Cisco NCS 4200 Series User manual

Layer 2 Configuration Guide for Cisco NCS 4200 Series
First Published: 2016-07-29
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

©Cisco Systems, Inc. All rights reserved.

CONTENTS
CHAPTER 1 Configuring Ethernet Dataplane Loopback 1
Prerequisites for Ethernet Data Plane Loopback 1
Restrictions for Ethernet Data Plane Loopback 1
2
Information on Ethernet Data Plane Loopback 2
QoS Support for Ethernet Data Plane Loopback 3
How to Configure Ethernet Data Plane Loopback 3
Enabling Ethernet Data Plane Loopback 3
Starting an Ethernet Data Plane Loopback Session 3
Stopping an Active Session 4
Configuration Examples 4
Example: Configuring External Loopback 4
Example: Configuring Terminal Loopback 4
Verifying Ethernet Data Plane Loopback 5
Example: Verifying Ethernet Dataplane Loopback 5
Use Cases or Deployment Scenarios 6
CHAPTER 2 Configuring Switched Port Analyzer 7
Prerequisites for Configuring Local Span and RSPAN 7
Restrictions for Local Span and RSPAN 8
Understanding Local SPAN and RSPAN 9
Information About Local SPAN Session and RSPAN Session 9
Local SPAN Session 9
Local SPAN Traffic 10
RSPAN Session 10
RSPAN Traffic 10
Destination Interface 11
Source Interface 11
Layer 2 Configuration Guide for Cisco NCS 4200 Series
iii

Traffic Directions 12
Configuring Local SPAN and RSPAN 15
Configuring Sources and Destinations for Local SPAN 15
Removing Sources or Destinations from a Local SPAN Session 16
Configuring RSPAN Source Session 17
Configuring RSPAN Destination Session 19
Removing Sources or Destinations from a RSPAN Session 20
Sample Configurations 21
Configuration Example: Local SPAN 21
Configuration Example: Removing Sources or Destinations from a Local SPAN
Session 22
Configuration Example: RSPAN Source 22
Configuration Example: RSPAN Destination 22
Verifying Local SPAN and RSPAN 22
CHAPTER 3 Layer 2 Access Control Lists on EVCs 25
Prerequisites for Layer 2 Access Control Lists on EVCs 25
Prerequisites for Layer 2 Access Control Lists on EVCs 25
Restrictions for Layer 2 Access Control Lists on EVCs 25
EVCs 26
Relationship Between ACLs and Ethernet Infrastructure 26
Information About Layer 2 Access Control Lists on EVCs 27
Creating a Layer 2 ACL 27
Applying a Layer 2 ACL to a Service Instance 28
Configuring a Layer 2 ACL with ACEs on a Service Instance 29
Verifying the Presence of a Layer 2 ACL on a Service Instance 31
Configuration Examples for Layer 2 Access Control Lists on EVCs 32
Example Applying a Layer 2 ACL to a Service Instance 32
Example Applying a Layer 2 ACL to Three Service Instances on the Same Interface 32
Verifying the Presence of a Layer 2 ACL on a Service Instance 33
Example Displaying the Details of a Layer 2 ACL on a Service Instance 34
Example Displaying the Details of Configured Layer 2 ACL 34
CHAPTER 4 Configuring MAC Address Security on Service Instances and EVC Port Channels 37
Prerequisites for MAC Address Security on Service Instances and EVC Port Channels 37
Layer 2 Configuration Guide for Cisco NCS 4200 Series
iv
Contents

Information About MAC Address Security on Service Instances and EVC Port Channels 38
Ethernet Virtual Circuits, Service Instances, and Bridge Domains 38
EVCs on Port Channels 38
MAC Security and MAC Addressing 38
MAC Address Permit List 38
MAC Address Deny List 39
Violation Response Configuration 40
MAC Address Aging Configuration 41
Sticky MAC Address Configurations 41
Aging for Sticky Addresses 42
Transitions 42
MAC Security Enabled on a Service Instance 42
MAC Security Disabled on a Service Instance 42
Service Instance Moved to a New Bridge Domain 42
Service Instance Removed from a Bridge Domain 42
Service Instance Shut Down Due to Violation 43
Interface Service Instance Down Linecard OIR Removed 43
Interface Service Instance Re-activated Linecard OIR Inserted 43
MAC Address Limit Decreased 43
Sticky Addresses Added or Removed on a Service Instance 43
How to Configure MAC Address Limiting on Service Instances Bridge Domains and EVC Port
Channels 43
Enabling MAC Security on a Service Instance 43
Enabling MAC Security on an EVC Port Channel 45
Configuring a MAC Address Permit List 47
Configuring a MAC Address Deny List 49
Configuring MAC Address Security on a Service Instance 51
Configuring a MAC Address Violation 53
Configuring MAC Address Aging 55
Configuring a Sticky MAC Address 56
Displaying the MAC Security Status of a Specific Service Instance 58
Displaying the Service Instances with MAC Security Enabled 59
Displaying the Service Instances with MAC Security Enabled on a Specific Bridge Domain 60
Showing the MAC Addresses of All Secured Service Instances 60
Showing the MAC Addresses of a Specific Service Instance 61
Layer 2 Configuration Guide for Cisco NCS 4200 Series
v
Contents

Showing the MAC Addresses of All Service Instances on a Specific Bridge Domain 62
Showing the MAC Security Statistics of a Specific Service Instance 63
Showing the MAC Security Statistics of All Service Instances on a Specific Bridge
Domain 63
Showing the Last Violation Recorded on Each Service Instance on a Specific Bridge
Domain 64
Clearing All Dynamically Learned Secure MAC Addresses on a Service Instance 65
Clearing All Dynamically Learned MAC Addresses on a Bridge Domain 66
Configuration Examples for MAC Address Limiting on Service Instances and Bridge Domains
and EVC Port Channels 67
Example Enabling MAC Security on a Service Instance 67
Example Enabling MAC Security on an EVC Port Channel 67
Example Configuring a MAC Address Permit List 67
Example Configuring a MAC Address Deny List 68
Example Configuring a MAC Address Security on a Service Instance 68
Example Configuring a MAC Address Violation Response 68
Example Configuring MAC Address Aging 68
Example Configuring a Sticky MAC Address 69
Example Displaying the MAC Addresses on a Specific Secure Service Instance 69
Example Displaying the Last Violation on a Specific Service Instance 69
Example Displaying the MAC Security Status of a Specific Service Instance 69
Example Displaying the MAC Addresses of All Secured Service Instances 69
Example Displaying the MAC Security Statistics of All Service Instances 70
Example: Displaying the MAC Addresses on All Service Instances for a Bridge
Domain 70
Example Displaying the Secured Service Instances for a Specific Bridge Domain 70
CHAPTER 5 Static MAC Address Support on Service Instances 71
Prerequsites for Static MAC Address Support on Service Instances 71
Restrictions for Static MAC Address Support on Service Instances 71
Information about Static MAC Address Support on Service Instances 72
Benefits of Static MAC Address Support on Service Instances 72
Configuring a Static MAC Address on a Service Instance 72
Example for Configuring a Static MAC Address on a Service Instance 73
Verifying Configured Static MAC Addresses on a Service Instance 74
Layer 2 Configuration Guide for Cisco NCS 4200 Series
vi
Contents

Example: Verifying Configured Static MAC Addresses on a Service Instance 74
CHAPTER 6 MAC Limiting 75
Restrictions and Usage Guidelines 75
Configuring MAC Limiting 75
Example of Enabling Per-Bridge-Domain MAC Limiting 76
Layer 2 Configuration Guide for Cisco NCS 4200 Series
vii
Contents

Layer 2 Configuration Guide for Cisco NCS 4200 Series
viii
Contents

CHAPTER 1
Configuring Ethernet Dataplane Loopback
Ethernet data plane loopback provides a means for remotely testing the throughput of an Ethernet port.
•Prerequisites for Ethernet Data Plane Loopback, page 1
•Restrictions for Ethernet Data Plane Loopback, page 1
•Information on Ethernet Data Plane Loopback, page 2
•How to Configure Ethernet Data Plane Loopback, page 3
•Configuration Examples, page 4
•Verifying Ethernet Data Plane Loopback, page 5
•Use Cases or Deployment Scenarios, page 6
Prerequisites for Ethernet Data Plane Loopback
•Ethernet loopback sessions are supported only of EFPs (service instances, Ethernet flow points, EVCs).
•Internal loopback sessions configured must be within the 1 GB reserved bandwidth.
•Internal loopback can be launched even when the physical interface port state is down.
Restrictions for Ethernet Data Plane Loopback
•Data plane loopback on routed port infrastructure is not supported.
•Etype, src-mac, and llc-oui based loopback traffic filtering is not supported.
•Port-level QoS is not bypassed.
•Port shaper cannot be bypassed in facility loopback.
•Facility and terminal Ethernet data plane loopback (ELB) are not supported on dot1ad nni interface.
•Internal loopback sessions configured must be within the 1 GB reserved bandwidth for Cisco ASR 900
Series RSP2 Module.
Layer 2 Configuration Guide for Cisco NCS 4200 Series
1

•A maximum number of 20 facility loopback sessions can be created per system, provided 16 sessions
are with Dot1Q and 4 sessions are with Dot1Q and destination MAC address. This scale reduces if SPAN
or RSPAN is configured. This scale is supported on the Cisco ASR 900 Series RSP2 module.
•A maximum number of 12 terminal loopback sessions can be created per system, provided 8 sessions
are with Dot1Q and 4 sessions are with Dot1Q and destination MAC address. This scale reduces if
RSPAN or SADT is configured. This scale is supported on the Cisco ASR 900 Series RSP2 module.
•Only one Ethernet loopback (terminal or facility) session can be active on an EFP at any instance.
•Local SPAN and ELB cannot be enabled on a physical interface at the same time.
•Loopback sessions cannot be initiated on a port configured with SPAN or RSPAN.
•Ethernet loopback is not supported on a range of dot1q tags.
•Ethernet Data Plane Loopback is affected on STP enabled interface.
•Dynamic addition of rewrite ingress tags with default EFP is not supported.
•Dynamic changes at EFP and interface level are not supported when Ethernet Data Plane Loopback is
active.
•Egress EFP is not updated for external Ethernet data plane loopback statistics.
•For internal Ethernet data plane loopback ingress and egress interface statistics are not updated on
interface, where internal ELB is enabled.
RSP3 Module
•Etype, VLAN, COS, src-mac, and llc-oui based loopback traffic filtering is not supported.
•Port-based ELB is not supported.
•Internal ELB is not supported when the physical interface port state is down.
•Data filtering of loopback is not enforced for the traffic coming in the opposite direction.
•Filtering based on specific VLAN is not supported.
•Dot1Q filter is not supported.
•Internal loopback sessions configured must be within the 100 GB reserved recycle bandwidth.
•MAC-ACL cannot be bypassed in with facility loopback.
•A maximum number of 20 facility loopback and 12 terminal loopback sessions are supported.
Information on Ethernet Data Plane Loopback
The Ethernet data plane loopback feature provides a means for remotely testing the throughput of an Ethernet
port. You can verify the maximum rate of frame transmission with no frame loss. This feature allows for
bidirectional or unidirectional throughput measurement, and on-demand/out-of-service (intrusive) operation
during service turn-up. This feature supports two types of Ethernet loopback.
Layer 2 Configuration Guide for Cisco NCS 4200 Series
2
Configuring Ethernet Dataplane Loopback