Cisco SAF provides a framework that allows applications to discover the existence, location, and configuration of networked resources within networks. Cisco SAF allows a timely and reliable awareness of the services within networks, as applications advertise and discover services on networks. Service information distributes though a network of Cisco SAF cooperative nodes that assume specific functions to efficiently distribute knowledge of services and facilitate their discovery.

A non-SAF node is any node in a network that does not understand SAF. Non-SAF nodes are called "dark nets" and are required to traverse ISPs. Cisco SAF messages are IP-based and therefore are unaffected by dark nets.

These Cisco SAF cooperative network nodes are grouped into two major functional responsibilities:

• Cisco SAF Forwarder-- Distributes service information through the network and makes these services discoverable by clients in the network
• Cisco SAF Client --Services are advertised and can be discovered

An effective Cisco SAF network requires both roles to be configured.

This section provides the following information:

• Cisco SAF Forwarder Overview
  
• Cisco SAF Client Overview
  
• External Cisco SAF Client using XMCP Overview
  

A service is any information that a Cisco SAF Client application wishes to advertise, that can then be used by other Cisco SAF Client applications. A service advertisement consists of service data. Service advertisements are propagated between forwarders using header data. Cisco SAF Clients that are interested in a service receive, and may inspect, service header and service data.

A service identifier number uniquely identifies the service on a network. The following example shows the format of a service identifier number:

service:sub-service:instance.instance.instance.instance

The service identifier is a 16-bit decimal identifier for the major service being advertised. A major service refers to a specific technology area, such as Cisco Unified Communications (UC). Service identifiers are assigned by Cisco to various customers requiring an SAF client.

The following example shows the service ID values for IP Everywhere and Cisco Unified Communications:

Cisco Defined Numbers 
    SAF_SERVICE_ID_IPE            	= 100 	 ! IP Everywhere
    SAF_SERVICE_ID_UC            	 = 101 	 ! Unified Communications

The sub-service identifier is a 16-bit decimal identifier for the minor service being advertised. A sub-service (also referred to as a minor service) refers to the type of service within a technology. For example, within UC:

• Sub-service 1 is TDM gateway.
• Sub-service 2 is hosted-DN.
• Instance identifies a specific service advertisement for this kind of service. For example, service identifier 101:1:abcd.1234.ef.678 could be an advertisement of a UC (service 101) TDM gateway (sub-service 1) announced by the Communications Manager cluster in a certain location (instance abcd.1234.ef.678).

The instance identifier is a unique 128-bit number that identifies the specific service advertised.

Client teams define the use of sub-service and instance values for their applications. Clients must ensure instance uniqueness within a Cisco SAF domain.

As the variety and number of network services grows, providing timely and reliable awareness of these services starts to play a more significant role in increasing productivity and efficiency. One of the biggest challenges in propagating service availability awareness over a WAN is one of scalability. As networks grow, the services offered by the devices on these networks increases. Protocols responsible for the service advertisement need to scale to handle this increased load. These protocols also need to react to rapid changes efficiently and propagate the new information in a timely manner.

Cisco SAF is designed to be a scalable solution for enterprise service locations and is capable of spanning LAN and WAN internet segments. As an enterprise solution, you can configure Cisco SAF to use domains to scale for very large networks. Just as Cisco Enhanced Interior Gateway Routing Protocol (EIGRP) defines the concept of an autonomous system in which routes can be searched for in a hierarchical manner, Cisco SAF employs the similar concept of a domain and sub-domains.

Cisco SAF provides a dynamic peer discovery and service advertisement propagation technique known as IP multicast. IP multicast requires the cooperation of IP Cisco SAF Forwarders (the devices that connect IP subnets together to form intranets). IP multicasting, however, may not be completely implemented across some intranets. In the absence of IP multicasting, Cisco SAF operates within the configured subnet, or within the groups of subnets over which IP multicast is supported.

Cisco SAF Forwarders offer two primary types of administrative domains (AD); a domain and a subdomain. A domain and a subdomain function the same with one notable exception; subdomains do not form unique neighbor relationships, but instead rely on a single peering.

Ideally, a network would only require a single domain to use for advertising all services. However, due to scaling and policy issues, some networks require the creation of multiple domains. The recommendation is to use a single domain. Consider using multiple domains when:

• More than 30,000 services are registered in a single domain
• Logical grouping of services is needed to restrict propagation of services

Closed groups are needed to prevent users from browsing services they are not allowed to access

Service redistribution allows different domains to exchange service information. Services may need to be bound to specific areas of the network, or the number of services in a given network my need to be limited. If you cannot use a single domain, service advertisement redistribution might be the solution.

Each domain on a network is separated into an administrative domain (AD). All Cisco SAF Forwarders in the same AD (running the same domain) have complete knowledge of the entire AS. A Cisco Forwarder that connects two (or more) administrative domains is known as a border Forwarder. A border Forwarder advertises service information from one AS to another AS. Proper design should also be considered if multiple border Forwarders are used to avoid loops (information learned from one AD being sent back to the same AD).

Cisco EIGRP Service-Family Support extends the named configuration to allow configuration of multiple instances, which operate independently. The addition of a Virtual Router ID (VRID) to the base Cisco EIGRP packet encoding allows for multiple instances.

As each virtual router is created, a VRID is assigned to the top level router and shared with the address families and service families that are configured under it.

Cisco SAF Forwarders can operate in networks that do not have routers that support the Cisco SAF Forwarder protocol. These networks are referred to as "dark nets." There are two methods for configuring Cisco SAF Forwarders over IP networks that do not support Cisco SAF (IP clouds); unicast Cisco SAF neighbors and multicast Cisco SAF neighbors.

You can use a unicast configuration to provide a reliable point-to-point adjacency with neighbors. As the number of Cisco SAF Forwarders increases, you can use multicast to provide an efficient transport between multiple Cisco SAF neighbors. A single IP multicast group address can be used for multiple Cisco SAF neighbors to exchange SAF information in a peer-group.

Traditionally, to locate services on a network, network applications must be configured with the hostname and the network address of the desired service or must use an overlay mechanism such as DNS. Existing protocols that support service advertisement provide periodic-based announcements of resource utilization. These network services are typically LAN-based.

The figure below shows a Cisco Unified Communications Manager network requiring a traditional configuration methodology.

Cisco SAF provides a framework that allows networking applications to automatically discover the existence, location, and configuration of networked services within networks. This automated discovery of services replaces the manual entry of complex configurations such as dial plans, that often require repetitive configuration changes. Cisco SAF also allows applications to advertise and discover their services. Cisco SAF allows you to create a configuration once, and then have it propagate to all devices that require the information.

The figure below shows a Cisco Unified Communications Manager network using Cisco SAF.

You can configure a Cisco SAF Client either on the same router as the Cisco SAF Forwarder or on an external router.

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    exit-service-family

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    sf-interface interface-name interface-number

6.    sf-interface

7.    exit-sf-interface

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    topology base

6.    exit-sf-topology

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    neighbor {ip-address {interface-type interface-number} | description word | maximum-service} | maximum-service number [threshold-value] [dampened | reset-time | restart interval | restart-count | warning-only]}

6.    exit-service-family

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system number

5.    eigrp stub [receive-only | connected]

6.    exit-service-family

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    sf-interface interface-name interface-number

6.    authentication key-chain name-of-chain

7.    authentication mode {hmac-sha-256 {0 | 7} password | md5}

8.    exit-sf-interface

9.    exit-service-family

10.    exit

11.    key-chain name-of-chain

12.    key key-id

13.    key-string text

14.    accept-lifetime start-time [local {duration seconds | end-time | infinite}]

15.    send-lifetime start-time [local {duration seconds | end-time | infinite}]

16.    exit

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    eigrp log-neighbor-changes

6.    eigrp log-neighbor-warnings seconds

7.    exit-service-family

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    sf-interface interface-name interface-number

6.    bandwidth-percent maximum-bandwidth-percentage

7.    exit-sf-interface

Because metric components can be changed rapidly, the frequency of the changes can have an impact on the network. Frequent changes require that prefixes learned though the SAF interface be updated and sent to all adjacencies. This update can result in further updates and in a worst-case scenario, cause network-wide churn. To prevent such effects, metrics can be dampened or thresholds set so that any change that does not exceed the dampening threshold is ignored.

Network changes that cause an immediate update include any change in a metric that results in the router selecting a new nexthop or a down interface or router.

Dampening the metric changes can be configured based on a change or on a time interval.

If the dampening method is:

• Change-based, changes in routes learned though a specific interface or in the metrics for a specific interface will not be advertised to adjacencies until the computed metric changes from the last advertised value are significant enough to cause an update to be sent.
• Interval-based, changes in routes learned though a specific interface or in the metrics for a specific interface will not be advertised to adjacencies until the specified interval is met or unless the change results in a new route path selection. When the timer expires, routes that have outstanding changes to report are sent. If a route changes and the final metric of the route matches the last updated metric, no updated routes are sent.

Refer to the following sections for information on configuring change-based and interval-based metric dampening parameters.

• Change-based Dampening Configuration
  
• Interval-based Dampening Configuration
  

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    sf-interface interface-name interface-number

6.    hello-interval seconds

7.    hold-time seconds

8.    exit-sf-interface

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    sf-interface interface-name interface-number

6.    no split-horizon

7.    exit-sf-interface

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    sf-interface interface-name interface-number

6.    metric maximum-hops

7.    exit-sf-interface

Before configuring:

• Cisco SAF Clients, you should understand the concepts in the Cisco SAF Client Overview.
• Neighbor relationships for Cisco SAF External Clients located on separate LANs, ensure that you have IP routing configured between each Cisco External Client.

1.    enable

2.    configure terminal

3.    router eigrp virtual-instance-name

4.    service-family {ipv4 | ipv6} [vrf vrf-name] autonomous-system autonomous-system-number

5.    topology base

6.    external-client client-label

7.    exit-sf-topology

8.    exit-service-family

9.    exit

10.    service-family external-client listen {ipv4 | ipv6} tcp_port_number

11.    external-client client-label basename

12.    username user-name

13.    password password-name

14.    keepalive number

15.    exit