Chapter 4, IP Networking

This chapter explains how to set up Cisco ONS 15327s in internet protocol (IP) networks and includes:

The chapter does not provide a comprehensive explanation of IP networking concepts and procedures.

Note To set up ONS 15327s within an IP network, you must work with a LAN administrator or other individual at your site who has IP networking training and experience. To learn more about IP networking, many outside resources are available. IP Routing Fundamentals, by Mark Sportack (Cisco Press, 1999), provides a comprehensive introduction to routing concepts and protocols in IP networks.

4.1 IP Networking Overview

•

IP Subnetting can create ONS 15327 node groups, which allow you to provision non-DCC connected nodes in a network.

•

Different IP functions and protocols can be used to achieve specific network goals. For example, Proxy Address Resolution Protocol (ARP) enables one LAN-connected ONS 15327 to serve as a gateway for ONS 15327s that are not connected to the LAN.

•

You can create static routes to enable connections among multiple CTC sessions with ONS 15327s that reside on the same subnet but have different destination IP addresses.

•

If ONS 15327s are connected to OSPF networks, ONS 15327 network information is automatically communicated across multiple LANs and WANs.

•

The ONS 15327 proxy server can be used to control the visibility and accessibility between CTC computers and ONS 15327 element nodes.

4.2 ONS 15327 IP Addressing Scenarios

ONS 15327 IP addressing generally has seven common scenarios or configurations. Use the scenarios as building blocks for more complex network configurations. Table 4-1 provides a general list of items to check when setting up ONS 15327s in IP networks. Additional procedures for troubleshooting Ethernet connections and IP networks are provided in Chapter 9, "Ethernet Operation."

Table 4-1 General ONS 15327 IP Networking Checklist
Item	What to check
Link integrity	Verify link integrity exists between: •CTC computer and network hub/switch •ONS 15327s (RJ-45 port) and network hub/switch •Router ports and hub/switch ports
ONS 15327 hub/switch ports	If connectivity problems occur, set the hub or switch port that is connected to the ONS 15327 to 10 Mbps half-duplex.
Ping	Ping the node to test connections between computers and ONS 15327s.
IP addresses/subnet masks	Verify ONS 15327 IP addresses and subnet masks are set up correctly.
Optical connectivity	Verify ONS 15327 optical trunk ports are in service; DCC is enabled on each trunk port.

4.2.1 Scenario 1: CTC and ONS 15327s on Same Subnet

Scenario 1 shows a basic ONS 15327 LAN configuration ( Figure 4-1). The ONS 15327s and CTC computer reside on the same subnet. All ONS 15327s connect to LAN A, and all ONS 15327s have DCC connections.

4.2.2 Scenario 2: CTC and ONS 15327s Connected to Router

In Scenario 2 the CTC computer resides on a subnet (192.168.1.0) and attaches to LAN A ( Figure 4-2). The ONS 15327s reside on a different subnet (192.168.2.0) and attach to LAN B. A router connects LAN A to LAN B. The IP address of router interface A is set to LAN A (192.168.1.1), and the IP address of router interface B is set to LAN B (192.168.2.1).

On the CTC computer, the default gateway is set to router interface A. If the LAN uses DHCP (Dynamic Host Configuration Protocol), the default gateway and IP address are assigned automatically. In the Figure 4-2 example, a DHCP server is not available.

4.2.3 Scenario 3: Using Proxy ARP to Enable an ONS 15327 Gateway

Scenario 3 is similar to Scenario 1, but only one ONS 15327 (node #1) connects to the LAN ( Figure 4-3). Two ONS 15327s (#2 and #3) connect to ONS 15327 #1 through the SONET DCC. Because all three ONS 15327s are on the same subnet, Proxy ARP enables ONS 15327 #1 to serve as a gateway for ONS 15327s #2 and #3.

ARP matches higher-level IP addresses to the physical addresses of the destination host. It uses a lookup table (called ARP cache) to perform the translation. When the address is not found in the ARP cache, a broadcast is sent out on the network with a special format called the ARP request. If one of the machines on the network recognizes its own IP address in the request, it sends an ARP reply back to the requesting host. The reply contains the physical hardware address of the receiving host. The requesting host stores this address in its ARP cache so that all subsequent datagrams (packets) to this destination IP address can be translated to a physical address.

Proxy ARP enables one LAN-connected ONS 15327 to respond to the ARP request for ONS 15327s not connected to the LAN. (ONS 15327 Proxy ARP requires no user configuration.) For this to occur, the DCC-connected ONS 15327s must reside on the same subnet. When a LAN device sends an ARP request to an ONS 15327 that is not connected to the LAN, the gateway ONS 15327 returns its MAC address to the LAN device. The LAN device then sends the datagram for the remote ONS 15327 to the MAC address of the proxy ONS 15327. The proxy ONS 15327 uses its routing table to forward the datagram to the non-LAN ONS 15327.

4.2.4 Scenario 4: Default Gateway on CTC Computer

Scenario 4 is similar to Scenario 3, but nodes #2 and #3 reside on different subnets, 192.168.2.0 and 192.168.3.0, respectively ( Figure 4-4). Node #1 and the CTC computer are on subnet 192.168.1.0. Proxy ARP is not used because the network includes different subnets. In order for the CTC computer to communicate with ONS 15327s #2 and #3, ONS 15327 #1 is entered as the default gateway on the CTC computer.

4.2.5 Scenario 5: Using Static Routes to Connect to LANs

•

To connect ONS 15327s to CTC sessions on one subnet connected by a router to ONS 15327s residing on another subnet. (These static routes are not needed if OSPF is enabled. Scenario 7 shows an OSPF example.)

•

To enable multiple CTC sessions among ONS 15327s residing on the same subnet.

In Figure 4-5, one CTC residing on subnet 192.168.1.0 connects to a router through interface A. (The router is not set up with OSPF.) ONS 15327s residing on subnet 192.168.2.0 are connected through ONS 15327 #1 to the router through interface B. Proxy ARP enables ONS 15327 #1 as a gateway for ONS 15327s #2 and #3. To connect to CTC computers on LAN A, a static route is created on ONS 15327 #1.

•

If a single CTC computer is connected to router, enter the complete CTC "host route" IP address as the destination with a subnet mask of 255.255.255.255.

•

If CTC computers on a subnet are connected to router, enter the destination subnet (in this example, 192.168.1.0) and a subnet mask of 255.255.255.0.

•

If all CTC computers are connected to router, enter a destination of 0.0.0.0 and a subnet mask of 0.0.0.0. Figure 4-6 shows an example.

The IP address of router interface B is entered as the next hop, and the cost (number of hops from source to destination) is 2.

4.2.6 Scenario 6: Using OSPF

Open Shortest Path First (OSPF) is a link state Internet routing protocol. Link state protocols use a "hello protocol" to monitor their links with adjacent routers and to test the status of their links to their neighbors. Link state protocols advertise their directly-connected networks and their active links. Each link state router captures the link state "advertisements" and puts them together to create a topology of the entire network or area. From this database, the router calculates a routing table by constructing a shortest path tree. Routes are continuously recalculated to capture ongoing topology changes.

ONS 15327s use the OSPF protocol in internal ONS 15327 networks for node discovery, circuit routing, and node management. You can enable OSPF on the ONS 15327s so that the ONS 15327 topology is sent to OSPF routers on a LAN. Advertising the ONS 15327 network topology to LAN routers eliminates the need to manually enter static routes for ONS 15327 subnetworks. Figure 4-7 shows the same network enabled for OSPF. Figure 4-8 shows the same network without OSPF. Static routes must be manually added to the router in order for CTC computers on LAN A to communicate with ONS 15327 #2 and #3 because these nodes reside on different subnets.

OSPF divides networks into smaller regions, called areas. An area is a collection of networked end systems, routers, and transmission facilities organized by traffic patterns. Each OSPF area has a unique ID number, known as the area ID, that can range from 0 to 4,294,967,295. Every OSPF network has one backbone area called "area 0." All other OSPF areas must connect to area 0.

When you enable ONS 15327 OSPF topology for advertising to an OSPF network, you must assign an OSPF area ID to the ONS 15327 network. Coordinate the area ID number assignment with your LAN administrator. In general, all DCC-connected ONS 15327s are assigned the same OSPF area ID.

Use the following procedure to enable OSPF on each ONS 15327 node that you want included in the OSPF network topology. ONS 15327 OSPF settings must match router OSPF settings, so you will need to get the OSPF Area ID, Hello and Dead intervals, and authentication key (if OSPF authentication is enabled) from the router to which the ONS 15327 network is connected before enabling OSPF.

Procedure: Set Up OSPF

Step 2

Click the Provisioning > Network > OSPF tabs ( Figure 4-9).

•

DCC OSPF Area ID—Enter the number that identifies the ONS 15327s as a unique OSPF area ID entered in dotted decimal format. It can be any number between 000.000.000.000 and 255.255.255.255. The number must be unique to the LAN OSPF area.

•

DCC Metric—This value is normally unchanged. It sets a "cost" for sending packets across the DCC, which is used by OSPF routers to calculate the shortest path. This value should always be higher than the LAN metric. The default DCC metric is 10. The metric changes to 100 if you check the OSPF Active on LAN check box in Step 4.

•

OSPF active on LAN—When checked, enables ONS 15327 OSPF topology to be advertised to OSPF routers on the LAN. Enable this field on ONS 15327s that directly connect to OSPF routers.

•

Area ID for LAN Port—Enter the OSPF area ID (dotted decimal format) for the router port where the ONS 15327 is connected. (This number is different from the DCC OSPF Area ID.)

•

Type—If the router where the ONS 15327 is connected requires authentication, choose Simple Password. Otherwise, choose No Authentication.

•

Key—If Simple Password is selected as the Authentication type, enter the password (OSPF key).

The OSPF priority and intervals default to values most commonly used by OSPF routers. In the Priority and Intervals area, verify that these values match those used by the OSPF router where the ONS 15327 is connected.

•

Hello Interval (sec)—Sets the number of seconds between OSPF "hello" packet advertisements sent by OSPF routers. Ten seconds is the default.

•

Dead Interval—Sets the number of seconds that will pass while an OSPF router's packets are not visible before its neighbors declare the router down. Forty seconds is the default.

•

Transit Delay (sec)—Indicates the service speed. One second is the default.

•

Retransmit Interval (sec)—Sets the time that will elapse before a packet is resent. Five seconds is the default.

•

LAN Metric—Sets a "cost" for sending packets across the LAN. This value should always be lower than the DCC metric. Ten is the default.

Step 7

Under OSPF Area Range Table, create an area range table if one is needed:

Note

Area range tables consolidate the information that is propagated outside an OSPF Area border. One ONS 15327 in the ONS 15327 OSPF area is connected to the OSPF router. An area range table on this node points the router to the other nodes that reside within the ONS 15327 OSPF area.

–

Range Address—Enter the area IP address for the ONS 15327s that reside within the OSPF area. For example, if the ONS 15327 OSPF area includes nodes with IP addresses 10.10.20.100, 10.10.30.150, 10.10.40.200, and 10.10.50.250, the range address would be 10.10.0.0.

–

Range Area ID—Enter the OSPF area ID for the ONS 15327s. This is either the ID in the DCC OSPF Area ID field or the ID in the Area ID for LAN Port field.

–

Mask Length—Enter the subnet mask length. In the Range Address example, this is 16.

Step 8

All OSPF areas must be connected to Area 0. If the ONS 15327 OSPF area is not physically connected to Area 0, use the following steps to create a virtual link table that will provide the disconnected area with a logical path to Area 0:

In the Create Virtual Link dialog box, complete the following fields (OSPF settings must match OSPF settings for the ONS 15327 OSPF area):

•

Hello Int (sec)—The number of seconds between OSPF "hello" packet advertisements sent by OSPF routers. Ten seconds is the default.

•

Auth Type—If the router where the ONS 15327 is connected uses authentication, choose Simple Password. Otherwise, choose No Authentication.

•

Retransmit Int (sec)—Sets the time that will elapse before a packet is resent. Five seconds is the default.

•

Dead Int (sec)—Sets the number of seconds that will pass while an OSPF router's packets are not visible before its neighbors declare the router down. Forty seconds is the default.

If you changed the Area ID, the XTC cards will reset, one at a time. The reset will take approximately 10-15 minutes.

4.2.7 Scenario 7: Provisioning the ONS 15327 Proxy Server

The ONS 15327 proxy server is a set of functions that allows you to network ONS 15327s in environments where visibility and accessibility between ONS 15327s and CTC computers must be restricted. For example, you can set up a network so that field technicians and network operating center (NOC) personnel can both access the same ONS 15327s while preventing direct access between the field and the NOC LAN. To do this, one ONS 15327 is provisioned as a gateway NE (GNE) and the other ONS 15327s are provisioned as element NEs (ENEs). The GNE ONS 15327 tunnels connections between a CTC computers and ENE ONS 15327s, providing management capability while preventing access for non-ONS 15327 management purposes.

•

Isolates DCC IP traffic from Ethernet (craft port) traffic and accepts packets based on filtering rules. The filtering rules depend on whether the packet arrives at the ONS 15327 DCC or XTC Ethernet interface.

•

Monitors ARP request packets on its Ethernet port. If the ARP request is from an address that is not on the current subnet, the ONS 15327creates an entry its ARP table. The ARP entry allows the ONS 15327 to reply to an address over the local Ethernet so craft technicians can connect to ONS 15327s without changing the IP addresses of their computers.

•

Processes SNTP/NTP requests. Element ONS 15327 NEs can derive timing from an SNTP/NTP LAN server through the GNE ONS 15327.

•

Process SNMPv1 traps. The GNE ONS 15327 receives SNMPv1 traps from the ENE ONS 15327s forwards them to all provisioned SNMPv1 trap destinations.

The ONS 15327 proxy server is provisioned using three checkboxes on the Provisioning > Network > General tab (see Figure 4-10):

•

Craft Access Only—When enabled, the ONS 15327 neither installs nor advertises default or static routes. CTC computers can communicate with the ONS 15327, but they cannot communicate directly with any other DCC-connected ONS 15327.

•

Enable Proxy—When enabled, the ONS 15327 serves as a proxy for connections between CTC clients and ONS 15327s that are DCC-connected to the proxy ONS 15327. The CTC client establishes connections to DCC-connected nodes through the proxy node. The CTC client can connect to nodes that it cannot directly reach from the host on which it runs. If Enable Proxy is off, the node does not proxy for any CTC clients, although any established proxy connections will continue until the CTC client exits.

•

Enable Firewall—If selected, the node prevents IP traffic from being routed between the DCC and the Ethernet port. The ONS 15327 can communicate with hosts connected to the Ethernet port or connected through the DCC. However, the DCC-connected hosts cannot communicate with the Ethernet-connected hosts, and the Ethernet-connected hosts cannot communicate with the DCC-connected hosts. A CTC client using the Ethernet to connect to the firewall-enabled node can use the proxy capability to manage the DCC-connected nodes that would otherwise be unreachable. A CTC client connected to a DCC-connected node can only manage other DCC-connected nodes and the firewall itself.

Figure 4-11 shows an ONS 15327 proxy server implementation. A GNE ONS 15327 is connected to a central office LAN and to ENE ONS 15327s. The central office LAN is connected to a NOC LAN, which has CTC computers. The NOC CTC computer and craft technicians must both be able to access the ONS 15327 ENEs. However, the craft technicians must be prevented from accessing or seeing the NOC or central office LANs.

In the example, the ONS 15327 GNE is assigned an IP address within the central office LAN and is physically connected to the LAN through its LAN port. ONS 15327 ENEs are assigned IP addresses that are outside the central office LAN and given private network IP addresses. If the ONS 15327 ENEs are co-located, the craft LAN ports could be connected to a hub. However, the hub should have no other network connections.

Figure 4-11 Scenario 7: ONS 15327 Proxy Server with GNE and ENEs on the same subnet

Table 4-2 shows recommended settings for ONS 15327 GNEs and ENEs in the configuration shown in Figure 4-11.

Table 4-2 ONS 15327 Gateway and Element NE Settings
Setting	ONS 15327 Gateway NE	ONS 15327 Element NE
Craft Access Only	Off	On
Enable Proxy	On	On
Enable Firewall	On	On
OSPF	Off	Off
SNTP Server (if used)	SNTP server IP address	Set to ONS 15327 GNE IP address
SNMP (if used)	SNMPv1 trap destinations	Set SNMPv1 trap destinations to ONS 15327 GNE (the ENE SNMPv1 trap destination must use port 391, if the destination is a GNE)

Figure 4-12 shows the same proxy server implementation with ONS 15327 ENEs on different subnets. Figure 4-13 shows the implementation with ONS 15327 ENEs in multiple rings. In each example, ONS 15327 GNEs and ENEs are provisioned with the settings shown in Table 4-2.

Figure 4-12 Scenario 7: ONS 15327 Proxy Server with GNE and ENEs on different subnets

Table 4-3 shows the rules the ONS 15327 follows to filter packets when Enable Firewall is enabled. If the packet is addressed to the ONS 15327, additional rules, shown in Table 4-4, are applied. Rejected packets are silently discarded.

Table 4-3 Proxy Server Firewall Filtering Rules
Packets Arrive At	Accepted
XTC Ethernet Interface	•The ONS 15327 itself •The ONS 15327's subnet broadcast address •Within the 224.0.0.0/8 network (reserved network used for standard multicast messages) •255.255.255.255
DCC Interface	•The ONS 15327 itself •An OSPF peer (another DCC-connected ONS 15327) •Within the 224.0.0.0/8 network

Table 4-4 Proxy Server Firewall Filtering Rules When Packet Addressed to ONS 15327
Packets Arrive At	Accepted	Rejected
XTC Ethernet Interface	•All UDP packets except those in the Rejected column •All TCP, OSPF and ICMP packets	•UDP packets addressed to the SNMP trap relay port (391) are rejected
DCC Interface	•All UDP packets •All TCP packets except those in the Rejected column •OSPF packets •ICMP packets	•TCP packets addressed to the telnet port are rejected. •TCP packets addressed to the IO card telnet ports are rejected. •TCP packets addressed to the proxy server port are rejected.

•

All DCC-connected ONS 15327s on the same Ethernet segment must have the same Craft Access Only setting. Mixed values will produce unpredictable results, and may leave some nodes unreachable through the shared Ethernet segment.

•

All DCC-connected ONS 15327s on the same Ethernet segment must have the same Enable Firewall setting. Mixed values will produce unpredictable results. Some nodes may become unreachable.

•

All DCC-connected ONS 15327s in the same SDCC area must have the same Enable Firewall setting. Mixed values will produce unpredictable results. Some nodes may become unreachable.

•

If you enable Enable Firewall, always enable Enable Proxy. If Enable Proxy is not enabled, CTC will not be able to see nodes on the DCC side of the ONS 15327.

•

If Craft Access Only is enabled, enable Enable Proxy. If Enable Proxy is not enabled, CTC will not be able to see nodes on the DCC side of the ONS 15327.

If nodes become unreachable in cases 1, 2 and 3, you can correct the setting by performing one of the following:

•

Disconnect the craft computer from the unreachable ONS 15327. Connect to the ONS 15327 through another ONS 15327 in the network that has a DCC connection to the unreachable ONS 15327.

•

Disconnect the Ethernet cable from the unreachable ONS 15327. Connect a CTC computer directly to the ONS 15327.

4.3 ONS 15327 Routing Table

ONS 15327 routing information is displayed on the Maintenance > Routing Table tabs ( Figure 4-14). The routing table provides the following information:

•

Mask—Displays the subnet mask used to reach the destination host or network.

•

Gateway—Displays the IP address of the gateway used to reach the destination network or host.

•

Interface—Shows the ONS 15327 interface used to access the destination. Values are:

–

pdcc0—an SDCC interface, that is, an OC-N trunk card identified as the SDCC termination.

Table 4-5 Sample Routing Table Entries
Entry	Destination	Mask	Gateway	Interface
1	0.0.0.0	0.0.0.0	172.20.214.1	cpm0
2	172.20.214.0	255.255.255.0	172.20.214.92	cpm0
3	172.20.214.92	255.255.255.255	127.0.0.1	lo0
4	172.20.214.93	255.255.255.255	0.0.0.0	pdcc0
5	172.20.214.94	255.255.255.255	172.20.214.93	pdcc0

•

Destination (0.0.0.0) is the default route entry. All undefined destination network or host entries on this routing table will be mapped to the default route entry.

•

Gateway (172.20.214.1) is the default gateway address. All outbound traffic that cannot be found in this routing table or is not on the node's local subnet will be sent to this gateway.

•

Interface (cpm0) indicates that the ONS 15327 Ethernet interface is used to reach the gateway.

•

Mask (255.255.255.0) is a 24-bit mask, meaning all addresses within the 172.20.214.0 subnet can be a destination.

•

Gateway (172.20.214.92) is the gateway address. All outbound traffic belonging to this network is sent to this gateway.

•

Interface (cpm0) indicates that the ONS 15327 Ethernet interface is used to reach the gateway.

•

Mask (255.255.255.255) is a 32 bit mask, meaning only the 172.20.214.92 address is a destination.

•

Gateway (127.0.0.1) is a loopback address. The host directs network traffic to itself using this address.

•

Interface (lo0) indicates that the local loopback interface is used to reach the gateway.

•

Mask (255.255.255.255) is a 32 bit mask, meaning only the 172.20.214.93 address is a destination.

•

Gateway (0.0.0.0) means the destination host is directly attached to the node.

•

Interface (pdcc0) indicates that a SONET SDCC interface is used to reach the destination host.

Entry #5 shows a DCC-connected node that is accessible through a node that is not directly connected:

•

Mask (255.255.255.255) is a 32-bit mask, meaning only the 172.20.214.94 address is a destination.

•

Gateway (172.20.214.93) indicates that the destination host is accessed through a node with IP address 172.20.214.93.

•

Interface (pdcc0) indicates that a SONET SDCC interface is used to reach the gateway.

Table Of Contents

IP Networking

4.1 IP Networking Overview

4.2 ONS 15327 IP Addressing Scenarios

4.2.1 Scenario 1: CTC and ONS 15327s on Same Subnet

4.2.2 Scenario 2: CTC and ONS 15327s Connected to Router

4.2.3 Scenario 3: Using Proxy ARP to Enable an ONS 15327 Gateway

4.2.4 Scenario 4: Default Gateway on CTC Computer

4.2.5 Scenario 5: Using Static Routes to Connect to LANs

4.2.6 Scenario 6: Using OSPF

Procedure: Set Up OSPF

4.2.7 Scenario 7: Provisioning the ONS 15327 Proxy Server

4.3 ONS 15327 Routing Table