This is the fifth post in the series, the goal of the series is to provide a guide for the MPLS and BGP Lab I posted awhile back. The labs consists of MPLS VPNs and BGP along with some OSPF, NAT, IPSEC and GRE exposure. I will be posting the files needed for this lab at the bottom. Here’s the topology and the requirements:


(click image for fullsize)

Requirements:
Internet
* The two Internet routers should serve as transit ASes. No other routers should permit transit traffic.
* Internet sites (modeled by loopbacks) should be accessible by all lan IPs.

Clients
* London, Paris, and New York have Internet connections to their respective ISPs. New York is dual-homed.
* London, Paris, New York, and Chicago all have MPLS connections to the same provider. New York and Chicago constitute one company, while London and Paris constitute another. Their routes should not mix over MPLS.
* London, Paris, and New York each have data centers with a DMZ that should be publicly accessible.
* London, Paris, New York, and Chicago each have 2 LANs which should not be accessible from the Internet, though they should be able to access the Internet.
* London and Paris have a GRE over IPSEC connection between them that should take over routing between their LANs in case the MPLS connection fails. Additionally, the MPLS connection should take over for DMZ sites if the Internet connection should fail.

MPLS
* The MPLS-P router should be the only one in area 0. It should be an ABR connection MPLS-PE1 (a stub area 1) and MPLS-PE2 (a stub area 2).
* Area 1 and Area 2 should be summarized to /24′s before being injected into the OSPF backbone.
* The PE routers should communicate via BGP to the CE routers.

Today we will configure the MPLS VPNs:

MPLS-PE

hostname MPLS-PE1
!
ip vrf 1
 rd 100:110
 route-target export 100:1000
 route-target import 100:1000
!
ip vrf 2
 rd 100:120
 route-target export 100:2000
 route-target import 100:2000
!
interface Loopback0
 ip address 172.16.255.1 255.255.255.255
!
interface Serial1/0
 description Connection to MPLS-P
 ip address 172.16.0.2 255.255.255.252
 mpls ip
!
interface Serial1/1
 description Connection to London-M
 ip vrf forwarding 1
 ip address 172.16.1.1 255.255.255.252
!
interface Serial1/2
 description Connection to NewYork-M
 ip vrf forwarding 2
 ip address 172.16.1.5 255.255.255.252
!
router ospf 100
 log-adjacency-changes
 area 1 stub
 summary-address 172.16.0.0 255.255.255.0
 network 172.16.0.0 0.0.0.3 area 1
 network 172.16.255.1 0.0.0.0 area 1
!
router bgp 65535
 no synchronization
 bgp log-neighbor-changes
 neighbor 172.16.255.2 remote-as 65535
 neighbor 172.16.255.2 update-source Loopback0
 neighbor 172.16.255.2 next-hop-self
 no auto-summary
 !
 address-family vpnv4
 neighbor 172.16.255.2 activate
 neighbor 172.16.255.2 send-community both
 exit-address-family
 !
 address-family ipv4 vrf 2
 redistribute connected
 neighbor 172.16.1.6 remote-as 65001
 neighbor 172.16.1.6 activate
 no auto-summary
 no synchronization
 exit-address-family
 !
 address-family ipv4 vrf 1
 redistribute connected
 neighbor 172.16.1.2 remote-as 65000
 neighbor 172.16.1.2 activate
 no auto-summary
 no synchronization
 exit-address-family
 !
mpls ldp router-id Loopback0

Lots of config. We have our normal interface/IP and OSPF configs, notice “mpls ip” under S1/0, this turns on LDP between the PE and P routers. S1/1 and S1/2 have the “ip vrf forwarding” command, which specifies the VRF associated with that interface. We also have our VRF configuration. “RD” is route distinguisher, which is added to the routing updates so they are unique even if the same addressing is being used. The “route-target” command says which routers to bring into the VRF, as well as which routes to send out of the VRF.

Now we look at the mammoth BGP config. It looks normal up until the “address-family vpnv4″, this tells the router to send pass the VRF information to the neighbors we specify. Then we have two “address-family ipv4 vrf” commands, these are almost separate BGP instances. They are still under the main process, but they produce completely separate RIBs. The routes learned from these neighbors will not show up in the global routing table (by default). In the VRFs we are using the “redistribute connected” command to advertise our links. PE2′s configuration is basically the same:

hostname MPLS-PE2
!
ip vrf 1
 rd 100:110
 route-target export 100:1000
 route-target import 100:1000
!
ip vrf 2
 rd 100:120
 route-target export 100:2000
 route-target import 100:2000
!
interface Loopback0
 ip address 172.16.255.2 255.255.255.255
!
interface Serial1/0
 description Connection to MPLS-P
 ip address 172.16.0.6 255.255.255.252
 mpls ip
 serial restart-delay 0
!
interface Serial1/1
 description Connection to Paris-M
 ip vrf forwarding 1
 ip address 172.16.2.1 255.255.255.252
!
interface Serial1/2
 description Connection to Chicago-M
 ip vrf forwarding 2
 ip address 172.16.2.5 255.255.255.252
!
router ospf 100
 log-adjacency-changes
 area 2 stub
 summary-address 172.16.0.0 255.255.255.0
 network 172.16.0.4 0.0.0.3 area 2
 network 172.16.255.2 0.0.0.0 area 2
!
router bgp 65535
 no synchronization
 bgp log-neighbor-changes
 neighbor 172.16.255.1 remote-as 65535
 neighbor 172.16.255.1 update-source Loopback0
 neighbor 172.16.255.1 next-hop-self
 no auto-summary
 !
 address-family vpnv4
 neighbor 172.16.255.1 activate
 neighbor 172.16.255.1 send-community both
 exit-address-family
 !
 address-family ipv4 vrf 2
 redistribute connected
 neighbor 172.16.2.6 remote-as 65003
 neighbor 172.16.2.6 activate
 no auto-summary
 no synchronization
 exit-address-family
 !
 address-family ipv4 vrf 1
 redistribute connected
 neighbor 172.16.2.2 remote-as 65002
 neighbor 172.16.2.2 activate
 no auto-summary
 no synchronization
 exit-address-family
!
mpls ldp router-id Loopback0

Now some show commands:

MPLS-PE2#sh ip bgp all
For address family: VPNv4 Unicast
BGP table version is 54, local router ID is 172.16.255.2
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
              r RIB-failure, S Stale
Origin codes: i - IGP, e - EGP, ? - incomplete
 
   Network          Next Hop            Metric LocPrf Weight Path
Route Distinguisher: 100:110 (default for vrf 1)
*>i10.1.0.0/30      172.16.255.1             0    100      0 65000 i
* i10.1.1.0/30      172.16.255.1             0    100      0 65000 64512 65001 i
*>                  172.16.2.2                             0 65002 64513 65001 i
*> 10.2.1.0/30      172.16.2.2                             0 65002 i
*>i10.128.0.0/16    172.16.255.1             0    100      0 65000 64512 i
*                   172.16.2.2                             0 65002 64513 64512 i
*> 10.129.0.0/16    172.16.2.2                             0 65002 64513 i
*>i10.192.0.0/24    172.16.255.1             0    100      0 65000 i
* i10.192.1.0/24    172.16.255.1             0    100      0 65000 64512 65001 i
*>                  172.16.2.2                             0 65002 64513 65001 i
*> 10.192.2.0/24    172.16.2.2                             0 65002 i
*>i172.16.1.0/30    172.16.255.1             0    100      0 ?
*> 172.16.2.0/30    0.0.0.0                  0         32768 ?
*>i192.168.1.0      172.16.255.1             0    100      0 65000 i
*> 192.168.4.0      172.16.2.2               0             0 65002 i
   Network          Next Hop            Metric LocPrf Weight Path
*> 192.168.254.0/30 172.16.2.2                             0 65002 i
* i                 172.16.255.1             0    100      0 65000 i
Route Distinguisher: 100:120 (default for vrf 2)
*>i10.1.0.0/30      172.16.255.1             0    100      0 65001 64512 65000 i
*>i10.1.1.0/30      172.16.255.1             0    100      0 65001 i
*>i10.2.1.0/30      172.16.255.1             0    100      0 65001 64513 65002 i
*>i10.128.0.0/16    172.16.255.1             0    100      0 65001 64512 i
*>i10.129.0.0/16    172.16.255.1             0    100      0 65001 64513 i
*>i10.192.0.0/24    172.16.255.1             0    100      0 65001 64512 65000 i
*>i10.192.1.0/24    172.16.255.1             0    100      0 65001 i
*>i10.192.2.0/24    172.16.255.1             0    100      0 65001 64513 65002 i
*>i172.16.1.4/30    172.16.255.1             0    100      0 ?
*> 172.16.2.4/30    0.0.0.0                  0         32768 ?
*>i192.168.1.0      172.16.255.1             0    100      0 65001 i
*> 192.168.5.0      172.16.2.6               0             0 65003 i

Here we see two different VRFs, both with different routing information. Our config has worked. Let’s try a ping:

MPLS-PE2#ping vrf 1 172.16.1.1
 
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 8/21/44 ms

That’s all. It’s a lot of configuration, leave comments if anything needs a more thorough explanation. Part six will be coming soon, it may be the last of the series.

That’s it for this one, part six will be coming soon. Here are the files needed for the lab:
The Dynagen/GNS3 .net file
The IP Address Allocations
The Visio Diagram for the Lab
(You will need to modify the .net file to reflect your own IOS and path values)

Colby

Colby Glass has been in IT since 2002. He is currently a Systems Engineer (presales) with a Cisco Gold partner and holds the CCNP R/S, CCNP DC, CCDP, CCIP, JNCIA-ER.

More Posts