From: Edouard Zorrilla (ezorrilla@tsf.com.pe)
Date: Thu Feb 12 2009 - 23:35:54 ARST
Yes Sir,
They were two issues,
Regards
----- Original Message -----
From: Sadiq Yakasai
To: Edouard Zorrilla
Cc: paul cosgrove ; security@groupstudy.com ; ccielab@groupstudy.com
Sent: Thursday, February 12, 2009 4:21 PM
Subject: Re: CBAC and Local Policy : Why OSPF neighbor relation dead ?
Nice one buddy!
So, in total, there were 2 issues here, right?
1) Outbound ACL when doing local-policy
2) TTL check when doing local-policy.
On Thu, Feb 12, 2009 at 8:46 PM, Edouard Zorrilla <ezorrilla@tsf.com.pe>
wrote:
Good, it works :
Excluding OSPF from the local routing policy:
My route-map adding "match ip address 122":
Rack1R4#sh run | sec route-map
ip local policy route-map POL-LOCAL
route-map POL-LOCAL permit 10
match ip address 122
set interface Loopback0
Rack1R4#
So ACL 122 is like:
Rack1R4#sh ip access-lists 122
Extended IP access list 122
10 deny ospf any any (24 matches)
20 permit ip any any (1 match)
Rack1R4#
And then :
Rack1R6#
000147: *Feb 12 21:34:55.944: %OSPF-5-ADJCHG: Process 1, Nbr 150.1.4.4 on
GigabitEthernet0/0 from EXSTART to DOWN, Neighbor Down: Too many
retransmissions
Rack1R6#
Rack1R6#
Rack1R6#sh ip ospf neighbor
Neighbor ID Pri State Dead Time Address
Interface
150.1.4.4 1 DOWN/DROTHER - 183.1.46.4
GigabitEthernet0/0
Rack1R6#
000148: *Feb 12 21:35:55.944: %OSPF-5-ADJCHG: Process 1, Nbr 150.1.4.4 on
GigabitEthernet0/0 from DOWN to DOWN, Neighbor Down: Ignore timer expired
000149: *Feb 12 21:35:55.948: %OSPF-5-ADJCHG: Process 1, Nbr 150.1.4.4 on
GigabitEthernet0/0 from LOADING to FULL, Loading Done
Rack1R6#
Neighbor ID Pri State Dead Time Address
Interface
150.1.4.4 1 FULL/DROTHER 00:00:37 183.1.46.4
GigabitEthernet0/0
Rack1R6#
000150: *Feb 12 21:36:02.160: %BGP-5-ADJCHANGE: neighbor 183.1.0.3 Up
Rack1R6#
OSPF relationship goes up.
Thanks to everydoby,
Regards
----- Original Message -----
From: paul cosgrove
To: Edouard Zorrilla
Cc: security@groupstudy.com ; ccielab@groupstudy.com
Sent: Thursday, February 12, 2009 2:42 PM
Subject: Re: CBAC and Local Policy : Why OSPF neighbor relation dead ?
Hi Edouard,
Exclude OSPF from your policy routing. The packets will have a TTL of 1
and
so it looks like they are being dropped when returning on the loopback.
Even
if the TTL was higher, your outbound ACL does not permit OSPF.
Paul.
On Thu, Feb 12, 2009 at 6:50 PM, Edouard Zorrilla <ezorrilla@tsf.com.pe>
wrote:
Just doing a lab and I run into this issue.
My topology:
R4(Gi0/0)---ethernet --- (Gi0/0)R6
Rack1R4#sh run int gi0/0
Building configuration...
Current configuration : 232 bytes
!
interface GigabitEthernet0/0
description Connected-to-SW1-Fa0/4
ip address 183.1.46.4 255.255.255.0
ip access-group inbound in
ip access-group outbound out
ip ospf message-digest-key 1 md5 CISCO
duplex auto
speed auto
end
Rack1R4#
Rack1R4#sh ip access-lists outbound
Extended IP access list outbound
11 permit icmp any any reflect acl-ccie (113 matches)
12 permit udp any any reflect acl-ccie (33 matches)
20 permit tcp any any reflect acl-ccie (624 matches)
30 deny ip any any log
Rack1R4#
Rack1R4#sh ip access-lists inbound
Extended IP access list inbound
9 permit icmp any any port-unreachable
10 permit ospf any any (1258 matches)
11 permit icmp any any time-exceeded (149 matches)
12 permit icmp any any unreachable (14 matches)
13 permit icmp any host 183.1.46.4 echo-reply (30 matches)
20 evaluate acl-ccie
30 deny ip any any log (31 matches)
Rack1R4#
It works fine, but If I need to push traffic out from the router R4
and
also
need the Reflexive ACL to not drop the traffic that I originate from
the
router, like this one:
Rack1R4#telnet 183.1.46.6
Trying 183.1.46.6 ...
Feb 12 18:23:37.857: %SEC-6-IPACCESSLOGP: list inbound denied tcp
183.1.46.6(23) -> 183.1.46.4(64178), 1 packet
Feb 12 18:23:39.857: %SEC-6-IPACCESSLOGP: list inbound denied tcp
183.1.46.6(23) -> 183.1.46.4(64178), 1 packet
% Connection reset by user
Rack1R4
Then I need to set a local policy pointing to any loopback (another
option
could be adding more acls inside inbound access-list), in that way I
make
my
traffic Flow Throw through the router, and not to be originated from
the
router itself. Good so far.
Then in R4:
Rack1R4#
route-map POL-LOCAL permit 10
set interface Loopback0
and
Rack1R4(config)#ip local policy route-map POL-LOCAL
Then in R4 I can telnet R6:
Rack1R4#telnet 183.1.46.6
Trying 183.1.46.6 ... Open
User Access Verification
Password:
Rack1R6>
But OSPF dies:
-------------
Rack1R4#sh ip ospf neighbor
Neighbor ID Pri State Dead Time Address
Interface
150.1.6.6 1 FULL/DR 00:00:38 183.1.46.6
GigabitEthernet0/0
150.1.5.5 0 FULL/ - 00:00:32 183.1.45.5
Serial0/2/0
150.1.5.5 0 FULL/ - 00:01:39 183.1.0.5
Serial0/3/0.345
Rack1R4#
and
Rack1R6#sh ip ospf neighbor
Neighbor ID Pri State Dead Time Address
Interface
150.1.4.4 1 FULL/BDR 00:00:37 183.1.46.4
GigabitEthernet0/0
Rack1R6#
In R6 I perform:
---------------------------------
Rack1R6#clear ip ospf process
Reset ALL OSPF processes? [no]: yes
Rack1R6#
Rack1R6#
000119: *Feb 12 19:33:56.213: %OSPF-5-ADJCHG: Process 1, Nbr 150.1.4.4
on
GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Interface down or
detached
Rack1R6#sh ip ospf neighbor
Neighbor ID Pri State Dead Time Address
Interface
150.1.4.4 1 EXSTART/DR 00:00:33 183.1.46.4
GigabitEthernet0/0
Rack1R6#
Rack1R4#sh ip ospf neighbor
Neighbor ID Pri State Dead Time Address
Interface
150.1.6.6 1 EXCHANGE/BDR 00:00:39 183.1.46.6
GigabitEthernet0/0
150.1.5.5 0 FULL/ - 00:00:39 183.1.45.5
Serial0/2/0
150.1.5.5 0 EXCHANGE/ - 00:01:59 183.1.0.5
Serial0/3/0.345
Rack1R4#
Why OSPF neighbord relationship dead when I add local policy routing ?
Any
one
one an idea ?
Regards
Blogs and organic groups at http://www.ccie.net
______________________________________________________________________
_
Subscription information may be found at:
http://www.groupstudy.com/list/CCIELab.html
Blogs and organic groups at http://www.ccie.net
_______________________________________________________________________
Subscription information may be found at:
http://www.groupstudy.com/list/CCIELab.html
--
CCIE #19963
Blogs and organic groups at http://www.ccie.net
This archive was generated by hypermail 2.1.4 : Sun Mar 01 2009 - 09:44:11 ARST