Use the following commands to configure Bidirectional Forwarding Detection (BFD) monitoring on the Active UP and Standby UP. This command is configured in the SRP Configuration Mode.

configure 
   context context_name 
      service-redundancy-protocol 
         [ no ] monitor bfd context context_name { ipv4_address | ipv6_address } { chassis-to-chassis | chassis-to-router } 
         exit 

NOTES:

• no : Disables BFD monitoring on the Active and Standby UP.

• context context_name : Specifies the context that is used. It refers to the context where the BFD peer is configured (SRP context).

  context_name must be an existing context expressed as an alphanumeric string of 1 through 79 characters.

• ipv4 _address | ipv6_address : Defines the IP address of the BFD neighbor to be monitored, entered using IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

  It refers to the IP address of the configured BFD (ICSR) peer.

• chassis-to-chassis | chassis-to-router :

  chassis-to-chassis : BFD runs between primary and backup chassis on non-SRP links.

  chassis-to-router : BFD runs between chassis and router.

  Caution

  Do not use the chassis-to-router keyword for BFD monitoring on the SRP link between the Active UP and the Standby UP.

• This command is disabled by default.

Use the following commands to flag BGP monitor failure on a single BGP peer (User Plane) failure. This command is configured in the SRP Configuration Mode.

Note

In this release, the exclusive-failover keyword is added to the existing monitor bgp CLI command as an alternate (new) algorithm to flag BGP monitoring failure. For more informnation about the monitor bgp CLI command in the "Service Redundancy Protocol Configuration Mode Commands" section command of the Command Reference Guide. Before adding the exclusive-failover keyword to the existing monitor bgp CLI command, implementing the monitor bgp command resulted in the following behavior: BGP peer group was up if any BGP peer in that group was up. Omitting a group configuration for a BGP monitor included that monitor in group 0. BGP group 0 monitored in a context from an implicit group. Each context formed a separate BGP group 0 implicit monitor group. BGP monitor was down if any BGP peer group was down.

configure 
   context context_name 
      service-redundancy-protocol 
         [ no ] monitor bgp exclusive-failover  
         end 

NOTES:

• no : Disables flagging of BGP monitor failure on a single BGP peer failure.

• On implementing the new exclusive-failover keyword, the behavior is as follows:

  • BGP peer group is Up if any BGP peer in that group is Up.

  • Including a BGP peer in group 0 is same as making it non-group (omitting group).

  • BGP monitor is down if any BGP peer group or any non-group BGP peer is down.

  • Removing a BGP peer being monitored induces a BGP monitor failure.

• This command is disabled by default.

Use the following commands to configure Sx monitoring on the Active UP and Standby UP. This command is configured in the SRP Configuration Mode.

configure 
   context context_name 
      service-redundancy-protocol 
         [ no ] monitor sx [ { context context_name | bind-address {ipv4_address |ipv6_address } | { peer-address {ipv4_address | ipv6_address } } ] 
         exit 

NOTES:

• no : Disables Sx monitoring on the Active and Standby UP.

• contextcontext_name : Specifies the context of the Sx service.

  context_name must be an existing context expressed as an alphanumeric string of 1 through 79 characters.

• bind-address { ipv4 _address | ipv6_address} : Defines the service IP address of the Sx service, entered using IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

  Note	The IP address family of the bind-address and peer-address must be same.

• peer-address { ipv4 _address | ipv6_address} : Defines the IP address of the Sx peer, entered using IPv4 dotted-decimal or IPv6 colon-separated-hexadecimal notation.

• disallow-switchover-on-peer-monitor-fail :

  Prevents the switchback of the UP to Active state when the working status of the UP to CP link is unknown.

• It is possible to implement this CLI command multiple times for monitoring multiple Sx connections.

• The Sx monitor state goes down when any of the monitored Sx connections are down.

• This command is disabled by default.

IPSec is a suite of protocols that interact with one another to provide secure private communications across IP networks. These protocols allow the system to establish and maintain secure tunnels with peer security gateways. IPSec provides confidentiality, data integrity, access control, and data source authentication to IP datagrams.

The CUPS architecture uses the IPSec protocol to encrypt the packets sent over the Interchassis Session Recovery (ICSR) connection between the active and standby UPs. This encryption is done by defining an access-list to match all traffic between Service Redundancy Protocol (SRP) peers and associating it with a crypto map. This crypto map is used to establish Security Association between IPSec peers residing in UPs.

Note	For more information on IPSec, its features or functionality, and applicable CLI configurations, refer the StarOS IPSec Reference.

The following CLI command is a sample configuration to configure SRP over IPSec for UPs.

context srp
   ip access-list srp-acl
   permit tcp host 209.165.200.225 host 209.165.200.226
   #exit
   ipsec transform-set A-foo
   #exit
   ikev2-ikesa transform-set ikesa-foo
   #exit
   crypto map srp-cm ikev2-ipv4
   match address srp-acl
   authentication local pre-shared-key key local key
   authentication remote pre-shared-key key remote key
   ikev2-ikesa transform-set list ikesa-foo
   payload foo-sa0 match ipv4
   ipsec transform-set list A-foo
   #exit
   peer 209.165.200.227
   #exit
   service-redundancy-protocol
   checkpoint session duration non-ims-session 30
   checkpoint session duration ims-session 30
   route-modifier threshold 18
   delta-route-modifier 2
   audit periodicity 60
   priority 2
   monitor bgp context isp 209.165.200.228
   monitor sx context EPC2 bind-address bbbb:abcd::77 peer-address bbbb:abcd::10
   peer-ip-address 209.165.200.226
   bind address 209.165.200.225
   #exit
   interface ike-lb loopback
   ip address 209.165.200.228 255.255.255.224
   crypto-map srp-cm
   #exit
   interface srp-rtr
   ip address 209.165.200.229 255.255.255.224
   #exit
   interface srp-loopback loopback
   ip address 209.165.200.225 255.255.255.224
   #exit
   ip route 209.165.200.226 255.255.255.224 209.165.200.231 srp-rtr
   ip route 209.165.200.227 255.255.255.224 209.165.200.231 srp-rtr
   #exit

Note	IKEv1 - Transport mode with Authentication Header (AH) protocol is not recommended. Encapsulating Security Payload (ESP) is recommended because ESP performs both Authentication and Encryption.

Use the following commands to configure Vector Packet Processing (VPP) monitor to trigger UP switchover on the Active UP if VPP goes down. This command is configured in the SRP Configuration Mode.

configure 
   context context_name 
      service-redundancy-protocol 
         monitor system vpp delay-period 0-300 seconds  
         exit 

no monitor system vpp 

NOTES:

• no : Disables VPP monitoring on the Active and Standby UP.

• vpp delay-period0-300 seconds : Specifies the delay period in seconds for a switchover, after a VPP failure.

  If the delay period is a value greater than zero, then the switchover is initiated after the specified delay period when VPP fails. The last VPP status notification within the delay period is the final trigger for switchover action. The default value is 0 seconds, which initiates an immediate switchover.

  The need for delay is to address the scenario wherein the VPP is temporarily down and the revival is in process. This implies that a switchover may not be necessary.

• This command is disabled by default.

Use the following commands to prevent the switchback of the new Standby UP to Active state again due to Sx monitor failure in the new Active. This command is configured in the SRP Configuration Mode.

configure 
   context context_name 
      service-redundancy-protocol 
         monitor sx disallow-switchover-on-peer-monitor-fail [ timeout seconds ] 
         exit 

Use either of the following CLIs to allow switchback of the new Standby UP to Active state.

no monitor sx disallow-switchover-on-peer-monitor-fail 

Or

monitor sx disallow-switchover-on-peer-monitor-fail timeout 0 

NOTES:

• no : Disables prevention of switchover.

• disallow-switchover-on-peer-monitor-fail [ timeout seconds ] : Prevents the switchback of the UP to Active state when the working status of the UP to CP link is unknown.

  timeout seconds: Timeout after which the switchback is allowed even if the Sx failure status is not reset in the Standby peer. The valid values range from 0 to 2073600 (24 days).

  Note	Assigning 0 seconds as the the timeout allows unplanned switchover.

  If timeout keyword is not specified, the Active chassis waits indefinitely for the Sx failure status to be reset in the Standby peer.

• The default configuration is to allow unplanned switchover due to Sx monitor failure in all conditions.

  Note	Manual planned switchover is allowed irrespective of whether this CLI is configured or not.

Use the following CLI configuration in CP to prevent dual Active error scenarios for UP 1:1 redundancy.

configure 
     user-plane-group  group_name 
         sx-reassociation disabled  
         end 

NOTE:

• sx-reassociation disabled : Disables UP Sx reassociation when the association already exists with the CP.

Use the following command only on the Standby chassis to reset the Service Redundancy Protocol (SRP) Sx monitor failure information. This command is configured in the Exec Mode.

srp reset-sx-fail 

This section provides information regarding show commands and/or their outputs in support of this feature.