=SNA/DLSw+ & Impact Question=

Question

Hi all,
this is related to discussion:
http://forums.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Network%20Infrastructure&topic=LAN%2C%20Switching%20and%20Routing&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.1dd82da4
I opened this new one since my question was answered.
Our Topology:
Server---L2 switch---L3 Dist switch---Firewall---L3 switch(Core)--Firewall--CLOUD--IBM host
The server would generate both IP and SNA traffic (port LU6.2). All media are ethernet. The L3 switches are DLSw+ capable. I don't know much about the firewalls and I don't have control in the cloud because its under a different administrator.
Questions:
1. if I would use DLSw+, I need to bridge the ethernet port of the L3 Dist switch connecting the Server side. But, the server's connection is part of a VLAN, so, in the config of L3 Dist Switch, I would need to bridge the VLAN to DLSw. Would this setup impact the original behaviour of my VLAN? The VLAN is a Switched VLAN interface routed to another VLANs also.
2. Is it possible to control the port that would be used where the DLSW+ would pass through? I think I would have problems w/ our Firewall which requires source-destination ports and IPs to pass traffic.
Any suggestions/opinions are very much welcome... thanks!!!
rodney

Answer 1

Hi,
if you are using vlan interfaces already than your configuration would look similar to this:
dlsw local-peer peer-id 10.10.10.1
dlsw remote-peer tcp 0 20.20.20.1
dlsw bridge-group 10
interface loopback 0
ip address 10.10.10.1 255.255.255.0
interface vlan 234
ip address ...
bridge-group 10
bridge 10 protocol vlan-bridge
that would allow you to bridge sna traffic into dlsw.
It assumes that 20.20.20.1 is the local peer configured on the partner router in front of the host.
The local peer tied to the loopback interface is just an example.
If you have i.e. more than one vlan you want to bridge than you can create multiple bridge-groups and you can configure multiple dlsw bridge-group statements. This way you bridge multiple vlans into dlsw but you dont bridge them together.
If you know the sap's you are using for sna, default is 4 as far as i know. Most commonly known are 4,8,12 than you can create an access list like this:
access-list 200 permit 0x0000 0x0d0d
and apply it to the bridge-group command on the interface.
interface vlan 234
bridge-group 10
bridge-group 10 input-sap-list 200
that allows only sap's 0,4,8,12 with and without the response bit set into the bridge group and effectively blocks all other traffic.
In respect to the tcp ports that dlsw is using over the WAN. Dlsw version 1, RFC1795, that is what cisco is using, opens always two tcp sessions at startup.
This router starts the connection, it opens a tcp connection on the destination port 2065, source port is a random port above 11000.
Now the receiving end is also opening a tcp session back to the first router. Destination port 2065, local, source port is a random port above 11000.
Next the dlsw capabilities exchange happens and the two peers exchange their information. Once they detected that they both are cisco devices and that they both support the usage of only one tcp session in both directions the one with the "numerically higher ip address" will drop its connection on the local tcp port 2065.
The remaining tcp connection is used for dlsw traffic in both directions.
this is described in detail in RFC1795, section 7.6.7.
thanks...
Matthias