L2VPN over IOS-XE and IOS-XR: Configuration, Deployment and Troubleshooting LTRSPG-2500

Transcription

1 L2VPN over IOS-XE and IOS-XR: Configuration, Deployment and Troubleshooting LTRSPG-2500 Kashif Islam Mobeen Tahir 1 of 22

2 Introduction The objective of this lab is to introduce network engineers to the concept of Carrier Ethernet MPLS Based Layer 2 VPN networks and to provide hands-on experience required for configuration and verification of point-to-point and multipoint L2VPN services as described by Metro Ethernet Forum (MEF) This lab is broken into the following modules: Module 1: Discover Your Lab Topology Module 2: Configuring Point-to-Point E-Line Module 3: Configuring Multipoint ELAN Service using VPLS Module 4: Configuring Multipoint ELAN Service Using M-BGP and H-VPLS Module 5: Troubleshooting MPLS L2VPN Services Prerequisites: Must know how to use Cisco IOS Must understand VLANs and Layer 2 Switching Must understand basics of MPLS and LDP operations Knowledge of MPLS based pseudowires (e.g. EoMPLS) is preferred, but not required Hardware Used: Cisco ASR-9000 Series Router Cisco ASR-903 Series Ethernet Aggregation Router Cisco ME3600X Series Ethernet Aggregation Router Cisco ASR-901 Series Cell Site Router Cisco 7600 with ES-20 Linecards Cisco ME of 22

3 Services Overview Full POD Topology You POD Topology is provided to you by the instructor in the class. 3 of 22

4 Module 1: Verify Connectivity and Identify Network Elements Estimated Completion Time: 15 min Objective: Establish connectivity to your POD Identify MPLS enabled interfaces Identify MPLS Router ID s for Access and Aggregation devices in your Pod. At the end of this module you should have fully populated individual POD diagram. Connectivity Details: A Putty shortcut is created on the desktop to automatically login to a Cisco Live DMZ device that connects to PODs for this Lab. Double clicking the shortcut will provide the following output: Using username "cisco". Last login: 7600-Live> To connect to a device in the pod, simply type the hostname of the device. For example, to connect to asr-901-x, simply type asr-901-x on the prompt: 7600-Live> me3600-x Trying Open User Access Verification Password: Use the following credentials throughout this lab: Username: cisco Password: cisco Enable Password: cisco Configuration Tasks: You can open as many connections to this server as required. 1. Identify your individual pod number and group number, identified as x and g from here on. 2. Ensure connectivity to following devices: Aggregation Nodes: ASR-903 and ASR-9K Look at your pod diagram for your ASR-9K For Pod number use ASR and ASR-9K-2 Access Nodes: ASR-901-x and ME3600-x, where x is your pod number CE Nodes: ce-x (3400 used as CE s connected to ASR-901 s) ce-[x+16] 7600 (3400 used as CE s connected to ME-3600 s) 4 of 22

5 3. Your pod topology diagram specifies the interface information for all nodes in the network. Take a moment to familiarize yourself with the network. 4. Basic MPLS has been pre-configured on all Aggregation devices. You will also find that the MPLS Router ID have been documented for Cisco 7600 on your POD. Use the following show commands to identify and document the MPLS Router ID for ASR-903 and ASR-9K in your POD. Example below is for ASR and ASR-9K-1. Make sure you use your own Aggregation nodes ASR-903-1# sh mpls ldp discovery Local LDP Identifier: ?? :0 Discovery Sources: Interfaces: <snip> RP/0/RSP0/CPU0:PR-ASR9K-1#sh mpls ldp discovery Thu Jun 20 19:52: UTC Local LDP Identifier: ?? :0 Discovery Sources: Interfaces: <snip> 5. On access nodes (ME3600-x and ASR-901-x) use show ip interface brief to document the Loopback0 (lo0) IP address. This IP address will be used as MPLS RID in upcoming modules. ASR-901-x# show ip interface brief loopback 0 Interface IP-Address OK? Method Status Protocol Loopback x YES NVRAM up up ME3600-x# show ip interface brief Loopback 0 Interface IP-Address OK? Method Status Protocol Loopback x YES NVRAM up up Identify and document the MPLS Router ID for MPLS devices in your POD before moving to next section. MPLS LDP Router ID s are typically used to establish EoMPLS or VPLS Virtual Circuits (VC s), as will be seen in the next module. Congratulations! You ve finished Module 1 successfully. (Not so bad, is it?) 5 of 22

6 Module 2: Transparent Point to Point L2VPN (E-Line) Services Estimated Completion Time: 25 min E-Line Topology Objective: Configure Aggregation node to accept any frame from Access nodes (equivalent to tunnel mode in legacy switchport configuration) Configure a point-to-point Layer 2 VPN service by creating an Ethernet over MPLS (EoMPLS) Pseudowire between EFP s on Aggregation Devices Verify the service through show commands Ping between Access Nodes (ME3600-x and ASR-901-x) devices using this service Devices Used: Aggregation: ASR-903 and ASR-9K Access: ASR-901-x and ME3600-x Configuration Tasks: 1. Login to your Access devices. (x is your pod number) ASR-901-x Used as CE connected to ASR-903 Aggregation ME3600-x Used as CE connected to ASR-9K Aggregation 2. Shut down the interface towards the CE device on both Access nodes. Keep this interface shut until instructed otherwise. ASR-901-x#conf t ASR-901-x(config)# int gig0/1 ASR-901-x(config-if)# shut ASR-901-x(config-if)#end ME3600-x#conf t ME3600-x(config)# int gig 0/1 ME3600-x(config-if)#shut ME3600-x(config-if)#end 3. Login to your Aggregation devices ASR-903-?? and ASR-9K-?? 6 of 22

7 4. Configure an EFP on Access-facing interface on your ASR-903 aggregation node. Use your pod number ad your EFP ID and use encapsulation Default : Make sure you configure the interface facing ASR-901-x allocated to your POD only ASR-903-??#configure terminal ASR-903-?(config)#int gig 0/??/?? ASR-903-?(config-if)# service instance x ethernet ASR-903-?(config-if-srv)#encapsulation default 5. On this EFP, configure an Ethernet over MPLS (EoMPLS) Pseudowire for Layer 2 data transport. Following parameters are needed for the EoMPLS PW: Peer IP Address MPLS LDP RID of the remote node Your POD s ASR-9K Virtual Circuit ID use x, where x is your Pod number Encapsulation Use encapsulation MPLS ASR-903-??#configure terminal ASR-903-?(config)#int gig 0/??/?? ASR-903-?(config-if)# service instance x ethernet ASR-903-?(config-if-srv)#encapsulation default ASR-903-1(config-if-srv)# xconnect ? x encapsulation mpls ASR-903-1(cfg-if-ether-vc-xconn)#end 6. Create a similar EFP on ASR-9K Aggregation Node on the interface facing ME3600- x. However since this is IOS-XR, EFP is created using an L2 sub-interface: Use your POD ID (x) as sub-interface ID. Make sure you configure the ASR-9K and interface allocated to your POD only. Remember to commit the config RP/0/RSP0/CPU0:PR-ASR9K-?#conf t RP/0/RSP0/CPU0:PR-ASR9K-?(config)# int gig 0/2/0/??.x l2transport RP/0/RSP0/CPU0:PR-ASR9K-?(config-subif)# encapsulation default RP/0/RSP0/CPU0:PR-ASR9K-1(config-subif)#commit 7. Configure an EoMPL PW on ASR-9K towards ASR-903. Use the newly created EFP as the Attachment circuit. ASR-9K uses IOS-XR hierarchical configuration which is different from IOS. Following parameters are required for EoMPLS configuration on IOS-XR: Xconnect group: Administrative grouping of similar point to point service. Use name EPL-PODx, where x is your POD number P2P connection name: Actual point to point service configuration. Use name PODx, where x is your POD number Neighbor IP LDP RID of the remote node Your ASR-903 in this case Virtual Circuit ID use x, where x is your Pod number Interface: Attachment Circuit. Use the sub-interface/efp configured in step 5 7 of 22

8 Here is the configuration sample: RP/0/RSP0/CPU0:PR-ASR9K-?#config t RP/0/RSP0/CPU0:PR-ASR9K-?(config-subif)#l2vpn RP/0/RSP0/CPU0:PR-ASR9K-?(config-l2vpn)#xconnect group EPL-PODx RP/0/RSP0/CPU0:PR-ASR9K-?(config-l2vpn-xc)# p2p PODx RP/0/RSP0/CPU0:PR-ASR9K-?(config-l2vpn-xc-p2p)#int gig 0/2/0/??.x RP/0/RSP0/CPU0:PR-ASR9K-?(config-l2vpn-xc-p2p)#neigh ? pw-id x RP/0/RSP0/CPU0:PR-ASR9K-?(config-l2vpn-xc-p2p-pw)#commit At this time, Layer 2 service configuration is complete between customer sites. Next, we will move on to the verification task to validate L2 connectivity between remote customer sites. Verification Tasks: 1. View service instance configured on the Aggregtion devices: ASR-903-?#sh ethernet service instance interface gig??? Identifier Type Interface State CE-Vlans x static GigabitEthernet0/??/? Up RP/0/RSP1/CPU0:PR-ASR9K-?#sh int gig 0/2/0/??.x <snip> 2. View detailed service instance information on both ASR-903 and ASR-9K: ASR-903-?# sh ethernet service instance interface gig 0/??/?? det Service Instance ID: x Service Instance Type: static Associated Interface: GigabitEthernet0/?/? Associated EVC: L2protocol drop CE-Vlans: Encapsulation: default Interface Dot1q Tunnel Ethertype: 0x8100 State: Up EFP Statistics: Pkts In Bytes In Pkts Out Bytes Out RP/0/RSP1/CPU0:PR-ASR9K-?#sh int gig 0/2/0/??.x <snip> 3. Verify the status of the EoMPLS PW by using the show mpls l2transport vc x and show l2vpn xconnect... command on ASR-903 and ASR-9K ASR-903-x# show mpls l2transport vc x Local intf Local circuit Dest address VC ID Status Gi0/??/?? Ethernet:x ? x UP 8 of 22

9 RP/0/RSP1/CPU0:PR-ASR9K-x# sh l2vpn xconnect group POD1 Legend: XC ST=XconnectState S1=Segment1 State S2=Segment2 State UP=Up DN=Down AD=Admin Down IA=Inactive SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware XConnect Segment 1 Segment 2 Group Name ST Description ST Description ST EPL-PODx PODx UP Gi0/2/0/??.x UP ? x UP Create two VLAN interfaces on both ASR-901-x and ME3600-x. Assign an IP address to both vlans as shown below. Use VLAN 100 and 200 VLAN 100: VLAN 200: ASR-901-x IP Address 100.x.x.1/24 ME3600-x IP Address 100.x.x.2/24 ASR-901-x IP Address: 200.x.x.1/24 ME3600-x IP address: 200.x.x..2/24 ASR-901-X#conf t ASR-901-x(config)#int vlan 100 ASR-901-x(config-if)#ip address 100.x.x ASR-901-x(config-if)#no shut ASR-901-x(config-if)# ASR-901-x(config-if)#int vlan 200 ASR-901-x(config-if)#ip addres 200.x.x ASR-901-x(config-if)#no shut ASR-901-x(config-if)#end ASR-901-x# ME3600-X#conf t ME3600-x(config)#int vlan 100 ME3600-x(config-if)#ip address 100.x.x ME3600-x(config-if)#no shut ME3600-xconfig-if)# ME3600-x(config-if)#int vlan 200 ME3600-x(config-if)#ip address 200.x.x ME3600-x(config-if)#no shut ME3600-x(config-if)#end 5. Create service instances (EFP) for VLAN 100 and 200 on ME3600-x and ASR-901-x. Use 100 and 200 as Service instance ID and Bridge-domain as well. Combined with VLAN created earlier, this step will create Layer-3 interfaces on both access nodes. ME3600-X#conf t ME3600-X(config)#int gig 0/2 ME3600-X(config-if)#service instance 100 ethernet ME3600-X(config-if-srv)#encap dot1q 100 ME3600-X(config-if-srv)#rewrite ingress tag pop 1 symm ME3600-X(config-if-srv)#bridge-domain 100 ME3600-X(config-if-srv)# 9 of 22

10 ME3600-X(config-if-srv)#service instance 200 ether ME3600-X(config-if-srv)#encap dot1q 200 ME3600-X(config-if-srv)#rewrite ingress tag pop 1 symm ME3600-X(config-if-srv)#bridge-domain 200 ME3600-X(config-if-srv)#end ASR-901-X#conf t ASR-901-X(config)#int gig 0/2 ASR-901-X(config-if)# service instance 100 ethernet ASR-901-X(config-if-srv)# encapsulation dot1q 100 ASR-901-X(config-if-srv)# rewrite ingress tag pop 1 symmetric ASR-901-X(config-if-srv)# bridge-domain 100 ASR-901-X(config-if-srv)# ASR-901-X(config-if-srv)# service instance 200 ethernet ASR-901-X(config-if-srv)# encapsulation dot1q 200 ASR-901-X(config-if-srv)# rewrite ingress tag pop 1 symmetric ASR-901-X(config-if-srv)# bridge-domain 200 ASR-901-X(config-if-srv)#end 6. Ensure that ping is successful between the two access nodes. Use the interfaces created above. ME3600-x#ping 100.x.x.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 100.x.x.1, timeout is 2 seconds:.!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms ME3600-x# ME3600-x# ME3600-x#ping 200.x.x.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 200.x.x.1, timeout is 2 seconds:.!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms You can use sh mpls l2transport vc detail to ensure traffic stats are increasing with ping Congratulations! You ve successfully established EPL connectivity between two sites through the SP core. 10 of 22

11 Module 3: Configuring Multipoint ELAN Service using VPLS Estimated Completion Time: 25 min Objective: Clear the service instance configuration used in earlier module Configure VLAN specific service instances with common bridge domain on Aggregation Nodes Configure full mesh VPLS Pseudowires between ASR-9K, ASR-903 and 7600 in the core. Verify service configuration Devices Used: Aggregation: ASR-903 and ASR-9K Access: ASR-901-x and ME3600-x Configuration Tasks: 1. Login to your Aggregation devices. (ASR-903 and ASR-9K) 2. On ASR-903 and ASR-9K, shut down the EFP s created in earlier module. ASR-903-?#conf t ASR-903-?(config)#int gig 0/n/n ASR-903-?(config-if)#service instance x ethernet ASR-903-?(config-if-srv)#shut RP/0/RSP1/CPU0:PR-ASR9K-?#conf t RP/0/RSP1/CPU0:PR-ASR9K-?(config)#int gig 0/2/0/n.x RP/0/RSP1/CPU0:PR-ASR9K-?(config-subif)#shut RP/0/RSP1/CPU0:PR-ASR9K-?(config-subif)#commit 11 of 22

12 3. On the same interface, configure two new EFP on ASR-903, one each for VLAN 100 and VLAN 200. Assign a common bridge-doman (1x) to both Service Instances. Ensure that the VLAN is popped before transmission : ASR-903-??#configure terminal ASR-903-?(config)#int gig 0/??/?? ASR-903-?(config-if)# service instance 100 ethernet ASR-903-?(config-if-srv)#encapsulation dot1q 100 ASR-903-?(config-if-srv)# rewrite ingress tag pop 1 symmentic ASR-903-?(config-if-srv)# bridge-domain 1x ASR-903-?(config-if)# service instance 200 ethernet ASR-903-?(config-if-srv)#encapsulation dot1q 200 ASR-903-?(config-if-srv)# rewrite ingress tag pop 1 symmentic ASR-903-?(config-if-srv)# bridge-domain 1x 4. Create a VFI on your ASR-903 with VPLS Pseudowires to your ASR-9K and to the 7600 in the SP Core Use 1x as your PW ID and PODx as VFI name, where x is your POD ID: PR-ASR903-?(config)#l2 vfi PODx manual PR-ASR903-?(config-vfi)#vpn id 1x PR-ASR903-?(config-vfi)#neighbor encap mpls PR-ASR903-?(config-vfi)#neighbor ? encap mpls 5. Create similar EFPs on ASR-9K Aggregation Node on the interface facing ME3600- x. However since this is IOS-XR, EFP is created using an L2 sub-interface: Use VLAN ID as your sub interface ID. RP/0/RSP0/CPU0:PR-ASR9K-?#conf t RP/0/RSP0/CPU0:PR-ASR9K-?(config)# int gig 0/2/0/??.100 l2transport RP/0/RSP0/CPU0:PR-ASR9K-?(config-subif)# encapsulation dot1q 100 RP/0/RSP0/CPU0:PR-ASR9K-?(config-subif)# rewrite ingres tag pop 1 symm RP/0/RSP0/CPU0:PR-ASR9K-1(config-subif)#commit RP/0/RSP0/CPU0:PR-ASR9K-?(config)# int gig 0/2/0/??.200 l2transport RP/0/RSP0/CPU0:PR-ASR9K-?(config-subif)# encapsulation dot1q 200 RP/0/RSP0/CPU0:PR-ASR9K-?(config-subif)# rewrite ingres tag pop 1 symm RP/0/RSP0/CPU0:PR-ASR9K-1(config-subif)#commit 6. Configure a Bridge Domain on ASR-9K. Allocate both Sub-interfaces to the Bridge- Domain as well as configure VFI and Pseudowires under the Bridge-Domain. Use POD1x as your P2P connection name. RP/0/RSP/CPU0:ASR9K-?(#configure terminal RP/0/RSP/CPU0:ASR9K-?(config)#l2vpn RP/0/RSP/CPU0:ASR9K-? (config-l2vpn)#bridge group ELAN-PODx RP/0/RSP/CPU0:ASR9K-? (config-l2vpn-bg)#bridge-domain PODx RP/0/RSP/CPU0:ASR9K-? (config-l2vpn-bg)# interface gig0/2/0/??.100 RP/0/RSP/CPU0:ASR9K-? (config-l2vpn-bg)# interface gig0/2/0/??.200 RP/0/RSP/CPU0:ASR9K-? (config-l2vpn-bg)#bridge-domain PODx RP/0/RSP/CPU0:ASR9K-?(config-l2vpn-bg-bd)#vfi PODx RP/0/RSP/CPU0:ASR9K-?(config-l2vpn-bg-bd-vfi)#neigh pw 1x RP/0/RSP/CPU0:ASR9K-?(config-l2vpn-bg-bd-vfi)#neighbor ? pw 1x RP/0/RSP/CPU0:ASR9K-?(config-l2vpn-bg-bd-vfi-pw)#commit RP/0/RSP/CPU0:ASR9K-?(config-l2vpn-bg-bd-vfi-pw)#end 12 of 22

13 7. Verify the status of the EoMPLS PW between ASR-9K and ASR-903 using following commands: Show mpls l2transport vc detail Show xconnect all Show l2vpn xconnect... What seems to be the problem? What are two ways of fixing this? What is the recommended way? (Hint: Its not the MTU command) 8. Add configuration to your EFP s (Service instance on ASR-903 and Subinterface on ASR-9K) to fix the problem seen above. Verify that the new EoMPLS PW is up. Once the new PW is up, move to the verification task for this module 13 of 22

14 Verification Tasks: 1. Verify that all PW s are up on both aggregation nodes. PR-ASR903-?#sh mpls l2 vc 1x Local intf Local circuit Dest address VC ID Status VFI PODx vfi ? 1x UP VFI PODx vfi x UP RP/0/RSP0/CPU0:PR-ASR9K-?# sh l2vpn bridge-domain bd-name PODx brief Bridge Group:Bridge-Domain Name ID State Num ACs/up Num PWs/up ELAN:PODx 0 up 0/0 2/2 1. Perform the ping test between the customer sites for both VLAN 100 and 200 created earlier in this lab. ME3600-x#ping 100.x.x.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:.!!!! Success rate is 80 percent (4/5), round-trip min/avg/max = 1/1/4 ms ME3600-x# ME3600-x# ME3600-x# ME3600-x#ping 100.x.x.3 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to , timeout is 2 seconds:... Success rate is 0 percent (0/5) Congratulations! You ve established VLAN based Multipoint Layer 2 connectivity between remote sites using VPLS Now off to something really interesting 14 of 22

15 Module 4a: Configuring L3/MPLS between Access and Aggregation Objective: Convert L2 links between Aggregation and Access into L3 interfaces Enable Routing exchange between Access and Aggregation nodes Enable MPLS Between Access and Aggregation Nodes IP Address Assignment Scheme ASR901 ASR903 Link: x.y/24. ME3600 ASR9K Link: x.y/24 Loopbacks o ASR901-x: x/32 o ME3600-x: x/32 x = Your pod number y = 1 for Aggregation (903/9K) and 2 for Access (901/3600) device Configuration Tasks for ASR-901 and ASR-903: 1. On ASR-903, clean up any configuration on your access node (ASR-901) facing interface. Be sure to use ONLY your interface PR-ASR903-?#conf t PR-ASR903-?(config)# default interface gig 0/??/?? PR-ASR903-?(config-if)#end 2. Configure an IP address on ASR-903 access node (ASR-901) facing interface for your pod and enable MPLS for this interface. ASR-903-1#conf t ASR-903-1(config)#int gig 0/??/... ASR-903-1(config-if)#ip address x.y ASR-903-1(config-if)#mpls ip ASR-903-1(config-if)#end 3. Start advertising this subnet in pre-existing OSPF interface. For simplicity, just use Area 0. ASR-903-1#conf t ASR-903-1(config)#router ospf 100 ASR-903-1(config-router)#netw x are 0 ASR-903-1(config-router)#end 15 of 22

16 4. On ASR-901-x, remove any service instances configured earlier on ASR-903 facing interface (gig 0/2 in most cases) ASR-901-x(config)# default interface gig 0/2 ASR-901-x(config-if)#end 5. On ASR-901 interface facing aggregation, create a new service instance matching on untagged frames and assign it to a bridge-domain. Use 11 as your EFP Id and Bridge Domain ID ASR-901-x#conf t ASR-901-x(config)#int gig 0/2 ASR-901-x(config-if)#service instance 11 ether ASR-901-x(config-if-srv)#encapsulation untagged ASR-901-x(config-if-srv)#bridge-domain 11 ASR-901-x(config-if)#end 6. On ASR-901-x, configure an SVI for the bridge domain created above and assign an IP address according to IP addressing scheme shown above. Enable MPLS on this SVI ASR-901-x#conf t ASR-901-x(config)#interface vlan 11 ASR-901-x(config-if)#ip address x.y ASR-901-x(config-if)#no shut ASR-901-x(config-if)#mpls ip ASR-901-1(config-if)#end 7. If not already created, on ASR-901, Create a loopback interface (lo0) and assign an IP address according to IP addressing scheme shown above. Configure 901 to use Lo0 as LDP RID ASR-901-x#conf t Enter configuration commands, one per line. End with CNTL/Z. ASR-901-x(config)#int lo0 ASR-901-x(config-if)#ip address x ASR-901-x(config-if)#exit ASR-901-x(config)# mpls ldp router-id lo0 force ASR-901-x(config)#end 8. On ASR-901, create an OSPF process and start advertising both newly created subnets: ASR-901-x#conf t 16 of 22

17 Enter configuration commands, one per line. End with CNTL/Z. ASR-901-x(config)#router ospf 100 ASR-901-x(config-router)#net x are 0 ASR-901-x(config-router)#net x are 0 ASR-901-x(config-if)#end At this point you should have OSPF and LDP enabled between ASR-901 and ASR-903. If not, start troubleshooting by using interface and Loopback pings Configuration Tasks for ME3600 and ASR-9k: 1. On ASR-9k, remove L2 Subinterfaces you have configured in the earlier module. RP/0/RSP0/CPU0:PR-ASR9K-#conf t Mon Oct 29 01:33: UTC RP/0/RSP0/CPU0:PR-ASR9K-(config)#no int Gig0/2/0/??.100 RP/0/RSP0/CPU0:PR-ASR9K-(config)#no int Gig0/2/0/??.200 RP/0/RSP0/CPU0:PR-ASR9K-(config-subif)#commit RP/0/RSP0/CPU0:PR-ASR9K-(config-subif)#end 2. Configure an IP address on ASR-9k interface facing the access node (ME3600X) for your pod and enable MPLS for this interface. RP/0/RSP0/CPU0:PR-ASR9K-?#conf t Mon Oct 29 01:34: UTC RP/0/RSP0/CPU0:PR-ASR9K-1(config)#int gig 0/2/0/nn RP/0/RSP0/CPU0:PR-ASR9K-?(config-if)#ip address x.y RP/0/RSP0/CPU0:PR-ASR9K-?(config-if)#commit 3. Start advertising this subnet in pre-existing OSPF interface as well as in MPLS process. For simplicity, just use Area 0. ASR-903-1#conf t RP/0/RSP0/CPU0:PR-ASR9K-1(config)#router ospf 100 RP/0/RSP0/CPU0:PR-ASR9K-1(config-ospf)#area 0 RP/0/RSP0/CPU0:PR-ASR9K-1(config-ospf-ar)#interface 0/2/0/?? RP/0/RSP0/CPU0:PR-ASR9K-1(config-ospf-ar-if)#commit RP/0/RSP0/CPU0:PR-ASR9K-1(config-ospf-ar-if)#exit RP/0/RSP0/CPU0:PR-ASR9K-1(config-ospf-ar)#exit RP/0/RSP0/CPU0:PR-ASR9K-1(config-ospf)#exit gigabit RP/0/RSP0/CPU0:PR-ASR9K-1(config)#mpls ldp RP/0/RSP0/CPU0:PR-ASR9K-1(config-ldp)#inter gig 0/2/0/?? RP/0/RSP0/CPU0:PR-ASR9K-1(config-ldp)#commit RP/0/RSP0/CPU0:PR-ASR9K-1(config-ldp-if)#end 17 of 22

18 4. On ME3600, cleanup the configuration on ASR-9k facing interface (gig 0/2 in most cases) ME3600-x(config)#default interface gig 0/2 ME3600-x(config-if)#end 5. On ME3600X, configure the IP Address on main interface according to IP addressing scheme shown above and enable MPLS on this interace ME3600-x(config)#int gig 0/2 ME3600-x(config-if)#ip address x.y ME3600-x(config-if)#no sh ME3600-x(config-if)#mpls ip ME3600-x(config-if)#end 6. If not already configured, on ME3600, Create a loopback interface (lo0) and assign an IP address according to IP addressing scheme shown above. Configure Lo0 to use as MPLS RID ME3600-x#conf t ME3600-x (config)#int lo0 ME3600-x (config-if)#ip add g ME3600-x (config-if)#exit ME3600-x (config)# mpls ldp router-id lo0 force ME3600-x (config)#end 7. On ME3600X, create an OSPF process and start advertising both newly created subnets: ME3600-x#conf t ME3600-x(config-if)#router ospf 100 ASR-901-x(config-router)#net g are 0 ASR-901-x(config-router)#net x are 0 ASR-901-x(config-if)#end At this point you should have OSPF and LDP enabled between ASR-9k and ME3600X. If not, start troubleshooting by using hop-by-hop interface and Loopback pings Make sure you can ping End to End between ME3600 and ASR901 using IP as well as MPLS before moving forward 18 of 22

19 Module 4b: Configuring Multipoint ELAN Service using M-BGP and H-VPLS Estimated Completion Time: 45 min E-LAN Multipoint Topology Service Provider Core CE-x VLAN 100: x.x Live CE-[x+16] VLAN 100: x.x100.2 ASR-901-x ASR-903 ASR-9K ME3600-x Spoke PW Full Mesh VPLS Spoke PW End to End L2VPN through H-VPLS Objective: Configure an end-to-end multipoint (E-LAN) service using o Cisco EVC Infrastructure on Access and Aggregation o Flexible VLAN matching and manipulation on Aggregation o Use BGP Auto Discovery for Full Mesh VPLS on Core/Aggregation Nodes o H-VPLS access from Aggregation/Core to Access Nodes Verify multipoint L2 Connectivity across SP network Devices Used: Aggregation: ASR-903 and ASR-9K Access: ASR-901-x and ME3600-x CE: CE-x and CE-[x+16] Where x is your POD number BGP Pre-Configuration Common devices (ASR903 and ASR9K) have been preconfigured for BGP. This BGP configuration will be used for VPLS Auto-discovery throughout this lab Verify BGP configuration on your ASR-903 and ASR-9K using the default configuration: ASR-903-1#sh runn sec bgp RP/0/RSP0/CPU0:PR-ASR9K-1#sh runn router bg 19 of 22

20 Configuration Tasks 1. On ASR-901 s CE facing interface and add a new service instance with an xconnect to ASR-903. Notice the MTU Command. Use PW-ID of x00 to avoid possible conflicts with PW s created earlier interface GigabitEthernet0/1 service instance 100 ethernet encapsulation dot1q 100 rewrite ingress tag pop 1 symmetric xconnect ? x00 encapsulation mpls mtu On your ASR-903 Aggregation node, create a Virtual Forwarding Interface (VFI) for H-VPLS. Make use of the BGP auto discovery for core and aggregation facing PW, but also configure a static PW towards ASR-901. Disable split-horizon on this PW. Make sure you configure your ASR-903 only. Name the VFI PODx. Assign a VPN ID x00, which also serves as the PW ID for VPLS pseudowires. Use the Bridge-Domain x00 as well. PR-ASR903-?#configure terminal PR-ASR903-?(config)#l2 vfi PODx manual PR-ASR903-?(config-vfi)#vpn id x00 PR-ASR903-?(config-vfi)# bridge-domain x00 PR-ASR903-?(config-vfi)# neighb ?? encap mpls no-split-h 3. Perform a similar configuration on ASR-9K. Use BGP autodiscovery as well as static PW to ME3600 Access Node with Split horizon disabled. Make sure you configure your ASR-9Konly. Use x00 as your VPN ID and PODx as your Bridge-group, BD and VFI. However use pw-id x01 to the PW going to ME3600 l2vpn router-id bridge group PODx bridge-domain PODx neighbor zz pw-id x01! vfi PODx vpn-id x00 autodiscovery bgp rd 3:x00 route-target 3:x00 signaling-protocol ldp 20 of 22

21 4. On ME3600-x, create a new EFP on interface towards CE-x. This is interface gig 0/1 in most cases. On this EFP configure a PW to ASR9K. Use x01 as your EFP and PW ID. ME3600-x#configure terminal ME3600-x(config)#interface gigabitethernet 0/1 ME3600-x(config-if)# no shut ME3600-x(config-if)# service instance x01 ethernet ME3600-x(config-if-srv)# encapsulation dot1q 100 ME3600-x(config-if-srv)# rewrite ingress tag pop 1 symmetric ME3600-x(config-if-srv)#xconnect ? x01 encap mpls ME3600-x(cfg-if-ether-vc-xconn)#end 5. Cisco 7600 simulating a third leg of the H-VPLS based L2VPN service has been preconfigured for L2 PW s to ASR-903 and ASR-9K aggregation devices. You can do a a sh run on this device to familiarize yourself with this configuration. Do NOT modify any config on this device! Module 4b Verification Tasks: 1. Verify that all PW s are up on all Access and aggregation nodes. ASR-901-g#sh mpls l2 vcx00 PR-ASR903-?#sh mpls l2 vc x00 Local intf Local circuit Dest address VC ID Status VFI PODx vfi ?x00 UP VFI PODx vfi x00 UP VFI PODx vfi g 1x UP RP/0/RSP0/CPU0:PR-ASR9K-?#sh l2vpn bridge-domain bd-name PODx brief Bridge Group:Bridge-Domain Name ID State Num ACs/up Num PWs/up PODx:PODx 0 up 0/0 3/3 ME3600-g#sh mpls l2 vcx00 Local intf Local circuit Dest address VC ID Status Gi0/1 Eth VLAN 1x ? 1x UP RP/0/RSP0/CPU0:ASR9k-?#sh l2vpn bridge-domain bd-name PODx Bridge group: ELAN, bridge-domain: PODx, id: 0, state: up, ShgId: 0, MSTi: 0 Aging: 300 s, MAC limit: 4000, Action: none, Notification: syslog Filter MAC addresses: 0 21 of 22

22 ACs: 0 (0 up), VFIs: 1, PWs: 3 (3 up), PBBs: 0 (0 up) List of ACs: List of Access PWs: Neighbor g pw-id 1x, state: up, Static MAC addresses: 0 List of VFIs: VFI PODx Neighbor ?pw-id 1x, state: up, Static MAC addresses: 0 Neighbor pw-id 1x, state: up, Static MAC addresses: 0 2. Since this is a multipoint L2VPN services, all customer sites should be able to reach each over H-VPLS full mesh. Verify this by pinging between the 4 customer sites 3. Helpful Show commands for bgp ASR-903-1#sh ip bgp l2vpn vpls all summ ASR-903-1#sh ip bgp l2vpn vpls rd 3:x00 ASR-903-1#sh vfi name [name] RP/0/RSP1/CPU0:PR-ASR9K-1#sh l2vpn bridge-domain bd-name auto brief Congratulations on implementing a fine multi-point L2VPN service. (Isn t H-VPLS Fun??) Thank you for completing LTROPT-2500: L2VPN Services over IOS-XE and IOS-CXR Please don t forget to complete your online Session Evaluation 22 of 22