Friday 27 March 2020

Upgrading Field Programmable Device (FPD) in CIsco IOS-XR


As per Cisco official site definition of FPD:
An FPD refers to any programmable hardware device on a router, which includes a Field Programmable Gate Array (FPGA) and Read Only Memory Monitor (ROMMON). Cisco IOS® XR routers use a number of FPDs that are crucial for the function of route processors, line cards, shared port adapters (SPAs), SPA Interface Processors (SIPs), and fan trays.


Sample of upgrading fpd in ASR9000 running in IOS-XR. Linecard used is 24x10GE Tomahawk linecard.


A. Check first the linecards installed

RP/0/RSP0/CPU0:ASR9K-BOX#show platform
Fri Mar 27 09:00:23.066 SGP
Node            Type                      State            Config State
-----------------------------------------------------------------------------
0/4/CPU0        A9K-24X10GE-1G-SE         IOS XR RUN       PWR,NSHUT,MON

B. See if need to upgrade , it will indicate Yes if need to upgrade.
Show it using this command "admin show hw-module fpd location all"
It will tell below that one of the FPDs need an upgrade. Type "yes" to reload"

RP/0/RSP0/CPU0:ASR9K-BOX#admin show hw-module fpd location all

===================================== ==========================================
                                      Existing Field Programmable Devices
                                      ==========================================
                                        HW                       Current SW Upg/
Location     Card Type                Version Type Subtype Inst   Version   Dng?
============ ======================== ======= ==== ======= ==== =========== ====

0/4/CPU0     A9K-24X10GE-1G-SE          1.0   lc   cbc     0      47.03     No
                                              lc   rommon  0      18.24     Yes
                                              lc   fpga2   0       1.87     Yes
                                              lc   fsbl    0       1.104    Yes
                                              lc   lnxfw   0       1.104    Yes
                                              lc   fpga3   0       1.00     No
                                              lc   fpga4   0       1.09     Yes
--------------------------------------------------------------------------------
NOTES:
1.  One or more FPD needs an upgrade.  This can be accomplished
    using the "admin> upgrade hw-module fpd <fpd> location <loc>" CLI.
2.  ^ One or more FPD will be intentionally skipped from upgrade using CLI with option "all" or during "Auto fpd".
      It can be upgraded only using the "admin> upgrade hw-module fpd <fpd> location <loc>" CLI with exact location.


C. Upgrade the FPD using the command "admin> upgrade hw-module fpd <fpd> location <loc>"

RP/0/RSP0/CPU0:ASR9K-BOX#admin
RP/0/RSP0/CPU0:ASR9K-BOX(admin)#upgrade hw-module fpd all location 0/4/CPU0

***** UPGRADE WARNING MESSAGE: *****
  *  This upgrade operation has a maximum timout of 90 minutes.  *
  *  If you are executing the cmd for one specific location and  *
  *  card in that location reloads or goes down for some reason  *
  *  you can press CTRL-C to get back the RP's prompt.           *
  *  If you are executing the cmd for _all_ locations and a node *
  *  reloads or is down please allow other nodes to finish the   *
  *  upgrade process before pressing CTRL-C.                     *

% RELOAD REMINDER:
  - The upgrade operation of the target module will not interrupt its normal
    operation. However, for the changes to take effect, the target module
    will need to be manually reloaded after the upgrade operation. This can
    be accomplished with the use of "hw-module <target> reload" command.
  - If automatic reload operation is desired after the upgrade, please use
    the "reload" option at the end of the upgrade command.
  - The output of "show hw-module fpd location" command will not display
    correct version information after the upgrade if the target module is
    not reloaded.
NOTE: Chassis CLI will not be accessible while upgrade is in progress.
Continue ? [no]: yes



FPD upgrade in progress on some hardware, reload/configuration change
on those is not recommended as it might cause HW programming failure
and result in RMA of the hardware.


Starting the upgrade/download of following FPDs:
=========== ==== ======= ======= =========== =========
                                   Current    Upg/Dng
Location    Type Subtype Upg/Dng   Version    Version
=========== ==== ======= ======= =========== =========
0/4/CPU0    lc   rommon  upg        18.24       18.27 
            lc   fpga2   upg         1.87        1.88 
            lc   fsbl    upg         1.104       1.110 
            lc   lnxfw   upg         1.104       1.110 
            lc   fpga4   upg         1.09        1.11 
------------------------------------------------------
 
FPD upgrade in progress. Max timeout remaining 89 min.
FPD upgrade in progress. Max timeout remaining 88 min.
FPD upgrade in progress. Max timeout remaining 87 min.
FPD upgrade in progress. Max timeout remaining 86 min.
FPD upgrade in progress. Max timeout remaining 85 min.
Successfully upgraded    rommon for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from 18.24 to 18.27
Successfully upgraded     fpga2 for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from  1.87 to  1.88
Successfully upgraded      fsbl for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from  1.104 to  1.110
Successfully upgraded     lnxfw for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from  1.104 to  1.110
Successfully upgraded     fpga4 for    A9K-24X10GE-1G-SE on location    0/4/CPU0 from  1.09 to  1.11


FPD upgrade has ended.

D. Reload the linecard that was upgraded using the command "hw-module location <loc> reload". Press y to reload.

RP/0/RSP0/CPU0:ASR9K-BOX(admin)#hw-module location 0/4/CPU0 reload

WARNING: This will take the requested node out of service.
Do you wish to continue?[confirm(y/n)]y
RP/0/RSP0/CPU0:ASR9K-BOX(admin)#

E. Verify again after reload. "No" means no longer need to upgrade , and it was successfully upgraded.

RP/0/RSP0/CPU0:ASR9K-BOX(admin)#show hw-module fpd location all

===================================== ==========================================
                                      Existing Field Programmable Devices
                                      ==========================================
                                        HW                       Current SW Upg/
Location     Card Type                Version Type Subtype Inst   Version   Dng?
============ ======================== ======= ==== ======= ==== =========== ====

0/4/CPU0     A9K-24X10GE-1G-SE          1.0   lc   cbc     0      47.03     No
                                              lc   rommon  0      18.27     No
                                              lc   fpga2   0       1.88     No
                                              lc   fsbl    0       1.110    No
                                              lc   lnxfw   0       1.110    No
                                              lc   fpga3   0       1.00     No
                                              lc   fpga4   0       1.11     No


Wednesday 25 March 2020

Configure Management Interface in Juniper

One of the best security practices in networking is separation of management traffic and data/control traffic. One way to achieve this is to use the management ports of Juniper devices to physically connect it preferably to different network.
The management Ethernet interface is usually em0 or fxp0 in Juniper, and provides out-of-band(OOB)management network of the device.
Assuming UTP cables are already connected to both management ports of both routing engine (RE) of the Juniper devices, here are the steps to follow:

1. Configure the following management IP address.
e.g.
re0 = 192.168.1.20
re1 = 192.168.1.21
vip = 192.168.1.22

configure:
#set groups re0 system host-name JUNOS-BOX-re0
#set groups re0 interfaces em0 unit 0 family inet address 192.168.1.22/26 master-only
#set groups re0 interfaces em0 unit 0 family inet address 192.168.1.20/26

#set groups re1 system host-name JUNOS-BOX-re1
#set groups re1 interfaces em0 unit 0 family inet address 192.168.1.22/26 master-only
#set groups re1 interfaces em0 unit 0 family inet address 192.168.1.21/26


It will be something like this when use show command
networkbio@JUNOS-BOX-re0# show groups re0
system {
    host-name JUNOS-BOX-re0;
}
interfaces {
    em0 {
        unit 0 {
            family inet {
                address 192.168.1.22/26 {
                    master-only;
                }
                address 192.168.1.20/26;
            }
        }
    }
}



networkbio@JUNOS-BOX-re0# show groups re1
system {
    host-name JUNOS-BOX-re1;
}
interfaces {
    em0 {
        unit 0 {
            family inet {
                address 192.168.1.22/26 {
                    master-only;
                }
                address 192.168.1.21/26;
            }
        }
    }
}

2. Configure Routing instance for management.  The name of the dedicated management instance is reserved and hardcoded as mgmt_junos. 
The name of the dedicated management instance is reserved and hardcoded as mgmt_junos

As per Juniper official website:
Once the mgmt_junos routing instance is deployed, management traffic no longer shares a routing table (that is, the default.inet.0 table) with other control or protocol traffic in the system, nor is configuring dynamic protocols on the management interface supported.

#set system management-instance

3. Configure the next-hop (192.168.1.1 is the gateway)

#set routing-instances mgmt_junos routing-options static route 0.0.0.0/0 next-hop 192.168.1.1

Commands to verify:
show route
show route protocol static
show route forwarding-table