<HTML
><HEAD
><TITLE
>Advanced Bridge Features</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.63
"><LINK
REL="HOME"
TITLE="Linux BRIDGE-STP-HOWTO"
HREF="index.html"><LINK
REL="PREVIOUS"
TITLE="Set Up The Bridge"
HREF="set-up-the-bridge.html"><LINK
REL="NEXT"
TITLE="A Practical Setup Example"
HREF="practical-example.html"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><DIV
CLASS="NAVHEADER"
><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>Linux BRIDGE-STP-HOWTO: About The Linux Modular Bridge And STP</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="set-up-the-bridge.html"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
></TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="practical-example.html"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="ADVANCED-BRIDGE"
>7. Advanced Bridge Features</A
></H1
><P
>Here we will cover some advanced features of the new bridge code.
</P
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="STP"
>7.1. Spanning Tree Protocol</A
></H2
><DIV
CLASS="FORMALPARA"
><P
><B
>Tell me... </B
> <P
></P
><UL
><LI
><P
>You are a networkadmin...?
</P
></LI
><LI
><P
>You have a switch on top of your ethernet tree...?
</P
></LI
><LI
><P
>You have nightmares of a switch emmiting smoke...?
</P
></LI
><LI
><P
>Your company is not extremely rich and con provide
another redundant switch just waiting for you to plug the
patchwires..?
</P
></LI
><LI
><P
>You don't feel like placing your bed close to your
main network node to plug the wires...?
</P
></LI
></UL
>
</P
></DIV
><DIV
CLASS="FORMALPARA"
><P
><B
>Don't wait until you're just another nervous wreck. </B
>Join linux bridge community and enjoy the relaxment a
stp-enabled inhouse scenario is offering to you.
</P
></DIV
><P
>Ok, let's leave that commercial and get back linux and the bridge.
Take a look on this small thread from the linux-bridge mailing list.
</P
><DIV
CLASS="QANDASET"
><H3
CLASS="TITLE"
>STP Thread from bridge@openrock.net (no more valid)</H3
><DL
><DT
> <A
HREF="advanced-bridge.html#AEN487"
>Could you give me some hints about multi-bridge scenarios.
</A
></DT
><DT
> <A
HREF="advanced-bridge.html#AEN506"
>Does the <SPAN
CLASS="ACRONYM"
>STP</SPAN
> <SPAN
CLASS="QUOTE"
>"heartbeat"</SPAN
> mechanism also work
with bridges with more than two cards?
</A
></DT
><DT
> <A
HREF="advanced-bridge.html#AEN515"
>How fast does it get up, and what can I do about it?
</A
></DT
></DL
><DIV
CLASS="QANDAENTRY"
><DIV
CLASS="QUESTION"
><P
><A
NAME="AEN487"
></A
><B
> </B
>Could you give me some hints about multi-bridge scenarios.
</P
></DIV
><DIV
CLASS="ANSWER"
><P
><B
> </B
>You can just set up two <SPAN
CLASS="QUOTE"
>"mirrored"</SPAN
> bridges.
You have two network interfaces in your bridge?
Set up the mirror bridge so that it has two network interfaces
as well, and connect each of the interfaces to one subnet.
This will work without the need of configuration.
</P
><P
> <DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Note: </B
>Be sure that you have the spanning tree protocol
enabled.
If you didn't use <B
CLASS="COMMAND"
>brctl</B
>, this should
be fine, because in Linux, it is on by default.
To check, you could check whether the bridge sends a
packet to <TT
CLASS="COMPUTEROUTPUT"
>0180c2000000</TT
>
every 2 seconds.
If it does, the <SPAN
CLASS="ACRONYM"
>STP</SPAN
> is on.
The <SPAN
CLASS="ACRONYM"
>STP</SPAN
> is needed so that only one bridge will be active
at any given time.
</P
></BLOCKQUOTE
></DIV
>
<DIV
CLASS="NOTE"
><BLOCKQUOTE
CLASS="NOTE"
><P
><B
>Note: </B
>To be able to see nicely formatted stp packages in your
network take a look at at the bridge homepage for the patches
to tcpdump.
</P
></BLOCKQUOTE
></DIV
>
</P
><P
> The <SPAN
CLASS="QUOTE"
>"master"</SPAN
> bridge will send out <SPAN
CLASS="ACRONYM"
>STP</SPAN
> packets every
2 seconds by default.
The <SPAN
CLASS="QUOTE"
>"slave"</SPAN
> bridge will receive these packets,
and will notice that the master is still up.
If the slave hasn't received a packet in 20 seconds (max.
message age parameter), it will start the takeover procedure.
From the moment the takeover procedure starts, it will take
about 30 seconds (twice the forward delay parameter) for the
bridge to become fully operational.
</P
></DIV
></DIV
><DIV
CLASS="QANDAENTRY"
><DIV
CLASS="QUESTION"
><P
><A
NAME="AEN506"
></A
><B
> </B
>Does the <SPAN
CLASS="ACRONYM"
>STP</SPAN
> <SPAN
CLASS="QUOTE"
>"heartbeat"</SPAN
> mechanism also work
with bridges with more than two cards?
</P
></DIV
><DIV
CLASS="ANSWER"
><P
><B
> </B
>Yes, it works with any number of interfaces.
You can invent bizarre topologies to your heart's desire.
You can use multiple (redundant) bridge-bridge connects,
you can insert loops, whatever.
The <SPAN
CLASS="ACRONYM"
>STP</SPAN
> code will always find the minimal spanning tree.
The bridge code will even deal with the loss of any number
of interfaces.
If there are two redundant bridges with identical connections,
the loss of an interface on one of the bridges will cause the
other bridge to take over forwarding to that specific
interface.
<EM
>Now isn't that great? :)</EM
>
</P
></DIV
></DIV
><DIV
CLASS="QANDAENTRY"
><DIV
CLASS="QUESTION"
><P
><A
NAME="AEN515"
></A
><B
> </B
>How fast does it get up, and what can I do about it?
</P
></DIV
><DIV
CLASS="ANSWER"
><P
><B
> </B
>If you think 50 seconds is too much -- and I guess you
should; alas, the IEEE specs gives us these default values
-- you can tweak these parameters.
If you set the hello time (the <SPAN
CLASS="ACRONYM"
>STP</SPAN
> packet interval) from 2 to 1
second, you can safely set the message age parameter to 4
seconds.
Then you can set the forward delay to 4 seconds, and this will
in total give you a takeover time of ~12 seconds.
</P
></DIV
></DIV
></DIV
><P
>The great thing which is made possible by <SPAN
CLASS="ACRONYM"
>STP</SPAN
> is
a redundant parallel bridging scenario, with automated take over
features.
Within a network basing on stp the bridges always try to send a
datagram the (by path cost) shortest path.
Only on that path the bridges are forwarding, all other paths between
this shortest way are blocked.
If there is a broken path, the bridges agree about the next shortest.
So doubled paths don't break the net, but are bringing more security...
For a example setup of a fail secured connection see
<A
HREF="practical-example.html"
>Section 8</A
>.
</P
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="IPCHAINS"
>7.2. Bridge And The IP-Chains</A
></H2
><P
>The normal idea about a bridge would not allow anything like
firewalling, but since several people have asked Lennert for ipchains
firewalling on bridge forwarding he implemented it.
</P
><DIV
CLASS="IMPORTANT"
><BLOCKQUOTE
CLASS="IMPORTANT"
><P
><B
>Important: </B
>If you want to do this, you will need to apply the
special ip-chain-bridge-patch (also available at
<A
HREF="http://www.math.leidenuniv.nl/~buytenh/bridge/"
TARGET="_top"
>the bridge homepage</A
>).
</P
></BLOCKQUOTE
></DIV
><P
>As soon you have everything up correctly, the bridging code will
check each to-be-forwarded packet against the ipchains chain which has
the same name as the bridge.
</P
><P
>So.. if a packet on eth0 is to be forwarded to eth1, and those
interfaces are both part of the bridge group br0, the
bridging code will check the packet against the chain called 'br0'.
</P
><DIV
CLASS="WARNING"
><P
></P
><TABLE
CLASS="WARNING"
BORDER="1"
WIDTH="100%"
><TR
><TD
ALIGN="CENTER"
><B
>Warning</B
></TD
></TR
><TR
><TD
ALIGN="LEFT"
><P
>If the chain does not exist, the packet will be forwarded.
So if you want to do firewalling, you'll have to create the chain
yourself.
</P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="EXAMPLE"
><A
NAME="SIMPLE-FW-CONFIG"
></A
><P
><B
>Example 10. A Simple Bridge Firewall Setup</B
></P
><TABLE
BORDER="0"
BGCOLOR="#E0E0E0"
WIDTH="100%"
><TR
><TD
><PRE
CLASS="SCREEN"
>Example:
# brctl addbr <TT
CLASS="USERINPUT"
><B
>br0</B
></TT
> <A
NAME="IPCH-ADDBR"
><IMG
SRC="../images/callouts/1.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(1)"></A
>
# brctl addif br0 eth0 <A
NAME="IPCH-ADDIF-ETH0"
><IMG
SRC="../images/callouts/2.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(2)"></A
>
# brctl addif br0 eth1 <A
NAME="IPCH-ADDIF-ETH1"
><IMG
SRC="../images/callouts/3.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(3)"></A
>
# ifconfig br0 10.0.0.254 <A
NAME="IPCH-IFCONFIG"
><IMG
SRC="../images/callouts/4.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(4)"></A
>
# ipchains -N <TT
CLASS="USERINPUT"
><B
>br0</B
></TT
> <A
NAME="IPCH-ADDCHAIN"
><IMG
SRC="../images/callouts/5.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(5)"></A
>
# ipchains -A br0 -s 10.0.0.1/8 -i eth0 -j DENY <A
NAME="IPCH-DEN-ETH0"
><IMG
SRC="../images/callouts/6.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(6)"></A
>
</PRE
></TD
></TR
></TABLE
><DIV
CLASS="CALLOUTLIST"
><DL
COMPACT="COMPACT"
><DT
><A
HREF="advanced-bridge.html#IPCH-ADDBR"
><IMG
SRC="../images/callouts/1.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(1)"></A
></DT
><DD
>Creating a bridge interface named <TT
CLASS="USERINPUT"
><B
>br0</B
></TT
>
</DD
><DT
><A
HREF="advanced-bridge.html#IPCH-ADDIF-ETH0"
><IMG
SRC="../images/callouts/2.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(2)"></A
><A
HREF="advanced-bridge.html#IPCH-ADDIF-ETH1"
><IMG
SRC="../images/callouts/3.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(3)"></A
></DT
><DD
>Placing eth0 and eth1 into the bridge.
</DD
><DT
><A
HREF="advanced-bridge.html#IPCH-IFCONFIG"
><IMG
SRC="../images/callouts/4.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(4)"></A
></DT
><DD
>Assigning a regular IP address to the bridge.
The IP is taken from private network 10.X.X.X (Class A).
</DD
><DT
><A
HREF="advanced-bridge.html#IPCH-ADDCHAIN"
><IMG
SRC="../images/callouts/5.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(5)"></A
></DT
><DD
>Creating a ip-chain named <TT
CLASS="USERINPUT"
><B
>br0</B
></TT
>
</DD
><DT
><A
HREF="advanced-bridge.html#IPCH-ADDBR"
><IMG
SRC="../images/callouts/1.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(1)"></A
><A
HREF="advanced-bridge.html#IPCH-ADDCHAIN"
><IMG
SRC="../images/callouts/5.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(5)"></A
></DT
><DD
> <DIV
CLASS="CAUTION"
><P
></P
><TABLE
CLASS="CAUTION"
BORDER="1"
WIDTH="100%"
><TR
><TD
ALIGN="CENTER"
><B
>Caution</B
></TD
></TR
><TR
><TD
ALIGN="LEFT"
><P
>It's vital to have the same name here
(<TT
CLASS="USERINPUT"
><B
>br0</B
></TT
> or whatever you have selected,
as long as you have the same in all places).
</P
></TD
></TR
></TABLE
></DIV
>
</DD
><DT
><A
HREF="advanced-bridge.html#IPCH-DEN-ETH0"
><IMG
SRC="../images/callouts/6.gif"
HSPACE="0"
VSPACE="0"
BORDER="0"
ALT="(6)"></A
></DT
><DD
>Denying all trafic with source 10.X.X.X on eth0.
</DD
></DL
></DIV
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="set-up-the-bridge.html"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="practical-example.html"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Set Up The Bridge</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
> </TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>A Practical Setup Example</TD
></TR
></TABLE
></DIV
></BODY
></HTML
>
