Print

某局点S12508G-AFIPV6流量软转导致访问外网卡顿问题

2020-11-09 发表

组网及说明

不涉及

问题描述

某局点ADCOMPUS5.0方案和传统网共有核心交换机,现场反馈传统网终端通过IPv6访问外网网址时,出现卡顿现象,通过PC直连设备来排查沿途故障设备,发现只有当PC接到核心交换机,才会出现卡顿现象,故怀疑交换机出现问题。

过程分析

首先在故障现象时,在核心交换机上下行口做双向流统,确定交换机是否丢包,结果显示,TCP报文上行没有问题,下行时有进无处,确定交换机有故障。并重点排查交换机上回程路由信息。

Interface: Ten-GigabitEthernet1/3/0/37------下行

  Direction: Inbound

  Policy: lt

   Classifier: lt

     Operator: AND

     Rule(s) :

      If-match acl ipv6 3333

     Behavior: lt

      Accounting enable:

        2323 (Packets)

        0 (pps)

Interface: Ten-GigabitEthernet1/3/0/37

  Direction: Outbound

  Policy: lt

   Classifier: lt

     Operator: AND

     Rule(s) :

      If-match acl ipv6 3333

     Behavior: lt

      Accounting enable:

        0 (Packets)

        0 (pps)

Interface: Ten-GigabitEthernet1/3/0/44-----上行

  Direction: Inbound

  Policy: lt  

   Classifier: lt

     Operator: AND

     Rule(s) :

      If-match acl ipv6 3333

     Behavior: lt

      Accounting enable:

        3308 (Packets)

        0 (pps)

Interface: Ten-GigabitEthernet1/3/0/44

  Direction: Outbound

  Policy: lt  

   Classifier: lt

     Operator: AND

     Rule(s) :

      If-match acl ipv6 3333

     Behavior: lt

      Accounting enable:

        2323 (Packets)

        0 (pps)

然后在交换机上查看设备到终端的回程路由发现,在外网出口vpn,即vpna 的路由表中只有对应终端的64位网段路由而无128位主机路由,该网段路由通过路由复制功能从中间vpnb复制过来,而vpnbvpn-default则通过RT值互引实现路由学习,查看vpn-default路由表中也只有64位网段路由,在交换机上查看ND表项发现是有对应表项的。

display ipv6 routing-table vpn-instance vpna 2001:250:5839:600::8-----终端地址

Summary count : 1

Destination: 2001:250:5839:600::/64    Protocol  : BGP4+

NextHop    : ::             Preference: 130

Interface  : Vlan1            Cost: 0

[S12508G-AF]display ipv6 routing-table vpn-instance vpnb 2001:250:5839:600::8

Summary count : 2

Destination: ::/0                        Protocol  : Static

NextHop    : 2001:250:5839:FF01:10:10:4:13     Preference: 60

Interface  : Vlan4050                 Cost : 0

Destination: 2001:250:5839:600::/64          Protocol  : BGP4+

NextHop    : ::                   Preference: 130

Interface  : Vlan1                  Cost : 0

[S12508G-AF]display ipv6 routing-table vpn-instance vpn-default

2001:250:5839:600::8

Summary count : 2

Destination: ::/0                    Protocol  : BGP4+

NextHop    : 2001:250:5839:FF01:10:10:4:13       Preference: 130

Interface  : Vlan4050                  Cost: 0

Destination: 2001:250:5839:600::/64           Protocol  : Direct

NextHop    : ::                    Preference: 0

Interface  : Vlan1                    Cost: 0

[S12508G-AF]disp"la"y ipv6 neighbors 2001:250:5839:600::8

Type: S-Static    D-Dynamic    O-Openflow     R-Rule    IS-Invalid static

IPv6 address         MAC address    VLAN/VSI   Interface   State T  Aging

2001:250:5839:600::8      0023-24a3-41da    1    XGE1/3/0/37   REACH D  655 

通过查询平台路由表项,并结合查询路由的硬件表项,发现按照网段路由表项转发报文会上送平台进行软转,则当访问外网地址时,报文量较大就会导致卡顿。在IPV4网络中,配置vpnavpnbroute-replicate 复制路由,当交换机收到去往终端的报文后,通过复制的路由上送平台,触发ARP学习,最后在vpna中有到终端的32位主机路由。在IPV6网络,配置route-replicate复制路由后,交换机收到IPV6报文后,通过复制的路由上送平台后,不会触发ND学习,从而在vpna中没有到终端的128位主机路由。

[S12508G-AF-probe]debug ipv6-drv show route 3 2001:250:5839:600::8 ch 1 sl 3

**********************************************************

- IPv6 Route Information        Chassis 1 Slot 3

**********************************************************

--- UNIT: 0 ---

- IPv6 ADDR:            2001:0250:5839:0600:0000:0000:0000:0008

- VRF:                  3

- MASKLEN:              64

- EGRESS ID:            149153 ------上送平台

- FLAGS:                0x2000c

- PRI:                  0

- CLASS ID:             2

- HWINDEX:              259

- TUNNEL OPT:           0

- HITBIT:               Source Dest


解决方法

在终端所在vlan对应的vlan虚接口下配置ipv6 nd route-direct advertise命令用来开启ND直连路由通告功能, 设备通过该接口学习到的ND表项生成128位的主机路由,vpn-default通过引入直连路由引入该主机路由,继而再通过路由互引和route-replicate复制到vpna中,在vpna中就有到终端的128位路由,此时交换机才能硬转,故障恢复。

[S12508G-AF]display ipv6 routing-table vpn-instance vpna 2001:250:5839:600::8

Summary count : 2

Destination: 2001:250:5839:600::/64   Protocol  : BGP4+

NextHop    : ::           Preference: 130

Interface  : Vlan1          Cost      : 0

Destination: 2001:250:5839:600::8/128    Protocol  : BGP4+

NextHop    : 2001:250:5839:600::8    Preference: 130

Interface  : Vlan1            Cost      : 0

[S12508G-AF] display ipv6 routing-table vpn-instance vpnb 2001:250:5839:600::8 128

Summary count : 1

Destination: 2001:250:5839:600::8/128      Protocol  : BGP4+

NextHop    : 2001:250:5839:600::8       Preference: 130

Interface  : Vlan1               Cost      : 0

[S12508G-AF] display ipv6 routing-table vpn-instance vpn-default 2001:250:5839:600::8 128

Summary count : 1

Destination: 2001:250:5839:600::8/128      Protocol  : Direct

NextHop    : 2001:250:5839:600::8      Preference: 0

Interface  : Vlan1               Cost      : 0