как пропустить DHCPOFFER через ISG

survivor

Posted February 27, 2013 (edited)

Доброго дня,

Столкнулся с такой проблемой:

Модель vlan-per-user, ip unnumbered loopback на SVI, dhcp snooping+relay, абонентский траффик в отдельном VRF.

Все работает, абоненты получают IP в соответствие с Option 82, проходят внутри VRF до ядра сети, затем попадают на ASR, там ISG, стартует сессия по IP, аутентифицируется на radius'е (логин=IP), привязывается нужный сервис, и абоненты попадают в global routing и интернет.

Но! Есть одна проблема - все это работает только по отдельности: т.е. сначала на ASR выключен ISG и тогда абоненты получают IP от DHCP сервера, потом включаю ISG, старует сессия и т.д. но абонент после истечения lease адреса не может его получить.

Причина мне понятна: клиент находится в VRF, а DHCP сервер в global. На SVI:

interface Vlan1101
description SW1-PORT1
ip vrf forwarding domonet
ip unnumbered Loopback52
ip helper-address global <DHCP SERVER>
end

В tcpdump'е вижу что запрос на сервер приходит из-под глобального (который в global routing'е) IP каталиста. Это есть хорошо.

19:16:03.123610 IP 10.111.1.1.bootps > dhcpserver.provider.net.bootps: BOOTP/DHCP, Request from 00:15:60:bb:cb:17 (oui Unknown), length 326

Но, ответ сервер отправляет на vrf-ный IP, который прописан на каталисте на loopback52 и который находится внутри VRF (он будет gateway для всех SVI) и который содержится в DHCP запросе как GIADDR. Соответственно обратный путь пакета заканчивается на ISG на ASR. А это уже не есть хорошо :)

Собственно говоря, это нормальное поведение сервера, потому как:

When the DHCP server replies to the client, it sends the reply to the GIADDR address, again using unicast. The relay agent then retransmits the response on the local network

Вот только что делать? Самое простое воткнуть DHCP сервер внутрь VRF'а. Но может еще есть какое-то решение? Буду рад ценным советам :)

Edited February 27, 2013 by survivor

Share this post

Link to post

Share on other sites

Ivan_83

Posted February 27, 2013

Есть ещё дхцп релеи.

Share this post

Link to post

Share on other sites

survivor

Posted February 28, 2013

дык - у меня релей и есть :)

проблема в том, что dhcp сервер посылает ответ не на тот IP с которого пришел запрос (т.е. не на адрес релея в global роутинге), а на IP находящийся в поле GIADDR (таков стандарт), в который циска сует IP от loopback'а (что верно - потому как она предполагает, что по этому IP сервер поймет какой пул использовать), но loopback то находится в VRF'е.... вот-с...

Share this post

Link to post

Share on other sites

survivor

Posted February 28, 2013

Попробовал другой вариант:

L3 свич:

interface Vlan1219
description SW2-PORT19
ip vrf forwarding domonet
ip unnumbered Loopback52
ip helper-address 10.200.98.31
end

ASR:

ip dhcp relay information option vpn

policy-map type control IPoE-ISG
...
class type control always event session-start
10 authorize aaa list ipoe-isg-aaa password cisco identifier circuit-id plus remote-id
...

interface GigabitEthernet0/0/2.1001
encapsulation dot1Q 1001
ip address 10.200.98.31 255.255.255.0
ip helper-address IP-of-DHCP-SERVER
service-policy type control IPoE-ISG
ip subscriber routed
 initiator dhcp class-aware
end

В результате - на dhcp сервер приходит запрос, параллельно на радиус приходит аутентификация по opt82, но сессия на ASR все равно не стартует, потому как dhcp ответ до клиента не добирается и клиент не может получить IP.

Share this post

Link to post

Share on other sites

Ivan_83

Posted February 28, 2013

Либо не давайте тупой кошке релеить и релейте чем то другим, либо берите мой дхцп сервер на перле и делайте на нём поведение какое удобно.

Share this post

Link to post

Share on other sites

survivor

Posted February 28, 2013

либо берите мой дхцп сервер на перле и делайте на нём поведение какое удобно.

это у меня план Z :)

вообще обнаружилась еще одна проблема:

при initiator unclassified ip-address запросы на авторизацию на радиус приходят регулярно, при initiator dhcp то приходят, а то - вообще на радиусе тишина...

может ios глючит?

Share this post

Link to post

Share on other sites

survivor

Posted February 28, 2013 (edited)

Вот сессия стартовавшая по initiator dhcp:

#sh subscriber session uid 1325
Type: IP, UID: 1325, State: authen, Identity: 000404c60015:00060011bb603880
Session Up-time: 00:00:56, Last Changed: 00:00:56
Switch-ID: 4929171
ET 6w2d    other external event
       OLDST[2]:check-auth-needed
       NEWST[4]:authorizing
       fxn[9]:sss_pm_fsm_extern_event_author_found  FLAGS:1
ET 6w2d    got apply config success
       OLDST[8]:wait-for-events
       NEWST[8]:wait-for-events
       fxn[3]:sss_pm_action_sm_req_apply_config_success  FLAGS:0

Policy information:
 Authentication status: authen
 Active services associated with session:
   name "L4REDIRECT", applied before account logon
 Rules, actions and conditions executed:
   subscriber rule-map IPoE-ISG
     condition always event session-start
       10 authorize aaa list ipoe-isg-aaa identifier circuit-id:remote-id
   subscriber rule-map default-internal-rule
     condition always event service-start
       1 service-policy type service identifier service-name

Classifiers:
Class-id    Dir   Packets    Bytes                  Pri.  Definition

Features:

Absolute Timeout:
Class-id   Timeout Value    Time Remaining       Source
0          60               00:00:03             Peruser

L4 Redirect:
Class-id   Rule cfg  Definition                               Source
2750       #1   SVC  to group NO-MONEY                        L4REDIRECT

Configuration Sources:
Type  Active Time  AAA Service ID  Name
SVC   00:00:56     -               L4REDIRECT
USR   00:00:56     -               Peruser
INT   00:00:56     -               GigabitEthernet0/0/2.1001

А вот - стартовавшая по initiator unclassified ip-address:

#sh subscriber session uid 3407                                                  
Type: IP, UID: 3407, State: unauthen, Identity: X.X.X.X
IPv4 Address: X.X.X.X 
Session Up-time: 00:00:09, Last Changed: 00:00:09
Switch-ID: 8895335

Policy information:
 Authentication status: unauthen
 Active services associated with session:
   name "L4REDIRECT", applied before account logon
 Rules, actions and conditions executed:
   subscriber rule-map IPoE-ISG
     condition always event session-start
       10 authorize aaa list ipoe-isg-aaa identifier source-ip-address
       20 set-timer UNAUTH-TIMER 1
       30 service-policy type service name L4REDIRECT

Classifiers:
Class-id    Dir   Packets    Bytes                  Pri.  Definition
0           In    0          0                      0    Match Any
1           Out   0          0                      0    Match Any
2760        In    0          0                      20   Match ACL traffic-for-redirect

Features:

L4 Redirect:
Class-id   Rule cfg  Definition                               Source
2760       #1   SVC  to group NO-MONEY                        L4REDIRECT

Configuration Sources:
Type  Active Time  AAA Service ID  Name
SVC   00:00:09     -               L4REDIRECT
USR   00:00:09     -               Peruser
INT   00:00:09     -               GigabitEthernet0/0/2.1001

Соответственно, со второй все нормально, а вот через первую dhcp ответ абоненту не возвращается....

Что означает NEWST[4]:authorizing ?

Edited February 28, 2013 by survivor

Share this post

Link to post

Share on other sites

survivor

Posted March 1, 2013

Разгадка кроется в этом куске:

ET 6w2d    other external event 
       OLDST[2]:check-auth-needed 
       NEWST[4]:authorizing 
       fxn[9]:sss_pm_fsm_extern_event_author_found  FLAGS:1 
ET 6w2d    got apply config success 
       OLDST[8]:wait-for-events 
       NEWST[8]:wait-for-events 
       fxn[3]:sss_pm_action_sm_req_apply_config_success  FLAGS:0

Вроде как check-auth-needed и в то же время State: authen у сессии

Никто не знает? Что это хрень означает и почему она возникает? Гугл молчит... В доках глухо.

Share this post

Link to post

Share on other sites

survivor

Posted March 1, 2013

Вот debug:

Mar  1 12:27:00.404 AZT: IPSUB: Session input interface(0x4B91D238) = GigabitEthernet0/0/2.1001
Mar  1 12:27:00.404 AZT: IPSUB: Circuit_id = 000404c60015
Mar  1 12:27:00.405 AZT: IPSUB: Remote_id = 00060011bb603880
Mar  1 12:27:00.405 AZT: IPSUB: Vendor_Class_id = MSFT 5.0
Mar  1 12:27:00.405 AZT: IPSUB: Try to create a new session
Mar  1 12:27:00.405 AZT: IPSUB: [uid:0] Request to create a new session
Mar  1 12:27:00.405 AZT: IPSUB: [uid:0] Session start event for session
Mar  1 12:27:00.405 AZT: IPSUB: [uid:0] Event session start, state changed from idle to requesting
Mar  1 12:27:00.405 AZT: IPSUB: HA[uid:3450]: Session init-notification on Active
Mar  1 12:27:00.405 AZT: IPSUB: HA[uid:3450]: Invalid SHDB handle
Mar  1 12:27:00.406 AZT: IPSUB: [uid:3450] AAA unique ID allocated
Mar  1 12:27:00.406 AZT: IPSUB: [uid:3450] IP session(0x1E000267) need not be associated to Gi0/0/2.1001
Mar  1 12:27:00.406 AZT: SSS INFO: Element type is AccIe-Hdl = 2449476604 (92000BFC)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is AAA-Id = 40588451 (026B54A3)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is SHDB-Handle = 0 (00000000)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is PM-Context-Handle = 2852129335 (AA000A37)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is IP-Session-Handle = 503317095 (1E000267)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Mac-Address = 0015.60bb.cb17
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Circuit-id = "000404c60015"
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Remote-id = "00060011bb603880"
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Vendor-Class-id = "MSFT 5.0"
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Final = 1 (YES)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Access-Type = 15 (IP)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Protocol-Type = 4 (IP Access Protocol)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Media-Type = 2 (IP)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Switch-Id = 124833 (0001E7A1)
Mar  1 12:27:00.407 AZT: SSS INFO: Element type is Segment-Hdl = 333730 (000517A2)
Mar  1 12:27:00.407 AZT: SSS MGR [uid:3450]: Sending a Session Assert ID Mgr request
Mar  1 12:27:00.407 AZT: SSS MGR [uid:3450]: Updating ID Mgr with the following keys:
 aaa-unique-id        0   40588451 (0x26B54A3)
 clid-mac-addr        0   00 15 60 BB CB 17 
Mar  1 12:27:00.407 AZT: SSS MGR [uid:3450]: Updating ID Mgr with the following data:
 circuit-id-tag       0   "000404c60015"
 remote-id-tag        0   "00060011bb603880"
 vendor-class-id-tag  0   "MSFT 5.0"
Mar  1 12:27:00.407 AZT: SSS MGR [uid:3450]: ID Mgr returned status: 'success' for Session Assert
Mar  1 12:27:00.407 AZT: SSS MGR [uid:3450]: Handling Policy Service Authorize action (1 pending sessions)
Mar  1 12:27:00.408 AZT: SSS AAA AUTHOR [uid:3450]: using named author method list "ipoe-isg-aaa"
Mar  1 12:27:00.408 AZT: SSS AAA AUTHOR [uid:3450]: using set aaa password "cisco"
Mar  1 12:27:00.414 AZT: IPSUB: [uid:3450] IP session context 0x43F805B4 available to authorize
Mar  1 12:27:00.414 AZT: IPSUB-VRFSET: [uid:3450] Entered allocate feature info
Mar  1 12:27:00.414 AZT: IPSUB-VRFSET: [uid:3450] Allocated sg vrfset info 0x49485D3C
Mar  1 12:27:00.414 AZT: IPSUB-VRFSET: [uid:3450] Freeing the sg vrfset info 0x49485D3C
Mar  1 12:27:00.425 AZT: IPSUB: [uid:3450] IP session context 0x43F805B4 available to authorize
Mar  1 12:27:00.425 AZT: IPSUB-VRFSET: [uid:3450] Entered allocate feature info
Mar  1 12:27:00.425 AZT: IPSUB-VRFSET: [uid:3450] Allocated sg vrfset info 0x49485D3C
Mar  1 12:27:00.425 AZT: IPSUB-VRFSET: [uid:3450] Freeing the sg vrfset info 0x49485D3C
Mar  1 12:27:00.426 AZT: SSS AAA AUTHOR [uid:3450]: SVM download for "ISG-1MBPS" ok
Mar  1 12:27:00.426 AZT: SSS MGR [uid:3450]: Got reply Local Terminate from PM
Mar  1 12:27:00.426 AZT: SSS MGR [uid:3450]: Handling Connect Local Service action
Mar  1 12:27:00.426 AZT: SSS LTERM [uid:3450]: Processing Local termination request
Mar  1 12:27:00.427 AZT: SSS LTERM [uid:3450]: L3 session - IDB not required for service
Mar  1 12:27:00.427 AZT: SSS LTERM [uid:3450]: Segment provision successful
Mar  1 12:27:00.427 AZT: SSS MGR [uid:3450]: Handling Local Service Connected action
Mar  1 12:27:00.427 AZT: SSS MGR [uid:3450]: Apply: segment 333730, owner 2986479485
Mar  1 12:27:00.427 AZT: SSS MGR [uid:3450]:   Interface config 4B91D238
Mar  1 12:27:00.427 AZT: SSS MGR [uid:3450]:   Service Profile config 4215E964
Mar  1 12:27:00.427 AZT: SSS MGR [uid:3450]:   Per-user config A90001C7
Mar  1 12:27:00.427 AZT: SSS MGR [uid:3450]: FM Segment Alloc: segment 333730, owner 2986479485,  target cca type 0, target handle 0, cids(0,1)
Mar  1 12:27:00.427 AZT: SSS LTERM [uid:3450]:  Switching session provisioned
Mar  1 12:27:00.427 AZT: SSS MGR [uid:3450]: Added flow cid [2840,2841] to session [0x41FA4DF0]
Mar  1 12:27:00.427 AZT: SSS MGR [uid:3450]: FM Flow Segment Alloc: segment 333730, owner 2986479485,  target cca type 0, target handle 0, cids(2840,2841)
Mar  1 12:27:00.428 AZT: SSS MGR [uid:3450]: Handling Local Service Connected, Features Applied action
Mar  1 12:27:00.428 AZT: IPSUB: [uid:3450] Recieved Message = connect local
Mar  1 12:27:00.428 AZT: IPSUB: [uid:3450] Connect Local event for session
Mar  1 12:27:00.428 AZT: IPSUB: [uid:3450] Event connect local, state changed from requesting to waiting
Mar  1 12:27:00.428 AZT: IPSUB: [uid:3450] Inside processing IPSIP info
Mar  1 12:27:00.428 AZT: IPSUB-ROUTE: [uid:3450] Checking whether routes to be inserted/removed
Mar  1 12:27:00.428 AZT: IPSUB-ROUTE: [uid:3450] Context not present, creating context
Mar  1 12:27:00.428 AZT: IPSUB-ROUTE: [uid:3450] Entered the sg subrte context alloc
Mar  1 12:27:00.428 AZT: IPSUB-ROUTE: [uid:3450] Returning the sg subrte context 0x4C830078
Mar  1 12:27:00.428 AZT: IPSUB-ROUTE: [uid:3450] Trying to remove Subscriber routes
Mar  1 12:27:00.428 AZT: IPSUB-ROUTE: [uid:3450] Entered the plane feature context free
Mar  1 12:27:00.429 AZT: IPSUB-ROUTE: [uid:3450] Freeing the sg subrte context 0x4C830078
Mar  1 12:27:00.429 AZT: IPSUB-ROUTE: [uid:3450] Removed SG SUBRTE feature
Mar  1 12:27:00.429 AZT: IPSUB-ROUTE: [uid:3450] Reqd keys are not available, postponing route insert
Mar  1 12:27:00.429 AZT: IPSUB: [uid:3450] Keys not changed, seg needn't be updated
Mar  1 12:27:00.429 AZT: IPSUB: [uid:3450] Key list to be created to update SM
Mar  1 12:27:00.429 AZT: IPSUB: [uid:3450] Created key list to update SM
Mar  1 12:27:00.429 AZT: SSS MGR [uid:3450]: Handling Action Ignore for client-updated

Mar  1 12:27:04.354 AZT: IPSUB_DP: [uid:0] Insert new entry for mac 0000.6d7f.3046
Mar  1 12:27:04.354 AZT: IPSUB_DP: [uid:0] Processing new in-band session request
Mar  1 12:27:04.354 AZT: IPSUB_DP: [uid:0] Delete mac entry 0000.6d7f.3046
Mar  1 12:27:04.354 AZT: IPSUB_DP: [uid:0] In-band session request event for session
Mar  1 12:27:04.354 AZT: IPSUB_DP: [uid:0] Added upstream entry into the classifier
Mar  1 12:27:04.354 AZT: IPSUB_DP: [uid:0] VRF = DFL, IP = X.X.X.X, MASK = 255.255.255.255
Mar  1 12:27:04.354 AZT: IPSUB: Try to create a new session
Mar  1 12:27:04.354 AZT: IPSUB: IPSUB: Check IP DHCP session recovery: X.X.X.X Gi0/0/2.1001 mac 00d0.007a.0800
Mar  1 12:27:04.354 AZT: IPSUB: IPSUB: No DHCP binding found
Mar  1 12:27:04.354 AZT: IPSUB: IP inband session not configured on Gi0/0/2.1001
Mar  1 12:27:04.354 AZT: IPSUB: [uid:0] IPSUB: Create no IP session. Start timer to teard down DP session
Mar  1 12:27:04.354 AZT: IPSUB: [uid:0] session disconnect delay timer started
Mar  1 12:27:04.354 AZT: IPSUB_DP: [uid:0] Sent message to control plane for in-band session creation
Mar  1 12:27:04.354 AZT: IPSUB_DP: [uid:0] Event inband-session, state changed from idle to intiated

Mar  1 12:27:05.952 AZT: IPSUB_DP: [uid:0] Insert new entry for mac 0000.6d7f.3046
Mar  1 12:27:05.952 AZT: IPSUB_DP: [uid:0] Processing new in-band session request
Mar  1 12:27:05.952 AZT: IPSUB_DP: [uid:0] Delete mac entry 0000.6d7f.3046
Mar  1 12:27:05.952 AZT: IPSUB_DP: [uid:0] Session already present in state 1

Mar  1 12:27:09.369 AZT: IPSUB_DP: [uid:0] Insert new entry for mac 0000.6d7f.3046
Mar  1 12:27:09.369 AZT: IPSUB_DP: [uid:0] Processing new in-band session request
Mar  1 12:27:09.369 AZT: IPSUB_DP: [uid:0] Delete mac entry 0000.6d7f.3046
Mar  1 12:27:09.369 AZT: IPSUB_DP: [uid:0] Session already present in state 1

Mar  1 12:27:12.964 AZT: IPSUB_DP: [uid:0] Insert new entry for mac 0000.6d7f.3046
Mar  1 12:27:12.965 AZT: IPSUB_DP: [uid:0] Processing new in-band session request
Mar  1 12:27:12.965 AZT: IPSUB_DP: [uid:0] Delete mac entry 0000.6d7f.3046
Mar  1 12:27:12.965 AZT: IPSUB_DP: [uid:0] Session already present in state 1

Mar  1 12:27:14.868 AZT: IPSUB_DP: [uid:0] Insert new entry for mac 0000.6d7f.3046
Mar  1 12:27:14.868 AZT: IPSUB_DP: [uid:0] Processing new in-band session request
Mar  1 12:27:14.868 AZT: IPSUB_DP: [uid:0] Delete mac entry 0000.6d7f.3046
Mar  1 12:27:14.868 AZT: IPSUB_DP: [uid:0] Session already present in state 1

Попробовал сделать так:

ip dhcp pool ISG-POOL
relay source <IPOE-ADDRESSES>
relay destination <DHCP-SERVER>

interface GigabitEthernet0/0/2.1001
encapsulation dot1Q 1001
ip address 10.200.98.31 255.255.255.0
service-policy type control IPoE-ISG
ip subscriber routed
 initiator dhcp
end

Та же фигня - на dhcp запрос приходит, на радиус аутентификация приходит, "State: authen" у сессии, но траффик она не пропускает....

IOS: asr1000rp1-advipservicesk9.03.05.00.S.152-1.S.bin очень стабильный

Share this post

Link to post

Share on other sites

Tsvetkov

Posted March 1, 2013 (edited)

сколько готов заплатить за решение?

в мануалах его нет

Edited March 1, 2013 by Tsvetkov

Share this post

Link to post

Share on other sites

survivor

Posted March 1, 2013 (edited)

Tsvetkov, написал в личку

Edited March 1, 2013 by survivor

Share this post

Link to post

Share on other sites

bignik

Posted June 5, 2013 (edited)

Имеется та же самая проблема. Подскажите в чем дело? в какую сторону копать? Т.е. имею на ISG которая выступает DHCP сервером вот такие же сессии:

ET 6w2d other external event

OLDST[2]:check-auth-needed

NEWST[4]:authorizing

fxn[9]:sss_pm_fsm_extern_event_author_found FLAGS:1

ET 6w2d got apply config success

OLDST[8]:wait-for-events

NEWST[8]:wait-for-events

fxn[3]:sss_pm_action_sm_req_apply_config_success FLAGS:0

Причем, таких сессий не много, но они есть постоянно...

Sign In

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Share this post

Link to post

Share on other sites

Join the conversation