be corrected by upgrading the Headset Adapter firmware to version 2.00.98 or greater.
The USB Headset Adapter firmware version 2.00.98 is available for download from the “Software Download” link under “Support and Training” on the Nortel website located at: http://support.nortel.com. The firmware is available for the 1120E, 1140E, 1150E and 1165E IP Deskphone models under “Phones, Clients and Accessories” as file Adapter3v2.0098.zip.

To load the version 2.00.98 firmware onto the USB Headset Adapter perform the following procedure:

  1. Download the firmware file Adapter3v2.0098.zip from the Nortel Technical Support web site
  2. Load the file Adapter3v2.0098.zip onto a PC
  3. Uncompress (unzip) the file to obtain Adapter3v2.0098.exe.
  4. Connect the USB Headset Adapter to the PC
  5. Start the Adapter3v2.0098.exe application to load the firmware onto the device.

Hopefully this helps someone else out. It took me quite sometime to locate any reference and I had almost given up.

I’ve placed copies of the zip archive and the readme file on my server.

Cheers!

Ethernet Routing Switch 5000 Software Release v6.2.0

by

Avaya has released software 6.2.0 for the Ethernet Routing Switch 5500/5600 series switches. In order to upgrade to 6.2 software the switch will already need to be running 6.x software along with firmware (diagnostic software) 6.0.0.6. Switches that are running older software will need to first be upgraded to 6.0 and then to 6.2 software.

Please review the release notes for all the details.

Here are some of the new features;

  • Enterprise Device Manager
  • 802.1AB (LLDP) MED Network Policy
  • 802.1X authentication and Wake on LAN
  • 802.1X or Non-EAP and Guest VLAN on same port
  • 802.1X or Non-EAP Last Assigned RADIUS VLAN
  • 802.1X or Non-EAP with Fail Open VLAN
  • 802.1X or Non-EAP with VLAN name
  • Autodetection and Autoconfiguration (ADAC) Uplink Enhancements
  • Automatic QoS 802
  • Automatic QoS and ADAC Interoperability
  • Cisco CLI commands
  • Content-based forward to next hop (formerly source address-based route selection)
  • DHCP enhancements
  • DHCP option 82 support
  • Dual Syslog Server support
  • EAP/NEAP separation
  • Energy Saver
  • Enhanced QoS engine
  • Filter Limiting
  • Full IGMPv3
  • IPv4 Tunneling for IPv6
  • IPv6 Automatic Address Assignment
  • IPv6 Routing DHCP Relay
  • IPv6 Static Routing
  • MAC Security enhancement
  • Multicast group scaling
  • Multiple Hosts with Multiple VLANs for EAP-enabled Ports
  • PIM-SM support
  • Port Mirroring – Bi-directional monitor port
  • QoS DSCP mutation
  • QoS Egress Queue Shaping
  • QoS Lossless Buffering Mode for Data Center Applications
  • Route scaling
  • Running configuration NNCLI display command enhancements
  • Secure Shell File Transfer Protocol (SFTP over SSH)
  • SFP support
  • Split Multi-link Trunk (SMLT) consistency with the Ethernet Routing Switch 8600
  • Split Multi-link Trunk (SMLT) over Link Aggregation Control Protocol (LACP)
  • Trace command
  • Unicast storm control
  • VLAN Scaling

Here are some of the issues that have been resolved in this release;

  • Q01219391 MAC Address table does not age out all MAC sources learned after the aging time has expired.
  • Q01470123 Passive static device behind a phone displayed as unknown after switch reboot.
  • Q01470123-01 Passive static device behind a phone displayed as unknown after switch reboot.
  • Q01728560 ADAC port configuration types not defined in manual.
  • Q01775378 Error message when disabling spanning tree learning.
  • Q01859874 Typed commands should not be sent remotely when log level is serious or critical.
  • Q01860782 A message is needed to confirm the successful upload of an ASCII configuration to USB with the PUSH button.
  • Q01862906 The Time Domain Reflectometer in the JDM displays an incorrect message for the Pin Short cable error.
  • Q01863512 MAC security Lifetime setting cannot be modified from the JDM.
  • Q01865091 MAC authorized clients are not reauthorized after a former base unit reenters the stack.
  • Q01895467 Some LLDP commands fail when configuring a device with an ASCII configuration file.
  • Q01895723 Metric for external routes jumps to 127174722 when a dummy vlink is created and deleted.
  • Q01906362 An NEAP client can change ports without a link down or age out timer event.
  • Q01909890 QoS-IGMP problems with known and unknown multicast options on 56xx ports.
  • Q01901336 Multicast traffic not forwarded through non-local static routes.
  • Q01923408-02 Management VLAN IP address should always be used in relation to RADIUS.
  • Q01927698 PIM interfaces become disabled on a device.
  • Q01938607 Incorrect error message displayed during software download from an unreachable server.
  • Q01942783 Restoring a device with an ASCII configuration file fails when Layer 3 settings are present.
  • Q01943527 Inconsistency between IPv4 and IPv6 in binary configuration file.
  • Q01945909 Some ARP, OSPF, or VRRP packets are unexpectedly mirrored when using XrxYtx mirroring mode and the monitored port is in the Management VLAN or in SMLT VLANs.
  • Q01946214 MAC addresses are lost when a base unit fails.
  • Q01946284 LLDP-Med does not work in certain circumstances
  • Q01947050 ADAC system message logged after a stack is reset.
  • Q01948343 On a pure 56xx stack, port mirroring mode XrxYtx multiplies unicast traffic on port Y in certain scenarios.
  • Q01950071 VLACP enabling does not work in some circumstances.
  • Q01950147 The EAP-TLS or PEAP-MsChapV2 clients could be unexpectedly transitioned to the EAP Held state on a multihost enabled port.
  • Q01950311 Voice traffic is blocked on a non-base unit when ARP inspection is enabled on a VoIP VLAN.
  • Q01951600 Error performing MIB walk on 5632.
  • Q01954041 LLDP Med-Network-Policies Voice Tagging command issue.
  • Q01955272 PIM OIF may not get installed on IR.
  • Q01956922 Continuous IPv6 ping out stops working after 2147 ICMPv6 messages.
  • Q01978465 Telnet session hangs on ERS 5510-48T during an ASCII configuration download.
  • Q02005019 ACG will fail when ports are added to VLANs if an STG was created, VLANs were added, the STG enabled and then ports added to VLANs (configuration control flexible and 1 port in 2 different VLANs).
  • Q02020938 After booting to default settings the syslog will display the message ASCII failed at line 1. This can be ignored. This only happens after a boot to default settings and not during a normal operation or reset of the switch. This does not affect subsequent ASCII downloads. The successful application of configurations can be confirmed using the show logging command. The bogus message will be the first in chronological order.

I would highly recommend you review the release notes for all the details. There are a lot of known issues that should be thoroughly reviewed before you made any decisions about upgrading.

There was one section that caught my eye on page 11 of the release notes;

Currently when ADAC is operational, a user can not change the non-ADAC VLANs on the port (without disabling ADAC, changing the VLAN and then re-enabling ADAC), which leads to usability issues that limit the deployment of ADAC.

The ADAC enhancements provide the ability to change the non-ADAC VLANs on a port irrespective of the ADAC status of the port. Any such changes in the underlying port VLAN assignment are saved as normal to NVRAM and ASCIII configurations.

I posted about this issue with ADAC way back in August of 2008. This one issue has been a real bear and the only real issue we’ve experienced with our ADAC deployments. While it might be the only issue, it can create some enormous problems if the engineers are following the procedure to disable ADAC, make the VLAN change and then enable ADAC again. I’ll be very interested to see if this problem is finally resolved.

I spent a few minutes playing with Enterprise Device Manager but I think this change will drive more folks to the CLI interface where Avaya/Nortel has alot of work to-do. I’m also excited to see that Avaya/Nortel is finally bringing together their Automatic QoS and ADAC features, I’m curious to see what changes they’ve made an how I might be able to tweak my switch configurations to better automate the deployment of IP telephony.

Cheers!

Traffic Filters and ACLs for the Ethernet Routing Switch 5000

by

1105094_15304690There have been a few recent comments on the blog and a few questions on the discussion forum around how ACLs (traffic filters) work on the Ethernet Routing Switch 5520. I thought I would take a few minutes to dive into the subject and perhaps either answer some of those questions or foster some additional discussion. Let me get right to the most popular question.

Is the Ethernet Routing Switch 5510/5520/5530 capable of performing basic IP filtering? Yes.

Prior to software release 5.0 you had to-do all filtering in QoS policies. It seems a lot of confusion comes from the fact that in order to perform IP filtering similar to an ACL in a Cisco router you had to create a QoS policy. With the release of 5.0 software you can now create fairly straight forward ACLs. You can only do this from the CLI or WEB interface, there’s no support for ACLs in Java Device Manager.

Let me walk you through a simple example.

I started with a ERS-5520-PwR and factory reset the switch I gave it a management IP address of 192.168.1.50 (VLAN 1);

5520-48T-PWR(config)#ip address switch 192.168.1.50
5520-48T-PWR(config)#ip default-gateway 192.168.1.1
5520-48T-PWR(config)#ip address netmask 255.255.255.0

I created VLAN 100 and moved ports 13-48 to VLAN 100 making sure to set the PVID;

5520-48T-PWR(config)#vlan members remove 1 13-48
5520-48T-PWR(config)#vlan create 100 type port
5520-48T-PWR(config)#vlan members add 100 14-48
5520-48T-PWR(config)#vlan ports 13-48 pvid 100

I enabled IP routing on the switch (remember out of the box it’s just a Layer 2 switch);

5520-48T-PWR(config)#ip routing

I enabled IP routing for VLAN 1 and then gave VLAN 100 an IP address/interface;

5520-48T-PWR(config)#interface vlan 1
5520-48T-PWR(config-if)#ip routing
5520-48T-PWR(config)#exit

5520-48T-PWR(config)#interface vlan 100
5520-48T-PWR(config-if)#ip address 192.168.100.1 255.255.255.0 2
5520-48T-PWR(config-if)#ip routing
5520-48T-PWR(config)#exit

Let’s just making sure that everything looks right before we get the real meat of this post;

5520-48T-PWR#show vlan ip
==============================================================================
Vid  ifIndex Address         Mask            MacAddress        Offset Routing
==============================================================================
Primary Interfaces
------------------------------------------------------------------------------
1    10001   192.168.1.50    255.255.255.0   00:1F:0A:CE:XX:40 1      Enabled
100  10100   192.168.100.1   255.255.255.0   00:1F:0A:CE:XX:41 2      Enabled
------------------------------------------------------------------------------
% Total of Primary Interfaces: 2

The two IP interfaces are configured properly and have routing enabled. Let’s make sure that the routing table is correct;

5520-48T-PWR#show ip route
===============================================================================
                                        Ip Route
===============================================================================
DST             MASK            NEXT            COST    VLAN PORT PROT TYPE PRF
-------------------------------------------------------------------------------
0.0.0.0         0.0.0.0         192.168.1.1     10       1    1     S  IB     5
192.168.1.0     255.255.255.0   192.168.1.50    1        1    ----  C  DB     0
192.168.100.0   255.255.255.0   192.168.100.1   1        100  ----  C  DB     0
Total Routes: 3
-------------------------------------------------------------------------------
TYPE Legend:
I=Indirect Route, D=Direct Route, A=Alternative Route, B=Best Route, E=Ecmp Route, U=Unresolved Route, N=Not in HW

Here’s where the real work starts. I created an ACL named “testacl” and then assigned it to port 23.

5520-48T-PWR(config)#qos ip-acl name testacl src-ip 192.168.100.0/24 protocol 6 dst-port-min 80 dst-port-max 80
5520-48T-PWR(config)#qos ip-acl name testacl drop-action enable
5520-48T-PWR(config)#qos acl-assign port 23 acl-type ip name testacl

In the statements above I created an ACL that will allow traffic sourced from 192.168.100.0/24 to a destination TCP port of 80 to pass unrestricted while blocking (dropping) all other traffic. I’ve assigned that ACL to port 23 where I have a test PC connected to the switch.

Let’s just pretend that you forgot to allow DNS (UDP/53) queries in your IP filter so let’s back out the ACL and recreate it.

First we need to determine the ACL number that was assigned to our ACL called “testacl”.  We can do that by issuing the following command;

5520-48T-PWR#show qos acl
Id               Name              State   ACL  Unit/Port Storage
Type             Type
_____ ____________________________ ________ ____ _________ ________
1     testacl                      Enabled  IP   1/23      NonVol

We also need to know how many rules are in the IP ACL that’s being referenced above. We can do that with the following command;

5520-48T-PWR#show qos ip-acl

Id: 1
Name: testacl
Block:
Address Type: IPv4
Destination Addr/Mask: Ignore
Source Addr/Mask: 192.168.100.0/24
DSCP: Ignore
IPv4 Protocol / IPv6 Next Header: TCP
Destination L4 Port Min: 80
Destination L4 Port Max: 80
Source L4 Port Min: Ignore
Source L4 Port Max: Ignore
IPv6 Flow Id: Ignore
Action Drop: No
Action Update DSCP: Ignore
Action Update 802.1p Priority: Ignore
Action Set Drop Precedence: Low Drop
Type: Access List
Storage Type: NonVolatile

Id: 2
Name: testacl
Block:
Address Type: IPv4
Destination Addr/Mask: Ignore
Source Addr/Mask: Ignore
DSCP: Ignore
IPv4 Protocol / IPv6 Next Header: Ignore
Destination L4 Port Min: Ignore
Destination L4 Port Max: Ignore
Source L4 Port Min: Ignore
Source L4 Port Max: Ignore
IPv6 Flow Id: Ignore
Action Drop: Yes
Action Update DSCP: Ignore
Action Update 802.1p Priority: Ignore
Action Set Drop Precedence: Low Drop
Type: Access List
Storage Type: NonVolatile

Now we can remove the ACL from port 23 and then delete it from the switch;

5520-48T-PWR(config)#no qos acl-assign 1
5520-48T-PWR(config)#no qos ip-acl 2
5520-48T-PWR(config)#no qos ip-acl 1

Now we’ll rebuild the ACL allowing DNS queries to the broadband router;

5520-48T-PWR(config)#qos ip-acl name testacl src-ip 192.168.100.0/24 protocol 6 dst-port-min 80 dst-port-max 80
5520-48T-PWR(config)#qos ip-acl name testacl src-ip 192.168.100.0/24 dst-ip 192.168.1.1/32 protocol 17 dst-port-min 53 dst-port-max 53
5520-48T-PWR(config)#qos ip-acl name testacl drop-action enable
5520-48T-PWR(config)#qos acl-assign port 23 acl-type ip name testacl

Now that we have our filter let’s see what it looks like (I’m not a fan of this output format);

5520-48T-PWR#show qos ip-acl

Id: 1
Name: testacl
Block:
Address Type: IPv4
Destination Addr/Mask: Ignore
Source Addr/Mask: 192.168.100.0/24
DSCP: Ignore
IPv4 Protocol / IPv6 Next Header: TCP
Destination L4 Port Min: 80
Destination L4 Port Max: 80
Source L4 Port Min: Ignore
Source L4 Port Max: Ignore
IPv6 Flow Id: Ignore
Action Drop: No
Action Update DSCP: Ignore
Action Update 802.1p Priority: Ignore
Action Set Drop Precedence: Low Drop
Type: Access List
Storage Type: NonVolatile

Id: 2
Name: testacl
Block:
Address Type: IPv4
Destination Addr/Mask: 192.168.1.1/32
Source Addr/Mask: 192.168.100.0/24
DSCP: Ignore
IPv4 Protocol / IPv6 Next Header: UDP
Destination L4 Port Min: 53
Destination L4 Port Max: 53
Source L4 Port Min: Ignore
Source L4 Port Max: Ignore
IPv6 Flow Id: Ignore
Action Drop: No
Action Update DSCP: Ignore
Action Update 802.1p Priority: Ignore
Action Set Drop Precedence: Low Drop
Type: Access List
Storage Type: NonVolatile

Id: 3
Name: testacl
Block:
Address Type: IPv4
Destination Addr/Mask: Ignore
Source Addr/Mask: Ignore
DSCP: Ignore
IPv4 Protocol / IPv6 Next Header: Ignore
Destination L4 Port Min: Ignore
Destination L4 Port Max: Ignore
Source L4 Port Min: Ignore
Source L4 Port Max: Ignore
IPv6 Flow Id: Ignore
Action Drop: Yes
Action Update DSCP: Ignore
Action Update 802.1p Priority: Ignore
Action Set Drop Precedence: Low Drop
Type: Access List
Storage Type: NonVolatile

That’s a basic ACL filter using Layer 3 parameters. There is a Technical Configuration Guide available from Nortel/Avaya that provides additional examples and covers Filtering and QoS configuration of the Ethernet Routing Switch 5500 series switches. The guide is a little dated by still a very useful resource in my opinion.

Cheers!

Reference;
2008_04_01_Filters_and_QOS_Configurati0on_for_Ethernet_Routing_Switch_5500_TCG_NN48500559.pdf

Ethernet Switch 460 and 470 Software Release v3.7.5

by

Avaya has released software 3.7.5 for the Ethernet Switch 460 and 470 switch models.

While there were no new features added but there were a number of bug fixes;

  • The status of the stack ports are now correctly displayed when interrogating the MIB for the stack (Q02082410)
  • If MAC addresses are quickly aged out of the forwarding database when the device is authenticated via Non-EAP memory is no longer memory incorrectly consumed (Q02090742)
  • Previously the ifOperStatus reported the status of the IP Management interface based on the port status. Now the switch reports status based on the virtual status of the IP Management VLAN, meaning that if any port in the management VLAN is up, then the status of the management VLAN is reported as up. (Q02114651)
  • The log events created on non-base units in a stack now correctly display the time when SNTP is enabled (Q02112485)
  • VLACP settings are now correctly set when operating in a stack and the VLACP parameters are defaulted (Q02069051)
  • When the member of a MLT group which was carrying multicast traffic is reset, IGMP membership is now correctly re-learnt without an unexpected delay of 40 second (Q02066898)
  • When IGMP Snooping and Proxy is enabled in a stack if the IGMP general query and IGMP host membership report are received on the same unit in the stack, IGMP packets are now correctly processed (Q02070898)

Please review the release notes for all the details.

Cheers!

Recent Posts

Categories

SUBSCRIBE BY EMAIL