APNIC elearning: MPLS L3 VPN

Size: px

Start display at page:

Download "APNIC elearning: MPLS L3 VPN"

Julian Crawford
5 years ago
Views:

ANIC elearning: MLS L3 VN 18 JANUARY 2017 11:00 AM AEST Brisbane (UTC+10)

0 Introduction resenter/s Jessica Bei Wei Training Officer jwei@apnic.

1 ANIC elearning: MLS L3 VN 18 JANUARY :00 AM AEST Brisbane (UTC+10) Issue Date: 07 July 2015 Revision: 2.0 Introduction resenter/s Jessica Bei Wei Training Officer Specialties: Routing & Switching MLS, Iv6 QoS Reminder: please take time to fill-up the survey Acknowledgement to Cisco Systems 2 1

2 Agenda MLS VN VRF RD & RT Control lane of MLS L3VN Data lane of MLS L3VN Configuration Example 3 MLS VN Models 3 2

3 Advantages of MLS Layer-3 VN Scalability Security Easy to Create Flexible Addressing Integrated Quality of Service (QoS) Support Straightforward Migration 5 MLS L3VN Topology E E VNB VNB MLS Network E: rovider Edge Router : rovider Router : Customer Edge Router 6 3

4 Virtual Routing and Forwarding Instance Virtual routing and forwarding table On E router Separate instance of routing (RIB) and forwarding table A VRF defines the VN membership of a customer site attached to a E device. VRF associated with one or more customer interfaces VRF A E MLS Backbone VNB VRF B 7 Control lane: Multi-rotocol BG E routers use M-BG to distribute VN routes to each other. M-BG customizes the VN Customer Routing Information as per the Locally Configured VRF Information at the E using: Route Distinguisher (RD) Route Target (RT) VN Label 8 4

What is RD Route distinguisher is an 8-octet field prefixed to the

RD makes the customer s Iv4 address unique inside the S MLS network.

bytes) Iv4 Address (4 bytes) Example: Type 0 100:1 10.1.1.1 Type 1 192.168.

converted into a VNv4 prefix by appending the RD to the Iv4 address E

5 What is RD Route distinguisher is an 8-octet field prefixed to the customer's Iv4 address. RD makes the customer s Iv4 address unique inside the S MLS network. RD is configured in the VRF at E VNv4 Address: Route Distinguisher (8 bytes) Iv4 Address (4 bytes) Example: Type 0 100: Type : Route Advertisement: RD VN customer Iv4 prefix is converted into a VNv4 prefix by appending the RD to the Iv4 address E devices use M-BG to advertise the VNv4 address VNv4 refixes on E: 100:1: :1: VRF A RD: 100:1 E MLS Backbone VNB VRF B RD: 200:1 10 5

100:1 192.168.1.1:1 Two types of RT: Export RT Import RT 11 Route Advertisement: RT VRF A: 200:1: RT: 200:1,

6 What is RT Route Target is a BG extended community attribute, is used to control VN routes advertisement. Route Target (8 bytes) Example: Type 0 Type 1 100: :1 Two types of RT: Export RT Import RT 11 Route Advertisement: RT VRF A: 200:1: RT: 200:1, 300:1 VRF B: VNB MLS Network VNB E1 E2 Import RT Export RT Import RT Export RT VRF A 100:1 100:1 VRF B 200:1 300:1 200:1 300:1 VRF A 100:1 400:1 500:1 100:1 400:1 VRF B 200:1 200:1 12 6

Using RT to Configure VN Topologies Im RT: 100:10 Ex RT: 100:10 Im RT: 100:12 Ex RT: 100:11 Site Spoke Site Im RT: 100:10 Ex RT: 100:10 Im RT: 100:10 Ex RT: 100:10 Im RT: 100:12 Ex RT:

in the VN can communicate with every other site in that same VN.

7 Using RT to Configure VN Topologies Im RT: 100:10 Ex RT: 100:10 Im RT: 100:12 Ex RT: 100:11 Site Spoke Site Im RT: 100:10 Ex RT: 100:10 Im RT: 100:10 Ex RT: 100:10 Im RT: 100:12 Ex RT: 100:11 Im RT: 100:12 Ex RT: 100:11 Site Site Spoke Site Spoke Site Im RT: 100:10 Ex RT: 100:10 Site Hub Site Im RT: 100:11 Ex RT: 100:12 Full Mesh Hub Spoke In a full-mesh VN, each site in the VN can communicate with every other site in that same VN. In a hub-and-spoke VN, the spoke sites in the VN can communicate only with the hub sites; they cannot communicate with other spoke sites. 13 VN Label 200:1: RT: 200:1, 300:1 Local Label: 100 VRF B: 200:1: RT: 200:1, 300:1 Out Label: 100 M-iBG VNB VNB E1 MLS Network E2 E adds the label to the NLRI field. 14 7

8 Control lane Walkthrough(1/2) Site 1 Next-Hop= E1 3 M-iBG Update: RD: Next-Hop=E-1 RT=200:1, Label=100 E2 2 Site 2 MLS Backbone 1. E1 receives an Iv4 update (ebg/osf/isis/ri/eigr) 2. E1 converts it into VNv4 address and constructs the M-iBG UDATE message Associates the RT values (export RT =200:1) per VRF configuration Rewrites next-hop attribute to itself Assigns a label (100); Installs it in the MLS forwarding table. 3. E1 sends M-iBG update to other E routers 15 Control lane Walkthrough(2/2) Site 1 Next-Hop= E1 3 M-iBG Update: RD: Next-Hop=E-1 RT=200:1, Label=100 Next-Hop=E-2 4 E2 5 2 Site 2 MLS Backbone 4. E2 receives and checks whether the RT=200:1 is locally configured as import RT within any VRF, if yes, then E2 translates VNv4 prefix back to Iv4 prefix Updates the VRF F Table for with label= E2 advertises this Iv4 prefix to 2 (using whatever routing protocol) 16 8

9 Control lane: Tunnel Label Local Label refix Out Out Interface Label Local Label refix Out Interface Out Label Local Label refix Out Interface Out Label Local Label refix Out Interface Out Label op- Label / /32 Eth0/1 op- Label /32 Eth0/ /32 Eth0/1 25 E1 L0: /32 1 Eth0/0 LD Eth0/0 2 MLS Backbone E2 LD runs on the MLS backbone network to build the public LS. The tunnel label is also called transport label or public label. Local label mapping are sent to connected nodes. Receiving nodes update forwarding table. 17 Data lane Site 1 Site E1 E I acket I acket MLS acket E2 imposes two labels for each I packet going to site2 Tunnel label is learned via LD; corresponds to E1 address VN label is learned via BG; corresponds to the VN address 1 does the enultimate Hop opping (H) E1 retrieves I packet (from received MLS packet) and forwards it to

10 Configuration Example Task: Configure MLS L3VN on Cisco IOS (Version 15.2) to make the following s communication with each other. rerequisite configuration: 1. I address configuration on E & routers 2. IG configuration on E & routers Make sure all the routers in public network can reach each other / /32 E / / /32 E /24 2 MLS Network 19 Configure MLS & LD Configuration steps: 1. Configure MLS and LD on E & routers ip cef mpls ldp router-id loopback 0 interface ethernet1/0 mpls ip mpls label protocol ldp interface ethernet1/1 mpls ip mpls label protocol ldp 20 10

11 Configure VRF Configuration steps: 2. Configure VRF instance on E routers vrf definition rd 100:10 route-target export 100:10 route-target import 100:10! address-family ipv4 exit-address-family! bind E- interface under VRF interface FastEthernet0/0 vrf forwarding ip address Configure M-iBG Configuration steps: 3. Activate VNv4 address family on E routers router bgp 100 neighbor remote-as 100 neighbor update-source loopback 0! address-family vpnv4 neighbor activate neighbor send-community both exit-address-family! 22 11

12 Configure E- ebg Neighbour Configuration steps: 4. Adding E- ebg neighbour in VRF context of BG on E router bgp 100 address-family ipv4 vrf neighbor remote-as neighbor activate exit-address-family! Adding E- ebg neighbour in BG on router bgp neighbor remote-as 100! address-family ipv4 network mask neighbor activate exit-address-family! ip route null 0 23 Verify Results VRF Routing Table Check the routes of VRF on E. E1#show bgp vpnv4 unicast vrf BG table version is 4, local router ID is Status codes: s suppressed, d damped, h history, * valid, > best, i - internal, r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, x best-external, a additional-path, c RIB-compressed, Origin codes: i - IG, e - EG,? - incomplete RKI validation codes: V valid, I invalid, N Not found Network Next Hop Metric Locrf Weight ath Route Distinguisher: 100:10 (default for vrf ) *> / i *>i i 24 12

Verify Results VN Reachability can learn the routes from each other: 2#show ip route... 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks C 10.1.2.0/30 is directly connected, FastEthernet0/1 L 10.

13 Verify Results VN Reachability can learn the routes from each other: 2#show ip route /8 is variably subnetted, 2 subnets, 2 masks C /30 is directly connected, FastEthernet0/1 L /32 is directly connected, FastEthernet0/ /24 is subnetted, 1 subnets B [20/0] via , 00:38: /24 is variably subnetted, 2 subnets, 2 masks S /24 is directly connected, Null0 C /32 is directly connected, Loopback1 25 Configuration Example Task: Configure MLS L3VN on Huawei VR (Version 5.1) to make the following s communication with each other. rerequisite configuration: 1. I address configuration on E & routers 2. IG configuration on E & routers Make sure all the routers in public network can reach each other / / / / / /24 1 E1 1 2 E2 2 MLS Network 26 13

14 Configure MLS & LD Configuration steps: 1. Configure MLS and LD on E & routers [E1] mpls lsr-id [E1] mpls Info: Mpls starting, please wait... OK! [E1-mpls] quit [E1] mpls ldp [E1-mpls-ldp] quit [E1] interface gigabitethernet 0/0/0 [E1-GigabitEthernet0/0/0] mpls [E1-GigabitEthernet0/0/0] mpls ldp [E1-GigabitEthernet0/0/0] quit 27 Configure VRF Configuration steps: 2. Configure VRF instance on E routers [E1] ip vpn-instance [E1-vpn-instance-] ipv4-family [E1-vpn-instance--af-ipv4] route-distinguisher 100:10 [E1-vpn-instance--af-ipv4] vpn-target 100:10 both IVT Assignment result: Info: VN-Target assignment is successful. EVT Assignment result: Info: VN-Target assignment is successful. [E1-vpn-instance--af-ipv4] quit Bind E- interface under VRF [E1] interface gigabitethernet 0/0/1 [E1-GigabitEthernet0/0/1] ip binding vpn-instance vpna Info: All Iv4 related configurations on this interface are removed! Info: All Iv6 related configurations on this interface are removed! [E1-GigabitEthernet0/0/1] ip address [E1-GigabitEthernet0/0/1] quit 28 14

15 Configure M-iBG Configuration steps: 3. Enable M-iBG neighbors in vpnv4 address-family on E routers [E1] bgp 100 [E1-bgp] peer as-number 100 [E1-bgp] peer connect-interface loopback 0 [E1-bgp] ipv4-family vpnv4 [E1-bgp-af-vpnv4] peer enable [E1-bgp-af-vpnv4] quit [E1-bgp] quit 29 Configure E- ebg Neighbour Configuration steps: 4. Adding E- ebg neighbour in VRF context of BG on E [E1] bgp 100 [E1-bgp] ipv4-family vpn-instance [E1-bgp-vpna] peer as-number [E1-bgp-vpna] quit Adding -E ebg neighbour in BG on [1] ip route-static null 0 [1] bgp [1-bgp] peer as-number 100 [1-bgp] network [1-bgp] quit 30 15

16 Verify Results VRF Routing Table Check the routes of VRF on E. <E1> display bgp vpnv4 vpn-instance routing-table BG Local router ID is Status codes: * - valid, > - best, d - damped, h - history, i - internal, s - suppressed, S - Stale Origin : i - IG, e - EG,? - incomplete VN-Instance, Router ID : Total Number of Routes: 2 Network NextHop MED Locrf refval ath/ogn *> / i *>i i 31 Check VN Routes in BG Check the detailed route of VRF on E. <E1> display bgp vpnv4 vpn-instance routing-table BG local router ID : Local AS number : 100 VN-Instance, Router ID : aths: 1 available, 1 best, 1 select BG routing table entry information of /24: Label information (Received/Applied): 1028/NULL From: ( ) Route Duration: 00h00m04s Relay Tunnel Out-Interface: GigabitEthernet0/0/0 Relay token: 0x18 Original nexthop: Qos information : 0x0 Ext-Community:RT <100 : 10> AS-path 65002, origin igp, MED 0, localpref 100, pref-val 0, valid, internal, b est, select, active, pre 255, IG cost 3 Advertised to such 1 peers:

17 Verify Results VN Reachability can learn the routes from each other: [2]display ip routing-table Route Flags: R - relay, D - download to fib Routing Tables: ublic Destinations : 7 Routes : 7 Destination/Mask roto re Cost Flags NextHop Interface /30 Direct 0 0 D GigabitEthernet 0/0/ /32 Direct 0 0 D GigabitEthernet 0/0/ /24 EBG D GigabitEthernet 0/0/ /8 Direct 0 0 D InLoopBack /32 Direct 0 0 D InLoopBack /24 Static 60 0 D NULL /32 Direct 0 0 D LoopBack0 33 lease remember to fill out the feedback form: pnic el1 Slides are available for download from ANIC FT

18 ANIC Helpdesk Chat Thank You! END OF SESSION 36 18

Deploy MPLS L3 VPN. APNIC Technical Workshop October 23 to 25, Selangor, Malaysia Hosted by:

Deploy MPLS L3 VPN. APNIC Technical Workshop October 23 to 25, Selangor, Malaysia Hosted by: Deploy MPLS L3 VPN APNIC Technical Workshop October 23 to 25, 2017. Selangor, Malaysia Hosted by: Issue Date: [201609] Revision: [01] Acknowledgement Cisco Systems Course Outline MPLS L3 VPN Models L3