BGP/MPLS VPN


MPLS
VPN

MP-BGP
BGP/MPLS VPN

MPLS
IP
90
QOS
IP

IPIP

ATM

ATM
ATM
IPIP
ATMIP

MPLS
ATM

MPLSlabelATM
IPIP
2. 5
label
multiprotocol
1997
MPLSMultiProtocol label Switch

MPLS
MPLS32Bit
20BitLabel
3BitEXP, COS
1BitS,MPLS
8BitTTL
0

20

2
MPLS

23 24

CoS S

IP

32

TTL

32

M
P
L
S

M
P
L
S

I
P

MPLS
5

MPLS
Label

FEC
FEC
Forwarding Equivalence ClassFEC
MPLSCOS
FEC
MPLSFECFEC

LSP
FEC
LSP
LSR

Label Switching RouterLSRMPLS

LER:
Label Switching Edge Router,MPLSMPLSLER
FECFEC

MPLS

LSP

Ingress

Egress
MPLS

(LSR)
MPLS

(LER)

LERIPIPIP
PUSHIP
POPIP

SWAP
7

IPhop-by-hop
Dest
47.1
47.2
47.3

DEST

OUT

47.1.0.0

47.0.0.0

47.1.1.0

47.3 3

Dest
47.1
47.2
47.3

Out
1
2
3

Out
1
2
3

1 47.1
1

IP 47.1.1.1

IP 47.1.1.1

3
2

1
IP 47.1.1.1

47.2

2
IP 47.1.1.1

IP

Label Switched Path (LSP)

Intf Label Dest Intf Label
In In
Out Out
3
50
47.1 1
40

Intf Dest Intf Label

In
Out Out
3
47.1 1
50

Label Dest Intf

In
Out
40
47.1 1
IP 47.1.1.1
1 47.1

3
1

Intf
In
3

47.3 3

47.2
2

IP 47.1.1.1

MPLS
LSP

Label Switched Path (LSP)

FEC
IPingress
FECLSR
IPFEC
ipcache
cache
FEC
FEC
FEC
LSPMPLS

10


MPLS
MPLS
MPLS
IPIP

MPLSlabel

0x8847()0x8848
MPLS0800IP
PPPNCPMPLSCP0x8281

11

LDP

MPLSMPLS
LDPLabel Distribution Protocol

LDPIPRIP

12

LDP
LDP4LDP
Discovery
LSR
Session
LDP

Advertisement
FEC-
Notification

13

LDP
hello(UDP/prot:646/IP:224.0.0.2

TCP(TCP/port:646)
Master

M
M

slave
keepalive

masterkeepalive

keepalive

M
TCP

14

LDP
Keep Alive

NON EXISTENT

Init

INITIALIZED
Init Init
Keep Alive

OPENREC

Init
Keep Alive

Init

OPENSENT
Init

Keep Alive

OPERATIONAL

Shutdown
Shutdown

LDP
LDP

15

DODDownstream On Demand
DUDownstream Unsolicited

Odered
Independent

LSPLSR
LSR(upstream LSR )LSRdownstream LSR

16

LDPDU
Intf Label Dest Intf Label
In In
Out Out
3
50
47.1 1
40

Intf
In
3

Label Dest Intf

In
Out
40
47.1 1
1

Intf Dest Intf Label

In
Out Out
3
47.1 1
50

47.1

3
3
1

Mapping: 40

47.3 3

16
DOD

17

LDP

Liberal retention mode

IPlsp

Conservative retention mode

IPlsp

18

LDP

Odered
LSRLSR

Independent
LSRLSR

19

LDP
DU+

MPLSMPLS
IPMPLSMPLS
IP

MPLSIP

20


IN interface

IN label

Prefix/MASK

OUT interface (nexthop)

OUT label

Serial0

50

10.1.1.0/24

Eth03.3.3.3

80

Serial1

51

10.1.1.0/24

Eth03.3.3.3

80

Serial1

62

70.1.2.0/24

Eth03.3.3.3

52

Serial1

52

20.1.2.0/24

Eth14.4.4.4

52

Serial2

77

30.1.2.0/24

Serial35.5.5.5)

3pop

INOUT
INOUT

( )
( )
( )
( )
( )
A B C
21

P H P
MPLSPHPPHP
MPLS

Egress LSRMPLSIP
MPLSMPLS
MPLS
IPEgress LSRMPLS
IPELSR

PHPPenultimate Hop Popping),

()

()

IP

IP

22

MPLSlabel
LSPIP
IP

IP

TTLMPLS
TTL
MPLS
TTLip
TTL

23

MPLS
MPLS
MPLS
IP

ASIC
NPPHP
AK47L3

label

24


MPLS
VPN

MP-BGP
BGP/MPLS VPN

25


IPATM

IP
IP
IP
VPN,
,Overlay VPN
Peer-to-Peer VPN

26

VPN
VPN_A

VPN_A

10.2.0.0

CE

CE

11.5.0.0
VPN_A

VPN_B

10.2.0.0 CE

PE

PE

CE

10.1.0.0

VPN_A

11.6.0.0
VPN_B

CE

10.1.0.0 CE

PE

P-Network

PE

CE

VPN_B

10.3.0.0

C-Network
CECustom Edge
PEProvider Edge Router
CEVPN
P Provider Router

PPE
P
27

Overlay VPNCE
PECE

VPN_A

10.1.0.0
VPN_B

VPN_A

PE

CE

P P

CE

10.1.0.0 CE

GRE tunnel

PE

P-Network

PE

CE

10.3.0.0

VPN_B

10.3.0.0

GRE tunnel

CECE
GRE
IPSec

VPN

28

Overlay VPNPE
PECE

VPN_A

10.1.0.0
VPN_B

VPN_A

PE

CE

P P

CE

11.1.0.0 CE

GRE tunnel

PE

P-Network

PE

CE

10.3.0.0

VPN_B

11.3.0.0

GRE tunnel

PEVPNGREPEPE
P

VPN

VPNPECE
tunnelACL

29

Overlay VPN
Overlay VPNVPN

1. N^2
VPN
N

2. VPN
CEPE

30

Peer-to-Peer VPN

VPNPeertoPeer VPN

PeertoPeerCEtoPECEPE
PEPNetwork
P-Network
PE
VPN
VPNCEVPN
CEPEP-Network

31

Peer-to-Peer VPNPE
rip

VPN_B

11.3.0.0

CE

ospf

VPN_A

11.1.0.0

VPN_A

P P

CE

10.1.0.0 CE

PE

ospf

P-Network

PE

CE

VPN_B

10.3.0.0

isis

VPNCEPEPECE
OSPF
PEPE
CE
PECEPE
ACL

32

Peer-to-Peer VPNPE
rip

PE

PE

ospf

P P

CE
PE

VPN_B

10.1.0.0 CE

11.3.0.0

CE

VPN_A

11.1.0.0

VPN_A

rip

P-Network

PE

CE

VPN_B

10.3.0.0

ospf

VPNPEPECE
VPNPEPBGP

BGPIBGP
ACL
EBGPBGP
VPN

PE

33

Peer-to-Peer VPN
Peer-to-Peer VPN

VPNCE
why

GREIPSec

VPN

34

VPN

VPN

VPN

~~~~~~,

MPLSPHP
MPLSLSP
LDP

PHP

36


MPLS
VPN

MP-BGP
BGP/MPLS VPN

37

BGP

TLV
EIGRPBGPISIS
ISISOSIIP
NSAP
EIGRP

BGP
1. VPNBGP

2. BGPTCP
PVPN
3. BGPBGP
BGPPE

BGP
38


IP
OSPFBGP

OSPF
BGP
BGP
OSPFOSPF300
BGP
70
OSPF
BGPBGPinternet
BGP

ATM
BGP

39

1. PEVPN

2.

3.
PEIP
VPNIP
VPN

40

1.

PEPE
2.
VPN
3. IP
IPVPNPE

41

VRF
ACLIP unnumberNAT

PEPE
VPNPPE

VPN-A

VPN Routing Table

CE

VPN-A

CE

VPN-B

CE

PE

PE

IGP &/or
BGP

PE

Global Routing Table

VPN Routing Table

VPN-A

CE
PE

VPN-A

VPN-B

CE
CE

VRF

VRF for VPN-A

VRF for VPN-B

IGP &/or
BGP

Global Routing Table

42

VRF
VRF---VPNVPN Routing & Forwarding Instance
VRFPE

VRF
VRF

PEVRF
VRF
VRFPE
VRF

43

RT
PE
BGPcommunity
communityRTRoute Target

communitytype0x0002
0x0102RT
Type0x0002

AS#16bit

Type0x0102

IP address32bit

Value32bit
Value16bit

44

RT
RTVRFExport
Targetimport Target

SITE-A
SITE-B
SITE-C
SITE-D
SITEASITE-BSITEC
SITE-DSITE-ASITEBVPN-ASITE-CSITE-D
VPN-B

PE

VPN P
BGPcommunityVPN
community
VPNPE
P

VRF

VRF
RTexport
PE

PE
VRFRT
import
RTmatch
VRF
45

RT
RT Export Targetimport Target

VPN
b

im:b
ex:a

im:a
ex:b

im:a
ex:a

a
hub-spoke

im:a
ex:a

im:b
ex:c
im:a,c
ex:a,b

b
extranet

46

RD(Route Distinguisher)

RT
RT
RT
IP
BGPRoute withdraw
RT
RDRT

47

RD
IPv4RDVPN-IPv4
VRFRDVPN
RDVPNRD
VRFRDVPNRDVPN
RD
VRFRD
VRF
PEVRFRDwhy
RDVRFVPNRT

PECEIPv4PE
RD
VPN-IPv4PE
PE
CEVPN-IPv4
VPNVPN-IPv4

48


PE
PEVRF10.0.0.0/24
10.0.0.1
VRFCE

RD
RD
RD64bit

MPLSMPLS
MPLSMP-BGP

49


VRFPE
RDRT
RTVRFVRF
BGPcommunity
RDPEPEVRF
PEPE

LabelPEPEVRF
PE
PEVRF
SITEVRFCE
VPNSITESITE

50

BGP
NLRI Network Layer Reachability Information
labelRD
MP_REACH_NLRI
addressfamily

VPN-IPV4

next-hop:

PEloopback

NLRI:
label

24bitMPLSTTL

prefix

RD:64bitip

RT
Extended_CommunitiesRT1
Extended_CommunitiesRT2
Extended_CommunitiesRT3

MP_REACH_NLRIBGPMP-BGP

51


MPLS
VPN

MP-BGP
BPG/MPLS VPN

52


MPLSPHPBGPVPN

PHP

JV
BGP/MPLS VPN

MPLSQOS
BGPIPv6
VPN

53

CEPE
C
E

Site-1

PE
EBGP,OSPF, RIPv2,Static

CE
Site-2

VRFPE
PE (VRF)

PEP IGP

VPN
PE CE EBGPOSPFRIP

RIPVRF
PEMP-iBGPredistribute

EBGPEBGPMP-EBGPPEVPN

OSPFsiteLSAbgpcommunity
VPNospfLSAsiteOSPFarea 0
super area 0OSPF3

54

VRFMP-iBGP
MP-iBGP
PE
BGP, OSPF, RIPv2 update
for 149.27.2.0/24,NH=CE-1

PE
VPN-v4 update:
RD:1:27:149.27.2.0/24,
Next-hop=PE-1
SOO=Paris, RT=VPN-A,
Label=(28)

CE-2

CE-1

PE
RDRDVPN-IPV4
loopback

RTRT
PE
RTexport

import

55

MP-iBGPVRF
MP-iBGP
PE

CE-1

VPN-v4 update:
RD:1:27:149.27.2.0/24,
Next-hop=PE-1
SOO=Paris, RT=VPN-A,
Label=(28)

PE

ip vrf VPN-A
route-target import VPN-A

VPN-v4 IPV4
VRFimport RT
VRF
VRF
CE

CE-2

VPN-v4 IPV4VRFimport RT
VRFVRF
CE

VPN

56


In Label
-

FEC
197.26.15.1/32

Out Label
-

In Label

FEC

41

197.26.15.1/32

Out Label
POP

In Label
-

FEC

Out Label

197.26.15.1/32

41

PE-1
P router
Use label implicit-null for
destination 197.26.15.1/32

Paris
149.27.2.0/24

Use label 41 for destination

197.26.15.0/24

VPN-v4 update:
RD:1:27:149.27.2.0/24,
NH=197.26.15.1
RT=VPN-A, Label=(28)

London

PEPIGPBGP
LDPLSP
BGP
VRFVPN
MPLS

57

CEIngress PE
In Label

FEC

Out Label

197.26.15.1/32

41
VPN-A VRF
149.27.2.0/24,
NH=197.26.15.1
Label=(28)

PE-1
41

Paris

28

149.27.2.27

149.27.2.27

London

149.27.2.0/24

CEVRFPEVRF
PEloopback

MPLS

58

Ingress PE>Egress PE>CE

In Label
28(V)

FEC

Out Label

In Label

FEC

Out Label

149.27.2.0/24

41

197.26.15.1/32

POP

VPN-A VRF
149.27.2.0/24,
NH=Paris

VPN-A VRF
149.27.2.0/24,
NH=197.26.15.1
Label=(28)

PE-1
149.27.2.27

Paris

28

149.27.2.27

41

28

149.27.2.27

149.27.2.27

London

149.27.2.0/24

LSP

PE
PE
VRFCE

59

MPLS VPN
MP-BGP
IBGP Peer
VPN-v4 update:
RD:1:27:149.27.2.0/24,
Next-hop=PE-C
RT=VPN-A, Label=(28)
149.27.2.0/24

Out 28

CE B2

CE A2
PEA

NH: PEC

MPLS
BGP, OSPF, RIPv2 update
for 149.27.2.0/24,NH=PE-A

BGP, OSPF, RIPv2 update

for 149.27.2.0/24,NH=CE-A2

PB

IN 28

CE A1

CE B1

149.27.2.0/24

NH: A2

PEC
VPN-v4 update:
RD:1:27:149.27.2.0/24,
Next-hop=PE-C
RT=VPN-A, Label=(28)

60

MPLS VPNLSP
PE Cloopback1.1.1.1

MPLS
20
PEA
1.1.1.1/32 out 20
149.27.2.0/24

Out 28

IGP

NH: PEC

PB
In 20

1.1.1.1/32 out 3

IGP
PEC

PE C
INOUT

1.1.1.1/32
IN 28

149.27.2.0/24

NH: A2

61

MPLS VPN
20

CE B2

CE A2

28

PEA

1.1.1.1/32 out 20
149.27.2.0/24

Out 28

NH: PEC

BGP, OSPF, RIPv2 update

for 149.27.2.0/24,NH=PE-A

PB
In 20

Ping 149.27.2.1

CE A1

MPLS

1.1.1.1/32 out 3

PEC

CE B1

PE-C28
VRF

1.1.1.1/32
IN 28

149.27.2.0/24

NH: A2

62

MPLS/VPN

1. MPLS/VPN
2. CEPEP
A.
B.MP-BGP
C.MPLS
3. RDRT
A.
B.
4. MPLS
PEloopback
T or F
5. VPNRDVPNRD
VRFRDVPN
RDVPNRDT or F
6. RD
7. PE

8. MPLSLSP

BGP/GRE VPN
5
63

64


MPLS
MP-BGP

Trouble shooting

65

MPLS

LsrIDrouter id
mpls lsr id 10.5.80.250
!
LDP
mpls ldp
!
LDP Session
interface Ethernet4/1/0
ip address 10.5.3.93 255.255.255.252
mpls ldp enable

66

MPLS
PE3_NE16#show mpls ldp session
Showing information about all sessions:
Peer LDP Ident: 192.168.255.38:0; Local LDP Ident: 220.163.42.126:3
Tcp connection:192.168.255.38 - 220.163.42.66
Session State: Operational
Session Role: Active Hello packets sent/received: 72121/82424
KeepAlive packets sent/received: 15018/20607
Negotiated Keepalive Timer Value: 60 Peer PV Limit: 0
LDP discovery source:GigabitEthernet4/1/0.1

67

MPLS
NCC-R# show mpls lsp brief
ID I/O-Label
In-Interface
Prefix/Mask
Next-Hop
22 382/264
VT20
10.5.61.250/32 10.5.3.94
23 388/266
VT20
10.5.37.250/32 10.5.3.94
24 408/274
VT20
10.5.32.250/32 10.5.3.94
25 ---/24
---------10.5.22.250/32 10.5.3.10
26 132/24
VT49
10.5.22.250/32 10.5.3.10
27 153/24
Eth4/1/0
10.5.22.250/32 10.5.3.10
28 155/24
Eth10/2/0
10.5.22.250/32 10.5.3.10
29 ---/20
---------10.5.23.250/32 10.5.3.10
30 186/20
VT49
10.5.23.250/32 10.5.3.10
31 229/20
Eth4/1/0
10.5.23.250/32 10.5.3.10

68


MPLS
MP-BGP
VRF
RD
RT
PECE
VRF
PECE
MPBGP

Trouble shooting
69

PE
VRF
ip vrf VPN-HW
VRFvrf
RD
VRFVRFRDVPN
RD
rd 100:1
RT
VRFVRFRT
RT,RD
route-target import 100:1
route-target export 100:1

70

PE
VPN-HW
CE
PE

VPN-HW

ip vrf VPN-HW
rd 100:1
route-target export 100:1
route-target import 100:1
ip vrf VPN-3COM
rd 100:2
route-target export 100:2
route-target import 100:2

CE

VRF VPN-HW

VRF VPN-3COM

VPN-3COM CE

VRF
for VPN-HW
(RT100:1)
routes
routes

VRF
for VPN-B
(RT100:2)
routes

71

VRF

VPN
ip vrf forwarding VPN-HW
interface Serial3/5
ip vrf forwarding VPN-HW
ip address 10.168.61.6 255.255.255.252
encapsulation ppp

72

PECE
RIPv2BGPStatic
VRF
Static
ip route vrf VPN-HW 10.10.1.0 255.255.255.0 10.10.1.2
ip route vrf VPN-3COM 10.10.1.0 255.255.255.0 10.10.1.2

RIPv2:
router rip
!
address-family ipv4 vrf VPN-HW
no auto-summary
network 10.0.0.0
!
address-family ipv4 vrf VPN-3COM
no auto-summary
network 10.0.0.0
73

PECE
BGP
router bgp 109
!
address-family ipv4 vrf VPN-HW
neighbor 10.168.62.5 remote-as 65503
exit-address-family
!
address-family ipv4 vrf VPN-3C0M
redistribute static
redistribute connected
redistribute rip
exit-address-family
!

74

MP-BGP
router bgp 30000
/*BGP*/
no synchronization
neighbor 10.5.80.240 remote-as 30000
neighbor 10.5.80.240 update-source LoopBack0
/*VRFVRFBGP*/
address-family ipv4 vrf VPN-HW
redistribute connected
redistribute static
no synchronization
exit-address-family
/*vpnv4*/
address-family vpnv4
neighbor 10.5.80.240 activate
exit-address-family

75


MPLS
MP-BGP

Trouble shooting

76

VPN
PE3_NE16#show ip route vrf VPN-HW
VPN-HW Route Information
Routing Table: VPN-HW RD: 65400:1
Destination/Mask Proto Pre Metric
Nexthop
Interface
1.1.1.1/32 BGP 170 0
220.163.42.62 LoopBack0
192.168.20.0/29 BGP 170 0
220.163.42.62 LoopBack0
192.168.20.0/30 BGP 170 0
220.163.42.62 LoopBack0
192.168.20.65/32 DIRECT 0 0
127.0.0.1
InLoopBack0
192.168.20.96/29 DIRECT 0 0
192.168.20.101 GE4/1/0.2
192.168.20.101/32 DIRECT 0 0
127.0.0.1
InLoopBack0
BGPPEloopback
loopback

77

BGPVPN
PE3_NE16#show ip bgp vpnv4 all
BGP local router ID is 220.163.42.126
Status codes: s suppressed, d damped, h history, * valid, > best, i internal
Origin codes: i - IGP, e - EGP, ? - incomplete
Network

Next Hop

Label(I/O) Metric

LocPrf

Path

Route Distinguisher:65400:1 (default for vrf vpna)

*>i 1.1.1.1/32
220.163.42.62
0/17
100
?
*>i 192.168.20.0/29 220.163.42.62
0/17
100
?
*>i 192.168.20.0/30 220.163.42.62
0/16
100
?
*> 192.168.20.65/32 0.0.0.0
19/0
?
*> 192.168.20.96/29 0.0.0.0
18/0
?

BGPVPNv4
next hop 0.0.0.0

78


PE3_NE16#show mpls lsp vrf brief
ID I/O-Label
In-Interface
Prefix/Mask
Next-Hop
1
---/141|17
---------1.1.1.1/32
220.163.42.62
2
---/141|17
---------192.168.20.0/29 220.163.42.62
3
---/141|16
---------192.168.20.0/30 220.163.42.62
3 Record(s) Found

BGP
show ip bgp vpnv4 all

79

Ping&Telnet&tracert
PEVPNpingtelnet
tracertvrfa
PE3_NE16#ping -vrf vpna -a 192.168.20.65 1.1.1.1
PE3_NE16#tracert -vrf vpna -a 192.168.20.65 1.1.1.1
PE3_NE16#telnet vrf vpna 1.1.1.1

80


MPLS
MP-BGP

Trouble shooting

81

MPLS/VPNtrouble-shooting
MPLS/VPNLSPLSP

BGP

LDP

IGP

MP-BGP
PECE
RT

YN

BGP
Y

MPLS

800

82

MPLS/VPNtrouble-shooting

BGP
Y

IGP

PEVRFPEVRF
show ip route vrf
BGP
Established
show ip bgp summary
Neighbor
V AS MsgRcvd
220.163.42.62 4 65400
6818

MsgSent OutQ Up/Down State

6895 0 14h48m Established

LSPPEloopback
32mask

IGP
IGPPEloopback

83

MPLS/VPNtrouble-shooting

MP-BGP
PECE
RT

BGP

PEPE

show mpls lsp vrf brief

ID I/O-Label
In-Interface
Prefix/Mask
Next-Hop
1
---/141|17
---------1.1.1.1/32
220.163.42.62

show ip bgp vpnv4 all

Network
Next Hop
Label(I/O) Metric LocPrf Path
*> 1.1.1.1/32
0.0.0.0
17/0
?

MP-BGPPECERT

/*VRFVRFBGP*/
address-family ipv4 vrf VPN-HW
redistribute connected
exit-address-family
/*vpnv4*/
address-family vpnv4
neighbor 10.5.80.240 activate
/*RT importexport*/

BGP
BGPBGP

84

MPLS/VPNtrouble-shooting

LDP

MPLS

PEloopback
32mask

ID
22

LSPPEloopback
show mpls lsp brief

I/O-Label
In-Interface Prefix/Mask
Next-Hop
382/264
VT20
10.5.61.250/32 10.5.3.94

LDP
PEPLDPsession
show mpls ldp session
Session State: Operational

MPLS
MPLSLDP

mpls lsr id 10.5.80.250!

mpls ldp
LDP Session
interface Ethernet4/1/0
mpls ldp enable

85

86