LAB: Avaya Ethernet Routing Switch 5600 6.2.4 -> 6.2.5 upgrade

Please read documentation before upgrading your system.
We decided to upgrade from software version 6.2.4 to 6.2.5. It is going to be done with console access.
It is easy to upgrade, but you must know what to do with command download.

Firstly, you need a new software, an USB 2.0 flash with software on it or a TFTP server (tftp32, atftpd, ...). Then you have to realize that you have a correct version already running on your stacks:

# show boot

# show system verbose


So we have diagnostic image 6.0.0.15 which is already newest in time of writing this (2013-02-05). Switch runs firmware from primary 6.2.4. Firmware version 6.1.7 is set as secondary (there is a lot of difference between 6.1.7 and 6.2.4). Note - switch always boots primary. But you direct it to boot secondary with command "boot secondary".

Our situation is simplified, because we have two pure (not mixed with 5500) stacks forming a cluster.

We are going to "upgrade" secondary boot image first.

 # download address 10.255.253.3 primary image 5xxx_625027s.img no-res

Then. You can check status of upgrade observing switch port LEDs. Duration download and saving firmware to two-switch stack is between 4 and 5 minutes. Please read documentation for more information. After that you can see with # show boot, that there is no secondary image on primary Switch #1. This should be fine.

After booting new image

# boot

or

# reload force minutes-to-wait 1

new image will boot. But you have a problem. Secondary is still 6.1.7 and you want 6.2.4.

Here I noticed some kind of bug. Command:

# download address 10.255.253.3 secondary image 5xxx_624011s.img no-res

did not upgrade secondary image but primary. So I have again 6.2.4 as primary and 6.1.7 as secondary. (I tried this scenario multiple times with same starting situation even with restart after doing upgrade of secondary. )

After I put command  

# download address 10.255.253.3 secondary image 5xxx_624011s.img 

again (2nd time) it fortunately upgraded secondary. So for now we have 6.2.4 and 6.2.4. Now you can upgrade primary with new software

# download address 10.255.253.3 primary image 5xxx_625027s.img no-res

Here you should have 6.2.5 and 6.2.4 on primary and secondary installed.

I find some kind of helpful this command:

# toggle-next-boot-image

and

# boot secondary

End Note:
Boot image = software = firmware
Sometimes a diagnostic image is named firmware.

toggle-next-boot-image
Use this procedure to toggle the next boot image.

boot secondary
Use this procedure to use the secondary boot image.

Documentation: google for NN47200-500_06.02 or NN47200-500 Configuration System

Mirroring from multiple physical interfaces to one interface

How to port mirror from multiple physical interfaces (on multiple devices) to a server with single ethernet interface?

(updated 25th March 2013)
How to differentiate between port mirroring source? You can choose netflow or sflow for switches, but not all devices can handle as much as every packet - 1:1 packet rate. In my example, I have an SRX 210. Mirrored ports are trunk ports with native vlan configured. You may know it as hybrid port. Incoming packet with no vlan tag is assigned to particular vlan (vlan 10). Other packet must have particluar vlan tag (vlan 5, vlan 6) that is configured on switch port. I did not tested port mirror on Juniper EX switches but rather Avaya switches 5000 series. Juniper EX port mirror configuration is added.

Configuration of Juniper EX switch for this type of port

# show interfaces

 ge-0/0/0 {
    unit 0 {
        family ethernet-switching {
            port-mode trunk;
            vlan {
                members [ 5 6 ];
            }
            native-vlan-id 10;
        }
    }
} 

Port mirroring of TX and RX traffic on Juniper EX switch

# show ethernet-switching-options
analyzer myportmirror {
    loss-priority high;
    input {
        ingress {
            interface ge-0/0/20.0;
        }
        egress {
            interface ge-0/0/20.0;
        }
    }
    output {
        interface {
            ge-0/0/0.0;
        }
    }
}

Avaya ERS 5600 with firmware 6.2.x

port-mirroring mode Xrx monitor-port 1 mirror-port-X 2

vlan create 5-6,10 type port 1
vlan configcontrol flexible
vlan members 1 NONE
vlan members 5-6,10 2
vlan ports 2 pvid 10
vlan configcontrol strict

Scenario

We want to mirror traffic from two devices, for example switches, but have server with single interface for pcap.
1. Turn on port mirroring on two devices.
2. Connect SRX 210 port ge-0/0/1 to server and ports from that two devices  devices to port fe-0/0/4 and fe-0/0/5.
3. Configure 802.1ad (QinQ) on SRX so ge-0/0/1 trunk port is facing a backbone and fe-0/0/4, fe-0/0/5 is facing CE. Each port connected to switch has its own S-vlan. All tagged and untagged (C-vlan) packets will now have additional L2 header (S-vlan).

Diagram

SRX 210 Configuration

interfaces {

    ge-0/0/1 {
        description "port mirror";
        unit 0 {
            family ethernet-switching {
                port-mode trunk;
                vlan {
                    members [ port1 port2 ];
                }
            }
        }
    }

    fe-0/0/4 {
        description "Mirror 1";
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members port1;
                }
            }
        }
    }
    fe-0/0/5 {
        description "Mirror 2";
        unit 0 {
            family ethernet-switching {
                port-mode access;
                vlan {
                    members port2;
                }
            }
        }
    }

}

# show vlans
port1 {
    vlan-id 1004;
    dot1q-tunneling;
}
port2 {
    vlan-id 1005;
    dot1q-tunneling;
}

To conserve MAC address table on SRX 210, disable MAC address learning on port, or vlans

ethernet-switching-options {
    interfaces {
        ge-0/0/1.0 {
            no-mac-learning;
        }
        fe-0/0/4.0 {
            no-mac-learning;
        }
        fe-0/0/5.0 {
            no-mac-learning;
        }
    }
}

I don't see a possibility to create firewall filter that drops incoming packet on port configured with family ethernet-switching.

Observing results. PC with Wireshark is connected to port ge-0/0/1. Please notice text under pictures.

Packet from fe-0/0/4, tagged to vlan 1004, packet was received untagged on fe-0/0/4.

Packet from fe-0/0/4, double tagged with additional vlan 1004, and original vlan 5.

Packet from fe-0/0/4, double tagged with additional vlan 1004, and original vlan 6. Difference between this and previous picture is vlan 6.

Mirrored port fe-0/0/5

Packet from fe-0/0/5, double tagged with additional vlan 1005, and original vlan 5.

Packet from fe-0/0/4, double tagged with additional vlan 1004, and original vlan 5.

Packet from fe-0/0/5, double tagged with additional vlan 1004, and original vlan 6. Difference between this and previous picture is vlan 6.

Note: You can see packets tagged with S-vlan as configured. Each port has its own S-vlan.

Bear in mind that packets received on server could be in wrong order because of SRX internal processing.

Jozef Klacko

References

Application note: J Series and branch SRX series ethernet switching configuration guide (pdf)
Avaya support documentation webpage: http://support.avaya.com/downloads/