IPv6 Deployment / Dual-Satck

[Ahmed Erfan Mehdi]

  Hello Friends,        

I hope you are doing great.

I am working on IPv6 deployment.

i am trying to configure my PE as a dual-stack toward CE, i have already establish EBGPv4 session with my customer.both PE end CE are dual-stack

I have set ipv4 and ipv6 address on the interface( directly connected to CE ).

i enabled ipv6 unicast-routing

i enabled  mls ipv6 vrf

I enabled vrf and upgrade to vrf-cli

i have tried with 6PE and 6VPE but i was failed.

So, here are my questions:

1- if PE and CE are dual-stack, so  i have to use 6VPE, right ? at CE side what is the required configuration ?

2- IOS version is 12.2(33) SRD3 - 7606- SUP720 , is it supported for Dual-Stack ?

3- at PE toward CE, shall i configure address-family ipv6 or vpn ipv6 or ipv6 vrf  ? at CE only ipv6 ?

4- my Topology is like this CE-------PE-----IGW .....Would you please guide me in that ..

=====================================

At PE:

===============================

vrf definition IPv6

rd 6500:1

!

address-family ipv4

route-target export 6500:1

route-target import 6500:1

exit-address-family

!

address-family ipv6

route-target export 6500:1

route-target import 6500:1

exit-address-family

=========================

interface GigabitEthernet1/18

description IPv6-test

vrf forwarding IPv6

ip address 10.10.10.1 255.255.255.0

ipv6 address 2A03:4700::FFFF:0:1/64

==================================

router bgp 6501

neighbor 10.10.10.2 remote-as 6500

neighbor 10.10.10.2 update-source GigabitEthernet1/18

neighbor 2A03:4700::FFFF:0:2 remote-as 6500

neighbor 2A03:4700::FFFF:0:2 update-source GigabitEthernet1/18

address-family ipv4 vrf IPv6

  no synchronization

  neighbor 10.10.10.2 remote-as 6500

  neighbor 10.10.10.2 activate

exit-address-family

!

address-family ipv6 vrf IPv6

  no synchronization

  neighbor 2A03:4700::FFFF:0:2 remote-as 6500

  neighbor 2A03:4700::FFFF:0:2 activate

exit-address-family

==============

Thanks

[Harold Ritter]

Hi Ahmed,

1- If you have enabled ipv6 in the VRF context on the CE, that would be 6VPE. There is not special configuration on the CE other than enabling ipv6.

2- SRD3 does support DS and 6VPE.

3- On the PE towards the CE, you need "address-family ipv6 vrf" just like you would need "address-family ipv4 vrf" for v4. For 6VPE, you need "address-family vpnv6" to propagate the ipv6 routes between the PEs just as you need "address-family vpnv4" to propagate ipv4 routes.

4- In the context of 6VPE, the IGW would act as any other PE. If all you want is provide ipv6 Internet access via the MPLS network, maybe 6PE would be good enough for you.

BTW, You do not need the following commands in BGP global mode. They only need to be in the "address-family ipvx vrf"

neighbor 10.10.10.2 remote-as 6500

neighbor 10.10.10.2 update-source GigabitEthernet1/18

neighbor 2A03:4700::FFFF:0:2 remote-as 6500

neighbor 2A03:4700::FFFF:0:2 update-source GigabitEthernet1/18

Regards

[Ahmed Erfan Mehdi]

Dear Harold,

Thanks for your reply.

1- CE is directly connected to PE, BGPv4 is already exist between CE-PE.

at CE, just add address-family ipv6 toward PE ?

2- What is IOS version support for DS ?  at IGW i have IOS-XR 3.9.2 ?

3- If i apply 6PE, when i did sh ip bgp summary, neighbor IPv6 address but BGPv4 !!!

i will use address-family ipv6 vrf for IPv6 routes but for address-family ipv4 vrf only for CE routes or toward other PEs.

4- It is easy to apply 6PE, PE1 is BGPv4 with IGW, CE is connected to PE1, so 6PE will work ?

Thanks for your patience to read my questions.

I am waiting tour reply.

Thanks

[Harold Ritter]

Hi Ahmed,

1- That is correct.

2- 3.9.2 is fine.

3- "sh ip bgp summ" is the old command command format and applies to v4. You need to use :sh bgp ipv6 uni summ" for v6. For 6vpe, you need to configure "address-family ipv6 vrf" towards the CE and "address-family vpnv6" towards the other PE (or route-reflector in case you have one).

4- 6pe should work. 6pe requires that PE1 be dual-stack. The difference between 6pe is 6vpe is you do not use VRF for 6vpe. Given that PE1 is directly connected to the IGW, I would even question whether you really need 6pe. The easiest thing would be to go native ipv6 between PE1 and IGW. Any specific reason for you to use 6pe?

Regards

[Ahmed Erfan Mehdi]

Thanks Harold again for you reply.

1- Check out BGP at CE:

router bgp 6500

bgp router-id 11.10.10.10

bgp log-neighbor-changes

neighbor 10.10.10.1 remote-as 6501

neighbor 10.10.10.1 update-source GigabitEthernet1/18

neighbor 2A03:47C0:0:2::1 remote-as 6501

neighbor 2A03:47C0:0:2::1 update-source GigabitEthernet1/18

!

address-family ipv4

  no synchronization

  neighbor 10.10.10.1 activate

  neighbor 2A03:47C0:0:2::1 activate

  no auto-summary

exit-address-family

!

address-family ipv6

  no synchronization

  network 2A03:47C0:0:3::/64

  neighbor 2A03:47C0:0:2::1 activate

exit-address-family

At PE :

router bgp 6501

neighbor 10.10.10.2 remote-as 6500

neighbor 10.10.10.2 update-source GigabitEthernet1/18

neighbor 2A03:47C0:0:2::2 remote-as 6500

neighbor 2A03:47C0:0:2::2 update-source GigabitEthernet1/18

address-family ipv4

neighbor 10.10.10.2 activate

no neighbor 2A03:47C0:0:2::2 activate ------ It come automatically and i remove it by no command but stil exsit

exit-address-family

address-family ipv6

  no synchronization

  network 2A03:47C0:0:1::/64

  neighbor 2A03:47C0:0:2::2 activate

exit-address-family

PE# sh bgp ipv6 unicast summary === why it is still BGPv4

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd

2A03:47C0:0:2::2

                4  6500       0       0        0    0    0 never    Idle

#ping 2A03:47C0:0:2::2                

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 2A03:47C0:0:2::2, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 0/0/0 ms

I dont know what i am missing

PE:Version 12.2(33)SRD3

CE:Version 12.2(33)SRD4

at CE:

#sh ip bgp summary

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd

10.10.10.1      4 6501   73667   73170  2246902    0    0 00:20:35   447104

2A03:47C0:0:2::1

                4 6501       0       0        0    0    0 never    Idle

2- Which IOS should i use?

3- PE---IGW ( iBGPv4 ).... address familly IPv4 .

on existing BGP session i would like to add IPv6 address family for IPv6 routes.

but i have VPNv4 with other PEs. MY PE is Route Reflector.

4- I cant go with native ipv6, I have IPv4/ MPLS backbone.

right now i have CE with dual-stack will be connected to this PE only.

5- Regarding to BGP filter , it will be same as BGPv4 ?

Thanks for your help.

Regards,

Ahmed

[Harold Ritter]

Hi Ahmed,

1- You need to remove "neighbor 2A03:47C0:0:2::1 activate" from under address-family ipv4 on the CE. Otherwise the session will not be negotiated properly. You can also use "no bgp default ipv4-unicast" under bgp global mode so that ipv4 is not activated by default on ipv6 session.

I am not sure why you say that "sh bgp ipv6 unicast summary" is still bgpv4. The V = 4 you see in the output is for BGP version 4 not ip version 4.

One more thing, update-source is not really required for a directly connected session.

2- You IOS versions are fine. If you fix the above, the session should come up.

3- If you already use vpnv4 for ipv4, it makes sense to go with vpnv6 (6vpe) for ipv6 then.

4- Running mpls for v4 does not necessarly mean that you could not run native ipv6 in your core. But it also fine to run ipv6 over mpls. This is a design decision. I have customers deploying with either one of these two approaches.

5- The way to apply filters is the same as with ipv4.

Regards

[Ahmed Erfan Mehdi]

Hello Harold,

Thanks for sharing info.

It is really super useful.

1- PE-CE is up ( at PE i applied 6PE), if i will go with 6VPE, my IOS is not Suport right ? and at IGW is support ?

2- Do u suggest any recommanded doc for IPv6 deployment ? configuration guide in operational way ?

3- At IGW will act as 6PE ( dual-stack ) with UP Link ?

Regards,

Ahmed

[Harold Ritter]

Hi Ahmed,

1- SRD3 and 3.9.2 are fine for either 6pe or 6vpe. Why do you think your IOS is not supported?

2- Here are the 6pe and 6vpe deployment guide:

6pe:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_data_sheet09186a008052edd3.html

6vpe:

http://www.cisco.com/en/US/docs/net_mgmt/ip_solution_center/5.1/mpls_vpn/user/guide/ipv6.html

3- That is correct. You iGW will act as either a 6pe or 6vpe. The upstream router will act as a ce.

Regards

[Ahmed Erfan Mehdi]

Thanks Harold,

1- that is good

2- thanks for sharing doc

3-At CE:

Router#sh bgp ipv6 unicast summary

B

Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd

2A03:47C0:0:2::1

                4 6501      32      32        1    0    0 00:27:07        0

Router#sh bgp ipv6 unicast neighbors 2A03:47C0:0:2::1 advertised-routes

Total number of prefixes 0

router bgp 6500

bgp router-id 11.10.10.10

no bgp default ipv4-unicast

bgp log-neighbor-changes

neighbor 10.10.10.1 remote-as 6501

neighbor 2A03:47C0:0:2::1 remote-as 6501

!

address-family ipv4

  no synchronization

  network 11.11.11.0 mask 255.255.255.0

  neighbor 10.10.10.1 activate

  no auto-summary

exit-address-family

!

address-family ipv6

  no synchronization

  network 2A03:47C0:0:3::/64

  neighbor 2A03:47C0:0:2::1 activate

exit-address-family

Why it is not advertising any prefix ?

Regards,

Ahmed

[Harold Ritter]

Hi Ahmed,

The reason the CE does not advertise any prefix is probably that prefix 2A03:47C0:0:3::/64 is not present in the RIB. The network statement only originates prefixes if they are present in the RIB.

Regards

[Ahmed Erfan Mehdi]

Hello Harold,

Thanks for your help.

I am still working on 6VPE in my network.

Regarding to RR, both vpn-ipv4 and vpn-ipv6 should be present right ?

to make my prefix  present in RIB, it should be assigned ?

Regards,

Ahmed

[Harold Ritter]

Hi Ahmed,

Yes, vpnv4 and vpnv6 address family should be activated on session to the RR. I am not sure about your second question. Could you please elaborate?

Regards

[Ahmed Erfan Mehdi]

Hello Harold,

I am stil working on it !!!!

Before i apply it on live network, i prepare a draft config for 6PE as below:

Our network design is as below:

PEs --- MP-BGP ---RR ( address-family vpnv4 )

RR------ BGP-----IGW  ( address-family ipv4  )

what i understand is :

- Add address family IPv6 at PEs :

address-family ipv6

  neighbor x.x.x.x activate    ( x.x.x.x is IPv4 address of RR )

  neighbor x.x.x.x send-community both

  exit-address-family

- Add address family IPv6 at RR

address-family ipv6

  neighbor y.y.y.y send-community both (y.y.y.y  is IPv4 address of PE )

  neighbor y.y.y.y route-reflector-client

  neighbor y.y.y.y.y activate

- Add  address-family vpnv6 ( RR-----IGW )

This is the plan , i dont know if i am missing something.

I have Full BGP table IPv4+ IPv6 from my UP LINKS , in order to deploy IPv6 so i need MP-BGP  ( RR--- IGW ).

We can say MP-BGP ( vpnv4 ) will carry IPv6 packets as a label across IPv4 MPLS Backone.

Thanks in advance for sharing info.

Regards,

Ahmed

[Harold Ritter]

Hi Ahmed,

You will need to configure neighbor x.x.x.x send-label on the PE and the RR for 6PE to work. It is not vpnv4 that is used in this case. It is simply labeled ipv6.

Regards

[Ahmed Erfan Mehdi]

Hello Harold,

it is clear to add send-label at PEs & RR.

Now i am thinking about IGW, if we consider it as a PE so we have to enable MP-BGP ?

RR is directly connected to IGW, i am thinking to establish a new link for native IPv6 ?

So at RR has two links connected to IGW, one of them is address family ipv4 and other IPv6 address ?

What do u think ?

Regards,

Ahmed