Maximum routes under customer vrf, if the service provider had unlimited resources he would not have needed that!
however normally resources are limited and expensive, and Service provider would like to make money from his available resources. maximum routes configured under VRF provide a mean of controlling PE local resource and abuse avoidance from the CE side.
I have vrf called DC_EXTRANET, you can see that I have 16 routes, I have configured10 maximum routes under that vrf however I did not want to be aggressive so I have set the
warning only option.See that immediately I get a notice that I have more routes then the maximum, however no actionis taken other then alerting and sending a syslog.!PE_ashdod_otherisp.n(config-vrf)# maximum routes 10 warning-only% The current number of routes in the routing table is equal to, or exceeds the configured warning limitPE_ashdod_otherisp.n(config-vrf)#*Nov 26 20:39:41.175: %IPRT-3-ROUTELIMITWARNING: IP routing table limit warning - DC_EXTRANETPE_ashdod_otherisp.n(config-vrf)#do sh ip rou vrf DC_EXTRANETRouting Table: DC_EXTRANETCodes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2ia - IS-IS inter area, * - candidate default, U - per-user static routeo - ODR, P - periodic downloaded static route, H - NHRP, l - LISP+ - replicated route, % - next hop overrideGateway of last resort is not set50.0.0.0/8 is variably subnetted, 3 subnets, 3 masksB 50.0.0.0/30 [200/0] via 20.255.10.10, 00:09:31B 50.0.100.0/24 [200/0] via 20.255.10.10, 00:09:31B 50.255.255.1/32 [200/0] via 20.255.10.10, 00:09:3160.0.0.0/8 is variably subnetted, 6 subnets, 3 masksB 60.0.0.0/30 [200/0] via 7.7.7.7, 00:00:04B 60.0.100.0/24 [200/0] via 7.7.7.7, 00:00:04B 60.0.101.0/24 [200/0] via 7.7.7.7, 00:00:04B 60.0.102.0/24 [200/0] via 7.7.7.7, 00:00:04B 60.0.103.0/24 [200/0] via 7.7.7.7, 00:00:04B 60.255.255.1/32 [200/0] via 7.7.7.7, 00:00:0470.0.0.0/8 is variably subnetted, 7 subnets, 3 masksC 70.0.0.0/30 is directly connected, FastEthernet2/0L 70.0.0.1/32 is directly connected, FastEthernet2/0B 70.0.100.0/24 [20/0] via 70.0.0.2, 00:20:22B 70.0.101.0/24 [20/0] via 70.0.0.2, 00:20:22B 70.0.102.0/24 [20/0] via 70.0.0.2, 00:20:22B 70.0.103.0/24 [20/0] via 70.0.0.2, 00:20:22B 70.255.255.1/32 [20/0] via 70.0.0.2, 00:20:22PE_ashdod_otherisp.n(config-vrf)#
now I would like to show you what will happen from RIB/FIB and BGP when I am activating the maximum prefix’s in aggressive mode:
Prior to modifying the maximum value, on the CE you can see that I am getting BGP updates:CE_ashdod_DC_SERVICES# show ip bgpBGP table version is 160, local router ID is 70.255.255.1Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,r RIB-failure, S StaleOrigin codes: i - IGP, e - EGP, ? - incompleteNetwork Next Hop Metric LocPrf Weight Path*> 50.0.0.0/30 70.0.0.1 0 9002 33462 ?*> 50.0.100.0/24 70.0.0.1 0 9002 33462 ?*> 50.255.255.1/32 70.0.0.1 0 9002 33462 ?*> 60.0.0.0/30 70.0.0.1 0 9002 9001 33462 ?*> 60.0.100.0/24 70.0.0.1 0 9002 9001 33462 ?*> 60.0.101.0/24 70.0.0.1 0 9002 9001 33462 ?*> 60.0.102.0/24 70.0.0.1 0 9002 9001 33462 ?*> 60.0.103.0/24 70.0.0.1 0 9002 9001 33462 ?*> 60.255.255.1/32 70.0.0.1 0 9002 9001 33462 ?Now maximum routes is set to 10 and Threshold before sending warning to 100% noticeimmediately RIB and FIB will be updated accordingly however BGP is not effected meaning thatthis is locally significant and will not cause a lot of noise due to a local problem / over utilizing allowedresources.PE_ashdod_otherisp.n(config-vrf)# maximum routes 10 100% The current number of routes in the routing table is equal to, or exceeds the configured warning limit% The routing table is being reloaded to enforce (or allow) the new route limit.PE_ashdod_otherisp.n(config-vrf)#*Nov 26 20:57:08.359: %IPRT-3-ROUTELIMITWARNING: IP routing table limit warning - DC_EXTRANET*Nov 26 20:57:08.363: %IPRT-3-ROUTELIMITEXCEEDED: IP routing table limit exceeded - DC_EXTRANETPE_ashdod_otherisp.n(config-vrf)#PE_ashdod_otherisp.n(config-vrf)#PE_ashdod_otherisp.n(config-vrf)#do sh ip rou vrf DC_EXTRANETRouting Table: DC_EXTRANETCodes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2ia - IS-IS inter area, * - candidate default, U - per-user static routeo - ODR, P - periodic downloaded static route, H - NHRP, l - LISP+ - replicated route, % - next hop overrideGateway of last resort is not set50.0.0.0/8 is variably subnetted, 3 subnets, 3 masksB 50.0.0.0/30 [200/0] via 20.255.10.10, 00:00:15B 50.0.100.0/24 [200/0] via 20.255.10.10, 00:00:15B 50.255.255.1/32 [200/0] via 20.255.10.10, 00:00:1560.0.0.0/8 is variably subnetted, 5 subnets, 2 masksB 60.0.0.0/30 [200/0] via 7.7.7.7, 00:00:15B 60.0.100.0/24 [200/0] via 7.7.7.7, 00:00:15B 60.0.101.0/24 [200/0] via 7.7.7.7, 00:00:15B 60.0.102.0/24 [200/0] via 7.7.7.7, 00:00:15B 60.0.103.0/24 [200/0] via 7.7.7.7, 00:00:1570.0.0.0/8 is variably subnetted, 2 subnets, 2 masksC 70.0.0.0/30 is directly connected, FastEthernet2/0L 70.0.0.1/32 is directly connected, FastEthernet2/0PE_ashdod_otherisp.n(config-vrf)#CE_ashdod_DC_SERVICES# show ip bgpBGP table version is 184, local router ID is 70.255.255.1Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,r RIB-failure, S StaleOrigin codes: i - IGP, e - EGP, ? - incompleteNetwork Next Hop Metric LocPrf Weight Path*> 50.0.0.0/30 70.0.0.1 0 9002 33462 ?*> 50.0.100.0/24 70.0.0.1 0 9002 33462 ?*> 50.255.255.1/32 70.0.0.1 0 9002 33462 ?*> 60.0.0.0/30 70.0.0.1 0 9002 9001 33462 ?*> 60.0.100.0/24 70.0.0.1 0 9002 9001 33462 ?*> 60.0.101.0/24 70.0.0.1 0 9002 9001 33462 ?*> 60.0.102.0/24 70.0.0.1 0 9002 9001 33462 ?*> 60.0.103.0/24 70.0.0.1 0 9002 9001 33462 ?*> 60.255.255.1/32 70.0.0.1 0 9002 9001 33462 ?
Additional scenario:
maximum prefix’s are at 14
Routing Table: DC_EXTRANETCodes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2ia - IS-IS inter area, * - candidate default, U - per-user static routeo - ODR, P - periodic downloaded static route, H - NHRP, l - LISP+ - replicated route, % - next hop overrideGateway of last resort is not set50.0.0.0/8 is variably subnetted, 3 subnets, 3 masksB 50.0.0.0/30 [200/0] via 20.255.10.10, 00:01:23B 50.0.100.0/24 [200/0] via 20.255.10.10, 00:01:23B 50.255.255.1/32 [200/0] via 20.255.10.10, 00:01:2360.0.0.0/8 is variably subnetted, 6 subnets, 3 masksB 60.0.0.0/30 [200/0] via 7.7.7.7, 00:00:20B 60.0.100.0/24 [200/0] via 7.7.7.7, 00:00:20B 60.0.101.0/24 [200/0] via 7.7.7.7, 00:00:20B 60.0.102.0/24 [200/0] via 7.7.7.7, 00:00:20B 60.0.103.0/24 [200/0] via 7.7.7.7, 00:00:20B 60.255.255.1/32 [200/0] via 7.7.7.7, 00:00:2070.0.0.0/8 is variably subnetted, 5 subnets, 3 masksC 70.0.0.0/30 is directly connected, FastEthernet2/0L 70.0.0.1/32 is directly connected, FastEthernet2/0B 70.0.100.0/24 [20/0] via 70.0.0.2, 00:01:23B 70.0.101.0/24 [20/0] via 70.0.0.2, 00:01:23B 70.0.102.0/24 [20/0] via 70.0.0.2, 00:01:23
I send withdraw for 70.0.101.0/24 from the CE router, now I have one more spot (14 –1) available, however the router does not re-evaluate the table and insert the next available, think of what if it did! (the CE could have abuse the router causing him to always re-evaluate what need to be inserted/removed to/from RIB/FIB!!), re-evaluation happen when you modify maximum routes value or when you re-send (withdraw and update) the un-used routes :
PE_ashdod_otherisp.n(config)#do sh ip rou vrf DC_EXTRANETRouting Table: DC_EXTRANETCodes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGPD - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2ia - IS-IS inter area, * - candidate default, U - per-user static routeo - ODR, P - periodic downloaded static route, H - NHRP, l - LISP+ - replicated route, % - next hop overrideGateway of last resort is not set50.0.0.0/8 is variably subnetted, 3 subnets, 3 masksB 50.0.0.0/30 [200/0] via 20.255.10.10, 00:01:30B 50.0.100.0/24 [200/0] via 20.255.10.10, 00:01:30B 50.255.255.1/32 [200/0] via 20.255.10.10, 00:01:3060.0.0.0/8 is variably subnetted, 6 subnets, 3 masksB 60.0.0.0/30 [200/0] via 7.7.7.7, 00:00:27B 60.0.100.0/24 [200/0] via 7.7.7.7, 00:00:27B 60.0.101.0/24 [200/0] via 7.7.7.7, 00:00:27B 60.0.102.0/24 [200/0] via 7.7.7.7, 00:00:27B 60.0.103.0/24 [200/0] via 7.7.7.7, 00:00:27B 60.255.255.1/32 [200/0] via 7.7.7.7, 00:00:2770.0.0.0/8 is variably subnetted, 4 subnets, 3 masksC 70.0.0.0/30 is directly connected, FastEthernet2/0L 70.0.0.1/32 is directly connected, FastEthernet2/0B 70.0.100.0/24 [20/0] via 70.0.0.2, 00:01:30B 70.0.102.0/24 [20/0] via 70.0.0.2, 00:01:30PE_ashdod_otherisp.n(config)#
However if you do not care about abuse from CE side you can use the below command, that will re-evaluate once crossing certain threshold, but I think that if you do not care about the abuse (do not limit the amount of prefix’s):
PE_ashdod_otherisp.n(config-vrf)# maximum routes 14 100 reinstall ?<1-100> Threshold value (%) at which to reinstall routes back to VRF
No comments:
Post a Comment