|
|
The Director Response Protocol (DRP) is a simple User Datagram Protocol (UDP)-based application developed by Cisco Systems. It enables Cisco's DistributedDirector product to query routers (DRP Server Agents) in the field for Border Gateway Protocol (BGP) and Interior Gateway Protocol (IGP) routing table metrics between distributed servers and clients. DistributedDirector, a separate standalone product, uses DRP to transparently redirect end-user service requests to the topologically closest responsive server. DRP enables DistributedDirector to provide dynamic, scalable, and "network intelligent" Internet traffic load distribution between multiple geographically dispersed servers.
DRP Server Agents are border routers (or peers to border routers) that support the geographically distributed servers for which DistributedDirector service distribution is desired. Note that, because DistributedDirector makes decisions based on BGP and IGP information, all DRP Server Agents must have access to full BGP and IGP routing tables.
Refer to the Cisco DistributedDirector 2501 Installation and Configuration Guide or the Cisco DistributedDirector 4700-M Installation and Configuration Guide for information on how to configure DistributedDirector.
This feature is supported on these platforms:
Perform the following tasks to configure and maintain the DRP Server Agent. The first task is required; the remaining tasks are optional.
The DRP Server Agent is disabled by default. To enable it, perform the following task in global configuration mode:
| Task | Command |
|---|---|
| Enable the DRP Server Agent. | ip drp server |
As a security measure, you can limit the source of valid DRP queries. If a standard IP access list is applied to the interface, the Server Agent will respond only to DRP queries originating from an IP address in the list. If no access list is configured, the server agent will answer all queries.
If both an access group and a key chain (described in the next section) have been configured, both security mechanisms must allow access before a request is processed.
To limit the source of valid DRP queries, perform the following task in global configuration mode:
| Task | Command |
|---|---|
| Control the sources of valid DRP queries by applying a standard IP access list. | ip drp access-group access-list-number |
Another available security measure is to configure the DRP Server Agent to authenticate DRP queries and responses. You define a key chain, identify the keys that belong to the key chain, and specify how long each key is valid. To do so, perform the following tasks beginning in global configuration mode:
When configuring your key chains and keys, keep these points in mind:
To monitor and maintain the DRP Server Agent, perform the following tasks in EXEC mode:
| Task | Command |
|---|---|
| Clear statistics being collected on DRP requests and responses. | clear ip drp |
| Display information about the DRP Server Agent. | show ip drp |
The following example enables the DRP Server Agent. Sources of DRP queries are limited by access list 1, which permits only queries from the host at 33.45.12.4. Authentication is also configured for the DRP queries and responses.
ip drp server access-list 1 permit 33.45.12.4 ip drp access-group 1 ip drp authentication key-chain mktg key chain mktg key 1 key-string internal exit exit
The commands used in the "Configuration Tasks" section that do not appear in this section were previously documented in the Cisco IOS Release 11.2 Network Protocols Command Reference, Part 1, in the "IP Routing Protocols Commands" chapter.
This section documents the following new commands:
To clear all statistics being collected on Director Response Protocol (DRP) requests and replies, use the clear ip drp EXEC command.
clear ip drpThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 11.2 F.
The following example clears all DRP statistics:
clear ip drp
ip drp access-group
ip drp authentication key-chain
To control the sources of Director Response Protocol (DRP) queries to the DRP Server Agent, use the ip drp access-group global configuration command. To remove the access list, use the no form of this command.
ip drp access-group access-list-number| access-list-number | Number of a standard IP access list in the range 1 to 99. |
The DRP Server Agent will answer all queries.
Global configuration
This command first appeared in Cisco IOS Release 11.2 F.
This command applies an access list to the interface, thereby controlling who can send queries to the DRP Server Agent.
If both an authentication key chain and an access group have been specified, both security measures must permit access before a request is processed.
The following example configures access list 1, which permits only queries from the host at 33.45.12.4:
access-list 1 permit 33.45.12.4 ip drp access-group 1
ip drp authentication key-chain
show ip drp
To configure authentication on the DRP Server Agent for DistributedDirector, use the ip drp authentication key-chain global configuration command. To remove the key chain, use the no form of this command.
ip drp authentication key-chain name-of-chain| name-of-chain | Name of the key chain containing one or more authentication keys. |
No authentication is configured for the DRP Server Agent.
Global configuration
This command first appeared in Cisco IOS Release 11.2 F.
When a key chain and key are configured, the key is used to authenticate all Director Response Protocol requests and responses. The active key on the DRP Server Agent must match the active key on the primary agent. Use the key and key-string commands to configure the key.
The following example configures a key chain named ddchain:
ip drp authentication key-chain ddchain
accept-lifetime
ip drp access-group
key
key chain
key-string
send-lifetime
show ip drp
show key chain
To enable the Director Response Protocol (DRP) Server Agent that works with DistributedDirector, use the ip drp server global configuration command. To disable the DRP Server Agent, use the no form of this command.
ip drp serverThis command has no arguments or keywords.
Disabled
Global configuration
This command first appeared in Cisco IOS Reelease 11.2 F.
The following example enables the DRP Server Agent:
ip drp server
ip drp access-group
ip drp authentication key-chain
show ip drp
To display information about the DRP Server Agent for DistributedDirector, use the show ip drp EXEC command.
show ip drpThis command has no arguments or keywords.
EXEC
This command first appeared in Cisco IOS Release 11.2 F.
The following is sample output from the show ip drp command:
Router# show ip drp
Director Responder Protocol Agent is enabled
717 director requests, 712 successful lookups, 5 failures, 0 no route
Authentication is enabled, using "test" key-chain
Table 6 describes the significant fields in the display.
| Field | Description |
|---|---|
| director requests | Number of DRP requests that have been received (including any using authentication key-chain encryption that failed). |
| successful lookups | Number of successful DRP lookups that produced responses. |
| failures | Number of DRP failures (for various reasons including authentication key-chain encryption failures). |
ip drp access-group
ip drp authentication key-chain
This section describes the debug command related to the DRP Server Agent.
To control debugging information related to the Director Response Protocol (DRP), use the debug ip drp EXEC command. To disable debugging output, use the no form of this command.
[no] debug ip drpFigure 10 shows sample debug ip drp output.
Router# debug ip drp
Director Response Protocol debugging is on
Router#
DRP: received v1 packet from 171.69.232.68, via Ethernet0
DRP: RTQUERY for 171.69.113.50 returned internal=0, external=0
DRP: RTQUERY for 171.69.58.119 returned internal=0, external=0
Table 7 describes the significant fields in the sample output.
| Field | Description |
|---|---|
| DRP: received v1 packet from 171.69.232.68, via Ethernet0 | The router received a version 1 DRP packet from the IP address shown, via the interface shown. |
| DRP: RTQUERY for 171.69.113.50 | The DRP packet contained two Route Query requests. The first request was for the distance to the IP address 171.69.113.50. |
| returned internal | Returned value for the DRP internal metric. |
| external | Returned value for the DRP external metric. |
|
|