本文档介绍在性能路由(PfR)通过多个边界中继(BR)优化流量的网络中使用的嵌入式事件管理器(EEM)小程序。 还观察到一些转发环路。当观察到环路时,使用小程序来收集数据并减轻转发环路的影响。
本文档没有任何特定的要求。
本文档中的信息基于支持EEM版本4.0的Cisco IOS®软件。
要检查Cisco IOS版本支持的EEM版本,请使用以下命令:
Router#sh event manager version | i Embedded
Embedded Event Manager Version 4.00
Router#
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始(默认)配置。如果您使用的是真实网络,请确保您已经了解所有命令的潜在影响。
当PfR控制流量类(TC)时,它会在BR上创建动态路由映射/访问控制列表(ACL)。BR上具有选定送出的路由映射指向选定送出,而其他BR上的路由映射指向内部接口(下一跳=选定BR)。
当动态ACL未在不同BR之间正确同步时(例如,由于错误)会出现问题。
在本图中,重点是TC,将发往172.16.1.0/24的所有IP数据包与DSCP EF匹配。在此场景中,相关ACL条目从所选BR(BR-2)中删除,但不从BR-1中删除。该TC的数据包在BR-2上命中前缀条目,该条目与发往172.16.1.0/24的所有IP数据包匹配。该前缀条目的选定退出为Exit-1,因此相关路由映射/ACL在BR-2上指向BR-1。
该TC的数据包现在在BR之间循环,直到生存时间(TTL)达到0。
本文档提供了必要的EEM小程序,用于:
主控制器(MC)/BR组合使用的小程序要容易得多(当MC在其中一个BR上运行时)。 还介绍了使用专用MC的场景。
本节介绍用于此进程的访问列表以及Applet日志文件。
为了检测转发环路,小程序依赖ACL来匹配TTL较低的数据包。
建议在2x连续、相对较低的TTL值(20和21)上使用ACE匹配,以便为BR之间循环的每个数据包获得一个(且仅一个)命中。使用的TTL值不应太低,以避免跟踪路由数据包频繁命中。
interface gig0/0 (internal interface)
ip access-group LOOP in
!
ip access-list extended LOOP
permit ip 10.116.48.0 0.0.31.255 any ttl range 20 21
permit ip any any
ACL应放置在show pfr master border topology命令输出中报告的内部接口上。
源IP范围(此处为10.116.48.0/20)应与内部网络(通过内部接口可到达的前缀)匹配。
为了确定哪个远程站点/TC受环路影响,您可以在接口上添加第二个出站ACL,并为每个远程站点/TC添加更具体的ACE。
interface gig0/0 (internal interface)
ip access-group LOOP-DETAIL out
!
ip access-list extended LOOP-DETAIL
permit ip 10.116.48.0 0.0.31.255 10.116.132.0 0.0.0.255 ttl range 20 21
permit ip 10.116.48.0 0.0.31.255 10.116.128.0 0.0.0.255 ttl range 20 21
.... (add here one line per remote site)
permit ip any an
目的IP与不同远程站点中的子网匹配:
10.116.132.0/24 -> site-1
10.116.128.0/24 -> site-2
如果需要确定受环路影响的确切TC,您还可以为每个远程站点添加多行。
小程序每30秒检查一次ACL环路中TTL上ACE匹配的命中计数。根据这些检查的结果,小程序可能执行以下任务:
该小程序维护一个日志文件,用于跟踪中断计数的数量(当计数大于0时),以及任何遇到临时环路(当超过THRESHOLD_1但不超过THRESHOLD_2时)或实际环路(当超过THRESHOLD_1和THRESHOLD_2时)。
以下是本文档中描述的最简单方案。环路检测和PfR清除在同一设备上完成,因此无需进入设备EEM小程序通信。在MC/BR组合和其他BR上运行单独的小程序。
此输出显示MC/BR组合上使用的小程序的重要信息。以下是此特定输出的一些重要说明:
event manager environment THRESHOLD_1 1000
event manager environment THRESHOLD_2 500
event manager environment DISK bootflash
!
event manager applet LOOP-MON authorization bypass
event timer watchdog name LOOP time 30
action 100 cli command "enable"
action 110 cli command "show ip access-list LOOP"
action 120 set regexp_substr 0
action 130 regexp "range 20 21 \(([0-9]+) matches\)"
$_cli_result _regexp_result regexp_substr
action 140 cli command "clear ip access-list counters LOOP"
action 150 if $regexp_substr gt 0
action 200 set MATCHES $regexp_substr
action 210 file open LOGS $DISK:script-logs.txt a
action 220 cli command "enable"
action 230 cli command "show clock"
action 240 regexp "[0-9]+:[0-9]+:[0-9]+.[0-9]+ est [A-Za-z]+
[A-Za-z]+ [0-9]+ 201[0-9]" $_cli_result _regexp_result
action 250 set TIME $_regexp_result
action 260 if $MATCHES gt $THRESHOLD_1
action 270 wait 15
action 280 cli command "show ip access-list LOOP"
action 290 set regexp_substr 0
action 300 regexp "range 20 21 \(([0-9]+) matches\)"
$_cli_result _regexp_result regexp_substr
action 310 if $regexp_substr gt $THRESHOLD_2
action 320 cli command "enable"
action 330 cli command "show ip access-list LOOP-DETAIL
| tee /append $DISK:script-output-$_event_pub_sec.txt"
action 340 cli command "show pfr master traffic-class perf det
| tee /append $DISK:script-output-$_event_pub_sec.txt"
action 350 cli command "show route-map dynamic detail
| tee /append $DISK:script-output-$_event_pub_sec.txt"
action 360 cli command "show ip route
| tee /append $DISK:script-output-$_event_pub_sec.txt"
action 370 cli command "clear pfr master *"
action 380 cli command "clear ip access-list counters LOOP-DETAIL"
action 390 file puts LOGS "$TIME - LOOP DETECTED - PfR CLEARED -
matches $MATCHES > $THRESHOLD_1 and $regexp_substr
> $THRESHOLD_2 - see $DISK:script-output-$_event_pub_sec.txt"
action 400 syslog priority emergencies msg "LOOP DETECTED -
PfR CLEARED - see $DISK:script-output-$_event_pub_sec.txt !"
action 410 else
action 420 file puts LOGS "$TIME - TEMPORARY LOOP : matches
$MATCHES > $THRESHOLD_1 and $regexp_substr < or = $THRESHOLD_2"
action 430 cli command "clear ip access-list counters LOOP-DETAIL"
action 440 end
action 450 else
action 460 cli command "en"
action 470 cli command "clear ip access-list counters LOOP-DETAIL"
action 480 file puts LOGS "$TIME - number of matches =
$MATCHES < $THRESHOLD_1"
action 490 end
action 500 else
action 510 cli command "clear ip access-list counters LOOP-DETAIL"
action 520 end
本节介绍用于其他BR的小程序。以下是此特定输出的一些重要说明:
event manager environment THRESHOLD 700
event manager environment DISK flash 0
!
event manager applet LOOP-BR authorization bypass
event timer watchdog name LOOP time 20
action 100 cli command "enable"
action 110 cli command "show ip access-list LOOP"
action 120 set regexp_substr 0
action 130 regexp "range 20 21 \(([0-9]+) matches\)"
$_cli_result _regexp_result regexp_substr
action 140 cli command "clear ip access-list counters LOOP"
action 150 if $regexp_substr gt 0
action 160 set MATCHES $regexp_substr
action 170 file open LOGS $DISK:script-logs.txt a
action 180 cli command "show clock"
action 190 regexp "[0-9]+:[0-9]+:[0-9]+.[0-9]+
est [A-Za-z]+ [A-Za-z]+ [0-9]+ 201[0-9]" $_cli_result _regexp_result
action 200 set TIME $_regexp_result
action 210 if $MATCHES gt $THRESHOLD
action 220 cli command "enable"
action 230 cli command "show route-map dynamic detail | tee /append
$DISK:script-output-$_event_pub_sec.txt"
action 240 cli command "show ip route | tee /append
$DISK:script-output-$_event_pub_sec.txt"
action 250 file puts LOGS "$TIME : matches = $MATCHES >
$THRESHOLD - see $DISK:script-output-$_event_pub_sec.txt"
action 260 syslog priority emergencies msg "LOOP DETECTED -
Outputs captured - see $DISK:script-output-$_event_pub_sec.txt !"
action 270 else
action 280 file puts LOGS "$TIME : matches = $MATCHES < or = $THRESHOLD"
action 290 end
action 300 end
环路检测和PfR清除/统计信息收集在必须具有设备间EEM小程序通信的不同设备上完成。设备之间的通信以不同的方式进行。本文档介绍通过跟踪对象进行的设备通信,以检查IGP中通告的专用环回的可达性。当检测到事件时,环回将关闭,这允许在被跟踪对象脱机时启动远程设备上的小程序。如果需要交换不同的信息,可以使用不同的环回。
使用以下小程序和通信方法:
小程序名称 | 位置? | 什么? | 触发器? | 通信? |
LOOP-BR | BR | 检查ACL中断计数以检测环路 |
定期 | shut loop100 |
LOOP-MC | MC | — 收集PfR信息 — 清除PfR |
跟踪可达性环路100 | shut Loop200 |
收集 — BR | BR | 收集信息 | 跟踪可达性环路200 | none |
下图说明了这一点:
以下是小程序使用的过程:
本节介绍如何创建环回(确保IP在IGP上通告)和跟踪对象。
在创建跟踪对象时,需牢记以下要点:
BR-1
interface Loopback100
ip address 10.100.100.1 255.255.255.255
!
track timer ip route 1
track 1 ip route 10.100.100.200 255.255.255.255 reachability
BR-2
interface Loopback100
ip address 10.100.100.2 255.255.255.255
!
track timer ip route 1
track 1 ip route 10.100.100.200 255.255.255.255 reachability
MC
interface Loopback200
ip address 10.100.100.200 255.255.255.255
!
track timer ip route 1
track 1 ip route 10.100.100.1 255.255.255.255 reachability
track 2 ip route 10.100.100.2 255.255.255.255 reachability
track 11 ip route 10.116.100.1 255.255.255.255 reachability
track 12 ip route 10.116.100.2 255.255.255.255 reachability
track 20 list boolean and
object 11
object 12
LOOP-BR
本节介绍如何在BR上创建环回。以下是需要牢记的一些重要注意事项:
event manager environment THRESHOLD_1 100event manager environment
THRESHOLD_2 500event manager environment DISK bootflash
!event manager applet LOOP-BR authorization bypass
event timer watchdog name LOOP time 30 maxrun 27
action 100 cli command "enable"
action 110 cli command "show ip access-list LOOP"
action 120 set regexp_substr 0
action 130 regexp "range 20 21 \(([0-9]+) matches\)"
$_cli_result _regexp_result regexp_substr
action 140 cli command "clear ip access-list counters LOOP"
action 150 if $regexp_substr gt 0
action 200 set MATCHES $regexp_substr
action 210 file open LOGS $DISK:script-detect-logs.txt a
action 220 cli command "enable"
action 230 cli command "show clock"
action 240 regexp "[0-9]+:[0-9]+:[0-9]+.[0-9]+
est [A-Za-z]+ [A-Za-z]+ [0-9]+ 201[0-9]"
$_cli_result _regexp_result
action 250 set TIME $_regexp_result
action 260 if $MATCHES gt $THRESHOLD_1
action 270 wait 15
action 280 cli command "show ip access-list LOOP"
action 290 set regexp_substr 0
action 300 regexp "range 20 21 \(([0-9]+) matches\)"
$_cli_result _regexp_result regexp_substr
action 310 if $regexp_substr gt $THRESHOLD_2
action 320 cli command "enable"
action 330 cli command "conf t"
action 340 cli command "interface loop100"
action 350 cli command "shut"
action 360 file puts LOGS "$TIME - LOOP DETECTED - Message sent to MC -
matches $MATCHES > $THRESHOLD_1 and $regexp_substr > $THRESHOLD_2"
action 370 wait 5
action 375 cli command "enable"
action 380 cli command "conf t"
action 390 cli command "interface loop100"
action 400 cli command "no shut"
action 410 else
action 420 file puts LOGS "$TIME - TEMPORARY LOOP : matches $MATCHES >
$THRESHOLD_1 and $regexp_substr < or = $THRESHOLD_2"
action 430 cli command "clear ip access-list counters LOOP-DETAIL"
action 440 end
action 450 else
action 460 cli command "en"
action 470 cli command "clear ip access-list counters LOOP-DETAIL"
action 480 file puts LOGS "$TIME - number of matches =
$MATCHES < $THRESHOLD_1"
action 490 end
action 500 else
action 510 cli command "clear ip access-list counters LOOP-DETAIL"
action 520 end
LOOP-MC
本节介绍如何在MC上创建环回。以下是需要牢记的一些重要注意事项:
event manage environment DISK bootflash
event manager applet LOOP-MC authorization bypass
event syslog pattern "10.100.100.[0-9]/32 reachability Up->Dow" ratelimit 60
action 100 file open LOGS $DISK:script-logs.txt a
action 110 regexp "10.100.100.[0-9]" "$_syslog_msg" _regexp_result
action 120 set BR $_regexp_result
action 130 wait 2
action 140 track read 20
action 150 if $_track_state eq "up"
action 160 cli command "enable"
action 170 cli command "show clock"
action 180 regexp "[0-9]+:[0-9]+:[0-9]+.[0-9]+
est [A-Za-z]+ [A-Za-z]+ [0-9]+ 201[0-9]"
"$_cli_result" _regexp_result
action 190 set TIME "$_regexp_result"
action 200 cli command "show pfr master traffic-class perf det
| tee /append $DISK:script-output-$_event_pub_sec.txt"
action 210 cli command "conf t"
action 220 cli command "interface loop200"
action 230 cli command "shut"
action 240 wait 10
action 250 cli command "conf t"
action 260 cli command "interface loop200"
action 270 cli command "no shut"
action 280 cli command "end"
action 290 cli command "clear pfr master *"
action 300 file puts LOGS "$TIME - LOOP DETECTED by $BR -
PfR CLEARED - see $DISK:script-output-$_event_pub_sec.txt"
action 310 syslog priority emergencies msg "LOOP DETECTED by $BR -
PfR CLEARED - see $DISK:script-output-$_event_pub_sec.txt !"
action 320 else
action 330 file puts LOGS "$TIME - REACHABILITY LOST with
$BR - REACHABILITY TO ALL BRs NOT OK - NO ACTION"
action 340 end
收集 — BR
本节介绍如何收集BR。当BR失去MC上Loopback200(10.100.100.200)的可达性时,小程序将在中启动。用于收集的命令列在操作120、130和140。
event manager environment DISK bootflash
event manager applet COLLECT-BR authorization bypass
event syslog pattern "10.100.100.200/32 reachability Up->Dow" ratelimit 45
action 100 file open LOGS $DISK:script-collect-logs.txt a
action 110 cli command "enable"
action 120 cli command "sh ip access-list LOOP-DETAIL |
tee /append $DISK:script-output-$_event_pub_sec.txt"
action 130 cli command "show route-map dynamic detail
| tee /append $DISK:script-output-$_event_pub_sec.txt"
action 140 cli command "show ip route | tee /append
$DISK:script-output-$_event_pub_sec.txt"
action 150 cli command "show clock"
action 160 regexp "[0-9]+:[0-9]+:[0-9]+.[0-9]+ CET [A-Za-z]+ [A-Za-z]+
[0-9]+ 201[0-9]" "$_cli_result" _regexp_result
action 170 set TIME "$_regexp_result"
action 180 file puts LOGS "$TIME - OUTPUTs COLLECTED -
see $DISK:script-output-$_event_pub_sec.txt"
SYSLOG-MC
以下是检测到环路时MC上的系统日志:
MC#
*Mar 8 08:52:12.529: %TRACKING-5-STATE: 1 ip route 10.100.100.1/32
reachability Up->Down
MC#
*Mar 8 08:52:16.683: %LINEPROTO-5-UPDOWN:
Line protocol on Interface Loopback200, changed state to down
*Mar 8 08:52:16.683: %LINK-5-CHANGED: Interface Loopback200,
changed state to administratively down
MC#
*Mar 8 08:52:19.531: %TRACKING-5-STATE: 1
ip route 10.100.100.1/32 reachability Down->Up
MC#
*Mar 8 08:52:24.727: %SYS-5-CONFIG_I: Configured from console by
on vty0 (EEM:LOOP-MC)
*Mar 8 08:52:24.744: %PFR_MC-1-ALERT: MC is inactive due to PfR
minimum requirements not met;
Less than two external interfaces are operational
MC#
*Mar 8 08:52:24.757: %HA_EM-0-LOG: LOOP-MC:
LOOP DETECTED by 10.100.100.1 - PfR CLEARED
- see unix:script-output-1362732732.txt !
MC#
*Mar 8 08:52:26.723: %LINEPROTO-5-UPDOWN:
Line protocol on Interface Loopback200, changed state to up
MC#
*Mar 8 08:52:26.723: %LINK-3-UPDOWN: Interface Loopback200,
changed state to up
MC#
*Mar 8 08:52:29.840: %PFR_MC-5-MC_STATUS_CHANGE: MC is UP
*Mar 8 08:52:30.549: %TRACKING-5-STATE: 2
ip route 10.100.100.2/32 reachability Up->Down
MC#
*Mar 8 08:52:37.549: %TRACKING-5-STATE: 2
ip route 10.100.100.2/32 reachability Down->Up
MC#