2D1490 p Bridging, spanning tree and related issues. Olof Hagsand KTHNOC/NADA

Transcription

1 D490 p4 007 Bridging, spanning tree and related issues Olof Hagsand KTHNOC/NADA

2 Literature Radia Pearlman Interconnections Section 3 (Handouts)

3 Building a network: routing or bridging? Scaling differences: traffic, state in nodes Cost Ease of configuration Addressing

4 IDs, addresses and routes ID/Name What something is does not change when moved Address Where it is changed when moved Route How to get there changed when accessed from different points IPv4: HostID is an ID Netid is an address can be combined (aggregated) into more general prefixes. Ethernet (80) MAC address is an ID no structure

5 IEEE 80 vs IPv4 addresses vendor code IEEE vendor assigned Group/ Individual bit Global/ Localbit netid IPv4 addr hostid

6 Routing vs bridging Bridging - forwarding on layer A MAC address has a flat structure many nodes -> large forwarding tables broadcast reaches all nodes Simple to configure and manage, cheaper Loops detected by spanning tree protocol Routing forwarding on layer 3 The netid of the IP addresses can be aggregated many nodes -> smaller forwarding tables than bridging routers partition broadcast domains Routing is more difficult to configure Loops detected by routing protocols and TTL decrementation

7 Ethernet Frame (RFC894) Format DST SRC TYPE DATA CRC DST: Destination Address, 48-bit MAC address SRC: Source Address, 48-bit MAC address Type: Type of data carried, e.g., IP packet Data: min size is 46 bytes, max size is 500 bytes CRC: Cyclic Redundancy Check (or FCS Frame Check Sum) 48-bit MAC address is normally written :34:56:78:9a:bc

8 IEEE 80./80.3 Encapsulation (RFC 04) 80.3 MAC dst addr 6 src addr LLC length DSAP AA SSAP AA 80. SNAP cntl 03 org code 00 3 type DATA CRC 4

9 Ethernet: Bus and Hubs (L) Yellow cable Cables and Hubs form one collision domain (Layer ) All packets broadcast on network using CDMA/CD hub

10 Bridging (L) Bridges operate in the link layer (according to TCP/IP) physical and link layer (according to OSI) Bridges do not modify the structure or content of a frame Bridges contain logic allowing them to keep the traffic for each segment separate A packet entering a bridge is copied only to the segment to which the receiving address belongs A multiport bridge can act as a switch to connect two or more segments, e.g., as in a switched Ethernet

11 Switches / Bridges hub switch Switches partitions the LAN into segments, each segment is one collision domain Switches (actually learning bridges) learn on which port hosts are connected Tries to forward packets to where the host actually is The whole LAN is still a broadcast domain Some packets are sent to all other stations (not learned, broadcast, multicast)

12 Routers (L3) /4 switch /4 router switch Each LAN is still a broadcast domain with respect to IP (Layer ) It forms one IP subnetwork. To transmit traffic between LANs, packets pass through a router (Layer 3) Some see a router simply as a box that limits broadcasts!

13 Bridging cont d Port Segment Port Segment B A Q Address Port A Q M M Forwarding table A bridge keeps state in a forwarding table In principle, MAC addresses can be configured per ports But it learns where the stations are located

14 The Learning Bridge Strategy of a learning bridge:. Listen promiscously, receiving every packet. Store the source address of every packet in a learning table (station cache) reset aging 3. For each packet, check destination address with learning table If not found, flood: forward on all (except receiving) ports If addr found, forward only on port specified in learning table. If specified port == receiving port, drop packet 4. Bridge ages each entry in the learning table. Deletes entry if no traffic is received from that source after a certain period of time

15 Learning Bridges Example Learning tables: AQ KDMT DQMA Port Port Port Seg A Seg B Q Address Port A Q M D K T D M KT Port Seg 3 B Address Port A Q M D K T B cannot distinguish between Segment and Segment 3 B cannot distinguish between Segment and Segment In fact, Bridge concept works for any number of ports Bridge concept works for any tree (loop-free) topology K T

16 Multicast and broadcast in a bridge Multicast (*:**:**:**:**:**) and Broadcast (ff:ff:ff:ff:ff:ff) are flooded on all ports But bridges can be extended with multicast (eg IGMP snooping) to keep track of where members are. But SA is still learnt This means that multicast/broadcast frames typically populates the learning tables (they reach the whole broadcast domain) In an IPv4 sub-network, hosts send ARP requests on broadcast as soon as they communicate with another host, This populates all bridges with their src adress And may cause broadcast storms in a large switched network A second common cause is DHCP requests: > to ask for an address.

17 Bridging Limitations Can a bridged network be of an arbitrary size? No, it is not scaling because of: Addressing No structure in the MAC addresses no aggregation can be used Table sizes (size of the forwarding table) Traffic congestion Broadcast and multicast spans the whole broadcast domain Broadcast domains must be kept at a reasonable size

18 Switch HW architecture CPU Backplane/Switchplane Port logic Port logic Port logic 3 CPU for signaling protocols, management, etc Forwarding done in hardware (learning, forwarding, filtering)

19 Forwarding table: CAM Forwarding tables are usually implemented by CAM: Content Addressable Memory Access memory via content instead of adress Requires extra hardware logic compared to RAM CAMs are relatively expensive and powerconsuming But makes a lookup in one cycle (parallell lookup) Lookup: 00:0e:35:64:e9:e7 Address 00:0a:e4:a:30:bc 00:0e:35:64:e9:e7 00:00:4:c0:59:3a Port 3 You cannot build very large CAMs When the forwarding table is full Send everything on broadcast! Result:

20 IPv4 forwarding table: TCAM Lookup: IPv4 Forwarding tables cannot be implemented by CAMs. need exact match: tables would be too large But TCAM (Ternary CAM) can be used A TCAM have '*' dont care values used by netmask Address Mask Port Result:

21 Link aggregate group (LAG) Ethernet trunking / Link Groups IEEE 80.ad Suppose your Gbps link is overloaded But you cannot afford a 0Gbps link (0G cards are very expensive) Then you can group many links into a LAG (or Link Group) They are physically (L) different ports But logically (L), the same link. Packets forwarding use caching to send packets on different links So that packets from same flow is not re-ordered But this means that some links can be overloaded,and others not!

22 Example: Opto SUNET backbone University A Stockholm 0GE DWDM University B 0GE DWDM LAG: 4*0GE 0GE DWDM LAG: 4*0GE 5* Juniper T640 LAG: *0GE

23 Learning Bridge Loop Problem A Segment A -> B Segment B Learning bridges are unaware of hosts until they receive a packet from them. The bridges are not aware of the existence of other bridges. Example: If the bridges are unaware of B, and A sends a frame to B, the frame may start looping. Solution: Spanning Tree Protocol.

24 Spanning Tree Purpose: Bridges dynamically discovers a loop-free topology subset (a tree) The tree has just enough connectivity so that there is a path between every pair of segments where physically possible (the tree is spanning) Basic Idea: All bridges exchange configuration messages, called bridge protocol data units (BPDUs), allowing them to calculate a spanning tree

25 Spanning Tree Algorithm An ID number is assigned to each bridge, and a cost to each port. Process of finding the spanning tree:. The bridges choose a bridge to be the root bridge of the tree by finding the bridge with the smallest ID.. Each bridge determines its root port, the port that has the least root path cost to the root. The root path cost is the accumulated cost of the path from the port to the root. 3. One designated bridge is chosen for each segment 4. Select ports to be included in the spanning tree (root port plus designated ports) Data traffic is forwarded only to and from ports selected for inclusion in the spanning tree

26 STP operation A bridge initially assumes itself to be the root (cost == 0) A bridge continously receives configuration messages on each of its ports and saves the best configuration message from each port If a bridge receives a better configuration message on a segment than the configuration message it would send, it stops sending configuration messages When the algorithm stabilizes, only one bridge on each segment (Designated Bridge) sends configuration messages on that segment

27 Spanning tree poem I think that I shall never see A graph more lovely than a tree. A tree whose crucial property Is loop-free connectivity. A tree which must be sure to span So packets can reach every LAN. First the Root must be selected By ID it is elected. Least cost paths from Root are traced In the tree these paths are placed. A mesh is made by folks like me Then bridges find a spanning tree. Radia Pearlman

28 Priority vector The bridges construct a priority vector from: <Root ID, Root Path Cost, Bridge ID> These are used to construct the spanning tree Lower value --> Higher priority Example: <,5,7> is better than <3,0,0> <4,7,> is better than <4,7,3> Actually, both sending and receiving ports are also a part: <Root ID, Root Path Cost, Bridge ID, snd port, rcv port>

29 Simple bridged network BID= 3 Edge (Host) Networks Broadcast link c=5 A 0 B 4 BID Bridge Id: <prio>.<macaddress> Example: :4:6c:e0:65:39 Note: bridge has assigned cost 5 on its left link

30 Initial State I am root 3 <,0,> I am root <,0,> <,0,> <3,0,3> <,0,> <0,0,0> I am root I am root <,0,> c=5 0 <0,0,0> <4,0,4> 4 I am root <RootID, Root Path Cost, Bridge ID>

31 Final state Root port 3 <0,,> Designated Designated <0,,3> Root port <0,0,0> I am root Designated Blocked Root port c=5 0 <0,0,0> Root port 4 <RootID, Root Path Cost, Bridge ID>

32 Example: traffic path from A to Bl BID=0 3 Edge (Host) Networks B A I am root 4

33 Why are ports a part of the priority vector? <Root ID, Root Path Cost, Bridge ID, snd port, rcv port> hub Many links connecting two switches Many ports to same LAN

34 BPDU format Proto ID Ver BPDU Type Flags 8 4 Root ID Root Path Cost TC Ack Topology Change Prio 8 Bridge Port ID ID MAC Address Msg Age Max Age Prio Hello Forward Time Delay Port Bridge/Root priority was originally bytes, but now (from 004) only 4 bits. Port priority was originally byte, but is now (from 004) 4 bits. # tcpdump -ni iwi0 5:0: d config root=8000.0:4:6c:e0:65:39 rootcost=0x0 bridge=8000.0:4:6c:e0:65:39 port=0x800 age=0/0 max=0/0 hello=/0 fwdelay=0/0

35 BPDU Fields Proto ID: 0 Version: 0 BPDU type: 0 (Configuration message) 8 (Topology Change Notification) Flags: TC: Topology Change flag TCA: Topology change notification acknowledge RootID: Macaddr+prio of bridge that is root Root Path Cost: Total cost to root Bridge ID: Macaddr+prio of bridge that sent message Port ID: Prio + port nr of port where message was sent Message age: time since root sent message (in /56th second) Max age: When message should be deleted Hello time: Time between generation of config msgs by root bridge Forward delay: () Time to stay in intermediate states before port is forwarding; () entry timeout when topology change.

36 Failure A topology change occurs failed link failed switch new link cost Message aging times out (Maxage ~0s). Possible actions: Bridge selects a new root (or itself) Becomes designated bridge of a segment Blocks a port Ports changing state enter Listening state. Takes * Forwarding delay until port starts forwarding (~30s) Notifies root of change: Topology Change Notification Continue until Configuration Message with TCA is received Root sends Configuration Message with TC set This will cause all aging entries to use short cache timeout (forwarding delay) instead of long (eg 5min -> 5s)

37 Port States Listening Selected as designated or root port BPDU processing, no learning, no forwarding Forward Delay timeout Learning BPDU processing, learning, no forwarding Forward Delay timeout Blocked by algorithm Blocked by algorithm Blocking Blocking Received BPDUs processed, No BPDU processing, no no learning, learning, no forwarding no forwarding Blocked by algorithm Forwarding BPDU processing, learning, forwarding Disabled Not operational Either Root port or designated

38 A change occurs link breaks 3 <0,,> <0,0,0> <0,,3> <0,0,0> I am root c=3 0 <0,0,0> 4 <RootID, Root Path Cost, Bridge ID>

39 A change occurs link breaks 3 <0,,> <0,,3> <0,0,0> I am root c=3 0 <0,0,0> 4 <RootID, Root Path Cost, Bridge ID>

40 Bridge (or 3) times out Receives no config messages Timeout is MaxAge (~0s) Bridge elects sets new root port and sends Topology notification upstreams and sets port in listening state 3 <0,,> Root port& listening <0,5,> TCN I am root c=5 0 <0,0,0> 4

41 Root notifies that topology has changed Root sends TC (Topology Changed) flag Causes all bridges to use shorter cache timeout Forward Delay: ~5s 3 <0,,,TC> Root port& listening <0,0,0,TC> <0,5,,TC> TCN I am root c=5 0 <0,0,0,TC> 4

42 Bridge ports in forwarding state Bridge 's port is in forwarding state (after ~5s + 5s) Total time for re-configuration: ~50s 3 <0,,> Root port& forward <0,0,0> <0,5,> TCN I am root c=5 0 <0,0,0> 4

43 Example: traffic path from A to B BID=0 3 Edge (Host) Networks B A I am root 4

44 Why TCN? If no TCN -> bridges could keep their old cache timeout (~5min) and old forwarding paths could remain. TCN ensures that old state is flushed. But if network is large, TCNs will occur all the time and cause frequent re-learning (and flooding) BID=0 3 Edge (Host) Networks B A I am root 4

45 STP Parameters Parameter Default Range Description Hello time s -0s Time between (root) config msgs Max Age 0s 6-40s Max age of BPDU messages 4.30s () State transition timeout () entry timeout when topology changes (Short cache timer) Bridge prio 07 Priority for selecting root Port prio Long cache timer 07 Port priority 5min Path cost 00K (00Mbps) Forward Delay 5s Timeout of table entry -00M Cost added to root path

46 Rapid Spanning Tree Protocol RSTP Ordinary STP takes seconds to converge, with default settings RSTP converges around a second First defined in IEEE 80.w Replaces STP after 004 in 80.D Full-duplex mode - No shared links Backwards compatible with STP

47 RSTP vs STP RSTP has two more port designations Alternate port backup for root port Backup port backup for Designated Port on the segment In RSTP all bridges send BPDUs automatically In STP, root triggers BPDUs (hello timer) In RSTP, bridges act to bring network to convergence In STP, bridges passively wait for time-outs before changing port state

48 STP vs RSTP - convergence STP (up to 50s) When a topology change is detected, the bridge sends a notification towards the root. Can take MaxAge = 30s Replaces old tree with new after *forwarding delay timers (*5s) This takes 0s of seconds. Up to 50s. RSTP (around second) Flushes learning table immediately when topology change is detected Does not wait for max age time Generates BPDU itself This may take less than a second. Backwards compatible with STP

49 Virtual LANs (VLANs) Need a way to divide the LAN into different parts Without physical reconfiguration Moving stations without reconfigurations Create virtual workgroups Keep broadcasts isolated Keep different protocols from each other Requires a router to communicate between VLANs

50 VLANs VLAN VLAN

51 VLAN grouping How is VLAN membership determined? Port numbers (portvid) Ports,, 5: VLAN Ports 3, 4, 6: VLAN MAC adress Frame tagging VLAN trunking Multiplex many VLANs over the same link Frames belonging to different VLANs can be sent on the same trunk by VLAN encapsulation using tagging. Trunks can interconnect any number of bridges in any topology

52 VLAN Tags and Trunks pvid :,,5 pvid : 3,4,6 tagged: 7 VLAN members:,,5,7 VLAN members: 3,4,6, VLAN trunk pvid :,4 pvid : 3,5 tagged: VLAN members:,,4 VLAN members:,3, VLAN VLAN VLAN VLAN 5

53 VLAN Encapsulation A VLAN tag or VID ( bits) has been added to the Ethernet frame in order to distinguish between the VLANs 4096 VLANs IEEE 80.Q Special payload type: 0x800 User priority field (3 bits) SRC 800 Tag Header TYPE 6 6 userpriority CFI DST VLAN ID 3bits bit bits DATA

54 Routing between VLANs Router sees every VLAN as a separate interface Every VLAN is one IP subnet Many switches have this routing capability VLAN trunk 7 eth0 VLAN eth0: tagged ethernet vlan0: on eth /4 vlan: on eth / /4 VLAN /4

55 Multiple Spanning Tree Protocol (MSTP) Separate trees for separate VLANs Part of IEEE 80.Q Network organized into regions Regions have their own spanning tree topologies VLANs are associated with each topology One common spanning tree for the entire network MSTP based on RSTP

56 MSTP several STP instances VLAN VLAN root bridge VLAN BID: 0 BID: BID: BID: 3 VLAN root bridge VLAN VLAN May need to build different STPs VLAN

57 VLAN stacking: Q in Q Only 4096 VLANs. You may need more. Or you may want to have several VLAN namespaces multiplexed on one link. E.g. Many customers on same trunk VLAN stacking puts a VLAN trunk header inside another one: 6 6 VID 88a8 inner Type 800 prio DST SRC Type: prio outer VID LEN/TYPE DATA

58 VLAN stacking - Example VLAN VLAN VLAN VLAN trunk Customer A VLAN Customer B VLAN trunk (outer) VLAN trunk Customer A VLAN trunk Customer A VLAN trunk VLAN Customer B Customer B VLAN 4 VLAN VLAN VLAN VLAN

59 Tunneling L over IP/Internet LAN interconnection may be done by tunneling layer frames (eg Ethernet) over an (IP) network. Most are point-to-point and for dial-up services Layer- Forwarding (LF) Point-to-point Tunneling Protocol (PPTP) In Windows 95/NT Layer Two Tunneling Protocol(LTP) RFC 66 PPP based

60 LVPN and Virtual Private LAN Services (VPLS) Multipoint solutions VPN services for L (eg switched networks) Backbone over IP Interconnects a switched L network In VPLS an IP network works as a distributed switch MPLS is used together with BGP to create pseudo-wires between the LAN islands. MPLS Multi-protocol label switching LVPN: Pseudo-wires created statically VPLS: Dynamic establishment of pseudo-wires Bridging (learning) enabled IPSEC is also possible

61 VPLS example Customer B LAN Customer B Acts as a distributed switch LAN MPLS paths Customer A IP network Customer A LAN LAN Customer A Customer B LAN LAN