EOS 4.30.0F TOI

802.1X is an IEEE standard protocol that prevents unauthorized devices from gaining access to the network.

EOS 4.21.3F introduces support for BGP Flowspec, as defined in RFC5575 and RFC7674. The typical use case is to filter or redirect DDoS traffic on edge routers.

This feature adds support for sending and receiving BGP IPv6 labeled-unicast routes with IPv4-mapped IPv6 next hops. With this feature enabled, when a BGP speaker receives a next hop with IPv4-mapped IPv6 address,

To understand why BGP-LU tunnels are required to be redistributed into LDP and vice versa, let’s consider the following basic topology for InterAS Option C. It uses IS-IS as IGP where indicated along with LDP:

BGP Monitoring Protocol (BMP) allows a monitoring station to connect to a router and collect all of the BGP announcements received from the router’s BGP peers. The announcements are sent to the station in the form of BMP Route Monitoring messages generated from path information in the router’s BGP Adj-Rib-In tables. A BMP speaker may choose to send either pre-policy routes, post-policy routes, or both.

Operations, Administration and Management (OAM) includes the following five broad functionalities for any service and transport infrastructure

Arista CloudEOS provides optimized routing and security functionality by connecting different enterprise branches, DCs and head office across different geographical regions, zones and sites.  It uses traffic engineering to leverage the best paths across a bunch of dynamic Path Selection( DPS ) tunnels which are used to carry the overlay data traffic. It uses the concept of AVT( Adaptive Virtual Topology) to map any given VRF traffic into a specific subsets of traffic each of which is treated uniformly for the routing/security perspective. 

By default when a configuration session is committed everything modified in the configuration session will be committed to the running configuration, even if the running-configuration has also changed since the configuration session was created. This means that if the running-config has been modified since the start of the configuration session then those modifications could be overridden when the configuration session is committed. 

The counters per-entry command places the ACL in counting mode. In counting mode, the feature generally displays the number of instances each rule in the list matches an inbound packet and the elapsed time since the last match. However, for certain select platforms, in addition to the packet counter, ACL counters can also be enabled for byte counts when applied to data plane ACLs.

Arista’s DCS-7130LBR series of switches are powerful network devices designed for ultra latency applications along with a wealth of networking features.

Application based routing has previously been restricted to use only the IP header fields to classify a flow into a user defined application.  A deep packet inspection module is now available and extends application identification for traffic destined for the WAN network.

As Ethernet technologies made their way into the Metropolitan Area Networks ( MAN ) and the Wide Area Networks ( WAN ), from the conventional enterprise level usage, they are now widely being used by service providers to provide end-to-end connectivity to customers. Such service provider networks are typically spread across large geographical areas. Additionally, the service providers themselves may be relying on certain internet backbone providers, referred to as “operators”, to provide connectivity in case the geographical area to be covered is too huge.

Source port filtering is enabled by default to prevent traffic from egressing out the same interface it ingressed on.

In vEos/CloudEos deployed as a WAN router, when DPS (Dynamic Path Selection) is configured, all the user traffic coming from the LAN side and going to the WAN side gets load balanced on the DPS paths. This feature enables the automatic discovery of end to end Path MTU for a DPS Path through an internal probing mechanism. 

DPS (Dynamic Path Selection) provides the ability to select different paths for different types of traffic to optimize application performance.

The feature allows the assignment of reserved IPv4 addresses from reserved ranges 240.0.0.0/4 and 0.0.0.0/8 to network interfaces. by default, with no option to turn that off.

Traffic policies applied to interfaces are used to match traffic based on packet header fields or their summarized counterparts and take configured actions against them. The match rules configured in these policies are usually installed in a prioritized hardware table (i.e., TCAM) where the action of the first-hit filter is taken. The summarized fields are also installed in various hardware tables. 

EOS currently supports EVPN Multicast by setting up PIM tunnels in the underlay with VXLAN as the transport. While this is an efficient delivery mechanism, it requires PIM to be deployed in the underlay. In certain cases, the overheads of provisioning/maintaining the multicast routers and the multicast routing state in the underlay may be significant. To support such scenarios, Ingress Replication (IR) or Head-End Replication (HER) can be used in the underlay to distribute overlay multicast traffic.

EOS supports the ability to match on a single VLAN tag (example: encapsulation dot1q vlan 10)  or a VLAN tag pair (example: encapsulation dot1q vlan 10 inner 20) to map matching packets to an interface. In this case, the encapsulation string is considered consumed by the mapped interface before forwarding, which means that the tags are effectively removed from the incoming packet for the purposes of any downstream forwarding.

This feature is used to send gratuitous ARPs and NDs to update the mac address in neighbors’ mac address table when the users configure to change the mac address in the routed interface.

This feature introduces the hardware forwarding support for IPv4 over IPv4, GRE-Tunnel interfaces on Arista Switches. A GRE-Tunnel interface acts as a logical interface which performs the GRE encapsulation or decapsulation.

This feature adds support for offloading BFD Transmit path to hardware (ASIC) for specific types of BFD sessions. This will improve accuracy of transmit timer implementations for BFD (especially with fast timers like 50 ms) and relieve pressure on the main CPU in scenarios of scale.

This feature adds support for separate unicast and multicast counters, per ingress interface and per traffic class. 

This is a platform-independent feature. Therefore applicable to all platforms that support L2 EVPN Multicast solution.

The document describes the support for dedicated and group ingress policing on interfaces without using QoS policy-maps to match on the traffic and apply policing.

The advertise high-metrics feature, when enabled on a device, advertises it with the metric as maxLinkMetric-1 value (i.e. 16777214). This allows the router to be used as a last resort if no other path is available.

This feature implements RFC 5310 that allows IS-IS PDUs to be authenticated using following secure hash algorithms (SHA): SHA-1, SHA-224, SHA-256, SHA-384 and SHA-512. The feature is supported in both default and non-default vrf. Unlike the existing authentication scheme based on MD5 and ClearText, with this feature two IS-IS nodes can be configured with different SHA algorithm and secret-key and can still exchange IS-IS PDUs. 

The difference between the two forms of authentication is in the level of security provided. In case of clear text authentication, the password is specified as text in the authentication TLV, making it possible for an attacker to break the authentication by sniffing and capturing IS-IS PDUs on the network.

This feature will allow the user to select whether port mirror destinations of type GRE tunnel include the optional “key” field in the GRE header on certain platforms. The key field allows the user to uniquely identify a particular packet flow. The feature also allows the user to specify the value of the 32 bit key field.

EOS-4.30.0F adds support for relaxing L1 CLI guards. This feature allows the ability to configure the handling of unsupported L1 configurations (e.g. speed, error-correction, etc.): either rejecting the unsupported configurations with error messages or prompting for confirmation with warning messages.

At a high level, L1 profiles are a set of configurations which allow EOS users to change the numbering scheme and default L1 configurations of all front panel interfaces across their network switch.

Arista's 7130 Connect Series of Layer 1+ switches are powerful network devices that allow for dynamic connections between various layer 1 components on the system, such as the front panel, FPGA, and ASIC ports. 

A L2 sub-interface is a logical bridging endpoint associated with traffic on an interface distinguished by 802.1Q tags, where each <interface, 802.1q tag> tuple is treated as a first class bridging interface.

Introduced in EOS-4.20.1F, “selectable hashing fields” feature controls whether a certain header’s field is used in the hash calculation for LAG and ECMP.

MACsec Stateful Switchover (SSO) allows for a switchover from an active supervisor to a standby supervisor where MACsec traffic remains undisrupted during switchover. This TOI describes details and limitations of MACsec Stateful Switchover.

The main motivation for the feature is to provide high availability to the ManagementActive interface (Management0) via multiple redundant paths in the modular system. The ManagementActive interface(Management0) is a virtual interface pointing to the active supervisor.

This feature allows classification of packets on QoS policy-maps based on the Class of Service (CoS), VLAN, Drop Eligible Indicator (DEI) in the 802.1q header of the packet. CoS (Class of Service) corresponds to the Priority code point (PCP) bits in the 802.1q header.

MDI/MDI-X refer to the pin layout of BASE-T ports on various networking devices. Historically, servers, workstations etc. use MDI pin layout while switches generally have MDI-X pin layout. MDI is part of the media attachment unit that provides the physical and electrical connection to the cabling medium when linking two endpoint devices.

MetaMux is an FPGA-based feature available on Arista’s 7130 platforms. It performs ultra-low latency Ethernet packet multiplexing with or without packet contention queuing. The port to port latency is a function of the selected MetaMux profile, front panel ingress port, front panel egress port, FPGA connector ingress port, and platform being used.

MetaWatch is an FPGA-based feature available for Arista 7130 Series platforms. It provides precise timestamping of packets, aggregation and deep buffering for Ethernet links. Timestamp information and other metadata such as device and port identifiers are appended to the end of the packet as a trailer.

Arista switches provide several mirroring features. Filtered mirroring to CPU adds a special destination to the mirroring features that allows the mirrored traffic to be sent to the switch supervisor. The traffic can then be monitored and analyzed locally without the need of a remote port analyzer. Use case of this feature is for debugging and troubleshooting purposes.

From the 4.29.2F release of EOS, proactive probing of servers is supported. Using this feature Arista switches can continuously probe configured servers to check their liveliness and use the information obtained from these probes while sending out requests to the servers.

This feature enables per port TC-To-COS mapping, where TC represents Traffic-Class and COS represents Vlan tag PCP bits. While at present there is a global TC-To-COS mapping, we can use the TC-To-COS feature to create custom profiles which can be applied to the required interfaces. 

This article is intended to discuss how to configure the Phone VLAN on an Arista switch.

Policy-based routing (PBR) is a feature that is applied on routable ports, to preferentially route packets. Forwarding is based on a policy that is enforced at the ingress of the applied interface and overrides normal routing decisions. In addition to matches on regular ACLs, PBR policy-maps can also include “raw match” statements that look like a single entry of an ACL as a convenience for users.

Precoding is used to help reduce the burst error length of DFE (Decision Feedback Equalizer) error events with PAM-4 modulation

This priority drop feature provides a way to drop packets according to QOS priority when the device ingress maximum packet rate is oversubscribed.

Enabling “Proxy ARP/ND for Single Aggregation (AG) VTEP Campus Deployments without EVPN” allows an aggregation VTEP to proxy reply to a VXLAN-encapsulated ARP request/NS when the ARP/NS target host is remote and the ARP/ND binding is already learned by the AG VTEP.

Routing control functions (RCF) is a language that can be used to express route filtering and attribute modification logic in a powerful and programmatic fashion.

Routing Control Functions (RCF) is a language that can express route filtering and attribute modification logic in a powerful and programmatic fashion.The document covers: Configurations of a RCF function for BGP points of application