H3C S9500 Series Routing Switches

Transcription

1 Operation Manual Hangzhou H3C Technologies Co., Ltd. Manual Version: T C-2.03 Product Version: S9500-CMW520-R2132

2 Copyright , Hangzhou H3C Technologies Co., Ltd. and its licensors All Rights Reserved No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. Trademarks H3C,, Aolynk,, H 3 Care,, TOP G,, IRF, NetPilot, Neocean, NeoVTL, SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V 2 G, V n G, PSPT, XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co., Ltd. All other trademarks that may be mentioned in this manual are the property of their respective owners. Notice Technical Support The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied. To obtain the latest information, please access: customer_service@h3c.com

3 About This Manual Related Documentation In addition to this manual, each documentation set includes the following: Manual Installation Manual Command Manual Description It introduces the installation procedure, commissioning, maintenance and monitoring of the S9500 series routing switches. It includes Feature List and Command Index, Access Volume, IP Service Volume, IP Routing Volume, IP Multicast Volume, MPLS VPN Volume, QoS ACL Volume, Security Volume, System Volume, and unsupported commands. Organization H3C Configuration Manual is organized as follows: Part 00 Product Overview 01 Access Volume 02 IP Services Volume Contents includes Obtaining the Documentation, Product Features, and Features. includes Ethernet Interface Configuration, POS Interface Configuration, GVRP Configuration, Link Aggregation Configuration, Port Mirroring Configuration, RPR Configuration, Ethernet OAM Configuration MSTP Configuration, VLAN Configuration, QinQ Configuration, BPDU Tunneling Configuration, and Port Isolation Configuration. includes ARP Configuration, DHCP Configuration, DNS Configuration, IP Addressing Configuration, IP Performance Configuration, UDP Helper Configuration IPv6 Basics Configuration, Dual Stack Configuration, Tunneling Configuration, and Adjacency Table Configuration.

4 Part 03 IP Routing Volume 04 IP Multicast Volume 05 MPLS VPN Volume Contents includes IP Routing Overview, BGP Configuration, IS-IS Configuration, OSPF Configuration, RIP Configuration, Routing Policy Configuration, Static Routing Configuration, IPv6 BGP Configuration, IPv6 IS-IS Configuration, IPv6 OSPFv3 Configuration, IPv6 RIPng Configuration, and IPv6 Static Routing Configuration. includes Multicast Overview, Multicast Routing and Forwarding Configuration, IGMP Snooping Configuration, IGMP Configuration, PIM Configuration, MSDP Configuration, IPv6 Multicast Routing and Forwarding Configuration, MLD Snooping Configuration, MLD Configuration, IPv6 PIM Configuration, and Multicast VLAN Configuration. includes MPLS Basics Configuration, MPLS TE Configuration, VPLS Configuration, MPLS L2VPN Configuration, MPLS L3VPN Configuration, MPLS Hybrid Insertion Configuration, and GRE Configuration. 06 QoS ACL Volume includes QoS Configuration and ACL Configuration. 07 Security Volume 08 System Volume 09 OAA Volume includes 802.1x Configuration, AAA RADIUS HWTACACS Configuration, MAC Authentication Configuration, L3+NAT Configuration, Password Control Configuration, SSH2.0 Configuration, and Portal Configuration. includes GR Configuration, VRRP Configuration, HA Configuration, Device Management Configuration, NQA Configuration, NetStream Configuration, NTP Configuration, RMON Configuration, SNMP Configuration, File System Management Configuration, System Maintaining and Debugging Configuration, Basic System Configuration, Information Center Configuration, User Interface Configuration, MAC Address Table Management Configuration, PoE Configuration, and Clock Monitoring Configuration. includes OAP Module Configuration and ACSEI Configuration. 10 Acronyms Offers the acronyms used in this manual.

5 Conventions The manual uses the following conventions: I. Command conventions Convention Boldface italic [ ] { x y... } [ x y... ] { x y... } * [ x y... ] * &<1-n> Description The keywords of a command line are in Boldface. Command arguments are in italic. Items (keywords or arguments) in square brackets [ ] are optional. Alternative items are grouped in braces and separated by vertical bars. One is selected. Optional alternative items are grouped in square brackets and separated by vertical bars. One or none is selected. Alternative items are grouped in braces and separated by vertical bars. A minimum of one or a maximum of all can be selected. Optional alternative items are grouped in square brackets and separated by vertical bars. Many or none can be selected. The argument(s) before the ampersand (&) sign can be entered 1 to n times. # A line starting with the # sign is comments. II. GUI conventions Convention Description < > [ ] / Button names are inside angle brackets. For example, click <OK>. Window names, menu items, data table and field names are inside square brackets. For example, pop up the [New User] window. Multi-level menus are separated by forward slashes. For example, [File/Create/Folder].

6 III. Symbols Convention Warning Caution Note Description Means reader be extremely careful. Improper operation may cause bodily injury. Means reader be careful. Improper operation may cause data loss or damage to equipment. Means a complementary description.

7 Operation Manual MPLS VPN Volume Organization Manual Version T C-2.03 Product Version S9500-CMW520-R2132 Organization The MPLS VPN Volume is organized as follows: Features (operation manual) MPLS Basics Configuration MPLS TE VPLS MPLS L2VPN MPLS L3VPN Description MPLS (Multiprotocol Label Switching) brings together the advantages of the connectionless control with IP and the connection-oriented forwarding with ATM. In addition to the support from IP routing and control protocols, its powerful and flexible routing functions allows it to accommodate to various emerging applications. The volume describes: MPLS overview MPLS basic attributes configuration Network congestionoccur either when network resources are inadequate or when load distribution is unbalanced. Traffic engineering (TE) is intended to avoid the latter situation where partial congestion may occur as the result of inefficient resource allocation. The volume describes: MPLS TE overview MPLS TE configuration VPLS can deliver a point-to-multipoint L2VPN service over public networks. The volume describes: VPLS overview VPLS configuration MPLS L2VPN provides Layer 2 VPN services on the MPLS network. The volume describes: MPLS L2VPN overview MPLS L2VPN configuration MPLS L3VPN is a kind of PE-based L3VPN technology for service provider VPN solutions. The volume describes: MPLS L3VPN overview MPLS L3VPN configuration

8 Operation Manual MPLS VPN Volume Organization Features (operation manual) MPLS Hybrid Insertion GRE Description The MPLS hybrid insertion feature is used to enable deployment of MPLS VPN services on cards that do not support MPLS. The volume describes: MPLS hybrid insertion overview MPLS hybrid insertion configuration GRE is a protocol designed for performing encapsulation of one network layer protocol over another network layer protocol. The volume describes: GRE overview GRE configuration

9 Operation Manual MPLS Basics Table of Contents Table of Contents Chapter 1 MPLS Basics Configuration MPLS Overview Basic Concepts of MPLS Architecture of MPLS MPLS and Routing Protocols Applications of MPLS MPLS Configuration Basics Label Advertisement and Management PHP TTL Processing in MPLS Inspecting an MPLS LSP LDP Overview LDP Basic Concepts LDP Label Distribution Fundamental Operation of LDP LDP Loop Detection Configuring MPLS Basic Capability Configuration Prerequisites Configuration Procedure Configuring PHP Configuration Prerequisites Configuration Procedure Configuring a Static LSP Configuration Prerequisites Configuration Procedure Configuring MPLS LDP Configuration Prerequisites MPLS LDP Configuration Tasks Configuring MPLS LDP Capability Configuring Local LDP Session Parameters Configuring Remote LDP Session Parameters Configuring the Policy for Triggering LSP Establishment Specifying the Label Processing Modes Configuring LDP Loop Detection Configuring LDP MD5 Authentication Enabling MTU Signaling Configuring LDP Instances Configuration Prerequisites i

10 Operation Manual MPLS Basics Table of Contents Configuration Procedure Configuring MPLS IP TTL Processing Configuration Prerequisites Configuring MPLS IP TTL Propagation Specifying the Type of Path for ICMP Responses Setting the Interval for Reporting Statistics Inspecting an MPLS LSP Enabling MPLS Trap Displaying and Maintaining MPLS Resetting LDP Sessions Displaying MPLS Operation Displaying MPLS LDP Operation Clearing MPLS Statistics MPLS Configuration Examples LDP Session Configuration Example Configuring LDP to Establish LSPs Troubleshooting MPLS ii

11 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration Chapter 1 MPLS Basics Configuration When performing MPLS basics configuration, go to these sections for information you are interested in: MPLS Overview MPLS Configuration Basics LDP Overview Configuring MPLS Basic Capability Configuring PHP Configuring a Static LSP Configuring MPLS LDP Configuring LDP Instances Configuring MPLS IP TTL Processing Setting the Interval for Reporting Statistics Inspecting an MPLS LSP Enabling MPLS Trap Displaying and Maintaining MPLS MPLS Configuration Examples Troubleshooting MPLS Note: A routing switch can also function as a router while running MPLS. The term router in this document refers to a router in a generic sense or a Layer 3 Ethernet switch running MPLS. For the S9500 Series Routing Switches, only the line processor units (LPUs) and VPLS service processor cards (SPCs) whose names contain such suffix like C, CA or CB support MPLS. To enable the MPLS VPN function on an S9500 switch, you need to configure an MPLS-capable LPU or VPLS SPC. You can identify a card name suffix by the silkscreen at the upper right corner of the front panel of a card. For example, the silkscreen of the LSB1P4G8CA0 card is P4G8CA and its suffix is CA. 1.1 MPLS Overview Multiprotocol label switching (MPLS), originating in Internet Protocol version 4 (IPv4), was initially proposed to improve forwarding speed. Its core technology can be extended to multiple network protocols, such as Internet Protocol version 6 (IPv6), 1-1

12 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration Internet packet exchange (IPX), and connectionless network protocol (CLNP). That is what the term multiprotocol means. MPLS integrates both Layer 2 fast switching and Layer 3 routing and forwarding, satisfying the requirements of various new applications for network performance. Note: For details about MPLS architecture, refer to RFC 3031 Multiprotocol Label Switching Architecture Basic Concepts of MPLS I. FEC As a forwarding technology based on classification, MPLS groups packets to be forwarded in the same manner into a class called the forwarding equivalence class (FEC). That is, packets of the same FEC are handled in the same way. The classification of FECs is very flexible. It can be based on any combination of source address, destination address, source port, destination port, protocol type and VPN. For example, in the traditional IP forwarding using longest match, all packets to the same destination belongs to the same FEC. II. Label A label is a short fixed length identifier for identifying a FEC. A FEC may correspond to multiple labels in scenarios where, for example, load sharing is required, while a label can only represent a single FEC. A label is carried in the header of a packet. It does not contain any topology information and is local significant. A label is four octets, or 32 bits, in length. Figure 1-1 illustrates its format. Figure 1-1 Format of a label A label consists of four fields: Label: Label value of 20 bits. Used as the pointer for forwarding. Exp: For QoS, three bits in length. S: Flag for indicating whether the label is at the bottom of the label stack, one bit in length. 1 indicates that the label is at the bottom of the label stack. This field is very useful when there are multiple levels of MPLS labels. 1-2

13 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration TTL: Time to live (TTL) for the label. Eight bits in length. This field has the same meaning as that for an IP packet. Similar to the VPI/VCI in ATM and the DLCI in frame relay, an MPLS label functions as a connection identifier. If the link layer protocol has a label field like VPI/VCI in ATM or DLCI in frame relay, the MPLS label is encapsulated in that field. Otherwise, it is inserted between the data link layer header and the network layer header as a shim. As such, an MPLS label can be supported by any link layer protocol. Figure 1-2 shows the place of a label in a packet. Figure 1-2 Place of a label in a packet Note: Currently, the S9500 series does not support the cell mode. III. LSR Label switching router (LSR) is a fundamental component on an MPLS network. All LSRs support MPLS. IV. LSP Label switched path (LSP) means the path along which a FEC travels through an MPLS network. Along an LSP, two neighboring LSRs are called upstream LSR and downstream LSR respectively. In Figure 1-3, R2 is the downstream LSR of R1, while R1 is the upstream LSR of R2. 1-3

14 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration Figure 1-3 Diagram for an LSP An LSP is a unidirectional path from the ingress of the MPLS network to the egress. It functions like a virtual circuit in ATM or frame relay. Each node of an LSP is an LSR. V. LDP Label distribution protocol (LDP) means the protocol used by MPLS for control. An LDP has the same functions as a signaling protocol on a traditional network. It classifies FECs, distributes labels, and establishes and maintains LSPs. MPLS supports multiple label distribution protocols of either of the following two types: Those dedicated for label distribution, such as LDP and constraint-based routing using LDP (CR-LDP). The existing protocols that are extended to support label distribution, such as border gateway protocol (BGP) and resource reservation protocol (RSVP). In addition, you can configure static LSPs. Note: For information about CR-LDP and RSVP, refer to MPLS TE Configuration in the MPLS VPN Volume. For information about BGP, refer to BGP Configuration in the IP Routing Volume. Currently, the S9500 series does not support CR-LDP. VI. LSP tunneling MPLS support LSP tunneling. An LSR of an LSP and its downstream LSR are not necessarily on a path provided by the routing protocol. That is, MPLS allows an LSP to be established between two LSRs that are not on a path established by the routing protocol. In this case, the two LSRs are respectively the start point and end point of the LSP, and the LSP is an LSP tunnel, which does not use the traditional network layer encapsulation tunneling technology. For example, the LSP <R2 R21 R22 R3> in Figure 1-3 is a tunnel between R2 and R3. 1-4

15 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration If the path that a tunnel traverses is exactly the hop-by-hop route established by the routing protocol, the tunnel is called a hop-by-hop routed tunnel. Otherwise, the tunnel is called an explicitly routed tunnel. VII. Multi-level label stack MPLS allows a packet to carry a number of labels organized as a last-in first-out (LIFO) stack, which is called a label stack. A packet with a label stack can travel along more than one level of LSP tunnel. At the ingress and egress of each tunnel, these operations can be performed on the top of a stack: PUSH and POP. MPLS has no limit to the depth of a label stack. For a label stack with a depth of m, the label at the bottom is of level 1, while the label at the top has a level of m. An unlabeled packet can be considered as a packet with an empty label stack, that is, a label stack whose depth is Architecture of MPLS I. Structure of the MPLS network As shown in Figure 1-4, the element of an MPLS network is LSR. LSRs in the same routing or administrative domain form an MPLS domain. In an MPLS domain, LSRs residing at the domain border to connect with other networks are label edge routers (LERs), while those within the MPLS domain are core LSRs. All core LSRs, which can be routers running MPLS or ATM-LSRs upgraded from ATM switches, use MPLS to communicate, while LERs interact with devices outside the domain that use traditional IP technologies. Each packet entering an MPLS network is labeled on the ingress LER and then forwarded along an LSP to the egress LER. All the intermediate LSRs are called transit LSRs. Ingress LSP Egress IP network Transit IP network Figure 1-4 Structure of the MPLS network 1-5

16 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration The following describes how MPLS operates: 1) First, the LDP protocol and the traditional routing protocol (such as OSPF and ISIS) work together on each LSR to establish the routing table and the label information base (LIB) for intended FECs. 2) Upon receiving a packet, the ingress LER completes the Layer 3 functions, determines the FEC to which the packet belongs, labels the packet, and forwards the labeled packet to the next hop along the LSP. 3) After receiving a packet, each transit LSR looks up its label forwarding table for the next hop according to the label of the packet and forwards the packet to the next hop. None of the transit LSRs performs Layer 3 processing. 4) When the egress LER receives the packet, it removes the label from the packet and performs IP forwarding. Obviously, MPLS is not a service or application, but actually a tunneling technology and a routing and switching technology platform combining label switching with Layer 3 routing. This platform supports multiple upper layer protocols and services, as well as secure transmission of information to a certain degree. II. Structure of an LSR Figure 1-5 Structure of an LSR As shown in Figure 1-5, an LSR consists of two components: Control plane: Implements label distribution and routing, establishes the LFIB, and builds and tears LSPs. Forwarding plane: Forwards packets according to the LFIB. 1-6

17 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration An LER forwards both labeled packets and IP packets on the forwarding plane and therefore uses both the LFIB and the FIB. An ordinary LSR only needs to forward labeled packets and therefore uses only the LFIB MPLS and Routing Protocols When establishing an LSP hop by hop, LDP uses the information in the routing tables of the LSRs along the path to determine the next hop. The information in the routing tables is provided by routing protocols such as IGPs and BGP. LDP only uses the routing information indirectly; it has no direct association with routing protocols. On the other hand, existing protocols such as BGP and RSVP can be extended to support label distribution. In MPLS applications, it may be necessary to extend some routing protocols. For example, MPLS-based VPN applications requires that BGP be extended to propagate VPN routing information, and MPLS-based traffic engineering (TE) requires that OSPF or IS-IS be extended to carry link state information Applications of MPLS By integrating both Layer 2 fast switching and Layer 3 routing and forwarding, MPLS features improved route lookup speed. However, with the development of the application specific integrated circuit (ASIC) technology, route lookup speed is no longer the bottleneck hindering network development. This makes MPLS not so outstanding in improving forwarding speed. Nonetheless, MPLS can easily implement the seamless integration between IP networks and Layer 2 networks of ATM, frame relay, and the like, and offer better solutions to quality of service (QoS), traffic engineering (TE), and virtual private network (VPN) applications thanks to the following advantages. I. MPLS-based VPN Traditional VPN depends on tunneling protocols such as GRE, L2TP, and PPTP to transport data between private networks across public networks, while an LSP itself is a tunnel over public networks. Therefore, implementation of VPN using MPLS is of natural advantages. MPLS-based VPN connects geographically different branches of a private network to form a united network by using LSPs. MPLS-based VPN also supports the interconnection between VPNs. 1-7

18 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration VPN 3 CE 3 PE 3 MPLS backbone VPN 1 VPN 2 CE 1 PE 1 PE 2 CE 2 Figure 1-6 MPLS-based VPN Figure 1-6 shows the basic structure of an MPLS-based VPN. Two of the fundamental components are customer edge device (CE) and service provider edge router (PE). A CE can be a router, switch, or host. All PEs are on the backbone network. PE is responsible for managing VPN users, establishing LSP connections between PEs, and allocating routes among different branches of the same VPN. Route allocation among PEs is usually implemented by LDP or extended BGP. MPLS-based VPN supports IP address multiplexing between branches and interconnection between VPNs. Compared with a traditional route, a VPN route requires the branch and VPN identification information. Therefore, it is necessary to extend BGP to carry VPN routing information. II. MPLS-based TE MPLS-based TE and the Diff-Serv feature allow not only high network utilization, but different levels of services based on traffic precedence, providing voice and video streams with services of low delay, low packet loss, and stable bandwidth guarantee. Since TE is more difficult to be implemented on an entire network, the Diff-Serv model is often adopted in practical networking schemes. The Diff-Serv model maps a service to a certain service class at the network edge according to the QoS requirement of the service. The DS field (derived from the TOS field) in the IP packet identifies the service uniquely. Then, each node in the backbone network performs the preset service policies to diversified services according to the field to ensure the corresponding QoS. The QoS classification in Diff-Serv is similar to the MPLS label distribution. In fact, the MPLS-based Diff-Serv is implemented by integrating the DS distribution into the MPLS label distribution. 1-8

19 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration 1.2 MPLS Configuration Basics Note: Currently, the device supports the graceful restart (GR) feature of LDP. For details about GR, refer to GR Configuration in System Volume Label Advertisement and Management In MPLS, the decision to assign a particular label to a particular FEC is made by the downstream LSR. The downstream LSR informs the upstream LSR of the assignment. That is, labels are advertised in the upstream direction. I. Label advertisement mode Two label advertisement modes are available: Downstream on demand (DoD): In this mode, a downstream LSR binds a label to a particular FEC and advertises the binding only when it receives a label request from its upstream LSR. Downstream unsolicited (DU): In this mode, a downstream LSR does not wait for any label request from an upstream LSR before binding a label to a particular FEC. An upstream LSR and its downstream LSR must use the same label advertisement mode; otherwise, no LSP can be established normally. For more information, refer to LDP Label Distribution. II. Label distribution control mode There are two label distribution control modes: Independent: In this mode, an LSR can notify label binding messages upstream anytime. The drawback of this mode is that an LSR may have advertised to the upstream LSR the binding of a label to a particular FEC when it receives a binding from its downstream LSR. Ordered: In this mode, an LSR can send label binding messages about a FEC upstream only when it receives a specific label binding message from the next hop for a FEC or the LSR itself is the egress node of the FEC. III. Label retention mode Label retention mode dictates how to process a label to FEC binding that is received by an LSR but not useful at the moment. There are two label retention modes: 1-9

20 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration Liberal: In this mode, an LSR keeps any received label to FEC binding regardless of whether the binding is from its next hop for the FEC or not. Conservative: In this mode, an LSR keeps only label to FEC bindings that are from its next hops for the FECs. In liberal mode, an LSR can adapt to route changes quickly; while in conservative mode, there are less label to FEC bindings for an LSR to advertise and keep. The conservative label retention mode is usually used together with the DoD mode on LSRs with limited Label space and LDP identifier. IV. Basic concepts for label switching Next hop label forwarding entry (NHLFE): Operation to be performed on the label, which can be Push or Swap. FEC to NHLFE map (FTN): Mapping of a FEC to an NHLFE at the ingress node. Incoming label map (ILM): Mapping of each incoming label to a set of NHLFEs. The operations performed for each incoming label includes Null and Pop. V. Label switching process Each packet is classified into a certain FEC at the ingress LER. Packets of the same FEC travel along the same path in the MPLS domain, that is, the same LSP. For each incoming packet, an LSR examines the label, uses the ILM to map the label to an NHLFE, replaces the old label with a new label, and then forwards the labeled packet to the next hop PHP As described in Architecture of MPLS, each transit LSR on an MPLS network forwards an incoming packet based on the label of the packet, while the egress LER removes the label from the packet and forwards the packet based on the network layer destination address. In fact, on a relatively simple MPLS application network, the label of a packet is useless for the egress, which only needs to forward the packet based on the network layer destination address. In this case, the penultimate hop popping (PHP) feature can pop the label at the penultimate node, relieving the egress of the label operation burden and improving the packet processing capability of the MPLS network TTL Processing in MPLS MPLS TTL processing involves two aspects: TTL propagation and ICMP response path. I. IP TTL propagation An MPLS label contains an 8-bit long TTL field, which has the same meaning as that of an IP packet. 1-10

21 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration According to RFC 3031 Multiprotocol Label Switching Architecture, when an LSR labels a packet, it copies the TTL value of the original IP packet or the upper level label to the TTL field of the newly added label. When an LSR forwards a labeled packet, it decrements the TTL value of the label at the stack top by 1. When an LSR pops a label, it copies the TTL value of the label at the stack top back to the TTL field of the IP packet or lower level label. TTL can be used not only to prevent routing loops, but to implement the tracert function: With IP TTL propagation enabled at ingress, whenever a packet passes a hop along the LSP, its IP TTL gets decremented by 1. Therefore, the result of tracert will reflect the path along which the packet has traveled. With IP TTL propagation disabled at ingress, the IP TTL of a packet does not decrement when the packet passes a hop, and the result of tracert does not show the hops within the MPLS backbone, as if the ingress and egress were connected directly. Caution: Within an MPLS domain, TTL propagation always occurs between the multi-level labels. The TTL value of a transmitted local packet is always copied regardless of whether IP TTL propagation is enabled or not. This ensures that the local administrator can tracert for network test. For network security, the structure of the MPLS backbone may need to be hidden in an MPLS VPN application. In this case, TTL propagation is not allowed for private network packets at ingress. II. ICMP response On an MPLS VPN, P routers cannot route VPN packets carried by MPLS. When the TTL of an MPLS packet expires, an ICMP response will be generated and transported along the LSP until it reaches the destination router of the LSP, where it is forwarded by IP routing. Such processing increases the network traffic and the packet forwarding delay. Note: For description and configuration of P routers, refer to MPLS L3VPN Configuration and MPLS L2VPN Configuration in the MPLS VPN Volume. 1-11

22 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration For an MPLS packet with only one level of label, the ICMP response message travels along the IP route when the TTL expires Inspecting an MPLS LSP In MPLS, the MPLS control plane is responsible for establishing an LSP. However, it cannot detect the error when an LSP fails to forward data. This brings difficulty to network maintenance. MPLS LSP ping and traceroute provide a mechanism for detecting errors in LSP and locating nodes with failure in time. Similar to IP ping and traceroute, MPLS LSP ping and traceroute use MPLS echo requests and MPLS echo replies to check the availability of LSPs. The MPLS echo request message carries FEC information to be detected, and is sent along the LSP like other data packets of the same FEC. Thus, the LSP can be checked. MPLS LSP ping is a tool for checking the validity and availability of an LSP. It uses messages called MPLS echo requests. In a ping operation, an MPLS echo request is forwarded along an LSP to the egress, where the control plane determines whether the LSR itself is the egress of the FEC and responds with an MPLS echo reply. When the ping initiator receives the reply, the LSP is considered perfect for forwarding data. MPLS LSP traceroute is a tool for locating LSP errors. By sending MPLS echo requests to the control plane of each transit LSR, it can determine whether the LSR is really a transit node on the LSP. Note: When an MPLS echo request reaches the egress, the destination address in the IP header is set to an address on /8 (loopback address of the LSR) and the TTL is set to 1, so as to prevent further forwarding of the request. 1.3 LDP Overview LDP Basic Concepts An LDP dictates the messages to be used in label distribution and the related processes. 1-12

23 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration Using LDP, LSRs can map network layer routing information to data layer switching paths directly and further establish LSPs. LSPs can be established between both neighboring LSRs and LSRs that are not directly connected, making label switching possible at all transit nodes on the network. Note: For detailed description about LDP, refer to RFC 2036 LDP Specification. I. LDP peer Two LSRs with an LDP session established between them and using LDP to exchange label to FEC bindings are called LDP peers, each of which obtains the label to FEC bindings of its peer over the LDP session between them. II. LDP session LDP sessions are used to exchange messages for label binding and releasing. LDP sessions come in two categories: Local LDP session: Established between two directly connected LSRs. Remote LDP session: Established between two indirectly connected LSRs. III. LDP message type There are four types of LDP messages: Discovery message: Used to declare and maintain the presence of an LSR on a network. Session message: Used to establish, maintain, and terminate sessions between LDP peers. Advertisement message: Used to create, alter, or remove label to FEC bindings. Notification message: Used to provide advisory information and signal errors. For reliable transport of LDP messages, TCP is used for LDP session messages, advertisement messages, and notification messages, while UDP is used only for discovery messages. IV. Label space and LDP identifier A scope of labels that can be assigned to LDP peers is called a label space. A label space can be per interface or per platform. A per interface label space is interface-specific, while a per platform label space is for an entire LSR. 1-13

24 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration An LDP identifier is used to identify an LSR label space. It is a six-byte numerical value in the format of <LSR ID>:<Label space ID>, where LSR ID is four-byte long. A label space ID of 1 means per interface, a label space ID of 0 means per platform. Note: Currently, only per platform label space is supported LDP Label Distribution Figure 1-7 illustrates how LDP distribute labels. Figure 1-7 Label distribution In Figure 1-7, B is the upstream LSR of C on LSP 1. As described previously, there are two label advertisement modes. The main difference between them is whether the downstream advertises the bindings unsolicitedly or on demand. The following details the advertisement process for each of the two modes. I. DoD mode In DoD mode, an upstream LSR sends a label request message containing the description of a FEC to its downstream LSR, which assigns a label to the FEC, encapsulates the binding information in a label mapping message and sends the message back to it. When the downstream LSR responds with label binding information depends on the label distribution control mode used by the LSR: In ordered mode, an LSR responds to its upstream LSR with label binding information only when it receives that of its downstream LSR. 1-14

25 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration In independent mode, an LSR immediately responds to its upstream LSR with label binding information no matter whether it receives that of its downstream LSR or not. Usually, an upstream LSR selects its downstream LSR based on the information in its routing table. In Figure 1-7, all LSRs on LSP 1 work in ordered mode, while LSR F on LSP 2 works in independent mode. II. DU mode In DU mode, a downstream LSR advertises label binding information to its upstream LSR unsolicitedly after the LDP session is established, while the upstream LSR keeps the label binding information and processes the information based on its routing table information Fundamental Operation of LDP LDP goes through four phases in operation: Discovery, Session establishment and maintenance, LSP establishment and maintenance, and Session termination. I. Discovery In this phase, an LSR who wants to establish a session sends Hello messages to its neighboring LSRs periodically, announcing its presence. This way, LSRs can automatically find their peers without manual configuration. LDP provides two discovery mechanisms: Basic discovery mechanism The basic discovery mechanism is used to discover local LDP peers, that is, LSRs directly connected at link layer, and to further establish local LDP sessions. Using this mechanism, an LSR periodically sends LDP link Hellos as UDP packets out an interface to the multicast address known as all routers on this subnet. An LDP link Hello message carries information about the LDP identifier of a given interface and some other information. Receipt of an LDP link Hello message on an interface indicates that a potential LDP peer is connected to the interface at link layer. Extended discovery mechanism The extended discovery mechanism is used to discover remote LDP peers, that is, LSRs not directly connected at link layer, and to further establish remote LDP sessions. Using this mechanism, an LSR periodically sends LDP targeted Hellos as UDP packets to a given IP address. An LDP targeted Hello message carries information about the LDP identifier of a given LSR and some other information. Receipt of an LDP targeted Hello message on an LSR indicates that a potential LDP peer is connected to the LSR at network layer. 1-15

26 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration At the end of the discovery phase, Hello adjacency is established between LSRs, and LDP is ready to initiate session establishment. II. Session establishment and maintenance In this phase, LSRs pass through two steps to establish sessions between them: 1) Establishing transport layer connections (that is, TCP connections) between them. 2) Initializing sessions and negotiating session parameters such as the LDP version, label distribution mode, timers, and label spaces. After establishing sessions between them, LSRs send Hello messages and Keepalive messages to maintain those sessions. III. LSP establishment and maintenance Establishing an LSP is to bind FECs with labels and notify adjacent LSRs of the bindings. This is implemented by LDP. The following gives the primary steps when LDP works in DU mode and ordered mode: 1) When the network topology changes and an LER finds in its routing table a new destination address that does not belong to any existing FEC, the LER creates a new FEC for the destination address. 2) If the LER has upstream LSRs and has at least one free label, it assigns a label to the FEC and sends the label binding information to the upstream LSRs. 3) Upon receiving the label binding information, an upstream LSR records the binding. Then, it checks whether the source LSR of the binding information is the next hop of the FEC. If yes, it adds an entry in its LFIB, assigns a label to the FEC, and sends the new label binding information to its own upstream LSRs.. 4) When the ingress LER receives the label binding information, it adds an entry in its LFIB. Thus, an LSP is established for the FEC, and packets of the FEC can be label switched along the LSP. IV. Session termination LDP checks Hello messages to determine adjacency and checks Keepalive messages to determine the integrity of sessions. LDP uses different timers for adjacency and session maintenance: Hello timer: LDP peers periodically send Hello messages to indicate that they intend to keep the Hello adjacency. If the timer expires but an LSR still does not receive any new Hello message from its peer, it removes the Hello adjacency. Keepalive timer: LDP peers keep LDP sessions by periodically sending Keepalive message over LDP session connections. If the timer expires but an LSR still does not receive any new Keepalive message, it closes the connection and terminates the LDP session. 1-16

27 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration LDP Loop Detection LSPs established in MPLS may be looping. The LDP loop detection mechanism can detect looping LSPs and prevent LDP messages from looping forever. The LDP loop detection mechanism must be configured on all LSR for it to work. However, for an LDP session to be established, LDP loop detection configuration on LDP peers may be different. LDP loop detection can be in either of the following two modes: I. Maximum hop count A label request message or label mapping message can include information about its hop count, which increments by 1 for each hop. When this value reaches the specified limit, LDP considers that a loop is present and the attempt to establish an LSP fails. II. Path vector A label request message or label mapping message can include path information in the format of path vector list. When such a message reaches an LSR, the LSR checks the path vector list of the message to see whether its MPLS LSR ID is in the list. If either of the following cases occurs, the attempt to establish an LSP fails: The MPLS LSR ID of the LSR is already in the path vector list. Hop counts of the path reaches the specified limit. If the MPLS LSR ID of the LSR is not in the path vector list, the LSR adds it into the list. 1.4 Configuring MPLS Basic Capability Configuration Prerequisites Before configuring MPLS basic capability, be sure to complete these tasks: Configuring physical parameters on related interfaces Configuring link layer attributes on related interfaces Configuring IP addresses for related interfaces Configuring static routes or an IGP protocol, ensuring that LSRs can reach each other Note: MPLS basic capability can be configured on LSRs even when LSRs cannot reach each other. However, you must configure the mpls ldp transport-address command in this case. 1-17

28 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration Configuration Procedure Follow these steps to configure MPLS basic capability: To do Use the command Remarks Enter system view system-view Configure the MPLS LSR ID Enable MPLS for the current node and enter MPLS view mpls lsr-id lsr-id mpls By default, no LSR ID is configured. Not enabled by default Exit to system view quit Enter interface view Enable MPLS for the interface interface interface-type interface-number mpls Not enabled by default Note: An LSR ID uses the format of an IP address and is unique within an MPLS domain. You are recommended to use the IP address of a loopback interface on an LSR as the LSR ID. 1.5 Configuring PHP You configure PHP on the egress and select the type of labels for the egress to distribute based on whether the penultimate hop supports PHP Configuration Prerequisites Before configuring PHP, be sure to complete configuring MPLS basic capability on all LSRs Configuration Procedure According to RFC 3032 MPLS Label Stack Encoding : A label value of 0 represents an IPv4 explicit null label and is valid only when it appears at the bottom of the label stack. It indicates that the label of the packet must be popped out on the node, and that the next node will perform IP forwarding. 1-18

29 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration A label value of 3 represents an implicit null label and never appears in the label stack. When an LSR finds that it is assigned an implicit null label, it directly performs a pop operation, rather than substitutes the value for the original label at the stack top. Follow these steps to configure PHP: To do Use the command Remarks Enter system view system-view Enter MPLS view mpls Specify the egress to support PHP and set the type of the label to be distributed to the penultimate hop label advertise { explicit-null implicit-null non-null } Optional By default, an egress supports PHP and distributes to the penultimate hop an implicit null label. Note that you must reset LDP sessions for the configuration to take effect. 1.6 Configuring a Static LSP An LSP can be static or dynamic. A static LSP is manually configured, while a dynamic LSP is established by MPLS LDP. For a static LSP to work, all LSRs along the LSP must be configured properly. Static LSPs can be used in MPLS L2VPN. Note: For configuration of MPLS L2VPN, refer to MPLS L2VPN Configuration in the MPLS VPN Volume Configuration Prerequisites Before configuring a static LSP, be sure to complete these tasks: Determining the ingress, transit LSRs, and egress for the static LSP Configuring MPLS basic capability on all the LSRs Configuration Procedure Follow these steps to configure a static LSP: 1-19

30 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration To do Use the command Remarks Enter system view system-view Configure a static LSP taking the current LSR as the ingress Configure a static LSP taking the current LSR as a transit LSR Configure a static LSP taking the current LSR as the egress static-lsp ingress lsp-name destination dest-addr { mask mask-length } { nexthop next-hop-addr outgoing-interface interface-type interface-number } out-label out-label static-lsp transit lsp-name incoming-interface interface-type interface-number in-label in-label { nexthop next-hop-addr outgoing-interface interface-type interface-number } out-label out-label static-lsp egress lsp-name incoming-interface interface-type interface-number in-label in-label Optional Optional Optional Note: If you specify the next hop when configuring a static LSP, and the address of the next hop is in the routing table, you must specify the next hop when configuring the static IP route. If you specify the outgoing interface for a static LSP, you must also specify the outgoing interface when configuring the static IP route. When configuring an ingress or transit LSR, the local public network address cannot be specified as the next hop. For information about configuring static IP route, refer to Static Routing Configuration in IP Routing Volume. 1.7 Configuring MPLS LDP Configuration Prerequisites Before configuring LDP, be sure to complete the following task: Configuring MPLS basic capability Configuring a route between an LSR and the opposite LSR MPLS LDP Configuration Tasks Complete these tasks to configure LDP: 1-20

31 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration Task Configuring MPLS LDP Capability Configuring Local LDP Session Parameters Configuring Remote LDP Session Parameters Configuring the Policy for Triggering LSP Establishment Specifying the Label Processing Modes Configuring LDP Loop Detection Configuring LDP MD5 Authentication Enabling MTU Signaling Remarks Optional Optional Optional Optional Optional Optional Optional Configuring MPLS LDP Capability Follow these steps to enable MPLS LDP capability: To do Use the command Remarks Enter system view system-view Enable LDP capability for the current node and enter MPLS LDP view Configure the LDP LSR ID mpls ldp lsr-id lsr-id Not enabled by default Optional MPLS LSR ID of the LSR by default Exit to system view quit Enter interface view Enable LDP capability on the interface interface interface-type interface-number mpls ldp Not enabled by default 1-21

32 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration Note: Disabling LDP on an interface terminates all LDP sessions on the interface, causing all LSPs using the sessions to be deleted. Usually, the default value of the LDP LSR ID, that of the MPLS LSR ID, answers the requirement. In some networking schemes where VPN instances are deployed, such as MPLS L3VPN networking schemes, if the address space of a VPN and that of the public network overlap, you must configure an LDP LSR ID that is different from the MPLS LSR ID for the TCP connection to be established normally Configuring Local LDP Session Parameters You can configure the local session transport address to be the IP address of the interface, or that of a specified interface. Follow these steps to configure local LDP session parameters: To do Use the command Remarks Enter system view system-view Enter interface view Set the link Hello timer Set the link Keepalive timer Configure the LDP transport address interface interface-type interface-number mpls ldp timer hello-hold value mpls ldp timer keepalive-hold value mpls ldp transport-address { interface-type interface-number interface } Optional 15 seconds by default Optional 45 seconds by default Optional MPLS LSR ID of the LSR by default Configuring Remote LDP Session Parameters Configure the remote session transport address to be the IP address of a specified interface. Follow these steps to configure remote LDP session parameters: To do Use the command Remarks Enter system view system-view Create a remote peer entity and enter MPLS LDP remote peer view mpls ldp remote-peer remote-peer-name 1-22

33 Operation Manual MPLS Basics Chapter 1 MPLS Basics Configuration To do Use the command Remarks Specify the LDP remote peer IP address Set the targeted Hello timer Set the targeted Keepalive timer Configure the transport address remote-ip ip-address mpls ldp timer hello-hold value mpls ldp timer keepalive-hold value mpls ldp transport-address interface-type interface-number Optional 45 seconds by default Optional 45 seconds by default Optional MPLS LSR ID of the LSR by default Note: In the current implementation, LDP itself does no send any label information through remote sessions, and remote sessions are used only to transfer messages for L2VPNs. For applications of remote sessions, refer to MPLS L2VPN Configuration in the MPLS VPN Volume. Caution: If Hello adjacency exists between two peers, no remote adjacency can be established between them. If remote adjacency exists between two peers, and local adjacency is then created for the remote peer, the remote adjacency is removed. That is, only one remote session or local session can exist between two LSRs, and the local session takes precedence over the remote session. The remote peer IP address to be configured must be different from all existing remote peer IP addresses. Otherwise, the configuration fails Configuring the Policy for Triggering LSP Establishment You can specify the routes that are allowed to trigger the establishment of LSPs: All static and IGP routes. IGP routes that can survive the IGP route filtering based on an IP address prefix list. An IP address prefix list affects only static routes and IGP routes. Follow these steps to configure the policy for triggering LSP establishment: 1-23