Configuring and Troubleshooting MPLS VPN Vinit Jain, CCIE Security, - - PowerPoint PPT Presentation

▶
configuring and troubleshooting mpls vpn
SMART_READER_LITE
LIVE PREVIEW

Configuring and Troubleshooting MPLS VPN Vinit Jain, CCIE Security, - - PowerPoint PPT Presentation

Apr 08, 2023 556 likes •1.14k views

Cisco Support Community Expert Series Webcast Configuring and Troubleshooting MPLS VPN Vinit Jain, CCIE Security, Data Center, SP, and R&S September 15, 2015 Ask the Expert Events Now through September 18 Implementing and Troubleshooting

slide-1
SLIDE 1

Vinit Jain, CCIE Security, Data Center, SP, and R&S

September 15, 2015

Configuring and Troubleshooting MPLS VPN

Cisco Support Community

Expert Series Webcast

slide-2
SLIDE 2

Switch and IOS Architecture and Unexpected Reboots

  • n all Cisco Catalyst Switches with Ivan Shirshin and

Naveen Venkateshaia.

September 21 – October 2

Ask the Expert Events

Join the discussion for these Ask The Expert Events: http://bit.ly/events-webinar

Implementing and Troubleshooting VSS on Catalyst 6500 and 4500 with Inayathulla Shariff and Suresh Vs.

Now through September 18

slide-3
SLIDE 3

T.

Next Webcast

Register for this event at

http://bit.ly/octwebcast-reg

Cisco Data Center Overlays with Focus on VXLAN. With Vishal Mehta and Pranav Doshi

Tuesday October 20th, 10:00 AM PDT

slide-4
SLIDE 4

https://supportforums.cisco.com/expert-corner/top-contributors

Participate in Live Interactive Technical Events and much more http://bit.ly/1jlI93B

Become an Event Top Contributor

slide-5
SLIDE 5

Rate Content

Now your ratings on documents, videos, and blogs count give points to the authors!!! So, when you contribute and receive ratings you now get the points in your profile. Help us to recognize the quality content in the community and make your searches easier. Rate content in the community.

https://supportforums.cisco.com/blog/154746

Encourage and acknowledge people who generously share their time and expertise

slide-6
SLIDE 6

Cisco Support Community Expert Series Webcast

Vinit Jain

CCIE Security, Data Center SP and R&S #22854

slide-7
SLIDE 7

Meet Your Question Managers

Mohammed Jameel Brian Dunn

slide-8
SLIDE 8

If you would like a copy of the presentation slides, click the PDF file link in the chat box on the right or go to: https://supportforums.cisco.com/document/12605756/webcast- slides-configuring-and-troubleshooting-mpls-vpn

Thank You For Joining Us Today!

slide-9
SLIDE 9

Now through September 25 Ask the Expert Event following the Webcast

Join the discussion for these Ask The Expert Events: http://bit.ly/events-webinar

https://supportforums.cisco.com/discussion/12604306/ask- expert-configuring-and-troubleshooting-mpls-vpn

slide-10
SLIDE 10

Submit Your Questions Now!

Use the Q & A panel to submit your questions and the panel of experts will respond.

Please take a moment to complete the survey at the end of the webcast

slide-11
SLIDE 11

Vinit Jain, CCIE Security, Data Center SP, and R&S

September 15, 2015

Configuring and Troubleshooting MPLS VPN

Cisco Support Community

Expert Series Webcast

slide-12
SLIDE 12
  • Introduction to MPLS VPN
  • MPLS VPN Overview
  • Terminologies
  • Understanding MPLS VPN Control Plane and Data Plane
  • Basic MPLS VPN Configuration
  • Live Troubleshooting Demo

Agenda

slide-13
SLIDE 13

Why do we need MPLS?

  • A. BGP free core
  • B. Scalability
  • C. Increased Performance
  • D. All of the above
  • E. None of the above

Polling Question 1

slide-14
SLIDE 14

Overlay VPN Scenarios

Internet Customer 802.1q VLANs Hosted Content Services Branch Office Head Office VPN Concentration Point NAS ISDN POTS On-Net Dial-in Users DSL Branch/Home Office Off-Net Dial- in Users

slide-15
SLIDE 15

15

Provider Edge (PE) Device Provider Edge (PE) Device

L2/L3 Virtual Circuit

CPE (CE) Device CPE (CE) Device

Layer-3 Routing Adjacency

How to Size, or provide, Inter-Site Circuit Capacity? Full Circuit Mesh Requirement for Optimal Routing Layer-3 CPE Routing Adjacencies between Sites Duplicate IP Addressing Capability Complete Isolation Between Customers Secure VPN Service

Overlay VPN Model

  

slide-16
SLIDE 16

16

Peer to Peer based VPN Scenarios

Internet Customer 802.1q VLANs Hosted Content Services Branch Office Head Office VPN Concentration Point NAS ISDN POTS On-Net Dial-in Users DSL Branch/Home Office Off-Net Dial- in Users VPN Client A

slide-17
SLIDE 17

17

Provider Edge (PE) Device Provider Edge (PE) Device CPE (CE) Device CPE (CE) Device

Layer-3 Routing Adjacency

Peer to Peer IP-VPN Model

All VPN Routes Carried in SP IGP Duplicate IP Addressing Is Not an Option Complex Filters or Dedicated Devices Routing between Sites Is Optimal Circuit Sizing between Sites No Longer Such an Issue Simple Routing Scheme for Customers

  

slide-18
SLIDE 18

18

PE Router PE Router

MPLS Backbone

CPE (CE) Device CPE (CE) Device

Combined Benefits of Overlay and Peer-to-Peer VPN Models

RFC 2547 / 4364 MPLS VPN Model

Routing between Sites Is Optimal Duplicate IP Addressing Capability Secure Service PE Routers Hold Only Relevant VPN Routes Complete Isolation between Customers No Complex Filters

  • r Dedicated

Routers

    

P Router

slide-19
SLIDE 19
  • Combine benefits of overlay and network models in a scalable

manner

  • Overlay (security and isolation between customers)
  • Network (simplified customer routing)
  • PE routers only hold routes for attached VPNs
  • Reduces size of PE routing information
  • Proportional to number of VPNs attached
  • MPLS used to forward packets (not routing)
  • Full routing within backbone no longer required

MPLS VPN Overview MPLS VPN Overview

slide-20
SLIDE 20

Benefits

  • Operating Efficiencies – Any to Any routing between

sites

  • Flexibility & Scalability – Easy to add or move sites.
  • Lower cost
  • Security
  • QoS

Benefits

slide-21
SLIDE 21

Terminologies

MPLS VPN

slide-22
SLIDE 22
  • Virtual Routing and Forwarding (VRF)
  • Route Distinguisher (RD)
  • Route Target (RT)
  • Multi-Protocol BGP (MP-BGP)

Terminologies

slide-23
SLIDE 23

23

  • VRF can be thought of as a virtual router with the

following structures:

  • rules to control import/export of routes from/into the VPN

routing table

  • set of routing protocols/peers which inject information into the

VPN routing table (including static routing)

  • forwarding table based on CEF

VPN Routing and Forwarding Instance (VRF)

slide-24
SLIDE 24

PE CE VPN-A VPN-A CE VPN-B CE

Multiple Routing and Forwarding Instances (VRFs) Provide the Separation

IGP/BGP

VPN Routing and Forwarding Instance (VRF)

VPN Routing Table Global Routing Table

VRF for VPN-B VRF for VPN-A

slide-25
SLIDE 25

RIP BGP EIGRP

PE to CE Routing Processes Routing Contexts VRF Routing Tables VRF Forwarding Tables

VRF and Multiple Routing Instances

  • Routing processes

run within specific routing contexts

  • Populate specific

VPN routing table and FIBs (VRF)

  • PE-CE Protocols –

BGP, OSPF, EIGRP, RIP, Static, (ISIS only

  • n IOS)
slide-26
SLIDE 26

Can we use VRF without MPLS VPN scenario?

  • A. No
  • B. Yes

Polling Question 2

slide-27
SLIDE 27

Route Distinguisher

  • Uniqueness of IPv4 prefix achieved through the use of

a Route Distinguisher

  • RD (64 bits) identifier
  • creates a VPN-V4 Prefix = RD + IPv4 Prefix (96 bits)
  • RD Format:
  • ASN:NN
  • IP_ADDR:NN
slide-28
SLIDE 28

Route Target

  • Identification of route placement achieved through use of BGP Extended

Community Attribute – Route Target

  • Used to identify the set of sites to which a particular route should be

exported to

  • Do not confuse RT with RD
  • Both values can be different
slide-29
SLIDE 29

Multi-protocol BGP (MP-BGP)

  • Multi-protocol BGP (MP-BGP) defined in RFC 2283
  • Provides the ability for BGP to carry routing

information other than IPv4

  • Through the use of Address Families
  • VPN-V4 Address-Family Defined
  • For use with MPLS VPN Architecture
  • AFI=1, Sub-AFI=128
slide-30
SLIDE 30

Understanding MPLS VPN Control Plane

MPLS VPN

slide-31
SLIDE 31

31

Distribution of Local VRF Routes

MP-BGP

VRF VPN-A

VPN-A VPN-A

VRF VPN-A

  • PE routers distribute local VPN information across the

MPLS VPN backbone

  • Through the use of MP-BGP & redistribution from VRF;
  • Receiving PE imports routes into attached VRFs
slide-32
SLIDE 32

VRF Population of MP-BGP

MP-BGP

VPN-A VPN-A

ip vrf VPN-A rd 1:27 route-target export 1:231

  • PE routers translate into VPN-V4 route

Assign a RD and RT based on configuration Re-write Next-Hop attribute (to PE loopback) Assign a label based on VRF and/or interface Send MP-BGP update to all PE neighbors

BGP, OSPF, RIPv2 192.168.2.0/24,NH=CE-1

192.168.2.0/24 CE-1 PE-1 PE-2 CE-2

VPN-v4 update: RD:1:27:192.168.2.0/24, NH=PE-1 RT=1:231, Label=(28)

slide-33
SLIDE 33

MP-BGP Update Contents

  • VPN-V4 address

Route Distinguisher (64 bits) Makes the IPv4 route globally unique RD is configured in the PE for each VRF IPv4 address (32bits)

  • Extended Community attribute (64 bits)

Route-target (RT): identifies the set of sites the route has to be advertised to

slide-34
SLIDE 34

MP-BGP Update Contents

  • Any other standard BGP attribute
  • Local Preference
  • MED
  • Next-hop
  • AS_PATH
  • Standard Community
  • A Label identifying:
  • The outgoing interface or VRF where a lookup has to be performed

(Aggregate / connected)

slide-35
SLIDE 35

MP-BGP Update Processing

  • Receiving PE routers translate to IPv4 prefix

Inserts the route into the relevant VRFs identified by the RT attribute

  • The label associated to the VPN-V4 address will be set on

packets forwarded towards the destination

MP-BGP

VPN-A VPN-A

ip vrf VPN-A rd 1:27 route-target import 1:231

192.168.2.0/24 CE-1 PE-1 PE-2 CE-2

VPN-v4 update: RD:1:27:192.168.2.0/24, NH=PE-1 RT=1:231, Label=(28)

VPN-v4 update is translated into IPv4 address and put into VRF VPN-A as RT=1:231matches import

  • statement. Optionally

advertised to CE-2

slide-36
SLIDE 36

Which protocols have Labeling capabilities?

  • A. LDP
  • B. BGP
  • C. OSPF / ISIS
  • D. A & B
  • E. A & C

Polling Question 3

slide-37
SLIDE 37

Understanding MPLS VPN Data Plane

MPLS VPN

slide-38
SLIDE 38

LDP & MP-BGP Label Distribution

  • PE and P routers have BGP next-hop reachability through the backbone IGP
  • Labels are distributed through LDP corresponding to BGP Next-Hops &

through MP-BGP for VPN routes

PE-1 PE-2 P-1 1.1.1.1

Use label implicit-null for destination 1.1.1.1/32 Use label 41 for destination 1.1.1.1/32

In Label FEC Out Label

  • 1.1.1.1/32 -

In Label FEC Out Label 41 1.1.1.1/32 POP In Label FEC Out Label

  • 1.1.1.1/32 41

VPN-v4 update: RD:1:27:192.168.2.0/24, NH=1.1.1.1 RT=1:231, Label=(28)

192.168.2.0/24

slide-39
SLIDE 39

Ingress PE Label Imposition

VPN-A VPN-A

192.168.2.0/24 CE-1 PE-1 PE-2 CE-2

VPN-A FIB 192.168.2.0/24, Label Stack {41 28} 192.168.2.2

P-1

  • Ingress PE receives normal IP packets
  • PE router performs IP Longest Match from VPN FIB, finds iBGP next-hop

and imposes a stack of labels <IGP, VPN>

192.168.2.2 28 41

slide-40
SLIDE 40

MPLS VPN Forwarding

VPN-A VPN-A

192.168.2.0/24 CE-1 PE-1 PE-2 CE-2

VPN-A FIB 192.168.2.0/24, Label Stack {41 28}

P-1

P-1 LFIB 192.168.2.0/24 In label {41} Out label {implicit-null} 192.168.2.2 28 PE-1 LFIB 192.168.2.0/24 (V) In label {28} 192.168.2.2

  • Penultimate PE router removes the IGP label
  • Egress PE router uses the VPN label to select which CE to forward the packet
  • VPN label is removed and the packet is routed toward the VPN site using the

relevant VRF

slide-41
SLIDE 41

MPLS VPN

Configuration

slide-42
SLIDE 42

ip vrf ABC rd 1:1 route-target import 1:1 route-target export 1:1 route-target import 2:2 vrf definition ABC rd 1:1 address-family ipv4 unicast route-target import 1:1 route-target export 1:1 route-target import 2:2 address-family ipv6 unicast . . .

Defining VRF

slide-43
SLIDE 43

Assigning VRF Interfaces

interface Gig0/1 ip vrf forwarding ABC ip address 192.168.10.1 255.255.255.252 interface Gig0/1 vrf forwarding ABC ip address 192.168.10.1 255.255.255.252

slide-44
SLIDE 44

MP-BGP Configuration

router bgp 100 neighbor 2.2.2.2 remote-as 100 neighbor 2.2.2.2 update-source loopback0 address-family vpnv4 unicast neighbor 2.2.2.2 activate neighbor 2.2.2.2 send-community [extended | both] address-family ipv4 vrf ABC neighbor 192.168.10.2 remote-as 65535 neighbor 192.168.10.2 activate exit-address-family

slide-45
SLIDE 45

CONFIGURATION DEMO

MPLS VPN

slide-46
SLIDE 46

Lab Topology

AS 100 PE1 P-1 PE2 CE1 CE2 CE3 CE4

AS-65001 AS-65535 AS-65000 AS-65001 VPN - ABC VPN - ABC VPN - XYZ VPN - XYZ

slide-47
SLIDE 47

TROUBLESHOOTING DEMO

MPLS VPN

slide-48
SLIDE 48

Resources

slide-49
SLIDE 49

Resources

  • RFC 4364
  • https://tools.ietf.org/html/rfc4364
  • CCO Documentation
  • http://www.cisco.com/c/en/us/td/docs/ios-

xml/ios/mp_l3_vpns/configuration/15-mt/mp-l3-vpns-15-mt-book/mp-cfg- layer3-vpn.html

  • http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-

mpls/mpls/13733-mpls-vpn-basic.html

  • CSC Blog post on Troubleshooting MPLS VPN
  • https://supportforums.cisco.com/blog/12599296/configuring-and-

troubleshooting-basic-mpls-layer3-vpn

slide-50
SLIDE 50

Submit Your Questions Now!

Use the Q & A panel to submit your questions and our expert will respond

slide-51
SLIDE 51

Collaborate within our Social Media

Facebook- http://bit.ly/csc-facebook Twitter- http://bit.ly/csc-twitter You Tube http://bit.ly/csc-youtube Google+ http://bit.ly/csc-googleplus LinkedIn http://bit.ly/csc-linked-in Instgram http://bit.ly/csc-instagram Newsletter Subscription http://bit.ly/csc-newsletter

Learn About Upcoming Events

slide-52
SLIDE 52

Cisco has support communities in

  • ther languages!

Spanish https://supportforums.cisco.com/community/spanish Portuguese https://supportforums.cisco.com/community/portuguese Japanese https://supportforums.cisco.com/community/csc-japan Russian https://supportforums.cisco.com/community/russian Chinese http://www.csc-china.com.cn

If you speak Spanish, Portuguese, Japanese, Russian or Chinese we invite you to participate and collaborate in your language

slide-53
SLIDE 53

More IT Training Videos and Technical Seminars on the Cisco Learning Network

View Upcoming Sessions Schedule https://cisco.com/go/techseminars

slide-54
SLIDE 54

Please take a moment to complete the survey

Thank you for Your Time!

slide-55
SLIDE 55

Thank you for participating! . Red Redeem yo your 35 35% disc scount off

  • ffer by entering co

code: CS CSC when checking out: Visit Cisco Press at:

Cisco Press

http://bit.ly/csc-ciscopress-sept

slide-56
SLIDE 56