ON THIS PAGE
Configure Maintenance Association Intermediate Points in ACX Series
Configure a MEP to Generate and Respond to CFM Protocol Messages
Configure Service Protection for VPWS over MPLS Using the MEP Interface
Configuring Continuity Check Protocol Parameters for Fault Detection
Junos OS Support for Performance Monitoring Compliant with Technical Specification MEF 36
Damping CFM performance Monitoring Traps and Notifications to Prevent Congestion of The NMS
Configure Connectivity Fault Management (CFM)
Use this topic to configure connectivity fault management features such as maintenance domains, maintenance associations, maintenance intermediate points (MIPs), and continuity check parameters. You can also use this topic to configure an action profile to specify the CFM action that must be performed when a specific CFM event occurs.
Starting in Junos OS Evolved 22.4R2 Release, the connectivity fault management process
(cfmd) runs only when the ethernet connectivity-fault-management
protocol is configured.
Create a Maintenance Domain
To enable connectivity fault management (CFM) on an Ethernet interface, you must first configure a maintenance domain and specify the name of the maintenance domain. You can also specify the format of the name. For instance, if you specify the name format to be domain name service (DNS) format, you can specify the name of the maintenance domain as www.juniper.net. The default name format is ASCII character string.
For logical interfaces, the maintenance domain name must
be unique across logical systems. If you configure the same maintenance
domain name across logical systems, then you receive the following
error message: error: configuration check-out failed
.
During the creation of the maintenance domain, you can also specify the maintenance domain level. The maintenance domain level indicates the nesting relationship between various maintenance domains. The maintenance domain level is embedded in each of the CFM frames.
The configuration display entries in the CFM maintenance domain list are "ordered by system" rather than "ordered by user."
To create a maintenance domain:
See Also
Create a Maintenance Association
To create a maintenance association, include the maintenance-association ma-name
statement at the [edit protocols oam
ethernet connectivity-fault-management maintenance-domain domain-name]
hierarchy level.
Maintenance association names can be in one of the following formats:
As a plain ASCII character string
As the VLAN identifier of the VLAN you primarily associate with the maintenance association
As a two-octet identifier in the range from 0 through 65,535
As a name in the format specified by RFC 2685
The default short name format is an ASCII character string.
To configure the maintenance association short name format,
include the short-name-format (character-string | vlan | 2octet
| rfc-2685-vpn-id)
statement at the [edit protocols oam
ethernet connectivity-fault-management maintenance-domain domain-name maintenance-association ma-name]
hierarchy level.
The configuration display entries in the CFM maintenance domain list are "ordered by system" rather than "ordered by user."
See Also
Configure Maintenance Intermediate Points (MIPs)
MX Series routers support maintenance intermediate points
(MIPs) for the Ethernet OAM 802.1ag CFM protocol at a bridge-domain
level. This enables you to define a maintenance domain for each default
level. The MIPs names are created as default-level-number
at the [edit protocols oam ethernet connectivity-fault-management
maintenance-domain]
hierarchy level. Use the bridge-domain
, instance
, virtual-switch
, and mip-half-function
MIP options to specify the MIP configuration.
Use the show oam ethernet connectivity-fault-management
mip (bridge-domain | instance-name | interface-name)
command
to display the MIP configurations.
To configure the maintenance intermediate point (MIP):
See Also
Configure Maintenance Association Intermediate Points in ACX Series
Maintenance Intermediate Point (MIP) provides monitoring capability of intermediate points for services such as Layer 2 bridging, Layer 2 circuit, and Layer 2 VPN. ACX5048 and ACX5096 routers support MIPs for the Ethernet OAM 802.1ag CFM protocol. Use the bridge-domain, interface, and mip-half-function MIP options to specify the MIP configuration.
ACX5048 and ACX5096 routers do not support MIP configuration on VPLS services.
ACX5448 router do not support MIP.
Whenever a MIP is configured and a bridge domain is mapped
to multiple maintenance domains or maintenance associations, it is
essential that the mip-half-function
value for all maintenance
domains and maintenance associations be the same.
To display MIP configurations, use the show oam ethernet
connectivity-fault-management mip (bridge-domain | instance-name |
interface-name)
command.
The following MIP configurations are supported in ACX5048 and ACX5096 routers:
MIP with with bridge domain
MIP with circuit cross-connect (CCC)
MIP with bridge domain when maintenance association end point is configured
MIP with CCC when maintenance association end point is configured
The following sections describe MIP configuration:
- Configure the Maintenance Domain Bridge Domain
- Configure the Maintenance Domain MIP Half Function
- Configure the Maintenance Association Intermediate Points with Bridge Domain
- Configure the Maintenance Association Intermediate Points with Circuit Cross-Connect
- Configure the Maintenance Association Intermediate Points with Bridge Domain when Maintenance Association End Point is Configured
- Configure the Maintenance Intermediate Points with Circuit Cross-Connect when Maintenance Association End Point is Configured
Configure the Maintenance Domain Bridge Domain
To configure the bridge domain, include the vlans
statement at the [edit protocols oam ethernet connectivity-fault-management
maintenance-domain maintenance-domain-name]
hierarchy level.
The Layer 2 CLI configurations and show commands for ACX5048 and ACX5096 routers differ compared to other ACX Series routers. For more information, see Layer 2 Next Generation Mode for ACX Series.
Configure the Maintenance Domain MIP Half Function
MIP Half Function (MHF) divides MIP functionality into two unidirectional segments, improves visibility with minimal configuration, and improves network coverage by increasing the number of points that can be monitored. MHF extends monitoring capability by responding to loopback and linktrace messages to help isolate faults.
Whenever a MIP is configured and a bridge domain is mapped to
multiple maintenance domains or maintenance associations, it is essential
that the MIP half function value for all maintenance
domains and maintenance associations be the same. To configure the
MIP half function, include the mip-half-function
statement at the [edit protocols oam ethernet connectivity-fault-management
maintenance-domain maintenance-domain-name]
hierarchy level.
Configure the Maintenance Association Intermediate Points with Bridge Domain
In ACX5048 and ACX5096 routers, you can configure the MIP with bridge domain. The following is a sample to configure the MIP with bridge domain:
[edit protocols] oam { ethernet { connectivity-fault-management { maintenance-domain default-6 { vlan bd1; mip-half-function default; } } } }
Configure the Maintenance Association Intermediate Points with Circuit Cross-Connect
In ACX5048 and ACX5096 routers, you can configure the MIP with circuit cross-connect (CCC). The following is a sample to configure the MIP with CCC:
[edit protocols] oam { ethernet { connectivity-fault-management { maintenance-domain default-6 { interface xe-0/0/42.0; mip-half-function default; } } } }
Configure the Maintenance Association Intermediate Points with Bridge Domain when Maintenance Association End Point is Configured
In ACX5048 and ACX5096 routers, you can configure the MIP with bridge domain when a maintenance association end point (MEP) is configured. The following is a sample to configure the MIP with bridge domain when MEP is configured:
[edit protocols] oam { ethernet { connectivity-fault-management { maintenance-domain md2 { level 5; mip-half-function default; maintenance-association ma2 { continuity-check { interval 1s; } mep 222 { interface xe-0/0/42.0; direction up; } } } } } }
Configure the Maintenance Intermediate Points with Circuit Cross-Connect when Maintenance Association End Point is Configured
In ACX5048 and ACX5096 routers, you can configure the MIP with circuit cross-connect (CCC) when a maintenance association end point (MEP) is configured. The following is a sample to configure the MIP with CCC when MEP is configured:
[edit protocols] oam { ethernet { connectivity-fault-management { maintenance-domain md2 { level 5; mip-half-function default; maintenance-association ma2 { continuity-check { interval 1s; } mep 222 { interface xe-0/0/42.0; direction up; } } } } } }
See Also
Configure a MEP to Generate and Respond to CFM Protocol Messages
A maintenance association end point (MEP) refers to the boundary of a domain. A MEP generates and responds to connectivity fault management (CFM) protocol messages. You can configure multiple up MEPs for a single combination of maintenance association ID and maintenance domain ID for interfaces belonging to a particular VPLS service or a bridge domain. You can configure multiple down MEPs for a single instance of maintenance domain identifier and maintenance association name to monitor services provided by Virtual Private LAN service (VPLS), bridge domain, circuit cross-connect (CCC), or IPv4 domains.
For layer 2 VPNs routing instances (local switching) and EVPN routing instances, you can also configure multiple up MEPs for a single combination of maintenance association ID and maintenance domain ID on logical interfaces. The logical interface can be configured on different devices or on the same device. To support multiple up MEPs on two IFLs, enhanced IP network services must be configured for the chassis.
You can enable automatic discovery of a MEP. With automatic discovery a MEP is enabled to accept continuity check messages (CCMs) from all remote MEPs of the same maintenance association. If automatic discovery is not enabled, the remote MEPs must be configured. If the remote MEP is not configured, the CCMs from the remote MEP are treated as errors.
Continuity measurement is provided by an existing continuity check protocol. The continuity for every remote MEP is measured as the percentage of time that remote MEP was operationally up over the total administratively enabled time. Here, the operational uptime is the total time during which the CCM adjacency is active for a particular remote MEP and the administrative enabled time is the total time during which the local MEP is active. You can also restart the continuity measurement by clearing the currently measured operational uptime and the administrative enabled time.
- Configure a Maintenance Association End Point (MEP)
- Configure a Remote Maintenance Association End Point (MEP)
Configure a Maintenance Association End Point (MEP)
To configure a maintenance association end point:
See Also
Configure a Remote Maintenance Association End Point (MEP)
To configure a remote maintenance association end point:
See Also
Configure Service Protection for VPWS over MPLS Using the MEP Interface
You can enable service protection for a virtual private wire service (VPWS) over MPLS by specifying a working path or protect path on the MEP. Service protection provides end-to-end connection protection of the working path in the event of a failure.
To configure service protection, you must create two separate
transport paths—a working path and a protect path. You can specify
the working path and protect path by creating two maintenance associations.
To associate the maintenance association with a path, you must configure
the interface
statement for the MEP within the maintenance
association and specify the path as working or protect.
If the path is not specified, the session monitors the active path.
Table 1 describes the available service protection options.
Option |
Description |
---|---|
|
Specifies the working path. |
|
Specifies the protect path. |
In this configuration, we enable service protection for
the VPWS service. The CCM session is configured for the working path
and references the CCM session configured for the protect path using
the protect-maintenance-association
statement. The name
of the protect transport path for the maintenance association is configured
and associated with the maintenance association for the working path.
To configure service protection for VPWS over MPLS:
See Also
Configure Linktrace Protocol in CFM
The linktrace protocol is used for path discovery between
a pair of maintenance points. Linktrace messages are triggered by
an administrator using the traceroute
command to verify
the path between a pair of MEPs under the same maintenance association.
Linktrace messages can also be used to verify the path between an
MEP and an MIP under the same maintenance domain. The linktrace protocol
enables you to configure the time to wait for a response. If no response
is received for a linktrace request message, the request and response
entries are deleted after the interval expires. You can also configure
the number of linktrace reply entries to be stored for the corresponding
linktrace request.
The operation of IEEE 802.1ag linktrace request and response
messages is similar to the operation of Layer 3 traceroute
commands. For more information about the traceroute
command,
see the Junos OS Administration Library for Routing Devices.
To configure the linktrace protocol:
See Also
Continuity Check Protocol Parameters Overview
The continuity check protocol is used for fault detection by maintenance end points (MEPs) within a maintenance association. The MEP periodically sends continuity check multicast messages. The continuity check protocol packets use the ethertype value 0x8902 and the multicast destination MAC address 01:80:c2:00:00:32.
The following list describes the continuity check protocol parameters you can configure:
interval
—Frequency of the continuity check messages (CCM) i.e time between the transmission of the CCM messages. You can specify 10 minutes (10m
), 1 minute (1m
), 10 seconds (10s
), 1 second (1s
), 100 milliseconds (100ms
), or 10 milliseconds (10ms
). The default value is 1 minute. For instance, if you specify the interval as 1 minute, the MEP sends the continuity check messages every minute to the receiving MEP.Note:For the continuity check message interval to be configured for 10 milliseconds, periodic packet management (PPM) runs on the Routing Engine and Packet Forwarding Engine by default. You can only disable PPM on the Packet Forwarding Engine. To disable PPM on the Packet Forwarding Engine, use the
no-delegate-processing
statement at the[edit routing-options ppm]
hierarchy level.Continuity check interval of 10 milliseconds is not supported for CFM sessions over a label-switched interface (LSI).
hold-interval
—Frequency at which the MEP database can be flushed, if no updates occur. Receiving MEPs use the continuity check messages to build a MEP database of all MEPs in the maintenance association. The frequency is the number of minutes to wait before flushing the MEP database if no updates occur. The default value is 10 minutes.Note:Hold timer based flushing is applicable only for autodiscovered remote MEPs and not for statically configured remote MEPs.
The hold interval logic runs a polling timer per CFM session level (not per remote MEP level) where the polling timer duration is equal to the configured hold time. When the polling timer expires, it deletes all the autodiscovered remote MEP entries which have been in the failed state for a time period equal to or greater than the configured hold time. If the remote MEP completes the hold time duration in the failed state, then flushing will not occur until the next polling timer expires. Hence remote MEP flushing may not happen exactly at the configured hold time.
loss-threshold
—Number of continuity check messages that can be lost before the router marks the MEP as down. The value can be from 3 to 256 protocol data units (PDUs). The default value is 3 PDUs.
See Also
Configuring Continuity Check Protocol Parameters for Fault Detection
The continuity check protocol is used for fault detection by a maintenance association end point (MEP) within a maintenance association. A MEP periodically generates and responds to continuity check multicast messages. The continuity check protocol packets use the ethertype value 0x8902 and the multicast destination MAC address 01:80:c2:00:00:32. The receiving MEPs use the continuity check messages (CCMs) to build a MEP database of all MEPs in the maintenance association.
To configure continuity check protocol parameters:
See Also
Configuring Rate Limiting of Ethernet OAM Messages
The M320 with Enhanced III FPC, M120, M7i, M10 with CFEB, and MX Series routers support rate limiting of Ethernet OAM messages. Depending on the connectivity fault management (CFM) configuration, CFM packets are discarded, sent to the CPU for processing, or flooded to other bridge interfaces. This feature allows the router to intercept incoming CFM packets for prevention of DoS attacks.
You can apply rate limiting of Ethernet OAM messages at either of two CFM policing levels, as follows:
Global-level CFM policing—uses a policer at the global level to police the CFM traffic belonging to all the sessions.
Session-level CFM policing—uses a policer created to police the CFM traffic belonging to one session.
To configure global-level CFM policing, include the policer
statement and its options at the [edit protocols oam ethernet
connectivity-fault-management]
hierarchy level.
To configure session-level CFM policing, include the policer
statement at the [edit protocols oam ethernet connectivity-fault-management
maintenance-domain md-name level number maintenance-association ma-name]
hierarchy
level.
The following example shows a CFM policer used for rate-limiting CFM:
[edit] firewall { policer cfm-policer { if-exceeding { bandwidth-limit 8k; burst-size-limit 2k; } then discard; } }
Case 1: Global-Level CFM Policing
This example shows a global level policer, at the CFM
level, for rate-limiting CFM. The continuity-check cfm-policer
statement at the global [edit protocols
oam ethernet connectivity-fault-management policer]
hierarchy
level specifies the policer to use for policing all continuity check
packets of the CFM traffic belonging to all sessions. The other cfm-policer1
statement at the [edit protocols
oam ethernet connectivity-fault-management policer]
hierarchy
level specifies the policer to use for policing all non-continuity
check packets of the CFM traffic belonging to all sessions. The all cfm-policer2
statement specifies to
police all CFM packets with the specified policer cfm-policer2. If the all policer-name
option
is used, then the user cannot specify the previous continuity-check
and other
options.
[edit protocols oam ethernet] connectivity-fault-management { policer { continuity-check cfm-policer; other cfm-policer1 ; all cfm-policer2; } }
Case 2: Session-Level CFM Policing
This example shows a session-level CFM policer used for
rate-limiting CFM. The policer
statement at the session [edit protocols oam ethernet connectivity-fault-management maintenance-domain md-name maintenance-association ma-name]
hierarchy level specifies the policer to use for policing
only continuity check packets of the CFM traffic belonging to the
specified session. The other cfm-policer1
statement at the [edit protocols oam ethernet connectivity-fault-management
maintenance-domain md-name maintenance-association ma-name]
hierarchy level specifies the policer to
use for policing all non-continuity check packets of the CFM traffic
belonging to this session only. The all cfm-policer2
statement specifies to police all CFM packets with the specified
policer cfm-policer2. If the all policer-name
option is used, then the user cannot
specify the previous continuity-check
and other
options.
[edit protocols oam ethernet] connectivity-fault-management { maintenance-domain md { level number; maintenance-association ma { continuity-check { interval 1s; } policer { continuity-check cfm-policer; other cfm-policer1; all cfm-policer2; } } mep 1 { interface ge-3/3/0.0; direction up; auto-discovery; } } }
In the case of global CFM policing, the same policer is shared across multiple CFM sessions. In per-session CFM policing, a separate policer must be created to rate-limit packets specific to that session.
Service-level policer configuration for any two CFM sessions on the same interface at different levels must satisfy the following constraints if the direction of the sessions is the same:
If one session is configured with
policer all
, then the other session cannot have apolicer all
orpolicer other
configuration.If one session is configured with
policer other
, then the other session cannot have apolicer all
orpolicer other
configuration.
A commit error will occur if such a configuration is committed.
Policers with PBB and MIPs are not supported.
See Also
Enabling Enhanced Connectivity Fault Management Mode
You can enable enhanced connectivity fault management (CFM) mode to enable effective Ethernet OAM deployment in scaling networks. On enabling enhanced CFM mode, Junos OS supports 32, 000 maintenance association end points (MEPs) and maintenance intermediate points (MIPs) each per chassis for bridge, VPLS, L2VPN, and CCC domains. In previous releases, Junos OS supports 8, 000 MEPs and 8000 MIPS per chassis. If you do not enable enhanced CFM, Junos OS continues to support existing number of MIPs and MEPs per chassis.
To support enhanced CFM mode, configure the network services
mode on the router as enhanced-ip
. If the network services
mode is not enhanced-ip
, and you have enabled enhanced
CFM, the following warning message is displayed:[edit protocols oam ethernet]
'connectivity-fault-management'
enhanced ip is not effective please configure enhanced
ip and give router reboot
To enable enhanced CFM mode, perform the following steps:
See Also
Configure Connectivity Fault Management for Interoperability During Unified In-Service Software Upgrades
Starting in Release 17.1, Junos OS connectivity fault management (CFM), during a unified in-service software upgrade (ISSU), works when the peer device is not a Juniper Networks router. Interoperating with the router of another vendor, the Juniper Networks router retains session information and continues to transmit continuity check message (CCM) PDUs during the unified ISSU. Connectivity fault management continues to operate.
This feature requires the following conditions be met:
Packet Forwarding Engine keepalives must be enabled to provide inline transmission of CCMs. The feature does not work when the CCMs are transmitted by the CPU of a line card, which is the default transmission method.
The interval between CCMs must be 1 second.
CFM interoperability during a unified ISSU is supported on the following MPCs: MPC1, MPC2, MPC2-NG, MPC3-NG, MPC5, and MPC6.
To enable CFM interoperability with third-party devices across a unified ISSU:
See Also
Junos OS Support for Performance Monitoring Compliant with Technical Specification MEF 36
Junos OS release 16.1R1 and later supports performance monitoring that is compliant with Technical Specification MEF 36. Technical Specification MEF 36 specifies the performance monitoring MIB. The performance monitoring MIB is required to manage service operations, administration, and maintenance (OAM) implementations that satisfy the Service OAM requirements and framework specified in MEF 17 and MEF 35, the management objects specified in MEF 7.1, and the performance monitoring functions defined in ITU-T Y.1731 and IEEE 802.1ag.
You can enable MEF-36-compliant performance monitoring by configuring
the measurement-interval
statement at the [edit protocols oam ethernet cfm performance-monitoring]
hierarchy level.
When MEF-36-compliant performance monitoring is enabled:
An SNMP get next request for a variable might not fetch the current value unless an SNMP walk is performed before performing the get next request. This limitation applies only to the current statistics for delay measurement, loss measurement, and synthetic loss measurement.
The output for the field
Current delay measurement statistics
might display a measurement interval of 0 (zero) and an incorrect timestamp until the first cycle time has expired.Supported data TLV size for performance monitoring protocol data units (PDUs) is 1386 bytes when MEF-36-compliant performance monitoring is enabled. The TLV size is 1400 bytes in legacy mode.
The maximum configurable value for the lower threshold bin is 4,294,967,294.
Frame loss ratio (FLR) is excluded in loss measurements during period of unavailability for synthetic loss measurement only. In case of loss measurement, FLR is included even during period of unavailability.
During a period of loss of continuity (adjacency down), although SOAM PDUs are not sent, FLR and availability calculations are not stopped. These calculations are performed with the assumption of 100% loss.
The number of SOAM PDUs that are sent during the first measurement interval might be less than expected. This is because of a delay in detecting the adjacency state at the performance monitoring session level.
The number of SOAM PDUs transmitted during a measurement interval for a cycle time of 100 ms might not be accurate. For example, in a measurement interval of two minutes with a cycle time 100 ms, the SOAM PDUs transmitted might be in the range of 1198—2000.
See Also
Damping CFM performance Monitoring Traps and Notifications to Prevent Congestion of The NMS
You can dampen the performance monitoring threshold-crossing traps and notifications that are generated every time a threshold-crossing event occurs to prevent congestion of the network management system (NMS).
Damping limits the number of jnxSoamPmThresholdCrossingAlarm traps sent to the NMS by summarizing the flap occurrences over a period of time, known as the flap trap timer, and sends a single jnxSoamPmThresholdFlapAlarm notification to the NMS. You can configure the duration of the flap trap timer to any value from 1 through 360 seconds.
The jnxSoamPmThresholdFlapAlarm notification is generated and sent when the following conditions are met:
At least one flap has occurred when the flap timer has expired.
You changed the value of the flap trap timer, which caused the timer to stop.
You can enable damping at the global level for the iterator
or you can enable damping at the individual threshold type of the
iterator. For instance, to enable damping at the global level, for
the iterator, use the following command: set protocols oam ethernet
cfm performance-monitoring sla-iterator-profiles profile-name flap-trap-monitor
. To enable damping at a specific threshold
type, for the avg-fd-twoway-threshold
, use the following
command: set protocols oam ethernet cfm performance-monitoring
sla-iterator-profiles profile-name avg-fdv-twoway-threshold
flap-trap-monitor
.
You can also disable damping.
See Also
Change History Table
Feature support is determined by the platform and release you are using. Use Feature Explorer to determine if a feature is supported on your platform.
no-control-word
statement for all
Layer 2 VPNs and Layer 2 circuits over which you are running CFM MEPs.no-control-word
statement for all
Layer 2 VPNs and Layer 2 circuits over which you are running CFM MEPs.no-control-word
statement for all
Layer 2 VPNs and Layer 2 circuits over which you are running CFM MEPs.