You are on page 1of 141

Implementing MPLS VPNs

http://www.INE.com
Instructor Introduction

• Keith Barker, CCIE #6783


• CCIE Routing and Switching – 2001
• CCIE Security – 2003
• kbarker@ine.com
• YouTube - keith6783

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Our Journey

• MPLS building blocks


• Label Distribution Protocol ( LDP )
• MPLS Virtual Private Networks ( VPNs )
– Advanced MPLS
• Overlapping VPNs
• Central Service VPNs
• Network Management VPNs
– Internet Access
• Traffic Engineering ( TE )

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS Exam Topics

• Exam # (642-611)
• Detailed topics listed on Cisco’s site
• https://learningnetwork.cisco.com/docs/DOC-5063
– MPLS Fundamentals/Operation/Configuration
• Includes troubleshooting
– MPLS VPNs Implementation/Configuration
• Includes troubleshooting
– Complex MPLS VPNs
– Internet Access from an MPLS VPN

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Topology we will build, together.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Overlay and Peer-to-Peer

• Overlay implementation:
– Frame (physical). IPSec and GRE logical.
– Hub and Spoke, partial or full mesh
– Service provider doesn’t know customer routes
• Peer to Peer
– Customer peers with service provider at the edge
• Provider has separate router for each customer, or creates a
virtual router and forwarding instance (VRF) for each
customer.
– Simpler, customer peers with provider
– Provider knows the customer routes

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS Applications (Solutions)

• Virtual Networks
– Using peer to peer, we can privately share the
routes from a customers site A and B over the
provider network (VPNs).
• Traffic Engineering
– Called “TE” allows traffic to flow over the
lowest cost that meets our requirements
• Quality of Service (QoS)
• Any Transport over MPLS (AToM)

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: MPLS Building Blocks

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
MPLS Building Blocks

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Our Journey

• MPLS building blocks


• Label Distribution Protocol ( LDP )
• MPLS Virtual Private Networks ( VPNs )
– Advanced MPLS
• Overlapping
• Central Service
• Network Management
– Internet Access
• Traffic Engineering ( TE )

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Forwarding Packets

• Dynamic protocols build control plane.


– IP routers make independent forwarding
decision based on IP packet header, and local
CEF (Cisco Express Forwarding) and
Forwarding Information Base (FIB) table.

– MPLS routers make independent forwarding


decisions based on the MPLS label, and the
LFIB (Label Forwarding Information Base).

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
IP routing table

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
IOS switching (moving) of IP packets

• Process switching
– Painfully slow, looking up each and every
packet to decide of forwarding
• Cache based switching
– Better, painful for first process-switched
packet, info cached for future packets in flow
• Topology based switching
– CEF uses the FIB and adjacency table, and
all the decision making is done, before the
first transit packet ever arrives at the door 
Copyright © 2010 Internetwork Expert, Inc
www.INE.com
CEF entry

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS Basics

• Each router assigns a locally significant


label for each IP route, and advertises
these labels to neighbors.
• Label Distribution Protocol (LDP) is used
to exchange labels.
• Uses the IP routing information to
determine the direction and next hop to
forward a labeled packet.
– Does this before first packet even arrives.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS Label bindings

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS Forwarding

• MPLS provider edge (PE) routers do a IP


route lookup and if PE LDP neighbor has
advertised a label for that IP network, the
PE will push the advertised label at layer
2.5  and forward the packet as an MPLS
packet to the downstream neighbor.
• P router will swap the local label, and put
on the label it learned from it’s
downstream neighbor, and forward it on.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS Forwarding cont.

• Downstream neighbors will continue to


swap the labels, and forward the MPLS
packet until packet reaches the MPLS
egress PE.
• The egress PE will pop of any remaining
label(s), and forward the packet as an IP
packet.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Trace over the MPLS network

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Acronyms for MPLS

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
Acronyms for MPLS

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MAT (MPLS Acronyms and Terms)

• LSR – Label Switch Router


– Router that supports MPLS
• Ingress LSR
– Provider Edge (PE) first hop. Takes IP naked transit
packet and pushes/imposes new label and forwards.
• Intermediate LSR
– Provider (P) takes labeled packet and swaps labels
and forwards to next LSR
• Egress LSR
– Provider Edge (PE) last hop. Pops/disposes lablel
and forwards naked IP packet
Copyright © 2010 Internetwork Expert, Inc
www.INE.com
The actual network is “DownStream”

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS Acronyms and Terms cont.

• LSP – Label Switched Path


– Data plane for a labeled packet through the LSRs
– LSP is unidirectional
• Downstream
– Transit path is downstream towards the network packets are
trying to reach. Also called the “data plane”
• Upstream
– Beginning at the network that is being advertised, this is the
“control plane” for LDP. Think of it similar to an IGP distance
vector routing protocol, with R1 connected to network X. R1 tells
R2, R2 tells R3, R3 tells R4, etc. This advertisement of their
own local labels builds the LSP. The protocol used to advertise
the labels is Label Distribution Protocol (LDP).

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Remote Control Plane

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Control Plane and Data Plane terms

• IP Control Plane
– EIGRP, OSPF, etc: routing protocols
– RIB: Routing information base
• MPLS Control Plane
– LDP: Label distribution protocol
– LIB: Label information base
• IP Data Plane
– FIB: CEF forwarding information base
• MPLS Data Plane
– LFIB: MPLS label forwarding information base

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Control/Data Plane for MPLS

• IP Routing protocols populate the Routing


Information Base (RIB) –control plane
• RIB populates CEF and its Forwarding
Information Base (FIB) – data plane
• Label Distribution Protocol (LDP) populates the
Label Information Base (LIB) – control plane
• LDP and RIB populate the Label Forwarding
Information Base (LFIB) – data plane

– CEF also stores some label info.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
RIB

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
CEF

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
RIB and CEF for 192.168.3.4

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
LIB (Label Information Base)

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
LFIB (Label Forwarding Info. Base)

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
LIB and LFIB for 192.168.3.4

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Labels

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
When we return: Labels

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS Labels

• Live between L2 and L3 of the OSI


• A single label corresponds to a single
route, and is locally significant to the
router. Labels are 4 bytes long.
• Each router generates a local label for
each route, and then shares them via LDP
with LDP neighbors.
• Labels identify a Forwarding Equivalence
Class (FEC). RFC 3031
Copyright © 2010 Internetwork Expert, Inc
www.INE.com
The MPLS Label Details

• 32 bits total
– 20 bits for the label #
– 3 bits for Traffic Engineering (TE)
– 1 bit to specify that this label is the last. This
is the bottom-of-stack bit. 1=on=last label.
– 8 bits for the TTL

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS Packet

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
More MPLS Acronyms and Terms

• FEC – Forwarding Equivalence Class


• Implicit Null
– Reserved label #3
• PHP – Penultimate Hop Pop
– Next to last LSR, removes top label, so that egress
LSR (PE) doesn’t have to

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
To push or not to push, a label.

• An ingress LSR (PE), when receiving a transit


packet, uses the CEF table to forward. In the
CEF table, there will be a label, if we have
learned a label for the IP destination. If a label
is present we will impose/push the label we
learned for this network/route, and forward the
packet to our downstream LDP neighbor.
• If an LSR receives a labeled packet, that it
doesn’t have a local label for, it drops it.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
RIB and CEF for 192.168.3.4

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Remove and Replace MPLS, new labels

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Where does the label go?

• In frame-mode
– Inserted between L2 and L3
– L2 protocol identifier (PID) is changed to
indicate that the packet has an MPLS label
• Unlabeled IP unicast PID = 0x 0800
• Labeled IP unicast PID = 0x 8847
• Labeled IP multicast PID = 0x 8848
• In cell-mode (ATM switches as LSRs)
– The fields of the ATM header are used as the
label
Copyright © 2010 Internetwork Expert, Inc
www.INE.com
Ethernet PID for MPLS 0x8847

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Stacks

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
Stacks

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Why a label “stack”?

• With MPLS VPNs we will have more than


1 label “stacked” between L2 and L3.
– Bottom of stack bit set to on means that that
label is the last one in the stack.
• With MPLS TE we could have multiple
labels as well.
– Top label could be used for TE, with the
second label pointing to the downstream
network.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS “Stack”

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Reminder, “Why are we doing this?”

• Unicast/Multicast Routing (PIM extentions)


• Traffic Engineering (TE) and QoS
• MPLS Virtual Private Networks (VPNs)
• Any Transport over MPLS (AToM)
– Transporting L2 packets for customers over
the Service Provider network, transparently to
the customer.
• Ethernet over MPLS (EoMPLS)
• ATM AAL5 over MPLS
• Frame Relay over MPLS (FRoMPLS)
Copyright © 2010 Internetwork Expert, Inc
www.INE.com
What we have learned…

• IP packets are forwarded based on IP address,


(except at the ingress PE).
• MPLS packets are forwarded based on labels,
(except at the egress PE).
• Control plane for IP and MPLS
• Data plane for IP and MPLS
• The MPLS label(s)
• Adding, removing or swapping labels
– Push/imposition, pop/disposition, swap

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Confirm what you learn.

• What are the characteristics of an “overlay” vs


“peer to peer” implementation
• How do ingress and egress PE LSRs differ from
each other, and how are they both different from
a P LSR?
• Where does the label live, how long is it, and
how does an LSR know there’s a label?
• What does an LSR do when it receives a labeled
packet, but doesn’t have a local label for it?
• What are the RIB, CEF, LIB and LFIB functions?

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Sharing Label Info

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
Sharing Label Info

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Our Journey

• MPLS building blocks


• Label Distribution Protocol ( LDP )
• MPLS Virtual Private Networks ( VPNs )
– Advanced MPLS
• Overlapping
• Central Service
• Network Management
– Internet Access
• Traffic Engineering ( TE )

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
We need to know what labels to push!

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Label Distribution Protocols

• Label Distribution Protocol (LDP)


• Tag Distribution Protocol (TDP) legacy
• Resource Reservation Protocol (RSVP)
– Used for Traffic Engineering (TE) only

• Note: even though TDP is legacy, the term “TAG”


still shows up in many of the IOS output
commands, even when we are using LDP.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Note how often the term “tag” appears.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Which comes first?

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
The order of things.

• IP IGP routing protocols build the IP tables


• LSRs assign a local label for each route
learned
• LSRs share their labels with other LSRs
using LDP
• LSRs build their own LIB, LFIB and FIBs
based on what they have learned from
their LDP neighbors

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Won’t you be my neighbor?

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Lets be LDP Neighbors

• Two step process


– Hello messages
• LDP link hello uses destination UDP port 646 and is sent to
224.0.0.2 every 5 seconds
• Hello may include the IP address desired for peering,
different than the source IP in the header.
• Indicates if the label space is system wide, or per interface.
– Setup LDP session with neighbor who says hello.
• Session is TCP based on destination port 646
• Router with highest LDP router ID will initiate this TCP
session ( called the active LSR ). Keepalives are sent every
60 seconds.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
LDP Hello

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
LDP Initialization Message

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
LDP Label Advertisement

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Space, Label Space

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
Space, Label Space

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Label Space

• System wide label space, uses the same


label for the same network, regardless of
interface used.
– LDP neighbors with parallel connections to
each other, will only use 1 of the paths.
– LDP ID = A.B.C.D:0 for system wide labels
– Frame mode LSRs use system-wide/per-
platform label space.
• Per Interface label space is the other
option.
Copyright © 2010 Internetwork Expert, Inc
www.INE.com
Label Space Identifier

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
LDP

• Each LSR assigns a local label to each IP


route, and then shares that local label with
it’s LDP neighbors.
• If an LSR wants it’s neighbor to pop off a
label before forwarding downstream
(towards the PE), it advertises an “implicit
null” (value is 3) for the given network.
• Penultimate Hop Popping (PHP) saves the
egress PE from an extra LFIB lookup.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implicit null label

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
FIB, not just for IP routing.

• CEF’s FIB initially has just IP related


information in it.
• When downstream LDP neighbors
advertise their local labels for networks,
we use those as outgoing labels, for those
networks.
• Upon learning the outgoing labels, we
populate the LIB, LFIB and CEF tables
with the information.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
CEF has labels in table, ready to run.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Label Advertising and Retention

• After locally assigning labels to all known


routes, we advertise them to ALL
neighbors, up and down stream.
• Neighbors calculate best path based on
IGP next hop, and addresses that are
owned by the LDP neighbors.
• Each LDP speaker will remember all the
labels received through advertisements,
and the best paths go into the LFIB/CEF.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Why label 18 and not label 28?

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Routing table, next hop, owned by neighbor.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Unsolicited Labels

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
Unsolicited Labels

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Unsolicited and Liberal

• Downstream routers that advertise their


labels, without being asked, are
considered to be doing down-stream un-
solicited label advertising.
• When an LSR keeps track of all the
advertisements, both best and not best
path, it is called Liberal label retention.
Nice to have for cutover to another path.
Sort of like EIGRPs feasible successor.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Downstream Unsolicited

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Loop Prevention

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Loop Prevention

• Hopefully, the IGP we are relying on, has


no loops, so we are probably fine.
• If the IGP does have loops, our MPLS TTL
runs out eventually.
• The initial TTL MPLS will use in the label,
is copied from the original ingress IP
packet TTL.
• The egress IP packet TTL is copied from
the then decremented MPLS TTL.
Copyright © 2010 Internetwork Expert, Inc
www.INE.com
TTL copied from IP and PUT in MPLS

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Dealing with the Core

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
Unsolicited Labels

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Unsolicited and Liberal

• Downstream routers that advertise their


labels, without being asked, are
considered to be doing down-stream un-
solicited label advertising.
• When an LSR keeps track of all the
advertisements, both best and not best
path, it is called Liberal label retention.
Nice to have for cutover to another path.
Sort of like EIGRPs feasible successor.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Downstream Unsolicited

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Loop Prevention

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Loop Prevention

• Hopefully, the IGP we are relying on, has


no loops, so we are probably fine.
• If the IGP does have loops, our MPLS TTL
runs out eventually.
• The initial TTL MPLS will use in the label,
is copied from the original ingress IP
packet TTL.
• The egress IP packet TTL is copied from
the then decremented MPLS TTL.
Copyright © 2010 Internetwork Expert, Inc
www.INE.com
TTL copied from IP and PUT in MPLS

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Hiding the Core

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
Hiding the Core and other MPLS options

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Hide the MPLS core from the Client

• Disabling the TTL propagation will not


copy the IP TTL to the MPLS TTL, and
MPLS will use 255.
• Results best seen via traceroute from the
local customer site, to the remote site
customer over the backbone.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
No mpls ip propagate-ttl (on a LSRs)

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS options

• MPLS MTU
• MPLS IP TTL Propagation
• Conditional Label Distribution
– Per prefix, or per neighbor

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Summary Routes in the LSP

• Breaks the LSP into 2 smaller LSPs


• Summarizing router in the middle will be
performing IP route-lookups.
– End to end LSP connectivity is required by
VPN, TE, and if the core of the provider
network ( the P LSRs) are not running BGP

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS States

• Steady state is, in a word, “Convergence”


– RIB
– LIB
– FIB
– LFIB
• Link failure state, absence of any of the above,
until it all converges. Because of liberal label
retention, the backups for the LSP are
immediately ready to go.
• IGP convergence is the biggest delay

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Configuring MPLS

• Requirements:
– CEF enabled: show ip cef [detail]
– IGP routing working
– Enable MPLS IP globally and on interfaces
• “MPLS IP” (both global and interface config)
• Optional:
– Specify LDP or TDP or both as protocol
– Specify LDP Router ID
– Specify transport IP address

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Monitoring MPLS

• Show mpls ldp parameters


• Show mpls interface
• Show mpls ldp discovery
• Show mpls ldp neighbor [detail]
• Show mpls ldp ldp bindings
• Show mpls forwarding-table [detail]
• Show ip cef [a.b.c.d detail]

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Troubleshooting

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
Troubleshooting MPLS

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Troubleshooting MPLS

• LDP neighborship failed


• MPLS not enabled, LDP TCP/646 or TDP TCP/711 ports filtered, no
L3 route to LDP neighbor LSR router-id, highest loopback address.
• Labels not assigned
• CEF not enabled
• Labels not shared
• Compatible LDP/TCP between neighbors
• Slow convergence
• Get rid of RIP  IGP is biggest factor in convergence delay

• Large packets dropped


• MTU not supported by switches. Multiple labels may be present pushing the
MTU to a size not supported by the infrastructure.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Debugs

• Debug mpls ldp


• Debug mpls lfib
• Debug mpls packets

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Confirm what you learn …

• What are 5 specific reasons that MPLS


may not be working?
• What happens when 2 frame-mode LDP
neighbors have parallel MPLS interfaces
with each other?
• What commands are use to see detailed
information regarding:
• LDP, LDP neighborships, CEF, LIB, LFIB and
MPLS interfaces?

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: MPLS VPNs

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
MPLS VPNs

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Our Journey

• MPLS building blocks


• Label Distribution Protocol ( LDP )
• MPLS Virtual Private Networks ( VPNs )
– Advanced MPLS
• Overlapping
• Central Service
• Network Management
– Internet Access
• Traffic Engineering ( TE )

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
VPNs (in General)

• L2 Virtual Circuits
– Frame Relay, ATM, SMDS, X.25 
• IP Tunneling
– IPSec, GRE, PPTP
• Implementation Methods
– Overlay
• Service provider gives the customers the circuits, and says
“have fun with that”.
– Peer-to-Peer
• Service provider peers with the customer and learns all their
routes

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Overlay designs

• Hub and spoke


– Central HQ acting as hub location
• Redundant hub and spoke
– Multiple hubs
• Partial mesh
• Full mesh
– Not likely in big environments

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS VPNs

• PE routers participate with customers,


peer-to-peer
• PE routers have a virtual routing and
forwarding instance (VRF) to keep all
customer routes separate from other
customers. (Like vmware for IOS routing)
• Customer1 and customer2 may have
networks that overlap each other, MPLS
VPNs have a way of handling that.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Lets review the ingredients…

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Ingredients in the MPLS VPN Recipe

• Customer Network
• Customer Edge routers (CE routers)
• Provider Network
• Provider Edge routers (PE routers)
– Edge of the MPLS provider network
– VRFs, 1 for each customer
– Routing protocol between PE and CE
• Provider core routers (P routers)

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
VRF: the Virtual Routing Table

• Cisco can have multiple VRFs


– VRF: Virtual Routing and Forwarding instance
• Some details about VRFs:
– Router can have multiple VRFs
– Each one has its own CEF table
– Interfaces are assigned to a specific VRF
• Interfaces not assigned to a VRF are part of the global
routing table on the router.
– VRFs contains identity information such as Route
Targets (RT), and Route Distinguishers (RD)
• More on RT and RD coming up.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
On PE-2 we create 2 VRFs, one for each customer.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: Route Targets and RD

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Implementing MPLS VPNs

http://www.INE.com
Route Targets and RD

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Route Distinguisher : RD

• If customer1 and customer2 have the same


10.0.0.0/8 network, how do they globally
distinguish between them?
– Each customers routes will have a 64 bit RD pre-
pended (by the PE) as an attribute of the route, so
now the same route from 2 different customers end
up as globally unique, due to the RD being different
for each customer. The 32 bit route is now 96 bits.
– Routes with a RD are now VPNv4 routes.
– PEs exchange VPNv4 routes across MPLS using
iBGP.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Route Distinguisher

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
RD Pre-pended to Prefix

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Route Targets : RT

• Route Targets (RT) allow for more


complex sharing of routes.
– Example: customer1 and customer2 both
want to learn the routes to a 3rd address
space, where servers are used by both.
– Using the RT we can specifically share those
routes from the shared services network to
both customers.
• RT values are included as extended
BGP community values.
Copyright © 2010 Internetwork Expert, Inc
www.INE.com
RT operation

• RT may be thought of as a tag.


– Example: If router 1 and router 2 injected networks
via an IGP, and tagged some of those routes as tag
1234, an upstream router could filter, and decide to
include or exclude those routes, based on the tag
1234.
• When an ingress PE takes customer1’s routes, a
RT value will be associated with those routes.
• Egress PEs can decide to give or not give those
routes to the far side customer sites, based on
the RT imposed at the ingress PE.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
RT is an extended community attribute

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
RT as part of BGP ext. Comm.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
RD and RT associated with VRF

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MPLS VPN Routing

• CE routers share routes with the PE using


a routing protocol.
• PE routers play the routing game with the
CE, but also have MPLS and IGP routing
enabled with the core provider network.
• PE routers have iBGP neighborships with
the other PE routers in the provider
network.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
Internet Routing

• PE routers, peering with other PE routers


can share VPNv4 routes (customer routes,
contained in the respective VRFs).
• PE can also share IPv4 Internet routes,
including routes in the provider core, in
their global routing table.

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
MP-BGP VPNv4 Configuration

Copyright © 2010 Internetwork Expert, Inc


www.INE.com
When we return: The VPN label

Copyright © 2010 Internetwork Expert, Inc


www.INE.com

You might also like