Mailing List Archive

i dont know of a 'guide' but they're very similar.. try a cut n paste and look
for the errors, with a few search+replaces it shouldnt be a big job.

Steve

On Wed, 30 Mar 2005, Tuc wrote:

> Hi,
>
> I'm looking to mirror a config we have running on a Cisco 6500
> to a Foundry, and wondered if there are any guides/resource/etc that
> someone might be able to point me to.
>
> Thanks, Tuc/TTSG Internet Services, Inc.
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp
>

On Wed, Mar 30, 2005 at 12:54:44PM -0500, Tuc wrote:

> I'm looking to mirror a config we have running on a Cisco 6500
> to a Foundry, and wondered if there are any guides/resource/etc that
> someone might be able to point me to.

Depends on what your config is mostly about. If it's doing mostly BGP
your BGP configuration can be almost be copied 1:1 (except for MD5
passwords and route-maps).

Interface syntax is almost the same, VLAN config is totally different.

But it would be pretty easy to build a perl script that would convert
Foundry 2 Cisco style (and the other way around).

--
Cliff Albert <cliff at oisec.net>

>
> On Wed, Mar 30, 2005 at 12:54:44PM -0500, Tuc wrote:
>
> > I'm looking to mirror a config we have running on a Cisco 6500
> > to a Foundry, and wondered if there are any guides/resource/etc that
> > someone might be able to point me to.
>
> Depends on what your config is mostly about. If it's doing mostly BGP
> your BGP configuration can be almost be copied 1:1 (except for MD5
> passwords and route-maps).
>
I'm doing Interfaces as part of Vlans, ospf (Which might come
out in this new config, haven't decided yet), BGP with redistributes
and route maps (BOY are there route-map's), and community lists, and
prefix-lists, and as-paths, and prepending and setting communitys and
adding communities and lots of metrics and local pref's.....
>
> Interface syntax is almost the same, VLAN config is totally different.
>
Where can I find out more about the VLAN stuff? We assign the IPs
in the VLANs and ospf priority and vtp-domain.
>
> But it would be pretty easy to build a perl script that would convert
> Foundry 2 Cisco style (and the other way around).
>
I don't mind doing it by hand, unless there is a text somewhere
that explains... If you have KEYWORD OPTION OPTION change it to
OTHERKEYWORD default OPTION backwardsnetmask. :)

Thanks, Tuc

On Wed, 30 Mar 2005, Tuc wrote:

> I'm doing Interfaces as part of Vlans,

different

> ospf (Which might come out in this new config, haven't decided yet),

mainly the same, check default metrics

> BGP with redistributes

same except no spaces in descs, and on route-map put 'in'/'out' before the
route-map name instead of after

> and route maps (BOY are there route-map's),

same (you'll be glad to hear!)

> and community lists, and prefix-lists, and as-paths,

same same same

> and prepending and setting communitys and
> adding communities and lots of metrics and local pref's.....

same same same, make sure your default metrics are the same

> > Interface syntax is almost the same, VLAN config is totally different.
> >
> Where can I find out more about the VLAN stuff? We assign the IPs
> in the VLANs and ospf priority and vtp-domain.

conf t
# vlan blah name foo
(vlan)# tag eth 1/2
(vlan)# router-interface ve 34

# int ve 34
(int) # ip add w.x.y.z

etc

Steve

> >
> > But it would be pretty easy to build a perl script that would convert
> > Foundry 2 Cisco style (and the other way around).
> >
> I don't mind doing it by hand, unless there is a text somewhere
> that explains... If you have KEYWORD OPTION OPTION change it to
> OTHERKEYWORD default OPTION backwardsnetmask. :)
>
> Thanks, Tuc
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp
>

Quoting "Stephen J. Wilcox" <steve at telecomplete.co.uk>:
>> Where can I find out more about the VLAN stuff? We assign the IPs
>> in the VLANs and ospf priority and vtp-domain.
>
> conf t
> # vlan blah name foo
> (vlan)# tag eth 1/2
> (vlan)# router-interface ve 34
>
> # int ve 34
> (int) # ip add w.x.y.z

VTP is Cisco proprietary, you can use GVRP if you're not using PVST.

OSPF is rather different config wise:

router ospf
area 0
area 1.2.3.4 nssa 1
area 1.2.3.4 nssa default-information-originate
redistribution connected
redistribution static

int ve 34
ip ospf area 1.2.3.4
ip ospf passive
ip ospf ?

There's no magic config changer. You'll have to add your config in section by
section and deal with any inconsistencies or changes. The good news is that
it's not that hard.

Tine Hutchison

> > BGP with redistributes
>
> same except no spaces in descs, and on route-map put 'in'/'out' before the
> route-map name instead of after
>
> > and route maps (BOY are there route-map's),
>
> same (you'll be glad to hear!)
>

Hi,

Just to give everyone a little giggle, I contacted the Foundry TAC
(I do pay for support....) and sent them some of my concerns and questions
how to go about some things. That was a week ago. They passed me off to
the local account team, which was a free for all trying to figure out
who would be helping. I finally got *1* person, laid it all out to him,
and hoped to hear back.

Well, I did. I was told my devices didn't support BGP.... Thats
weird :

telnet at f4802#sho ip bgp sum
BGP4 Summary
Router ID: AA.BB.X.X Local AS Number : 65535
Confederation Identifier : not configured
Confederation Peers:
Maximum Number of Paths Supported for Load Sharing : 1
Number of Neighbors Configured : 1, UP: 0
Number of Routes Installed : 0
Number of Routes Advertising to All Neighbors : 0
Number of Attribute Entries Installed : 0
Neighbor Address AS# State Time Rt:Accepted Filtered Sent ToSend
AA.BB.CC.DD YYYY OPENS 0h57m43s 0 0 0 0

I'm testing its ability to connect to something we call a "black hole
server". Its an offsite PC running Zebra that allows us to change BGP and
use it to restrict responding to whatever is in it.

So I configured :

router bgp
local-as 65535
neighbor AA.BB.CC.DD remote-as YYYY
neighbor AA.BB.CC.DD ebgp-multihop 20
neighbor AA.BB.CC.DD update-source loopback 1
neighbor AA.BB.CC.DD maximum-prefix 100 95 teardown
neighbor AA.BB.CC.DD route-map in bgp-from-blackhole
neighbor AA.BB.CC.DD route-map out bgp-to-blackhole
neighbor AA.BB.CC.DD soft-reconfiguration inbound
!
route-map bgp-from-blackhole permit 10
set local-preference 500
set community no-export
!
route-map bgp-to-blackhole deny 10


I seem to get it doing OpenSents, but it never really "connects".

Any thoughts?

Thanks, Tuc/TTSG Internet Services, Inc.

not sure, turn up some debug.. watch our for blackhole tho, until recently its
supported only in software and it doesnt work in the way other routers eg cisco
do. i found it wouldnt allow me to set next hop to an ip static routed to null

Steve


On Mon, 4 Apr 2005, Tuc wrote:

> > > BGP with redistributes
> >
> > same except no spaces in descs, and on route-map put 'in'/'out' before the
> > route-map name instead of after
> >
> > > and route maps (BOY are there route-map's),
> >
> > same (you'll be glad to hear!)
> >
>
> Hi,
>
> Just to give everyone a little giggle, I contacted the Foundry TAC
> (I do pay for support....) and sent them some of my concerns and questions
> how to go about some things. That was a week ago. They passed me off to
> the local account team, which was a free for all trying to figure out
> who would be helping. I finally got *1* person, laid it all out to him,
> and hoped to hear back.
>
> Well, I did. I was told my devices didn't support BGP.... Thats
> weird :
>
> telnet at f4802#sho ip bgp sum
> BGP4 Summary
> Router ID: AA.BB.X.X Local AS Number : 65535
> Confederation Identifier : not configured
> Confederation Peers:
> Maximum Number of Paths Supported for Load Sharing : 1
> Number of Neighbors Configured : 1, UP: 0
> Number of Routes Installed : 0
> Number of Routes Advertising to All Neighbors : 0
> Number of Attribute Entries Installed : 0
> Neighbor Address AS# State Time Rt:Accepted Filtered Sent ToSend
> AA.BB.CC.DD YYYY OPENS 0h57m43s 0 0 0 0
>
> I'm testing its ability to connect to something we call a "black hole
> server". Its an offsite PC running Zebra that allows us to change BGP and
> use it to restrict responding to whatever is in it.
>
> So I configured :
>
> router bgp
> local-as 65535
> neighbor AA.BB.CC.DD remote-as YYYY
> neighbor AA.BB.CC.DD ebgp-multihop 20
> neighbor AA.BB.CC.DD update-source loopback 1
> neighbor AA.BB.CC.DD maximum-prefix 100 95 teardown
> neighbor AA.BB.CC.DD route-map in bgp-from-blackhole
> neighbor AA.BB.CC.DD route-map out bgp-to-blackhole
> neighbor AA.BB.CC.DD soft-reconfiguration inbound
> !
> route-map bgp-from-blackhole permit 10
> set local-preference 500
> set community no-export
> !
> route-map bgp-to-blackhole deny 10
>
>
> I seem to get it doing OpenSents, but it never really "connects".
>
> Any thoughts?
>
> Thanks, Tuc/TTSG Internet Services, Inc.
>

>
> not sure, turn up some debug..watch our for blackhole tho, until recently its
> supported only in software and it doesnt work in the way other routers eg cisco
> do. i found it wouldnt allow me to set next hop to an ip static routed to null
>
I did. Foundry says Zebra closes the connection and thats it, Zebra
says the Foundry isn't doing anything. SIGH.......

Your killing me. Your serious I can't use my BGP black hole machine?
On the Cisco I do have "ip route 172.16.1.1 255.255.255.255 Null0". Maybe
I can tell it to go out a port that isn't up then instead?

Thanks, Tuc/TTSG Internet Services, Inc
(Already thinking my 2 week deadline is in SERIOUS jeopardy)



> Steve
>
>
> On Mon, 4 Apr 2005, Tuc wrote:
>
> > > > BGP with redistributes
> > >
> > > same except no spaces in descs, and on route-map put 'in'/'out' before the
> > > route-map name instead of after
> > >
> > > > and route maps (BOY are there route-map's),
> > >
> > > same (you'll be glad to hear!)
> > >
> >
> > Hi,
> >
> > Just to give everyone a little giggle, I contacted the Foundry TAC
> > (I do pay for support....) and sent them some of my concerns and questions
> > how to go about some things. That was a week ago. They passed me off to
> > the local account team, which was a free for all trying to figure out
> > who would be helping. I finally got *1* person, laid it all out to him,
> > and hoped to hear back.
> >
> > Well, I did. I was told my devices didn't support BGP.... Thats
> > weird :
> >
> > telnet at f4802#sho ip bgp sum
> > BGP4 Summary
> > Router ID: AA.BB.X.X Local AS Number : 65535
> > Confederation Identifier : not configured
> > Confederation Peers:
> > Maximum Number of Paths Supported for Load Sharing : 1
> > Number of Neighbors Configured : 1, UP: 0
> > Number of Routes Installed : 0
> > Number of Routes Advertising to All Neighbors : 0
> > Number of Attribute Entries Installed : 0
> > Neighbor Address AS# State Time Rt:Accepted Filtered Sent ToSend
> > AA.BB.CC.DD YYYY OPENS 0h57m43s 0 0 0 0
> >
> > I'm testing its ability to connect to something we call a "black hole
> > server". Its an offsite PC running Zebra that allows us to change BGP and
> > use it to restrict responding to whatever is in it.
> >
> > So I configured :
> >
> > router bgp
> > local-as 65535
> > neighbor AA.BB.CC.DD remote-as YYYY
> > neighbor AA.BB.CC.DD ebgp-multihop 20
> > neighbor AA.BB.CC.DD update-source loopback 1
> > neighbor AA.BB.CC.DD maximum-prefix 100 95 teardown
> > neighbor AA.BB.CC.DD route-map in bgp-from-blackhole
> > neighbor AA.BB.CC.DD route-map out bgp-to-blackhole
> > neighbor AA.BB.CC.DD soft-reconfiguration inbound
> > !
> > route-map bgp-from-blackhole permit 10
> > set local-preference 500
> > set community no-export
> > !
> > route-map bgp-to-blackhole deny 10
> >
> >
> > I seem to get it doing OpenSents, but it never really "connects".
> >
> > Any thoughts?
> >
> > Thanks, Tuc/TTSG Internet Services, Inc.
> >
>
> _______________________________________________
> foundry-nsp mailing list
> foundry-nsp at puck.nether.net
> http://puck.nether.net/mailman/listinfo/foundry-nsp
>

Hi,

NEVER MIND........................

Sigh..............................

Zebra needed "ebgp-multihop 20" for the Foundry, where the Ciscos
don't.

My black hole server is submitting routes, but the nexthop isn't
what I wanted. It COULD be a further configuration issue. I need
to decommision this router and load a clean config. I was just trying to
prove to a Foundry SE that this unit DOES do BGP.

Thanks, Tuc/TTSG Internet Services, Inc.

On Mon, Apr 04, 2005 at 07:55:34PM -0400, Tuc wrote:

> Just to give everyone a little giggle, I contacted the Foundry TAC
> (I do pay for support....) and sent them some of my concerns and questions
> how to go about some things. That was a week ago. They passed me off to
> the local account team, which was a free for all trying to figure out
> who would be helping. I finally got *1* person, laid it all out to him,
> and hoped to hear back.
>
> Well, I did. I was told my devices didn't support BGP.... Thats
> weird :

The FastIron itself does support BGP, however Foundry offers no support
for people running BGP on a FastIron, they do support BGP on BigIron's
and NetIrons.

--
Cliff Albert <cliff at oisec.net>

Hi Tuc,
I put in a feature request which was accepted so the blackhole may be supported
in the latest software.

ok so the normal system is you put a static route to null0 on your cisco then
inject routes thro bgp with next-hop of that static. iirc i got it to work but
setting the static to route to loopback.. of course this means software
switching which is bad if its a ddos your killing but as dropping to null was
also software i figured it was no worse.

the trouble seemed specifically that bgp wouldnt recursively lookup and would
assume the next hop was unavailable

Steve

On Mon, 4 Apr 2005, Tuc wrote:

> > not sure, turn up some debug..watch our for blackhole tho, until recently
> > its supported only in software and it doesnt work in the way other routers
> > eg cisco do. i found it wouldnt allow me to set next hop to an ip static
> > routed to null
> >
> I did. Foundry says Zebra closes the connection and thats it, Zebra says
> the Foundry isn't doing anything. SIGH.......
>
> Your killing me. Your serious I can't use my BGP black hole machine?
> On the Cisco I do have "ip route 172.16.1.1 255.255.255.255 Null0". Maybe
> I can tell it to go out a port that isn't up then instead?
>
> Thanks, Tuc/TTSG Internet Services, Inc
> (Already thinking my 2 week deadline is in SERIOUS jeopardy)
>
>
>
> > Steve
> >
> >
> > On Mon, 4 Apr 2005, Tuc wrote:
> >
> > > > > BGP with redistributes
> > > >
> > > > same except no spaces in descs, and on route-map put 'in'/'out' before the
> > > > route-map name instead of after
> > > >
> > > > > and route maps (BOY are there route-map's),
> > > >
> > > > same (you'll be glad to hear!)
> > > >
> > >
> > > Hi,
> > >
> > > Just to give everyone a little giggle, I contacted the Foundry TAC
> > > (I do pay for support....) and sent them some of my concerns and questions
> > > how to go about some things. That was a week ago. They passed me off to
> > > the local account team, which was a free for all trying to figure out
> > > who would be helping. I finally got *1* person, laid it all out to him,
> > > and hoped to hear back.
> > >
> > > Well, I did. I was told my devices didn't support BGP.... Thats
> > > weird :
> > >
> > > telnet at f4802#sho ip bgp sum
> > > BGP4 Summary
> > > Router ID: AA.BB.X.X Local AS Number : 65535
> > > Confederation Identifier : not configured
> > > Confederation Peers:
> > > Maximum Number of Paths Supported for Load Sharing : 1
> > > Number of Neighbors Configured : 1, UP: 0
> > > Number of Routes Installed : 0
> > > Number of Routes Advertising to All Neighbors : 0
> > > Number of Attribute Entries Installed : 0
> > > Neighbor Address AS# State Time Rt:Accepted Filtered Sent ToSend
> > > AA.BB.CC.DD YYYY OPENS 0h57m43s 0 0 0 0
> > >
> > > I'm testing its ability to connect to something we call a "black hole
> > > server". Its an offsite PC running Zebra that allows us to change BGP and
> > > use it to restrict responding to whatever is in it.
> > >
> > > So I configured :
> > >
> > > router bgp
> > > local-as 65535
> > > neighbor AA.BB.CC.DD remote-as YYYY
> > > neighbor AA.BB.CC.DD ebgp-multihop 20
> > > neighbor AA.BB.CC.DD update-source loopback 1
> > > neighbor AA.BB.CC.DD maximum-prefix 100 95 teardown
> > > neighbor AA.BB.CC.DD route-map in bgp-from-blackhole
> > > neighbor AA.BB.CC.DD route-map out bgp-to-blackhole
> > > neighbor AA.BB.CC.DD soft-reconfiguration inbound
> > > !
> > > route-map bgp-from-blackhole permit 10
> > > set local-preference 500
> > > set community no-export
> > > !
> > > route-map bgp-to-blackhole deny 10
> > >
> > >
> > > I seem to get it doing OpenSents, but it never really "connects".
> > >
> > > Any thoughts?
> > >
> > > Thanks, Tuc/TTSG Internet Services, Inc.
> > >
> >
> > _______________________________________________
> > foundry-nsp mailing list
> > foundry-nsp at puck.nether.net
> > http://puck.nether.net/mailman/listinfo/foundry-nsp
> >
>
>

> > Well, I did. I was told my devices didn't support BGP.... Thats
> > weird :
>
> The FastIron itself does support BGP, however Foundry offers no support
> for people running BGP on a FastIron, they do support BGP on BigIron's
> and NetIrons.
>
Odd, when I was sold the units in mid-2002 I was told they'd do
3 full BGP tables, and much more. Shame on me for believing a salesperson.

Tuc/TTSG Internet Services, Inc.

On Tue, Apr 05, 2005 at 12:57:53PM -0400, Tuc wrote:

> > > Well, I did. I was told my devices didn't support BGP.... Thats
> > > weird :
> >
> > The FastIron itself does support BGP, however Foundry offers no support
> > for people running BGP on a FastIron, they do support BGP on BigIron's
> > and NetIrons.
> >
> Odd, when I was sold the units in mid-2002 I was told they'd do
> 3 full BGP tables, and much more. Shame on me for believing a salesperson.

The Units WILL do 3 full BGP tables (even more) but Foundry will not
support you if you do so on a FastIron.

--
Cliff Albert <cliff at oisec.net>

On Tue, 5 Apr 2005, Tuc wrote:

> > > Well, I did. I was told my devices didn't support BGP.... Thats
> > > weird :
> >
> > The FastIron itself does support BGP, however Foundry offers no support
> > for people running BGP on a FastIron, they do support BGP on BigIron's
> > and NetIrons.
> >
> Odd, when I was sold the units in mid-2002 I was told they'd do
> 3 full BGP tables, and much more. Shame on me for believing a salesperson.

Of course in mid-2002 the routing table was about 110000 prefixes compared to
the current 160000 and memory is the issue.. both with main memory and cam size.

Having said that, a FI couldnt handle it even in 2002.. you'd probably need to
go back a few more years to find a point where the FI could take 3 tables.

Depending on your needs tho you may want to take a partial table..

Steve