Around The Globe ATG.WORLD

Visit our sister website :

http://www.atg.world/

This is a social network for enthusiasts just like us. No Junk! Only meaningful conversations with the people who share the same enthusiasm as us.

Around The Globe ATG.WORLD

Visit our sister website :

http://www.atg.world/

This is a social network for enthusiasts just like us. No Junk! Only meaningful conversations with the people who share the same enthusiasm as us.

Tuesday, September 22, 2015

MacSec over OTV (on VxLAN) + QoS

Cisco IOS-XE does not support Macsec encryption across a L3 backbone. I mean, that is what IPSec is for. Right ? Macsec is L2 encryption, plain and simple.

OTV and VxLAN are both L2 backbone extension protocols across a L3 backbone, which means connecting a direct cable between your data center in LA and data centre in Bangalore, but using the internet. :-)



1RU_H router :

otv site bridge-domain 501
otv site-identifier 0000.0000.0501
!
key chain k1 macsec
 key 01
   cryptographic-algorithm aes-128-cmac
   key-string 12345678901234567890123456789012
!
class-map match-all costest
 match qos-group 1
class-map match-all cos
 match cos  5
!
policy-map cos
 class cos
  set qos-group 1
policy-map costest
 class costest
  set cos 5
!
!
interface Overlay400
 no ip address
 otv join-interface TenGigabitEthernet0/0/1.10
 otv use-adjacency-server 10.3.1.2 unicast-only
 no otv isis hello padding always
 service instance 400 ethernet
  encapsulation dot1q 400
  bridge-domain 400
 !
interface TenGigabitEthernet0/0/0
 description " CONNECTED TO LOCAL LAN "
 no ip address
 cdp enable
 service instance 400 ethernet
  encapsulation dot1q 400
  bridge-domain 400
!
 service instance 501 ethernet
  encapsulation dot1q 501
  bridge-domain 501
!
interface TenGigabitEthernet0/0/0.1
 encapsulation dot1Q 1 native
 ip address 108.0.1.1 255.255.255.0
 ip pim dense-mode
!
interface TenGigabitEthernet0/0/1.10
 encapsulation dot1Q 10
 ip address 10.3.1.1 255.255.255.0
 ip mtu 1468
 ip pim sparse-dense-mode
 ip ospf 501 area 400
 eapol destination-address broadcast-address
 mka pre-shared-key key-chain k1
 macsec
 service-policy input costest
!
ip route 107.0.0.0 255.255.255.0 TenGigabitEthernet0/0/1.10




PE RTR CONFIG (Both the routers will have the similar VxLAN config and IGP / BGP reachability should be configured)

bridge-domain 1
 member vni 5010
 member TenGigabitEthernet0/2/0 service-instance 1
!
interface Loopback1
 ip address 11.11.11.1 255.255.255.255
!
interface nve1
 no ip address
 member vni 5010
  ingress-replication 22.22.22.1                   ! Loopback 1 address of other PE router
 !
 source-interface Loopback1
!
interface TenGigabitEthernet0/2/0
 no ip address
 service instance 1 ethernet
  encapsulation dot1q 10
  rewrite ingress tag pop 1 symmetric         ! Remove this cmd if L2 COS QoS is there on CE rtrs
!


1RU_D CONFIG :

 otv site bridge-domain 500
!
otv site-identifier 0000.0000.0500
!
key chain k1 macsec
 key 01
   cryptographic-algorithm aes-128-cmac
   key-string 12345678901234567890123456789012
!
class-map match-all costest
 match qos-group 1
class-map match-all cos
 match cos  5
!
policy-map cos
 class cos
  set qos-group 1
policy-map costest
 class costest
  set cos 5
!
interface Overlay400
 no ip address
 otv join-interface TenGigabitEthernet0/0/1.10
 otv adjacency-server unicast-only
 no otv isis hello padding always
 service instance 400 ethernet
  encapsulation dot1q 400
  bridge-domain 400
!
!
interface TenGigabitEthernet0/0/0
 description " CONNECTED TO SPIRENT CARD 3 PORT DOWN "
 no ip address
 cdp enable
 service instance 400 ethernet
  encapsulation dot1q 400
  bridge-domain 400
 !
 service instance 500 ethernet
  encapsulation dot1q 500
  bridge-domain 500
!
interface TenGigabitEthernet0/0/0.1
 encapsulation dot1Q 1 native
 ip address 107.0.1.1 255.255.255.0
 ip pim sparse-dense-mode
 ip igmp join-group 239.0.0.1
!
interface TenGigabitEthernet0/0/1
 no ip address
 macsec dot1q-in-clear 1
!
interface TenGigabitEthernet0/0/1.10
 encapsulation dot1Q 10
 ip address 10.3.1.2 255.255.255.0
 ip mtu 1468
 ip pim sparse-dense-mode
 ip ospf 500 area 400
 eapol destination-address broadcast-address
 mka pre-shared-key key-chain k1
 macsec
 service-policy output costest
!
ip route 108.0.0.0 255.255.255.0 TenGigabitEthernet0/0/1.10

No comments:

Post a Comment