Showing posts with label cisco. Show all posts
Showing posts with label cisco. Show all posts

Tuesday, April 14, 2026

Beyond PTP: Why Hybrid SyncE + PTP is the Competitive Edge in HFT Fabrics

PTP with SyncE in HFT Trading firm  in their Network Design

I recently explored the HFT network after discussing with a friend who was working with one of the HFT firms how to synchronize the time on all the devices in their network, as it is critical that time delay can cause orders to be placed at wrong intervals due to incorrect time, causing serious issues.

HFT firms rely on the discrepancies between buying and selling prices in the market data. Order execution happens in nanoseconds.



In general, most firms use PTP for time synchronization from the grandmaster to the boundary clock toward the slave.

It seems beneficial to rely on PTP alone in an HFT network, but it might bring risk to them.

I was exploring SyncE along with PTP, which might be a good to avoid any risk of using only PTP in their network

Why recommending SyncE along with PTP? For that, you need to identify the possible issue with the PTP-only design

1. Packet Delay Variation (PDV) 

PTP operates at Layer 3 and can also function at Layer 2. Its accuracy is influenced by network changes and packet timing, which can be delayed due to microbursts (PTP is subject to PDV), even on higher-capacity ports like 10G or 100G.

2. Oscillator Drift:

Even PTP packets are received at every interval, but the Node is not connected to the Master clock every time and it should rely on the local Hardware Oscillator.

Drift is not a one-time error; it's a slope. Accumulates slowly 

Let's see how SyncE might enhance the HFT network

In HFT Network, enabling SyncE can act as a stabilizer during the time interval for receiving the PTP packets.

SyncE provides a constant and high-frequency reference directly from the physical layer. If the local oscillator is locked with SyncE signal, then it doesn't wander. 

With SyncE, now the PTP algorithm works to correct the time offset, not the constant change in frequency.

What is the network device loss to the grandmaster? or continuous loss of PTP packets can be catastrophic. 

Without Sync-E , if the node stops receiving the PTP packets then the local oscillator drift immediately can cause huge impact

With Sync-E, the frequency is continuously locked to the upstream source. The node can maintain the time perfectly for much longer time as it is sync with the other nodes in the network

In an HFT environment, SyncE ensures all the device are synchronized (running at same frequency)

Alone, PTP time accuracy can be within sub-microseconds, but PTP with SyncE time accuracy is nanoseconds.

Conclusion: PTP provides the time of day, and SyncE provides frequency stability.

Configuring a hybrid SyncE + PTP environment requires a 2-step approach: first, establishing the physical layer frequency (SyncE) end-to-end, and second, layering the packet-based time synchronization (PTP).

Configuration to enable SyncE and PTP on Cisco, Arista, Juniper and Nokia Devices


Cisco (IOS-XR / ASR 9000)

SyncE Configuration

frequency synchronization

 source interface X/X/X

 !

interface X/X/X

 frequency synchronization

  selection input

  wait-to-restore 0


PTP Hybrid Configuration

ptp

 clock

  domain 0

  profile g.8275.1

  ! Tells PTP to use the physical layer frequency

  physical-layer-frequency 

 !

 interface X/X/X

  transport ethernet

  port state master


Arista (EOS / 7130 or 7050 Series)

SyncE Frequency

frequency-spec

 source interface Ethernet1

!

interface Ethernet1

 switchport mode trunk

 sync-e

 PTP Hybrid Mode

ptp mode boundary

ptp profile <XXX>

! Ensures the local clock is locked to the SyncE source

ptp holdover-spec sync-e 

!

interface Ethernet1

 ptp enable

 ptp role master


Juniper (Junos / MX Series)

SyncE

set chassis synchronization network-option option-1

set chassis synchronization interface ge-0/0/0 source-role primary


PTP Hybrid Configuration 

set protocols ptp clock-mode boundary-clock

set protocols ptp profile X.X.X

# Link PTP to the SyncE frequency source

set protocols ptp hybrid-mode

set protocols ptp slave interface X.X.X

set protocols ptp master interface X.X.X


Nokia (SROS / 7750 SR)

SyncE

configure system synchronization

    network-interface X/X

        source-priority 1

        no shutdown

    exit

exit


PTP Hybrid Mode 

configure system ptp

    clock-type boundary-clock

    profile <XXX>

    # Enable Hybrid Mode to leverage SyncE frequency

    hybrid

    no shutdown

    peer X.X.X.X

        no shutdown

    exit

exit



Monday, April 3, 2023

BGP Prefix Limit Configuration in Cisco, Juniper and Nokia - Interop

BGP Prefix Limit

Maximum Prefix-limit is used to control the BGP peer not to overload your BGP routing table and it helps to avoid the situation. let's explore how to configure in Cisco, Juniper, and Nokia router


Cisco Configuration

 !
router bgp 300
 neighbor 192.168.1.1
  address-family ipv4 unicast
   maximum-prefix <max-limit> <percentage> <Actions>
  !
 !

Juniper  Configuration

edit protocol
bgp {
        group nokia {
            neighbor 192.168.0.1 {
                family inet {
                    unicast {
                        prefix-limit {
                            maximum 1000;
                            teardown;
                        }
                    }


Nokia Configuration

/configure router bgp
            group "juniper"
                type external
                local-as 100
                neighbor 192.168.0.2
                    prefix-limit <family> <prefix-limit>
                    peer-as 200
                exit

   


TCP AO configuration on Cisco, Juniper and Nokia SR - Interop Configuration

TCP-AO is a new authentication method proposed through RFC5925, The TCP Authentication Option to enhance the security and authenticity of TCP segments exchanged during BGP.

 It supports both IPv4 and IPv6 traffic


Benefits of TCP-AO




Support multiple stronger algorithms, such as HMAC-SHA1 and AES-128 to create an internal traffic key and message digest.

Add a new user-configured key to re-generate internal traffic keys for an established connection and a mechanism to synchronize key change between BGP peers

Nokia Configuration

/configure system security 

keychain "aes-128-cmac-96-keychain"

                tcp-option-number

                    send tcp-ao

                    receive tcp-ao

                exit

                direction

                    uni

                        send

                            entry 20 key “key”algorithm aes-128-cmac-96

                                begin-time 2023/04/03 08:22:32 UTC

                            exit

                        exit

                        receive       

                            entry 10 key “key” algorithm aes-128-cmac-96

                                begin-time 2023/04/03 08:23:24 UTC

                            exit

                        exit

                    exit

                exit

                no shutdown

            exit

Apply the TCP AO authentication under BGP neighbor or Group

/configure router bgp group "juniper"

                type external

                local-as 100

                neighbor 192.168.0.2

                 auth-keychain "aes-128-cmac-96-keychain"

                exit

            exit


Juniper Configuration#

security {                              

    authentication-key-chains {

        key-chain nokia {

            tolerance 30;

            key 10 {

                secret "$9$vxA87Vg4ZiqfDi/t0OSy7-Vb2aZGiq.5"; ## SECRET-DATA

                start-time "2023-2-1.00:00:00 +0000";

                algorithm ao;

                ao-attribute {

                    send-id 10;

                    recv-id 20;

                    tcp-ao-option enabled;

                    cryptographic-algorithm aes-128-cmac-96;

                }

            }

Apply the TCP AO authentication under BGP neighbor or Group

set protocols bgp group nokia authentication-algorithm ao


Cisco XR Configuration#

key chain AS300

 key 0

  accept-lifetime 00:00:00 april 01 2023 infinite

  key-string password 0701245859060B0E1B1309

  send-lifetime 00:00:00 april 01 2023 infinite

  cryptographic-algorithm MD5

 !

!

key chain AS300

 key 1

  accept-lifetime 00:00:00 april 01 2023 infinite

  key-string password 0701245859060B0E1B1309

  send-lifetime 00:00:00 april 01 2023 infinite

  cryptographic-algorithm MD5

 !

!

router bgp 300

 neighbor 192.168.1.1

  keychain AS300

 !



BGP Protection - TTL Security Configuratoion Cisco, Juniper and Nokia

Hi Everyone,

In the blog, I am going to explain how TTL security is useful in BGP Session protection. Time to Live will be added to every packet and it will be reduced at each hop it transfers.

Consider someone who wants to hack your BGP session and will send the spoofed  BGP packets and try to negotiate with your BGP session. to avoid this kind of spoofing we use TTL Security


TTL security is a mechanism that evaluates the TTL value of incoming IP packets to ensure

that they have not been faked. The IP TTL value will be set to 255 by directly connected BGP

peers, making it impossible to relay spoof Internet protocol with TTL=255 through non

directly connected interfaces.



Cisco XR

router bgp 100
 neighbor-group ebgp
  ttl-security
 !
neighbor 192.168.1.1
  remote-as 100
  use neighbor-group ebgp
  address-family ipv4 unicast
  !
 !


Juniper 


protocols {                             
    bgp {
        group nokia {
            type external;
            neighbor 192.168.0.1 {
                ttl <1-255>;
                peer-as 100;
                local-as 200;
            }


Nokia vSR


router bgp 
 group "juniper"
                type external
                local-as 100
                ttl-security <1-255>
                neighbor 192.168.0.2
                    peer-as 200
                exit
            exit







Sunday, February 12, 2023

How to add Cisco IOU Image on Eve-ng Up and Running













Step 1#

Download Linux L2/L3 adventerprise Image 

Step 2#

Upload the downloaded image to the EVE path /opt/unetlab/addons/iol/bin/ using WinSCP or Filezilla

Step 3#

Fix the permission for the added image using the below command

/opt/unetlab/wrappers/unl_wrapper -a fixpermissions

Step 4#

Create an iou keygen file Copy the Cisco IOU Image Script provided below and add to the script

vim /opt/unetlab/addons/iol/bin/ioukeygen.py

Esc:wq

Step 5#

Fix the permission for the Python script

chmod –x vim /opt/unetlab/addons/iol/bin/ioukeygen.py

Step 6#

Run the license generator script 

/opt/unetlab/addons/iol/bin/ioukeygen.py

copy the license generated by the script



Step 7#

Create iourc license file for your EVE
vim /opt/unetlab/addons/iol/bin/iourc

Paste the output captured in Step 6

Step 8#

Fix the permission and start practicing your lab by adding the image on eve-ng web

/opt/unetlab/wrappers/unl_wrapper -a fixpermissions

Cisco IOU Image Script#

#! /usr/bin/python3

print("*********************************************************************")

print("Cisco IOU License Generator - Kal 2011, python port of 2006 C version")

import os

import socket

import hashlib

import struct

# get the host id and host name to calculate the hostkey

hostid=os.popen("hostid").read().strip()

hostname = socket.gethostname()

ioukey=int(hostid,16)

for x in hostname:

 ioukey = ioukey + ord(x)

print("hostid=" + hostid +", hostname="+ hostname + ", ioukey=" + hex(ioukey)[2:])

# create the license using md5sum

iouPad1 = b'\x4B\x58\x21\x81\x56\x7B\x0D\xF3\x21\x43\x9B\x7E\xAC\x1D\xE6\x8A'

iouPad2 = b'\x80' + 39*b'\0'

md5input=iouPad1 + iouPad2 + struct.pack('!i', ioukey) + iouPad1

iouLicense=hashlib.md5(md5input).hexdigest()[:16]


print("\nAdd the following text to ~/.iourc:")

print("[license]\n" + hostname + " = " + iouLicense + ";\n")

with open("iourc.txt", "wt") as out_file:

   out_file.write("[license]\n" + hostname + " = " + iouLicense + ";\n")

print("^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\nAlready copy to the file iourc.txt\n ")


print("You can disable the phone home feature with something like:")

print(" echo '127.0.0.127 xml.cisco.com' >> /etc/hosts\n")

# end of the script

Final output on eve-ng











Refer to the video with the steps