How to configure MPLS in Ufispace
UFISPACE – MPLS configuration In this article, you will learn how to configure MPLS in a multi-vendor topology involving UFISPACE, Huawei, and Mikrotik equipment. We will be using the following equipment: Physical topology of the MPLS scenario: The aim is to set up MPLS LDP between all the devices, and then set up VPWS and VPLS tunnels on 56DX and 28DC, 6730 and Mikrotik to test interoperability between the vendors. Let’s start the configurations with the UFISPACE 56DX. Configuring the loopback interface: Configuration of the OSPF protocol: Configuring the LDP protocol: Configuration of the interfaces that communicate between the equipment with MPLS: Note: what enables MPLS on the interfaces are the “label-switching” and “enable-ldp ipv4” commands. The next step is to configure the UFISPACE 28DC: Configuring the loopback interface: Configuration of the OSPF protocol: Configuring the LDP protocol: Configuration of the interfaces that communicate between the equipment with MPLS: Now we’re going to configure the Huawei S6730. Configuring the loopback interface: Configuration of the OSPF protocol: Configuring the MPLS protocol: Enable L2VPN mpls: Configuration of remote peers: Configuration of interfaces with MPLS enabled: Finally, let’s configure the mikrotik RB450. Configuring the loopback interface: Configuring the MPLS protocol: ip configuration of mpls interfaces: Now let’s see if the OSPF/MPLS neighbors have come up on the 56DX, Huawei and Mikrotik. Let’s just check out these 3 different vendors. We started with the UFISPACE 56DX: Verification of OSPF neighbos: Verification of LDP neighbors: We have verified that on the Ufispace 56DX side the OSPF and MPLS neighbors are forming correctly. Now let’s check it out on the Huawei S6730: Verification of OSPF neighbos: Verification of MPLS neighbors: We’ve seen that Huawei is also closing OSPF and LDP adjacencies. Finally, let’s validate it in mikrotik: Verification of OSPF neighbors: Verification of LDP neighbors: Checking through mikrotik we see that it has also closed the adjacencies correctly. Now that we have our scenario with mpls enabled between all the devices, let’s configure a VPWS tunnel between 56DX and 28DC. Configuring VPWS is simple, as we’ll see below. Let’s start configuring Ufispace 56DX by following a few steps. 1 – Create the l2-circuit tunnel: The number 3 in bold here is the tunnel ID, and right after that we have neighbor 3.3.3.3 which is Ufispace 28DC. 2 – Now we need to create a service-template that matches the vlan we want to transport, as in the example: In this example, we are configuring VLAN 10. It’s also possible to transport the entire port, in which case we need to create a template that contains a match-all, as shown in the example: 3 – The last step in closing the tunnel is to assign l2-circuit to the physical interface, which in this example will be the xe3/3 interface: That’s done on the 56DX, now let’s do the configuration on the 28DC device. On the Ufispace 28DC we need to do the same steps, but only change the IP of the MPLS neighbor, which will be the 56DX with IP 2.2.2.2, as we’ll see below: 1 – Create the l2-circuit tunnel: 2 – Create the service-template for vlan 10: 3 – Assign l2-circuit to the physical interface, which in this example will be the xe6 interface: We already have the configuration ready on both sides, let’s do the validations. Verification of the 56DX virtual-circuit tunnel: Checking the tunnel on the 28DC side: As we saw above, we now have a VPWS connection between 56DX and 28DC. Now we’re going to set up a VPLS connection using vlan 235 between 56DX, 28DC and Huawei S6730. Configuring the vpls tunnel on the 56DX: Assigning the VPLS to the interface: Assigning the VPLS to the interface: Configuring the vpls tunnel on 28DC: Assigning the VPLS to the interface: Validation of the vpls tunnel on the 56DX device. We can see that the tunnel is UP with the two peers, the Ufispace 28DC and the Huawei S6730: We found that the VPLS tunnel was also UP on the Huawei device: We also carried out VPLS tests between Ufispace and Mikrotik, which we can see worked normally, but we won’t go into detail about the settings so that this manual doesn’t get too long. You can see in the image that the VPLS between Ufispace 56DX and Mikrotik has been set up correctly: Conclusion: In this article we have demonstrated how to configure MPLS on Ufispace equipment and how to interoperate it with other vendors. We’ve seen that the configuration is relatively simple and makes it a great option for the network. In this article, you learned how to configure MPLS in a multi-vendor topology involving Ufispace, Huawei, and Mikrotik equipment. We followed a detailed step-by-step guide to configure MPLS LDP, VPWS, and VPLS tunnels, ensuring interoperability between different manufacturers. Would you like to speak with one of our UfiSpace and IPInfusion experts? At Made4it, we specialize in these technologies and offer comprehensive configuration and support services. In addition, we are official partners of Padtec, which sells UfiSpace routers. Contact us to learn more and optimize your network with professional solutions. See you in the next article!!
How to set up BGP sessions on Ufispace devices
This article will show you how to create BGP sessions on Ufispace devices, as well as some examples of filters, prefix lists and community application. To work out the configurations, the following scenario will be used: BGP Policy: Default route announcement + local prefix; Accept only the 210.0.0.0/22 prefix with community tag 65000:1000; Both using a route map Default route prefix list configuration: Prefix-List configuration with prefixes 200.0.0.0/22 and 210.0.0.0/22, allowing up to /24: Route-Map configuration allowing ASN prefix 65010 and marking community 65000:1000 : Route-Map configuration to announce default route and 200.0.0.0/22 prefix: Configuration of blackhole routes (to avoid static loops and create routes in the routing table): Access BGP configuration by entering the Local AS: Configure Router-ID IPv4 network configuration: BGP neighbor configuration: Configuring BGP filters: Check configuration and apply: To check the status of the BGP session: Check what is being announced in the BGP session: Check what we have received as a prefix: Summary of all settings applied
L3 configuration on Ufispace equipment
Static and Dynamic Routing Protocols, OSPF and BGP We’re going to present Layer 3 (L3) configuration on Ufispace equipment, both static and dynamic, using protocols such as OSPF (Open Shortest Path First) and BGP (Border Gateway Protocol). Below is a guide to configuring these features. To start the configuration, you need to access the Ufispace device via the command line interface (CLI). We will demonstrate access via ssh, but it can also be done via serial connection and telnet. Configuration directly on the interface: Example vlan Sub-Interface configuration. Using vlan 4 as an example. To configure static routing, add static routes to the configuration: OSPF is a dynamic routing protocol widely used in corporate networks. To configure OSPF on the Ufispace device: V4 V6 Add the interfaces participating in OSPF using the following commands: To check that the settings are correct and working: Finally, save the configuration to ensure that the changes are retained after a reboot: Conclusion Configuring static and dynamic routing on Ufispace equipment involves specific steps to define IP addresses on interfaces, add static routes and configure routing protocols such as OSPF and BGP. By following this guide, you can set up efficient and robust routing on your network. By the end of this guide, you will be ready to configure static and dynamic routing on Ufispace devices, using protocols such as OSPF and BGP to ensure an efficient and robust network. Follow the steps carefully, and if you have any questions, consult the official documentation or seek expert assistance. Would you like to speak with one of our UfiSpace and IPInfusion specialists? We at Made4it are experts in these technologies and offer comprehensive configuration and support services. In addition, we are official partners of Padtec, which sells UfiSpace routers. Contact us to learn more and optimize your network with professional solutions. See you later! https://made4it.com.br/
How to configure vlans on Ufispace devices
This article will show you how to configure vlans on Ufispace devices in trunk, hybrid and access mode. First of all, here’s a step-by-step guide on how to create a VLAN: Access Privileged mode: Access configuration mode: Create Bridge and configure RSTP protocol (OcNos requirement). Create a Vlan and associate it to the bridge created: Exit “vlan database” mode Check for pending settings: Expected output from the above command: If you need to undo the settings, you can use the command: If the settings are correct, they can be applied with the command: To check the VLAN configuration: Once the Vlan has been created, it must be assigned to an interface, either in TAG or UNTAGGED mode (in access). How to configure VLAN in Trunk mode: Access interface: Configure in Layer2 mode and assign a Bridge (created previously): Configure interface mode in Trunk: Configure vlan in TAG on the interface: Check configuration and apply: How to configure VLAN in Access mode Create a Vlan and associate it to the bridge created: Access interface: Configure in Layer2 mode and assign a Bridge: Configure interface mode in Trunk: Set vlan to UNTAGGED on the interface: Check configuration and apply: How to configure VLAN in Hybrid mode Access interface: Configure in Layer2 mode and assign a Bridge: Set the interface mode to Hybrid: Set vlan to UNTAGGED on the interface: Configure vlan in TAGGED on the interface: Check configuration and apply: Summary of all settings applied: Once you have completed all these detailed configurations, you will be able to manage VLANs efficiently on Ufispace devices, ensuring an organized and secure network. Follow the steps carefully, and if you have any questions, don’t hesitate to consult the official documentation or contact specialized technical support. Would you like to speak with one of our UfiSpace and IPInfusion specialists? We at Made4it are experts in these technologies and offer comprehensive configuration and support services. Contact our consultants to learn more and optimize your network with professional solutions: https://made4it.com.br/
Where to use Ufispace
Ufispace Equipment: Uses and Services Supported Introduction Ufispace is a company in the field of networks and telecommunications, specializing in providing high-quality network infrastructure solutions. Its equipment is designed to meet the growing demands for connectivity, capacity and performance in various sectors. In this article, we’ll explore the S9600-72XC, S9600-56DX and S9510-28DC devices, where they can be used and what services they support. Ufispace equipment S9600-72XC – Features 8 40/100G ports, 64 1/10/25G ports, 2 10G ports (MGMT, optical), and 1 100/1000M port (MGMT, electrical); Intel Skylake-D 8-core processor @ 1.9GHz, 32GB DDR4 memory, 128GB SSD storage, switching capacity of 2.4Tbps, and 4GB deep buffer. S9600-56DX – Features 8 40/100/400G ports, 48 40/100G ports, 4 1/10/25G ports, and 1 100/1000M port (MGMT, Power); Intel Icelake-D 8-core processor @ 2.1GHz, 32GB DDR4 memory, 128GB SSD storage, switching capacity of 4.8Tbps, and 8GB deep buffer. S9510-28DC – Features 2 100/400G ports, 2 40/100G ports, 24 10/25G ports, and 1 100/1000M port (MGMT, Power); Intel Denverton-NS 4-core processor @ 1.6GHz (Standard) / Intel Denverton-NS 8-core processor @ 1.7GHz (Premium), 8GB DDR4 memory (Standard) / 16GB DDR4 (Premium), 32GB SSD storage (Standard) / 128GB SSD (Premium), and switching capacity of 800Gbps with a 2GB deep buffer. Use of Ufispace Equipment Due to its high port density and switching capacity. As a Data Center Core or Server Aggregator. They can be used in Core topology scenarios, Aggregation, working as BGP, MPLS, as P and PE. In L2VPN, L3VPN, 6PE scenarios. Conclusion Ufispace switches are a great choice in data centers for critical functions such as server core and aggregation due to their high port density and switching capacity. For ISPs, they offer the robustness and flexibility needed for complex topologies, supporting protocols such as BGP and MPLS, as well as services such as L2VPN and L3VPN. Equipped with state-of-the-art processors, abundant memory and efficient storage, these switches guarantee superior performance and high capacity, making them ideal for building modern and efficient network infrastructures.
Initial access to Ufispace
Today we’re going to talk about how to perform initial access to UFISPACE devices with IP Infusion’s OcNOS operating system. The first time you access the device, you must use a serial cable. Most computers today do not have a serial port, so you can use a USB-to-RJ45 console adapter, as shown in the photo: With the cable in hand, connect the RJ45 side to the console port of the UFISPACE device, as shown in the example below: With the physical connection between the computer and UFISPACE, we can then use software, such as teraterm, putty, among others to make the initial access. In this example, we’ll demonstrate how to do it using Putty. To do this, open PuTTY and enter the information as shown below: In Serial line, enter the name of your computer’s COM interface. This can vary according to each device. Speed access to UFISPACE must be set to 115200. When you log in via the console, you’ll be taken to the username and password prompt screen, which by default displays the username “ocnos” and password “ocnos”: After logging in via the console, the first recommendation is to change the ocnos user’s password to a stronger one. To do this, follow these steps: 1 – Enter enable mode: OcNOS>enable 2 – Enter configuration mode: OcNOS#configure terminal 3 – Change the user’s password and create a new user, as shown in the example: OcNOS(config)#username ocnos password S3nh4-Super-F0rt3 OcNOS(config)#username made4it password S3nh4-Super-F0rtissima OcNOS(config)#username made4it role network-admin 4 – Alterar o nome do equipamento: hostname UFISPACE-01 5 – Apply the configuration: OcNOS(config)#commit 6 – Finally, save the configuration: OcNOS(config)#do write Building configuration… [OK] Now, let’s set up a management interface. By default, UFISPACE equipment comes with the “eth0” interface for use with out-of-band management. A good practice is to leave management only in a management VRF, with access controlled only through that VRF. To do this, follow these steps: 1 – Accesses the eth0 interface: OcNOS(config)#interface eth0 2 – Assign VRF management to the interface: OcNOS(config-if)#ip vrf forwarding management 3 – Configures the management IP and interface description: OcNOS(config-if)#ip address 10.10.0.2/30 OcNOS(config-if)#description GERENCIA 4 – Apply settings and save: OcNOS(config)#commit OcNOS(config-if)#do write Building configuration… [OK] To validate the interface configuration, we can use the “show ip interface brief” command, as shown in the example: If you are in configuration mode, use the command “do show ip interface brief” To configure the default route in the vrf, we use the following command: OcNOS(config)#ip route vrf management 0.0.0.0/0 10.10.0.1 eth0 description ROTA DEFAULT OcNOS(config)#commit To validate the default route in the VRF, we can use the command: OcNOS#show ip route vrf management By default, ssh is already enabled in vrf management, if you want to disable it, use the command: OcNOS(config)#no feature ssh vrf management To enable SSH on vrf main, use the command: OcNOS(config)#feature ssh OcNOS(config)#commit Finally, it is important to set up ACLs to protect SSH access and only allow networks that can actually access the equipment. Let’s then configure the ACL that contains our admin networks, which in this case will be 10.10.0.0/30 and 172.16.0.0/24: OcNOS(config)#ip access-list admin OcNOS(config-ip-acl)#10 permit tcp 10.10.0.0/30 any eq ssh OcNOS(config-ip-acl)#20 permit tcp 172.16.0.0/24 any eq ssh OcNOS(config-ip-acl)#65000 deny any any any OcNOS(config-ip-acl)#commit Now we need to apply the ACL to line vty: OcNOS(config)#line vty OcNOS(config-all-line)#ip access-group admin in OcNOS(config-all-line)#commit OcNOS(config-all-line)#do write Building configuration… [OK] Testing ssh access with a newly created user: We can see that the access worked correctly. Now let’s test whether the ACL we created for protection is working. In this case, we’re going to use IP 172.20.0.1 as the source for accessing the device: We can see that ping works normally: However, it does not give us SSH access, confirming that the ACL is working correctly: Now let’s configure SNMP to monitor a system like Zabbix. To enable SNMP in vrf management, use the command: UFISPACE-01(config)#snmp-server enable snmp vrf management UFISPACE-01(config)#snmp-server community made4it vrf management UFISPACE-01(config)#commit If you use the vrf main to perform monitoring, simply use the following commands: UFISPACE-01(config)#snmp-server enable snmp UFISPACE-01(config)#snmp-server community made4it-vrf-main UFISPACE-01(config)#commit It is important that we keep the time of the device correct so that we can validate logs for troubleshooting with the correct local time. To do this, let’s configure NTP to update the date and time: UFISPACE-01(config)#feature ntp vrf management UFISPACE-01(config)#ntp enable vrf management UFISPACE-01(config)#ntp server 200.160.7.186 vrf management UFISPACE-01(config)#commit To check the NTP peers, we use the following command: #show ntp peers ———————————————————– Peer IP Address Serv/Peer ———————————————————– 200.160.7.186 Server (configured) #show ntp peer-status Total peers : 1 * – selected for sync, + – peer mode(active), – – peer mode(passive), = – polled in client mode remote refid st t when poll reach delay offset jitter ============================================================================== * 200.160.7.186 LOCAL(0) 7 u 14 32 37 0.194 -4.870 3.314 Now we have to correct the timezone so that the time is correct: UFISPACE-01(config)#clock timezone Sao_Paulo UFISPACE-01(config)#commit Another important feature is the possibility of using “commit confirmed” with timeout, to use in cases of configurations that may cause network downtime. Let’s do an example by changing the hostname and applying a commit confirmed timeout of 10 seconds: If the commit is not confirmed, the configuration will revert to the previous configuration: To confirm the commit, we use the “confirm-commit” command. Conclusion After completing the initial settings, the device will be ready to respond to SSH access via the network to the IPs authorized in the firewall and with the users configured. SNMP monitoring can also query the information using the Community created. If you have any questions about the initial configuration of UFISPACE, please contact us so that we can help you.
