JNCIE-SP (Service Provider) Lab preparation workbook v2.0

Transcription

1 1 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 JNCIE-SP (Service Provider) Lab preparation workbook v2.0 For Juniper Networks, inc - JNCIE-SP Lab Exam - Copyright 2018 inet ZERO. All rights reserved for personal non commercial use only do not distribute

2 Copyright and licensing information This workbook, inet ZERO's JNCIE-SP Lab Preparation workbook is developed by inet ZERO. All rights reserved. No part of this publication may be reproduced or distributed in any form or by any means without the prior written permission of inet ZERO a registered company in the Netherlands. This product cannot be used by or transferred to any other person. You are not allowed to rent, lease, loan or sell inet ZERO training products including this workbook and its configurations. You are not allowed to modify, copy, upload, or distribute this workbook in any way. This product may only be used and printed for your own personal use and may not be used in any commercial way. Juniper (c), Juniper Networks inc, JNCIE, JNCIP, JNCIS, JNCIA, Juniper Networks Certified Internet Expert, are registered trademarks of Juniper Networks, Inc. JNCIE-SP workbook: Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON

3 About inet ZERO s content developers and authors: Maxim Frolov Maxim lives in Russia and speaks Russian and English. He started his networking career in Throughout the years Maxim has designed and implemented several large scale networks for enterprise and service provider customers. Over the years he has developed several high quality courseware materials for industry leading networking vendors. Maxim has the following certifications: JNCIE, JNCIP-ENT, JNCIS-SEC, Nortel NNCSS. For technology Max values efficiency and pragmatic design. When Max is not at work he likes to spend time with his family. Max enjoys being outside in the nature and loves to travel and exploring the world. Ivan Ivanov Ivan van lives in East Europe country of Bulgaria. He has more than 10 years experience with IP technologies, working at several Internet Service Providers, big enterprise companies and International system integrators. Throughout his career, Ivan gained extensive experience designing, implementing and supporting IP networks based mostly on Juniper Networks and Cisco Systems solutions and devices. Ivan worked on various international projects, designing, securing and implementing MPLS/IP backbone for multinational mobile operators. Ivan has the following certificates: JNCIE, JNCIP-SEC and various Cisco certificates. JNCIE-SP workbook: Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON

4 Jörg Buesink Jörg lives in the Netherlands and brings more than 15 years of experience in the IT and networking industry. He worked for several large ISPs / service providers in the role of technical consultant, designer and network architect. He has extensive experience in network implementation, design and architecture. Jörg is quadruple JNCIE certified (JNCIE-DC#007, JNCIE-ENT#21, JNCIE-SP#284 and JNCIE-SEC#30) as well as triple CCIE#15032 (Routing/ Switching, Service provider and Security), Cisco CCDE# , Huawei HCIE#2188 Routing and Switching certified. JNCIE-SP workbook: Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON

5 General information Rack rental service Did you know that this workbook can be used in combination with inetzeros JNCIE rack rental service? Take a look on our website for more information Target audience This workbook is developed for experienced network engineers who are preparing for the Juniper Networks JNCIE-SP lab exam. Although not required it is highly recommended that you have passed the JNCIS-SP and JNCIP-SP written exams before you start using this workbook. inet ZERO s JNCIE-SP preparation workbook is developed in such a way that we expect you to have theoretical knowledge about the JNCIE-SP lab exam blueprint topics (JNCIP-SP certified or working towards this certification). For example, in this workbook we will not explain what rib-groups, LSP s or Multicast VPNs are. What we will do is test if you are able to configure all these technologies based on certain requirements and understand how they interact in a typical SP environment. How to use this workbook We recommend that you start your JNCIE lab preparation with the workbook chapters only. Always take a note on the time spent for each chapter/ task to see if you improved once you go over the chapters again. Ensure that at least you go the workbook chapters twice before you start with the full day lab challenges. You are ready to try the Full day lab challenges if you are able to configure the chapter's tasks without the need of the chapter's answers. Each Full day lab challenge must be completed within 8 hours. Topology diagrams In the chapters you will find several topology diagrams in small format. In the appendix of this workbook you will find larger versions of the topology diagrams for better readability. We recommend to print the topology diagrams. inet ZERO support Always feel free to ask us questions regarding the workbook or JNCIE rack rental. You can reach us at info@inetzero.com. We love to hear from you regarding your preparation progress. Your feedback regarding our products is also very appreciated! JNCIE-SP workbook: General information Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON

6 Table of Contents General information... 5 Rack rental service... 5 Target audience... 5 How to use this workbook... 5 Topology diagrams... 5 inet ZERO support... 5 Exam strategy... 6 JNCIE Hall of Fame... 8 Workbook and configuration file updates... 8 Chapter One: General System Features Task 1. Initial System Settings Task 2. SNMP Configuration Task 3. Firewall Filters Task 4. Interface Configuration Task 5. Scripting Chapter Two: IGP Configuration and Troubleshooting Task 1. OSPF Troubleshooting Task 2. ISIS Troubleshooting Task 3. IGP Rollout Chapter Three: BGP and Routing Policy Task 1. IBGP and Confederation Task 2. EBGP Configuration Task 3. Routing Policies Task 4. IBGP and Route Reflection Chapter Four: MPLS Configuration Task 1. LDP Configuration Task 2. RSVP Configuration Task 3. RSVP Protection Task 4. IPv6 Tunneling with 6PE Chapter Five: L3VPN Configuration Task 1. L3VPN Configuration Task 2. Multicast in L3VPN Task 3. IPv6 Tunneling with 6VPE Chapter Six: L2VPN and VPLS Configuration Task 1. L2VPN Configuration Task 2. VPLS Configuration Chapter Seven: Inter-provider VPN Configuration Task 1. Inter-provider VPN Option B Task 2. Inter-provider VPN Option C Chapter Eight: Class of Service Task 1. Forwarding Classes, Queues and Schedulers Task 2. Classification, Policing and Marking JNCIE-SP workbook: General information Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON

7 Chapter Nine: A Full Day Lab Challenge Task 1: Initial System Configuration Task 2: Building the Network Task 3: IGP Configuration Task 4: BGP Configuration Task 5: MPLS Configuration Task 6: VPN Configuration Task 7: Class of Service Configuration A Full Day Lab Challenge II Part 1: System Features Task 1.1 Service Configuration Task 1.2: Centralized authentication management Task 1.3: Local user configuration Task 1.4: Active configuration archival and logging Task 1.5: Advanced Interface configuration and chassis features Task 1.6: Advanced RE Protection Part 2: Troubleshooting and Configuring IGP Task 2.1: Troubleshooting Task 2.2: Connectivity to OSPFv3 Area Task 2.3: RIP redistribution Task 2.4: Multilevel IS-IS configuration Task 2.5: Advanced IS-IS configuration Part 3: Troubleshooting and Configuring BGP Task 3.1: ibgp design and configuration Task 3.2: ebgp peers and configuration Task 3.3: BGP policy configuration Task 3.4: BGP general requirements Part 4: MPLS configuration Task 4.1: MPLS and RSVP configuration Task 4.2: MPLS and LDP configuration Part 5: IPv6 configuration Task 5.1: Native IPv6 configuration Task 5.2: IPv6 tunneling configuration Part 6: MPLS VPNs configuration Task 6.1: VPNA configuration Task 6.2: VPNA multicast configuration Task 6.3: VPLS configuration Task 6.4: L2VPN configuration A Full Day Lab Challenge III Part 1: System Features Task 1.1 Service Configuration Task 1.2: Centralized authentication management Task 1.3: Local user configuration Task 1.4: Active configuration archival and logging Task 1.5: Advanced Interface configuration and chassis functions Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON JNCIE-SP workbook: General information 10

8 Task 1.6: Advanced RE Protection Part 2: Troubleshooting and Configuring IGP Task 2.1: Troubleshooting Task 2.2: RIP redistribution Task 2.3: Multi-area OSPF configuration Task 2.4: Advanced OSPF configuration Part 3: Troubleshooting and Configuring BGP Task 3.1: Internal BGP design and configuration Task 3.2: external BGP peers and configuration Task 3.3: BGP policy configuration Task 3.4: BGP general requirements Part 4: MPLS configuration Task 4.1: MPLS and RSVP configuration Task 4.2: MPLS and LDP configuration Part 5: IPv6 tunneling and Multicast configuration Task 5.1: IPv6 tunneling configuration Task 5.2: Multicast configuration Part 6: MPLS VPNs configuration Task 6.1: VPNA configuration Task 6.2: VPNB configuration Task 6.3: VPLS configuration Appendix 1: Additional Theory OSPF adjacency troubleshooting BGP adjacency troubleshooting BGP IPV6 NLRI over IPV4 peering Troubleshooting: Multicast traffic engineering using RIB-groups Advanced firewall filtering Appendix 2 : Topology diagrams Task 1: Initial System Configuration Task 2: SNMP Configuration Task 3: Firewall filters Task 4: Interface Configuration Task 5: Scripting Chapter Two solutions: IGP Configuration and Troubleshooting Task 1: OSPF Troubleshooting Task 2: IS-IS Troubleshooting Task 3: IGP Rollout Chapter Three solutions: BGP and Routing policy Task 1: IBGP and Confederation Task Two: EBGP Configuration Task 3: Routing Policies Task 4: IBGP and Route Reflection Chapter Four solutions: MPLS configuration MPLS Overview Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON JNCIE-SP workbook: General information 11

9 LDP Overview Task 1: LDP Configuration Task 2: RSVP Configuration Task 3: RSVP Protection Task 4: IPv6 tunneling with 6PE Chapter Five solutions: L3VPN Configuration Task 1: L3VPN configuration Task 2: Multicast in L3VPNs Task 3: IPv6 Tunneling with 6VPE Chapter Six solutions: L2VPN and VPLS configuration Task 1: L2VPN Configuration Task 2: VPLS Configuration Chapter Seven solutions: Inter-provider VPN Configuration Task 1: Inter-provider VPN Option B Task 2: Inter-provider VPN Option C Chapter Eigh solutionst: Class of Service Task 1: Forwarding Classes, Queues and Schedulers Task 2: Classification, Policing and Marking Chapter Nine solutions: Full Day Lab Challenge I Task 1: Initial System Configuration Task 2: Building the network Task 3: IGP Configuration Task 4: BGP Configuration Task 5: MPLS configuration Task 6: VPN configuration Task 7: Class of Service Configuration Chapter Ten solutions: Full Day Lab Challenge II Part 1: System Features Solution - Task 1.1 Service Configuration Solution - Task 1.2: Centralized authentication management Solution - Task 1.3: Local user configuration Solution - Task 1.4: Active configuration archival and logging Solution - Task 1.5: Advanced Interface configuration and chassis features Solution - Task 1.6: Advanced RE Protection Appendix - Part 2: Troubleshooting and Configuring IGP Solution - Task 2.1: Troubleshooting Solution - Task 2.2: Connectivity to OSPFv3 Area Solution - Task 2.3: RIP redistribution Solution - Task 2.4: Multilevel IS-IS configuration Solution - Task 2.5: Advanced IS-IS configuration Part 3: Troubleshooting and Configuring BGP Solution - Task 3.1: ibgp design and configuration Solution - Task 3.2: ebgp peers and configuration Solution - Task 3.3: BGP policy configuration Solution - Task 3.4: BGP general requirements Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON JNCIE-SP workbook: General information 12

10 Part 4: MPLS configuration Solution - Task 4.1: MPLS and RSVP configuration Part 5: IPv6 configuration Solution - Task 5.1: Native IPv6 configuration Solution - Task 5.2: IPv6 tunneling configuration Part 6: MPLS VPNs configuration Solution - Task 6.1: VPNA configuration Solution - Task 6.2: VPNA multicast configuration Solution - Task 6.3: VPLS configuration Solution - Task 6.4: L2VPN configuration Chapter eleven solutions: Full Day Lab Challenge III Part 1: System Features Solution - Task 1.1 Service Configuration Solution - Task 1.2: Centralized authentication management Solution - Task 1.3: Local user configuration Solution - Task 1.4: Active configuration archival and logging Solution - Task 1.5: Advanced Interface configuration and chassis functions Solution - Task 1.6: Advanced RE Protection Part 2: Troubleshooting and Configuring IGP Solution - Task 2.1: Troubleshooting Solution - Task 2.2: RIP redistribution Solution - Task 2.3: Multi-area OSPF configuration Solution - Task 2.4: Advanced OSPF configuration Part 3: Troubleshooting and Configuring BGP Solution - Task 3.1: Internal BGP design and configuration Solution - Task 3.2: External BGP peers and configuration Solution - Task 3.3: BGP policy configuration Solution - Task 3.4: BGP general requirements Part 4: MPLS configuration Solution - Task 4.1: MPLS and RSVP configuration Solution - Task 4.2: MPLS and LDP configuration Part 5: IPv6 tunneling and Multicast configuration Solution - Task 5.1: IPv6 tunneling configuration Solution - Task 5.2: Multicast configuration Part 6: MPLS VPNs configuration Solution - Task 6.1: VPNA configuration Solution - Task 6.2: VPNB configuration Solution - Task 6.3: VPLS configuration JNCIE-SP workbook: General information Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON

11 Chapter Five: L3VPN Configuration In this chapter tasks you implement L3VPN s. The tasks include L3VPN configuration with customers running either OSPF or BGP, dual-homed customer sites, customer Internet access, multicasting in VPNs and IPv6 tunneling with 6VPE. Task 1. L3VPN Configuration In this task you deploy L3VPN for with customers running either OSPF or BGP. 1) Configure additional interfaces on your routers as indicated in Table 17. Set the interfaces description. Table 17 Router Interface Interface Name IP Address IPv6 Address R1 i7 ge-0/0/ /30 i8 ge-0/0/ /30 i9 ge-0/0/ /30 lo /32 lo /32 R2 i7 ge-0/0/ /30 i8 ge-0/0/ /30 i9 ge-0/0/ /30 lo /32 lo /32 R3 i8 ge-0/0/5.317 fc09:c0:ffee::9/126 i9 ge-0/0/ /30 lo /32 lo /32 fd17:f0f4:f691:5::12/128 R4 i8 ge-0/0/ /30 i9 ge-0/0/ /30 lo /32 lo /32 R5 i9 ge-0/0/ /30 lo /32 R6 i8 ge-0/0/ /30 lo /32 R7 i6 ge-0/0/ /30 lo /32 R8 i5 ge-0/0/ /30 i6 ge-0/0/5.325 fc09:c0:ffee::d/126 lo /32 lo /32 fd17:f0f4:f691:5::26/128 2) Configure L3VPNs as shown in Figure 11. Table 18 specifies the L3VPN details. JNCIE-SP workbook: Chapter Five: L3VPN Configuration Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON

12 Figure 11 Table 18 Customer Site Router PE-CE Protocol details Protocol C1 S1 CE1-1 OSPF Area 0 S2 CE1-2 OSPF Area 0 CE1-3 OSPF Area 0 S3 CE1-4 OSPF Area 0 C2 S1 CE2-1 BGP AS CE2-2 BGP AS S2 CE2-3 BGP AS CE2-4 BGP AS S3 CE2-5 BGP AS ) You may not have any MPLS LSPs on Route Reflector. A static route is allowed on the RR if needed. 4) Make sure that the customer C1 OSPF area 0 appears as a contiguous area without ABRs. JNCIE-SP workbook: Chapter Five: L3VPN Configuration Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON

13 5) Customer C1 has some backdoor OSPF connections but prefers that your MPLS network would be used for traffic forwarding between the customer sites. 6) Make sure that your MPLS network can be used as a backup path between CE1-2 and CE1-3. 7) Make sure that once customer C1 disables its backdoor connections any of the R3 or R4 PE failure will not result in any of the customer sites become isolated. 8) Customer C2 requires that the customer site S1 is used as a central transit site for all traffic exchanges among all the customer sites in a hub-and-spoke fashion. 9) Make sure that if a route is originated in customer C2 site S1 or S2, it is never advertised back to the same site. 10) Make sure that PE-CE link subnets in customer C2 VPN are advertised to the customer remote VPN sites. 11) Make sure that all PE routers receive only the routes with those targets that they specifically request for. 12) Allow local communication between customer C1 site S2 and customer C2 site S2 at R4. Make sure that the routes exchanged between the local VRFs are not advertised to any of the remote PE routers. 13) Customer C1 must be provided with Internet access at the customer site S2 using single customer-facing interface. Make sure that any of the R3 or R4 failure will not have customer C1 site S2 isolated from the Internet. NOTE: The customer IP ranges are assumed to be globally routable or NATted outside of your network. 14) Customer C2 must be provided with Internet access at the customer site S1, using a dedicated interface i9 at both R1 and R2 routers. All other customer sites should be able to reach the Internet via the site S1. JNCIE-SP workbook: Chapter Five: L3VPN Configuration Copyright 2018 inet ZERO. All rights reserved - SteganoID=ON

14 1292 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 Chapter eleven solutions: Full Day Lab Challenge III This lab scenario represents a complete 8 hour challenge, aiming to prepare potential candidate for the JNCIE-SP lab exam. It contains all major topics found in the exam blueprint. The external devices (CE and peers) are virtualized on the VR-device. Use only the interfaces and VLANs on the diagram for connectivity between the routers. AS BGP AS U1 U2 VPNB-CE1 Src1 VPNA-CE1 ibgp AS BGP AS Rsv1 GE-0/0/ GE-0/0/ GE-0/0/ GE-0/0/ GE-0/0/5.110 GE-0/0/5.101 VPNA-CE2 RIP P1 GE-0/0/ GE-0/0/5.200 GE-0/0/ GE-0/0/4.37 GE-0/0/4.35 GE-0/0/4.45 GE-0/0/4.47 RR DC-1 Area 8 GE-0/0/4.49 GE-0/0/ GE-0/0/5.200 R4 GE-0/0/4.46 R6 SILVER GE-0/0/ GE-0/0/ VPLS-2 Area 0 Rsv2 GE-0/0/ GE-0/0/ ISP1 C1 BGP AS VPNB-CE3 ISP1-PE2 ISP1-PE1 BGP AS 4356 R7 Area 50 GE-0/0/5.112 R3 GE-0/0/1 GE-0/0/2 GE-0/0/4.14 R1 GOLD GE-0/0/5.103 VPNA-CE3 OSPFv2 OSPFv3 GE-0/0/4.24 BRONZE GE-0/0/ VPLS-1 OSPFv2 OSPFv3 GE-0/0/4.12 GOLD Physical Diagram BGP AS65456 The logical diagram shows all information needed for configuring the logical connectivity between the devices. BRONZE C2 GE-0/0/4.16 BRONZE R5 GE-0/0/4.59 GOLD GE-0/0/4.56 SILVER GE-0/0/4.26 R2 GE-0/0/5.58 GE-0/0/4.68 GE-0/0/3 GE-0/0/ GE-0/0/5.104 VPNA-CE4 L2VPN-3 OSPF U3 R8 BGP AS 9687 GE-0/0/5.102 GE-0/0/5.111 VPNB-CE2 1292

15 1294 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 Part 1: System Features This part is focused on initial system configuration, monitoring and securing the JUNOS operating system. That includes configuring different interface features like bounding physical interface in logical links and applying various address families. You will learn how to configure user accounts and various authentication methods available in JUNOS. You will configure monitoring and backup system logs, coping automatically the configuration to remote server. Last you will configure a firewall filters to protect the routing-engine of the devices. Solution - Task 1.1 Service Configuration NOTE: It is highly recommended to read the whole lab and verify the state of the devices before starting with the configuration. Moving from one part to another is also recommended to read all of the tasks for each part you are about the start configuring as next. That will help you to get an idea on how the final network should look like. 1) SSH access is preconfigured as part of the initial configuration on all routers. Limit the SSH connections to 2 at a time and no more than 2 connection attempts per minute. a. All devices. RACK RENTAL NOTE: SSH is already configured as part of the initial configuration with user root allowed to login. Please, do not change it, as it is required by inetzero rack rental service. Below two configuration lines are required to successfully complete the first task. lab@r1# set system services ssh connection-limit 2 lab@r1# set system services ssh rate-limit 2 2) Enable NETCONF protocol over SSH using the standard port TCP 830. a. All devices. NETCONF provides mechanisms to install, manipulate, and delete the configuration of network devices. After enabling SSH on JUNOS devices, NETCONF is enabled automatically accepting connections on the default SSH port 22. The task asks for enabling NETCONF over the standard port 830 defined by RFC4742. In JUNOS, this is done when you add ssh option under the netconf service. lab@r1# set system services netconf ssh Below is excerpt from the system connection table on router R1 after committing the change. lab@r1# run show system connections 1294

16 1295 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 tcp4 0 0 *.830 *.* LISTEN 3) Configure SNMPv2c with community superlab on all routers, polled from management system with address /32. Since SNMPv2c is using clear text transmissions, make sure that SNMP traffic is accepted only over the management interface fxp0.0 Ensure that the reachability to /32 is provided even if the rpd process is not yet running. Assume the IP address is used as gateway in the management segment. Next, you have to configure the SNMPv2c management protocol. As the task suggests, you need to secure the SNMP communication to the devices also. You have to explicitly specify the exact interface where the request can come from and the exact IP address of the network management system that can access it. Along with that, you have to configure a single static route reaching the NMS via the management interface fxp0. Next part requires that the route to the management system is reachable when the RPD process is not running. This can happen if the process crashes or during the system boot process. To accomplish this, backup-router command under the system stanza has to be configured. When RDP process starts the backup route is removed from the local routing and forwarding tables. a. All devices. lab@r1# set snmp interface fxp0.0 lab@r1# set snmp community superlab clients /32 lab@r1# set routing-options static route /32 next-hop lab@r1# set system backup-router lab@r1# set system backup-router destination /32 Solution - Task 1.2: Centralized authentication management JUNOS provides three different methods for user account authentication, authorization and accounting. Those are the local database, using a RADIUS server and using a TACACS+ server. This Task requires configuring the devices to communicate successfully with a TACACS+ server. 4) Configure all devices to use TACACS server located at for authentication. The communication with the TACACS server should be encrypted with password jncie a. All devices.

17 1413 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 HelloInterval 9(second) Address ActiveResv 2, PreemptionCnt 0, Update threshold 10% Subscription 100%, bc0 = ct0, StaticBW 300Mbps ct0: StaticBW 300Mbps, AvailableBW 300Mbps MaxAvailableBW 300Mbps = (bc0*subscription) ReservedBW [0] 0bps[1] 0bps[2] 0bps[3] 0bps[4] 0bps[5] 0bps[6] 0bps[7] 0bps Protection: On, Bypass: 1, LSP: 1, Protected LSP: 1, Unprotected LSP: 0 1 Dec 3 11:56:46 New bypass to-r6 Bypass: to-r6, State: Up, Type: LP, LSP: 1, Backup: 0 4 Dec 3 11:56:46 Record Route: Dec 3 11:56:46 Up 2 Dec 3 11:56:46 CSPF: computation result accepted 1 Dec 3 11:56:46 Originate Call Solution - Task 4.2: MPLS and LDP configuration 5) Assume that R8 supports only LDP protocol. Configure R5 and R6 to provide MPLS transport gateway functionality to the rest of network for R8. CEs attached to R8 should be able to exchange labeled packets with the CEs behind R1 and R2. The task mentions that router R8 does not support RSVP. In order to enable services to be deployed between router R8 and routers R1 and R2, you have to configure R5 and R6 to transport LDP traffic in RSVP signaled LSP. You have to configure LDP targeted sessions between routers R1, R2, R5 and R6. a. R1 In JUNOS configuring LDP over RSVP can be done by enabling ldp-tunneling for the RSVP LSPs connecting the two routers configured for LDP. Targeted LDP sessions are established between the Loopback IP addresses. lab@r1# set protocols ldp interface lo0.0 lab@r1# set protocols mpls label-switched-path r1-to-r5 ldp-tunneling lab@r1# set protocols mpls label-switched-path r1-to-r6 ldp-tunneling b. R2 lab@r2# set protocols ldp interface lo0.0 lab@r2# set protocols mpls label-switched-path r2-to-r5 ldp-tunneling lab@r2# set protocols mpls label-switched-path r2-to-r6 ldp-tunneling c. R5 Routers R5, R6 with R8 establish direct LDP sessions over the logical interface between them. lab@r5# set protocols ldp interface ge-0/0/

18 1414 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 set protocols ldp interface lo0.0 set protocols mpls label-switched-path r5-to-r1 ldp-tunneling set protocols mpls label-switched-path r5-to-r2 ldp-tunneling d. R6 set protocols ldp interface ge-0/0/4.68 set protocols ldp interface lo0.0 set protocols mpls label-switched-path r6-to-r1 ldp-tunneling set protocols mpls label-switched-path r6-to-r2 ldp-tunneling e. R8 set protocols ldp interface ge-0/0/4.58 set protocols ldp interface ge-0/0/4.68 Enabling LDP on the Loopback interface on R8 is needed to establish targeted sessions to routers R1 and R2. set protocols ldp interface lo0.0 f. Verify the configuration The output below show the result of the commands applied. run show ldp interface Interface Label space ID Nbr count Next hello lo :0 3 0 ge-0/0/ :0 1 3 ge-0/0/ :0 1 2 lab@r8# run show ldp neighbor Address Interface Label space ID Hold time lo : lo : lo : ge-0/0/ : ge-0/0/ :0 14 lab@r8# run show ldp database Input label database, : :0 Labels received: 5 Label Prefix / / / /

19 1415 inet ZERO JNCIE-SP lab workbook with detailed solutions version FEC129 NoCtrlWord ETHERNET 000a012c: c 0a32fa01 0a32fa08 Output label database, : :0 Labels advertised: 6 Label Prefix / / / / / FEC129 NoCtrlWord ETHERNET 000a012c: c 0a32fa08 0a32fa01 Input label database, : :0 Labels received: 5 Label Prefix / / / / L2CKT CtrlWord ETHERNET VC 3 Output label database, : :0 Labels advertised: 6 Label Prefix / / / / / L2CKT CtrlWord ETHERNET VC 3 lab@r8# run show route table inet.3 inet.3: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both /32 *[LDP/9] 00:04:04, metric 1 > to via ge-0/0/4.68, Push /32 *[LDP/9] 00:04:04, metric 1 > to via ge-0/0/4.68, Push /32 *[LDP/9] 00:05:32, metric 1 > to via ge-0/0/ /32 *[LDP/9] 00:04:04, metric 1 > to via ge-0/0/4.68 lab@r1# run show ldp interface Interface Label space ID Nbr count Next hello lo :0 2 0 lab@r1# run show ldp neighbor Address Interface Label space ID Hold time lo : lo : lo :0 44 lab@r1# run show ldp database Input label database, : :0 Labels received: 4 Label Prefix / / / /

20 1435 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 > to via ge-0/0/4.56, label-switched-path r5-to-r /24 *[BGP/170] 00:02:51, MED 1, localpref 100, from AS path: I, validation-state: unverified > to via ge-0/0/4.56, label-switched-path r5-to-r2 to via ge-0/0/4.45, label-switched-path r5-to-r /24 *[BGP/170] 00:02:51, MED 1, localpref 100, from AS path: I, validation-state: unverified > to via ge-0/0/4.56, label-switched-path r5-to-r2 to via ge-0/0/4.45, label-switched-path r5-to-r2 Router R5 is advertising the routes from the other three sites to the VPNA-CE1. Two prefixes advertised by CE2 received from the MPLS core, are advertised as internal because of the independent-domain configuration. run show route advertising-protocol bgp VPNA.inet.0: 13 destinations, 13 routes (13 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path * /30 Self 100 I * /30 Self I * /30 Self I * /24 Self 100 I * /24 Self 100 I * /24 Self I * /24 Self I * /24 Self I * /24 Self I Similarly, router R8 receives two routes from VPNA-CE2 and advertises the routes for the other VPNA sites. lab@r8# run show bgp summary Groups: 3 Peers: 3 Down peers: 0 Table Tot Paths Act Paths Suppressed History Damp State Pending inet inet bgp.l3vpn bgp.l2vpn Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State #Active/Received/Accepted/Damped :40 Establ VPNA.inet.0: 2/2/2/0 lab@r8# run show route table VPNA.inet.0 VPNA.inet.0: 13 destinations, 13 routes (13 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both /30 *[BGP/170] 00:01:54, localpref 100, from AS path: I, validation-state: unverified > to via ge-0/0/4.58, Push /30 *[Direct/0] 07:47:26 > via ge-0/0/ /32 *[Local/0] 07:47:26 Local via ge-0/0/ /30 *[BGP/170] 00:09:50, localpref 100, from AS path: I, validation-state: unverified > to via ge-0/0/4.68, Push 16, Push (top) 1435

21 1445 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 run show bgp summary Groups: 3 Peers: 3 Down peers: 0 Table Tot Paths Act Paths Suppressed History Damp State Pending inet inet bgp.l3vpn bgp.l2vpn Peer AS InPkt OutPkt OutQ Flaps Last Up/Dwn State #Active/Received/Accepted/Damped :26:03 Establ VPNB.inet.0: 5/5/5/0 lab@r8# run show route receive-protocol bgp inet.0: 529 destinations, 529 routes (529 active, 0 holddown, 0 hidden) inet.3: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden) VPNA.inet.0: 13 destinations, 13 routes (13 active, 0 holddown, 0 hidden) VPNB.inet.0: 28 destinations, 28 routes (28 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path * / I * / I * / I * / I * / ) You have to provide connectivity to and from AS for site CE.. Make sure you do not advertise additional routes to the other VPN sites. a. R5 lab@r5# set policy-options policy-statement VPNB-export.target term filter.as from protocol bgp lab@r5# set policy-options policy-statement VPNB-export.target term filter.as from as-path origin lab@r5# set policy-options policy-statement VPNB-export.target term filter.as then reject The configuration lines below are explicitly advertising the routes received from AS to CE1. lab@r5# set policy-options policy-statement to.vpnb-ce1 term accept.as from protocol bgp 1445 lab@r5# set policy-options policy-statement to.vpnb-ce1 term accept.as from as-path origin

22 1447 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 set routing-options interface-routes rib-group inet local-interfaces The rib-group bgp.to.vpnb is associated to the internal BGP group. You might make the mistake here and apply the rib-group to the external BGP group to peer U2. Although that will accomplish what is asked, you have to take into account that the connection to U2 could fail. set protocols bgp group internal family inet unicast rib-group bgp.to.vpnb set routing-instances VPNB routing-options interface-routes rib-group inet local-interfaces set routing-instances VPNB protocols bgp group VPNB-CE1 family inet unicast rib-group VPNB.to.bgp b. Verify the configuration After the commit, all the routes received by AS are copied to the VPNB table. run show route table VPNB.inet.0 VPNB.inet.0: 492 destinations, 745 routes (491 active, 0 holddown, 1 hidden) + = Active Route, - = Last Active, * = Both /10 *[BGP/170] 02:27:24, MED 50, localpref 100, from AS path: I, validation-state: unverified > to via ge-0/0/4.35 [BGP/170] 03:44:01, MED 150, localpref 100 AS path: I, validation-state: unverified > to via ge-0/0/ /20 *[BGP/170] 03:44:01, MED 60, localpref 100 AS path: I, validation-state: unverified > to via ge-0/0/ /11 *[BGP/170] 02:27:24, MED 50, localpref 100, from AS path: I, validationstate: unverified > to via ge-0/0/4.35 [BGP/170] 03:44:01, MED 150, localpref 100 AS path: I, validationstate: unverified > to via ge-0/0/ /21 *[BGP/170] 03:44:01, MED 60, localpref 100 AS path: I, validationstate: unverified > to via ge-0/0/ /12 *[BGP/170] 02:27:24, MED 50, localpref 100, from AS path: I, validationstate: unverified > to via ge-0/0/4.35 [BGP/170] 03:44:01, MED 150, localpref 100 AS path: I, validationstate: unverified > to via ge-0/0/ Conversely, the routes received from VPNB-CE1 are copied to master routing table. lab@r5# run show route receive-protocol bgp

23 1448 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 inet.0: 563 destinations, 907 routes (559 active, 0 holddown, 4 hidden) Prefix Nexthop MED Lclpref AS path * / I * / I * / I * / I * / I * / I inet.1: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden) inet.3: 5 destinations, 9 routes (3 active, 0 holddown, 4 hidden) VPNA.inet.0: 13 destinations, 13 routes (13 active, 0 holddown, 0 hidden) VPNB.inet.0: 491 destinations, 744 routes (491 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path * / I * / I * / I * / I * / I * / I The AS routes are not sent to router R8, hence they are not advertised to VPNB- CE2. lab@r8# run show route advertising-protocol bgp VPNB.inet.0: 28 destinations, 28 routes (28 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path * /30 Self I * /30 Self I * /30 Self I * /30 Self I * /30 Self I * /32 Self I * /30 Self I * /30 Self 4356 I * /30 Self I * /24 Self I * /24 Self I * /24 Self I * /24 Self I * /24 Self I * /24 Self I 6) Since site CE3 is connected to 3rd party provider ISP1, you must extend the VPNB using an inter-provider method that will provide you with a way to filter routes received from ISP-1 based on target-communities. Do not use routing policy on R1 for providing connectivity to CE3. The remote PE is using route-target community target:4356:500. Three options can be used to extend a L3VPN via other provider network. Option A within each AS, the routes are announced by the MP-BGP protocol used for all L3VPNs. On the AS border routers a VRF for each Inter-AS L3VPN is configured and a pure IP connection is established between the ASBRs. This is the least scalable solution and does not fit in 1448

24 1449 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 the requirements of the Task. Because, the routes exchanged between the ASBRs are not vpnv4 routes, they do not carry route-target communities. Option B All routes exchanged should be stored locally on ASBR. Since, the exchanged routes are vpnv4 carying VPN labels with route-target communities, there is a way to further filter or manipulate the VPN routes. Option C provides the most scalable method, using Labeled BGP sessions to create an MPLS path end-to-end. On top of that, a multihop external MP-BGP session exchanges the vpnv4 routes between the ASs. Since, the ASBRs do not have visibility of the overlay MP-BGP routes, there is not way to control the exchange of the routes. From the three methods the Option B is one that should be used to accomplish the Task. a. R1 First, the interface between the two networks must be configured. Inter-AS option B exchanges labeled routes between the ASBRs, this means the interconnect interfaces must be also configured with family mpls. lab@r1# set interfaces ge-0/0/5 unit 112 description "=== connection to ISP1 ===" lab@r1# set interfaces ge-0/0/5 unit 112 vlan-id 112 lab@r1# set interfaces ge-0/0/5 unit 112 family inet address /30 lab@r1# set interfaces ge-0/0/5 unit 112 family mpls Next the external MP-BGP session is configured between router R1 and the ISP1 peer. lab@r1# set protocols bgp group ISP1 log-updown lab@r1# set protocols bgp group ISP1 family inet-vpn unicast lab@r1# set protocols bgp group ISP1 peer-as 4356 lab@r1# set protocols bgp group ISP1 neighbor b. R5 Because using a routing policy on router R1 to manipulate the routes exchanged between the ASBRs is not allowed, you can accept the remote route-target community on router R5 and R8. This will provide successful communication between the local and remote sites of VPNB. lab@r5# set policy-options policy-statement VPNB-export.target term accept.rest then community add VPNB-CE lab@r5# set policy-options policy-statement VPNB-import.target term 1 from community VPNB-CE3

25 1450 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 set policy-options community VPNB-CE3 members target:4356:500 c. R8 set policy-options policy-statement VPNB-export.target term accept.rest then community add VPNB-CE3 set policy-options policy-statement VPNB-import.target term 1 from community VPNB-CE3 lab@r8# set policy-options community VPNB-CE3 members target:4356:500 d. Verify the configuration Router R1 receives vpnv4 routes from the ISP1 peer. lab@r1# run show route table bgp.l3vpn.0 bgp.l3vpn.0: 39 destinations, 39 routes (39 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both 4356:500: /30 *[BGP/170] 04:41:35, localpref 100 AS path: 4356 I, validation-state: unverified > to via ge-0/0/5.112, Push :500: /24 *[BGP/170] 04:41:35, localpref 100 AS path: I, validation-state: unverified > to via ge-0/0/5.112, Push :500: /24 *[BGP/170] 04:41:35, localpref 100 AS path: I, validation-state: unverified > to via ge-0/0/5.112, Push :500: /24 *[BGP/170] 04:41:35, localpref 100 AS path: I, validation-state: unverified > to via ge-0/0/5.112, Push :500: /24 *[BGP/170] 04:41:35, localpref 100 AS path: I, validation-state: unverified > to via ge-0/0/5.112, Push :500: /24 *[BGP/170] 04:41:35, localpref 100 AS path: I, validation-state: unverified > to via ge-0/0/5.112, Push Using the remote route-target community in the import vrf policy, router R5 imports the remote routes into the vrf routing table. lab@r5# run show route /24 VPNB.inet.0: 492 destinations, 745 routes (492 active, 0 holddown, 0 hidden) + = Active Route, - = Last Active, * = Both /24 *[BGP/170] 02:48:55, localpref 100, from AS path: I, validation-state: unverified > to via ge-0/0/4.56, label-switched-path r5-to-r bgp.l3vpn.0: 21 destinations, 21 routes (21 active, 0 holddown, 0 hidden)

26 1451 inet ZERO JNCIE-SP lab workbook with detailed solutions version = Active Route, - = Last Active, * = Both 4356:500: /24 *[BGP/170] 02:48:55, localpref 100, from AS path: I, validation-state: unverified > to via ge-0/0/4.56, label-switched-path r5-to-r1 Similarly, router R8 successfully imports the routes into the VPNB routing table. lab@r8# run show route advertising-protocol bgp VPNB.inet.0: 28 destinations, 28 routes (28 active, 0 holddown, 0 hidden) Prefix Nexthop MED Lclpref AS path * /24 Self I * /24 Self I * /24 Self I * /24 Self I * /24 Self I 7) Ensure that all BGP sessions in VPNB can send and receive packets larger than the default 512-byte maximum segment size. a. R5 and R8 By default, BGP uses packets with a maximum size of 512-bytes. This way it is ensured that even if the MTU is lower on some links, BGP packets will not be fragmented. To force BGP to use bigger packets, you have to enable the MTU discovery functionality. This will automatically detect the maximum MTU between the peers and will use it for the size of the BGP packets. lab@r5# set routing-instances VPNB protocols bgp mtu-discovery lab@r8# set routing-instances VPNB protocols bgp mtu-discovery 8) Make sure that traffic coming from VPNB with precedence bits 010, 011, 100 and 100 is classified as assured-forwarding. Ensure 20% high priority bandwidth reservation for that traffic in your network, while keep the default reservation for rest of the traffic. The last task requires providing QoS should is for VPNB only. a. R1, R2, R4, R5, R6 and R8 First, behavior aggregate classifiers are configured that will be later used for classifying the traffic. The EXP classifier is needed to map the traffic coming from the MPLS core interfaces and associate it to forwarding-classes. To inherit the default mapping use the import function to use the default EXP classifier as a template. Next, change the mapping for the assuredforwarding classes as required by the task lab@r1# set class-of-service classifiers exp custom-exp import default

27 1452 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 set class-of-service classifiers exp custom-exp forwarding-class assuredforwarding loss-priority low code-points 010 set class-of-service classifiers exp custom-exp forwarding-class assuredforwarding loss-priority low code-points 011 set class-of-service classifiers exp custom-exp forwarding-class assuredforwarding loss-priority low code-points 100 set class-of-service classifiers exp custom-exp forwarding-class assuredforwarding loss-priority low code-points 101 An IP precedence classifier is intended to map the IP traffic coming from the CE sites to forwarding-classes. Again, the default classifier mappings are used as a template. lab@r1# set class-of-service classifiers inet-precedence VPNB-precedence import default lab@r1# set class-of-service classifiers inet-precedence VPNB-precedence forwarding-class assured-forwarding loss-priority low code-points 010 lab@r1# set class-of-service classifiers inet-precedence VPNB-precedence forwarding-class assured-forwarding loss-priority low code-points 011 lab@r1# set class-of-service classifiers inet-precedence VPNB-precedence forwarding-class assured-forwarding loss-priority low code-points 100 lab@r1# set class-of-service classifiers inet-precedence VPNB-precedence forwarding-class assured-forwarding loss-priority low code-points 101 A custom scheduler-map and classifier are assigned to the MPLS core interfaces. lab@r1# set class-of-service interfaces ge-0/0/4 scheduler-map custom-map lab@r1# set class-of-service interfaces ge-0/0/4 unit * classifiers exp customexp The custom scheduler-map is used to map the forwarding-classes to the schedulers. lab@r1# set class-of-service scheduler-maps custom-map forwarding-class assuredforwarding scheduler af lab@r1# set class-of-service scheduler-maps custom-map forwarding-class besteffort scheduler be lab@r1# set class-of-service scheduler-maps custom-map forwarding-class networkcontrol scheduler nc Custom schedulers are used to define the properties of output queues. The task requires modifying the assured-forwarding only, but it is a good practice to ensure the rest of the traffic is properly handled. 1452

28 1453 inet ZERO JNCIE-SP lab workbook with detailed solutions version 2.0 set class-of-service schedulers af transmit-rate percent 20 set class-of-service schedulers af priority high set class-of-service schedulers nc transmit-rate percent 5 lab@r1# set class-of-service schedulers nc priority low lab@r1# set class-of-service schedulers be transmit-rate remainder lab@r1# set class-of-service schedulers be priority low b. R5 By default, associating scheduler-map can be done under the physical interfaces under the class-of-service stanza. However, since you are not allowed to apply custom CoS policies to traffic other then VPNB, you have to enable per-unit-scheduler for the interface to the CE sites. This allows you to apply the custom scheduler only for a specific unit. lab@r5# set interfaces ge-0/0/5 per-unit-scheduler lab@r5# set class-of-service interfaces ge-0/0/5 unit 110 scheduler-map custommap lab@r5# set class-of-service interfaces ge-0/0/5 unit 110 classifiers inetprecedence VPNB-precedence When vrf-table-label is used for the routing instances, a default classifier is applied to the routing-instance logical interface. You have to replace the default EXP classifier with the custom one, to map the traffic coming from the MPLS core. The purpose of this classifier is to match on the vpn label after the transport label is stripped off. lab@r5# set class-of-service routing-instances VPNB classifiers exp custom-exp c. R8 The same configuration is applied to router R8 as well. lab@r8# set interfaces ge-0/0/5 per-unit-scheduler lab@r8# set class-of-service interfaces ge-0/0/5 unit 111 scheduler-map custommap lab@r8# set class-of-service interfaces ge-0/0/5 unit 111 classifiers inetprecedence VPNB-precedence 1453 lab@r8# set class-of-service routing-instances VPNB classifiers exp custom-exp