Admission control errors are not generated by Juniper Networks routers. These errors are sent from other vendor's equipment to a Juniper Networks router and appear in the log output of the show mpls lsp extensive command.
Admission control occurs on receipt of an RSVP Path message. When a new Path message is considered for admission, the bandwidth requested is compared with the bandwidth available at the priority specified in the Setup Prio field. If the requested bandwidth is not available, a PathErr message is returned with an Error Code of 01, admission control failure. See RFC 3209 for more details.
In this case study, the presenting problem is an admission control failure message in the output for the show mpls lsp extensive command. After the initial investigation, the available bandwidth is adjusted to accommodate the requested bandwidth. This action does not resolve the problem, and admission control failure messages continue to appear in the output for the show mpls lsp extensive command.
Upon further investigation, the admission control failure messages appear only when fast reroute is configured. When fast reroute is removed from the configuration, the admission control errors disappear. Fast reroute protection is required in the network configuration, indicating that removing fast reroute is not a viable solution. The problem is redefined as an interoperability issue and the investigation examines possible causes.
Figure 16 illustrates a network topology that is representative of a situation in which interoperability issues cause an admission control error.
The MPLS network topology in Figure 16 shows an Ethernet network of Juniper Networks and non-Juniper Networks equipment that consists of the following components:
- Seven LSPs originating from a T640 routing platform
- Four LSPs terminating at Juniper Networks equipment (
lsp1,lsp2,lsp6, andlsp7) - Three LSPs terminating in non-Juniper Networks equipment (
lsp3,lsp4, andlsp5) - All LSPs are transiting Non-Juniper Networks equipment
- MPLS trace options is enabled on the T640 routing platform
A sample configuration for the T640 routing platform shown in Figure 16 is provided at the end of this case study in Router Configuration.
Symptom
In the network shown in Figure 16, admission control failure messages appear in the output for the show mpls lsp ingress extensive command as shown in the following output.
user@T640> show mpls lsp ingress extensive
Ingress LSP: 7 sessions
10.100.100.2
From: 10.100.100.1, State: Up, ActiveRoute: 0, LSPname: lsp4
ActivePath: primary (primary)
FastReroute desired
LoadBalance: Random
Encoding type: Packet, Switching type: Packet, GPID: IPv4
*Primary primary State: Up
Bandwidth: 10Mbps
SmartOptimizeTimer: 180
Computed ERO (S [L] denotes strict [loose] hops): (CSPF metric: 10)
21.0.0.1 S
Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt):
21.0.0.1
1515 Aug 5 11:22:50 21.0.0.1: Admission Control failure[642 times]
1514 Aug 4 19:46:39 Fast-reroute Detour Up
1513 Aug 4 19:46:39 21.0.0.1: Admission Control failure
1512 Aug 4 19:46:39 Up
1511 Aug 4 19:46:39 Down
1510 Aug 4 19:46:36 21.0.0.1: Admission Control failure
1509 Aug 4 19:46:36 Up
1508 Aug 4 19:46:36 Down
1507 Aug 4 19:46:30 21.0.0.1: Admission Control failure
1506 Aug 4 19:46:27 Selected as active path
1505 Aug 4 19:46:27 Record Route: 21.0.0.1
1504 Aug 4 19:46:27 Up
[...Output truncated...]
Total 7 displayed, Up 7, Down 0
What It Means
The sample output for the show mpls lsp ingress extensive command is a snippet that shows one of the problem LSPs (lsp4). There are seven ingress LSPs (7 sessions) in the Up state (Up 7), even though at least four of the LSPs have admission control failure messages similar to this one. (See Troubleshooting Commands for the output for all seven LSPs.) The LSPs with the admission control messages appear to be intermittently coming up and going down (flapping).
Cause
The cause of the admission control failure errors appears to be that the other vendor's equipment cannot work with the RSVP Path message sent by the JUNOS software. In the Fast Reroute (FRR) object, the JUNOS software includes a legacy object and not the standard object. (See RFC 4090 for more information on FRR objects.)
The legacy object has a flags field value of 0x00, which indicates that one-to-one (fast reroute) or facility backup are not required. The standard object includes a value of 1 or 2 in the flags field depending on the type of protection required. 0x01 indicates one-to-one (fast reroute) backup required, and 0x02 indicates facility backup (many-to-one) backup required.
The JUNOS software recognizes both the legacy and standard forms of the fast-reroute object. At the moment, JUNOS software sends out only the legacy form which does not have a flags field value (0x00). In this case, the flags field value should be 0x01 for one-to-one or fast reroute backup. (See Figure 17.)
Figure 17 shows multiple RSVP Path messages for the same destination with a flags field value of 0x00, indicating that one-to-one or facility backup is not required.
Troubleshooting Commands
The JUNOS software includes commands that are useful when troubleshooting a problem. This section provides a brief description of each command, followed by sample output, and a discussion of the output in relation to the problem.
The following commands can be used when troubleshooting an admission control failure problem:
user@host> show mpls lsp ingress extensive
user@host> show configuration protocols mpls
user@host>monitor startfilename
user@host>show logfilename
 |
NOTE: Before you use the |
Sample Output
Use show mpls lsp lsp-name ingress extensive command to display detailed information about LSPs configured on the ingress router.
user@T640> show mpls lsp ingress extensive
Ingress LSP: 7 sessions
10.100.100.5
From: 10.100.100.1, State: Up, ActiveRoute: 0, LSPname: lsp1
ActivePath: primary (primary)
LoadBalance: Random
Encoding type: Packet, Switching type: Packet, GPID: IPv4
*Primary primary State: Up
Bandwidth: 10Mbps
SmartOptimizeTimer: 180
Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt):
21.0.0.1 31.0.0.1
11 Aug 4 19:46:27 Selected as active path
10 Aug 4 19:46:27 Record Route: 21.0.0.1 31.0.0.1
9 Aug 4 19:46:27 Up
[...Output truncated...]
10.100.100.6
From: 10.100.100.1, State: Up, ActiveRoute: 0, LSPname: lsp2
ActivePath: primary (primary)
LoadBalance: Random
Encoding type: Packet, Switching type: Packet, GPID: IPv4
*Primary primary State: Up
Bandwidth: 10Mbps
SmartOptimizeTimer: 180
Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt):
21.0.0.1 25.0.0.1
11 Aug 4 19:46:27 Selected as active path
10 Aug 4 19:46:27 Record Route: 21.0.0.1 25.0.0.1
9 Aug 4 19:46:27 Up
[...Output truncated...]
10.100.100.3
From: 10.100.100.1, State: Up, ActiveRoute: 0, LSPname: lsp3
ActivePath: primary (primary
FastReroute desired
LoadBalance: Random
Encoding type: Packet, Switching type: Packet, GPID: IPv4
*Primary primary State: Up
Bandwidth: 10Mbps
SmartOptimizeTimer: 180
Computed ERO (S [L] denotes strict [loose] hops): (CSPF metric: 20)
33.0.0.1 S 21.1.0.1 S
Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt):
33.0.0.1(flag=1) 21.1.0.1
608 Aug 4 19:46:30 21.0.0.1: Admission Control failure
607 Aug 4 19:46:27 Selected as active path
606 Aug 4 19:46:27 Record Route: 21.0.0.1 10.0.0.1
605 Aug 4 19:46:27 Up
604 Aug 4 19:46:27 Originate Call
603 Aug 4 19:46:27 CSPF: computation result accepted
602 Aug 4 19:46:27 Clear Call
601 Aug 4 19:46:27 Deselected as active
600 Aug 3 10:59:13 Fast-reroute Detour Up
599 Aug 3 10:59:13 Record Route: 33.0.0.1(flag=1) 21.1.0.1
598 Aug 3 10:58:57 Record Route: 33.0.0.1 21.1.0.1
597 Aug 3 10:58:57 Fast-reroute Detour Down
596 Aug 1 11:14:38 Record Route: 33.0.0.1(flag=1) 21.1.0.1
595 Aug 1 11:14:38 Fast-reroute Detour Up
594 Aug 1 11:14:18 Record Route: 33.0.0.1 21.1.0.1
593 Aug 1 11:14:18 Up
592 Aug 1 11:14:18 Originate make-before-break call
591 Aug 1 11:14:18 CSPF: computation result accepted
590 Aug 1 11:14:18 21.0.0.1: Admission Control failure
589 Aug 1 11:14:16 Fast-reroute Detour Down
588 Aug 1 11:14:15 Record Route: 21.0.0.1 10.0.0.1
587 Aug 1 11:14:15 Up
[...Output truncated...]
10.100.100.2
From: 10.100.100.1, State: Up, ActiveRoute: 0, LSPname: lsp4
ActivePath: primary (primary)
FastReroute desired
LoadBalance: Random
Encoding type: Packet, Switching type: Packet, GPID: IPv4
*Primary primary State: Up
Bandwidth: 10Mbps
SmartOptimizeTimer: 180
Computed ERO (S [L] denotes strict [loose] hops): (CSPF metric: 10)
21.0.0.1 S
Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt):
21.0.0.1
1515 Aug 5 11:22:50 21.0.0.1: Admission Control failure[642 times]
1514 Aug 4 19:46:39 Fast-reroute Detour Up
1513 Aug 4 19:46:39 21.0.0.1: Admission Control failure
[...Output truncated...]
10.100.100.4
From: 10.100.100.1, State: Up, ActiveRoute: 0, LSPname: lsp5
ActivePath: primary (primary)
FastReroute desired
LoadBalance: Random
Encoding type: Packet, Switching type: Packet, GPID: IPv4
*Primary primary State: Up
Bandwidth: 10Mbps
SmartOptimizeTimer: 180
Computed ERO (S [L] denotes strict [loose] hops): (CSPF metric: 30)
33.0.0.1 S 21.1.0.1 S 15.0.0.2 S
Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt):
33.0.0.1(flag=9) 21.1.0.1(flag=1) 15.0.0.2
572 Aug 4 19:47:39 Record Route: 33.0.0.1(flag=9) 21.1.0.1(flag=1) 15.0.0.2
571 Aug 4 19:46:54 Record Route: 33.0.0.1(flag=9) 21.1.0.1 15.0.0.2
570 Aug 4 19:46:54 Fast-reroute Detour Up
569 Aug 4 19:46:30 Record Route: 33.0.0.1 21.1.0.1 15.0.0.2
568 Aug 4 19:46:30 Up
567 Aug 4 19:46:30 Originate make-before-break call
566 Aug 4 19:46:30 CSPF: computation result accepted
565 Aug 4 19:46:30 21.0.0.1: Admission Control failure
564 Aug 4 19:46:27 Selected as active path
[...Output truncated...]
10.100.100.9
From: 10.100.100.1, State: Up, ActiveRoute: 0, LSPname: lsp6
ActivePath: (primary)
FastReroute desired
LoadBalance: Random
Encoding type: Packet, Switching type: Packet, GPID: IPv4
*Primary State: Up
SmartOptimizeTimer: 180
Computed ERO (S [L] denotes strict [loose] hops): (CSPF metric: 20)
21.0.0.1 S 28.0.0.1 S
Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt):
21.0.0.1 28.0.0.1
219152 Aug 5 11:24:10 21.0.0.1: Admission Control failure
219151 Aug 5 11:24:10 Up
219150 Aug 5 11:24:10 Down
[...Output truncated...]
10.100.100.8
From: 10.100.100.1, State: Up, ActiveRoute: 0, LSPname: lsp7
ActivePath: primary (primary)
FastReroute desired
LoadBalance: Random
Encoding type: Packet, Switching type: Packet, GPID: IPv4
*Primary primary State: Up
Bandwidth: 10Mbps
SmartOptimizeTimer: 180
Computed ERO (S [L] denotes strict [loose] hops): (CSPF metric: 20)
21.0.0.1 S 27.0.0.1 S
Received RRO (ProtectionFlag 1=Available 2=InUse 4=B/W 8=Node 10=SoftPreempt):
21.0.0.1 27.0.0.1
71812 Aug 5 11:24:11 21.0.0.1: Admission Control failure[2 times]
71811 Aug 5 11:24:11 Fast-reroute Detour Up
71810 Aug 5 11:24:11 Up
71809 Aug 5 11:24:11 Down
[...Output truncated...]
Total 7 displayed, Up 7, Down 0
What It Means
The sample output of the show mpls lsp ingress extensive command shows detailed information about the seven ingress LSPs on the T640 platform. All LSPs are up. Five LSPs (lsp3, lsp4, lsp5, lsp6, and lsp7) have admission control failure messages. Two LSPs (lsp1 and lsp2) do not have admission control failure messages.
All LSPs shown in the network topology in Figure 16 transit or terminate on non-Juniper Networks equipment. The question is, why do two LSPs (lsp1 and lsp2) not have admission control errors.
Sample Output
Use show configuration statement-path command to display a specific configuration hierarchy; for example, routing protocols.
user@T640> show configuration protocols mpls
traceoptions {
file mpls;
flag error;
}
label-switched-path lsp1 {
to 10.100.100.5;
no-cspf;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp2 {
to 10.100.100.6;
no-cspf;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp3 {
to 10.100.100.3;
fast-reroute;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp4 {
to 10.100.100.2;
fast-reroute;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp5 {
to 10.100.100.4;
fast-reroute;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp6 {
to 10.100.100.9;
no-cspf;
fast-reroute;
}
label-switched-path lsp7 {
to 10.100.100.8;
fast-reroute;
primary primary {
bandwidth 10m;
}
}
path primary;
interface ge-1/0/2.0
interface ge-1/0/4.0
}
What It Means
The sample output for the show configuration protocols mpls command shows the MPLS configuration. Included in the configuration are trace options, seven LSPs, a primary path, and interfaces. Trace options are configured to provide information to assist the investigation of the problem.
The first thing to notice about the MPLS configuration is that the two LSPs (lsp1 and lsp2) do not have the fast-reroute statement included. Further investigation shows the following:
-
lsp1transits non-Juniper Networks equipment, terminates in Juniper Networks equipment, fast reroute is not configured, and there are no admission control failure messages -
lsp2transits non-Juniper Networks equipment, terminates in Juniper Networks equipment, fast reroute is not configured, and there are no admission control failure messages -
lsp3transits and terminates in non-Juniper Networks equipment, fast reroute is not configured, and there are no admission control failure messages -
lsp4terminates in non-Juniper Networks equipment, fast reroute is configured, and there are admission control failure messages -
lsp5terminates in non-Juniper Networks equipment, fast reroute is configured, and there are admission control failure messages -
lsp6terminates in non-Juniper Networks equipment, fast reroute is configured, and there are admission control failure messages -
lsp6transits non-Juniper Networks equipment, terminates in an M-series routing platform, fast reroute is configured, and there are admission control failure messages -
lsp7transits non-Juniper Networks equipment, terminates in an M-series routing platform, fast reroute is configured, and there are admission control failure messages
When fast reroute is not configured, the LSPs transiting non-Juniper Networks equipment are free of admission control errors. The LSPs with FRR configured have admission control errors. Because all LSPs transit non-Juniper Networks equipment, it would appear that somehow the configuration of fast reroute is an issue for non-Juniper Networks equipment.
Sample Output
Use show log filename command to display the contents of the specified log file. In this case, the log file mpls is configured at the [edit protocols mpls traceoptions] hierarchy level. When the log file is configured, you must issue the monitor start filename command to begin logging messages to the file.
user@host> monitor start mpls
user@T640> show log /var/log/T640/mpls
Aug 4 19:08:32 trace_on: Tracing to "/var/log/T640/mpls" started
[...Output truncated...]
Aug 4 19:08:32 ReceivePathErrfrom 21.0.0.1 (27.0.0.2->0.0.0.0)Admission Control failure
Aug 4 19:08:32 mpls lsplsp6primary 21.0.0.1:Admission Control failure[4 times]
Aug 4 19:08:32 task_timer_uset: timer MPLS_MPLS short wait fast <Touched> set to interval 0.001000 at
Aug 4 19:08:32 task_timer_dispatch: calling MPLS_MPLS short wait fast, late by 0.014
Aug 4 19:08:32 task_timer_reset: reset MPLS_MPLS short wait fast
Aug 4 19:08:32 task_timer_dispatch: returned from MPLS_MPLS short wait fast, rescheduled in 0
Aug 4 19:08:32 CCC xmit lsp lookup: lsp6 is not a transmit LSP
Aug 4 19:08:32 CCC xmit lsp lookup: lsp6 is not a transmit LSP
Aug 4 19:08:32 mpls lsp lsp6 primary 21.0.0.1: Routing problem, subcode 0[2 times]
[...Output truncated...]
What It Means
The sample output of the show log filename command is a snippet from the log file that shows the path error (PathErr) message for lsp6 with the admission control failure error and a 0 subcode. Subcode 0 is not one of the error codes (1, 2, or 3) defined in RFC 2205.
|
NOTE: For readability, some lines in the output that extend beyond 80 characters have been truncated. |
Solution
The initial solution was to adjust the bandwidth for the LSPs with the admission control failure messages. This approach was not effective because the problem was also an interoperability issue; the other vendor's equipment could not work with the RSVP Path message sent by the JUNOS software which included a legacy object and not the standard object in the fast reroute object. For a discussion of the legacy and standard objects, see Cause.
The final solution was to configure all LSPs to be adaptive. An adaptive LSP sends out a standard form of the FRR object, and uses the SE RSVP reservation style, which in this case solves the interoperability issue. For information on configuring an adaptive LSP, see RSVP Reservation Styles in an MPLS Network.
Router Configuration
Purpose
Output that shows the configurations of the ingress router in the network. The no-more option entered after the pipe ( | ) prevents the output from being paginated if the output is longer than the length of the terminal screen.
Sample Output
The following sample output is for ingress router T640:
user@T640> show configuration | no-more
[...Output truncated...]
interfaces {
ge-1/0/2 {
unit 0 {
family inet {
address 21.0.0.2/30;
}
family iso;
family mpls;
}
}
ge-1/0/4 {
unit 0 {
family inet {
address 21.1.0.2/30;
}
family iso;
family mpls;
}
}
lo0 {
unit 0 {
family inet {
address 10.100.100.1/32;
}
family iso {
address 01.0000.0101.0010.0001.00;
}
}
}
}
protocols {
rsvp {
interface ge-1/0/2.0;
interface ge-1/0/4.0;;
}
mpls {
traceoptions {
file mpls;
flag error;
}
label-switched-path lsp1 {
to 10.100.100.5;
no-cspf;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp2 {
to 10.100.100.6;
no-cspf;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp3 {
to 10.100.100.3;
fast-reroute;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp4{
to 10.100.100.2;
fast-reroute;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp5{
to 10.100.100.4;
fast-reroute;
primary primary {
bandwidth 10m;
}
}
label-switched-path lsp6{
to 10.100.100.9;
no-cspf;
fast-reroute;
}
label-switched-path lsp7{
to 10.100.100.8;
fast-reroute;
primary primary {
bandwidth 10m;
}
}
path primary;
interface ge-1/0/2.0
interface ge-1/0/4.0
}
bgp {
group ibgp {
type internal;
local-address 10.100.100.1;
peer-as 2000;
neighbor 10.100.100.2;
neighbor 10.100.100.3;
neighbor 10.100.100.4;
neighbor 10.100.100.5;
neighbor 10.100.100.6;
neighbor 10.100.100.8;
neighbor 10.100.100.9;
}
}
isis {
level 1 disable;
interface ge-1/0/2.0;
interface ge-1/0/4.0;
interface lo0.0 {
passive;
}
}
}
routing-options {
autonomous-system 2000;
What It Means
The sample output for the show configuration command shows the interfaces, protocols, and routing options configuration for the ingress router (T640) in the network shown in Figure 16.