MPLS L3VPN connectivity issue between CEs

[bassomarco1998]

Hi all,

I configured the following lab to understand how the L3VPN service works. I set up everything except MPLS within AS 2. In the CE routers, I configured 2 loopbacks (R1: 1.1.1.1/32 and R4: 4.4.4.4/32) and advertised them via BGP. I then created a VRF "VRFA" on both routers and assigned the PE interfaces connected to the CEs to that VRF.

However, if I try to ping from loopback 1.1.1.1 to loopback 4.4.4.4, it doesn't work. This is because the VRF's routing table doesn't contain the subnet of the R2-R3 connection. How can this problem be resolved? Is it mandatory to use MPLS for this case?

Here ere are the R2's RIB (global and VRF).

R2#sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      192.168.0.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.0.0/24 is directly connected, Ethernet0/1
L        192.168.0.2/32 is directly connected, Ethernet0/1

R2#sh ip route vrf VRFA

Routing Table: VRFA
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      1.0.0.0/32 is subnetted, 1 subnets
B        1.1.1.1 [20/0] via 10.0.0.1, 00:21:01
      2.0.0.0/32 is subnetted, 1 subnets
C        2.2.2.2 is directly connected, Loopback1
      3.0.0.0/32 is subnetted, 1 subnets
B        3.3.3.3 [200/0] via 192.168.0.3, 00:21:01
      4.0.0.0/32 is subnetted, 1 subnets
B        4.4.4.4 [200/0] via 192.168.0.3, 00:13:15
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/24 is directly connected, Ethernet0/0
L        10.0.0.2/32 is directly connected, Ethernet0/0

 Thanks!

[MHM Cisco World]

All run same vrf ? Meaning R2 and R3 bgp run ipv4 vrf x or global?

[bassomarco1998]

Both R2 and R3 execute a VRF called VRFA to which the interfaces that connect to the CEs are assigned.

[MHM Cisco World]

you dont need VPNv4 and MPLS 
if you config R2 and R3 inbetween iBGP address family  IPv4 VRFA 
NOTE:- remember add next-hop-self to ibgp 

as rule VPNv4 need ONLY when there are many VRF connect to PE 
here you have one ONE so extended iBGP VRF between two PE and it will work.

[bassomarco1998]

Yes, thanks for your help, but my goal is to basically use MPLS.
However, I can't understand how R2 manages to get R1 and R4 to communicate via MPLS even if it doesn't have a valid route in the VRFA. 

192.168.0.3 is not present in the VRFA.

R2#sh ip rou vrf VRFA 4.4.4.4

Routing Table: VRFA
Routing entry for 4.4.4.4/32
  Known via "bgp 2", distance 200, metric 0
  Tag 3, type internal
  Last update from 192.168.0.3 00:04:54 ago
  Routing Descriptor Blocks:
  * 192.168.0.3 (default), from 192.168.0.3, 00:04:54 ago
      Route metric is 0, traffic share count is 1
      AS Hops 1
      Route tag 3
      MPLS label: 17
      MPLS Flags: MPLS Required
R2#
R2#sh ip rout vrf VRFA

Routing Table: VRFA
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      1.0.0.0/32 is subnetted, 1 subnets
B        1.1.1.1 [20/0] via 10.0.0.1, 00:13:11
      2.0.0.0/32 is subnetted, 1 subnets
C        2.2.2.2 is directly connected, Loopback1
      3.0.0.0/32 is subnetted, 1 subnets
B        3.3.3.3 [200/0] via 192.168.0.3, 00:13:12
      4.0.0.0/32 is subnetted, 1 subnets
B        4.4.4.4 [200/0] via 192.168.0.3, 00:06:27
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/24 is directly connected, Ethernet0/0
L        10.0.0.2/32 is directly connected, Ethernet0/0

[Harold Ritter]

Hi @bassomarco1998 ,

According to your previous output, you definitely had a route for 4.4.4.4 on R2. Make sure the BGP vpnv4 session between R2 and R3 is up.

R2#sh ip route vrf VRFA

Routing Table: VRFA
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      1.0.0.0/32 is subnetted, 1 subnets
B        1.1.1.1 [20/0] via 10.0.0.1, 00:21:01
      2.0.0.0/32 is subnetted, 1 subnets
C        2.2.2.2 is directly connected, Loopback1
      3.0.0.0/32 is subnetted, 1 subnets
B        3.3.3.3 [200/0] via 192.168.0.3, 00:21:01
      4.0.0.0/32 is subnetted, 1 subnets
B        4.4.4.4 [200/0] via 192.168.0.3, 00:13:15
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/24 is directly connected, Ethernet0/0
L        10.0.0.2/32 is directly connected, Ethernet0/0

Regards,

[bassomarco1998]

Ok, so you said that R2 should use the Global RIB to forward packets to VPNv4 networks.

The session between R2-R3 is established:

R2#sh bgp vpnv4 uni all s
BGP router identifier 2.2.2.2, local AS number 2
BGP table version is 7, main routing table version 7
6 network entries using 936 bytes of memory
6 path entries using 504 bytes of memory
5/4 BGP path/bestpath attribute entries using 840 bytes of memory
2 BGP AS-PATH entries using 48 bytes of memory
2 BGP extended community entries using 48 bytes of memory
0 BGP route-map cache entries using 0 bytes of memory
0 BGP filter-list cache entries using 0 bytes of memory
BGP using 2376 total bytes of memory
BGP activity 6/0 prefixes, 6/0 paths, scan interval 60 secs

Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd
10.0.0.1        4            1      24      25        7    0    0 00:18:55        1
192.168.0.3     4            2      24      24        7    0    0 00:18:57        2

The network 4.4.4.4 is present inside the VRFA but not in the Gloabl RIB:

R2#sh ip rou
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      192.168.0.0/24 is variably subnetted, 2 subnets, 2 masks
C        192.168.0.0/24 is directly connected, Ethernet0/1
L        192.168.0.2/32 is directly connected, Ethernet0/1
R2#sh ip rou vrf VRFA

Routing Table: VRFA
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
       a - application route
       + - replicated route, % - next hop override, p - overrides from PfR

Gateway of last resort is not set

      1.0.0.0/32 is subnetted, 1 subnets
B        1.1.1.1 [20/0] via 10.0.0.1, 00:21:40
      2.0.0.0/32 is subnetted, 1 subnets
C        2.2.2.2 is directly connected, Loopback1
      3.0.0.0/32 is subnetted, 1 subnets
B        3.3.3.3 [200/0] via 192.168.0.3, 00:21:41
      4.0.0.0/32 is subnetted, 1 subnets
B        4.4.4.4 [200/0] via 192.168.0.3, 00:14:56
      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        10.0.0.0/24 is directly connected, Ethernet0/0
L        10.0.0.2/32 is directly connected, Ethernet0/0

When i try to ping from R1 to R4 it doesn't work:

R1#ping 4.4.4.4 so lo1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.4.4.4, timeout is 2 seconds:
Packet sent with a source address of 1.1.1.1
.....
Success rate is 0 percent (0/5)

[Harold Ritter]

Hi @bassomarco1998 ,

Can you verify that MPLS is enabled between R2 and R3?

show mpls ldp neighbor

Regards,

[bassomarco1998]

I didn't enabled MPLS between R2 and R3. So is that the reason why i have no reachability between R1 and R4?

In the previous post you said that R2 would use its Global RIB to resolve the next hop (192.168.0.3) for the network 4.4.4.4 installed into VRFA ("The next hop resolution for VPNv4 routes take place in the global routing table and the routes are then imported in the VRF").

Based on what you say, shouldn't R2 still be able to resolve the next hop using the Global RIB?

[Harold Ritter]

Hi @bassomarco1998 

Yes, the next hop is resolved via the global, but packet forwarding assumes that MPLS is enabled between R2 and R3. The updates received on either side via VPNv4 include a label. Without MPLS being enabled on the link between R2 and R3, this will not work as R2 is not able to send labelled traffic to R3 and vice versa.

Regards,

[bassomarco1998]

Ok, so just to clarify:
R3 advertise the network 4.4.4.4/32 to R2, attaching to it also the service label (or VPN label, which in this case is 17).

R2#sh bgp vpnv4 uni vrf VRFA 4.4.4.4
BGP routing table entry for 100:100:4.4.4.4/32, version 7
Paths: (1 available, best #1, table VRFA)
  Advertised to update-groups:
     2
  Refresh Epoch 1
  3, imported path from 200:200:4.4.4.4/32 (global)
    192.168.0.3 (via default) from 192.168.0.3 (3.3.3.3)
      Origin IGP, metric 0, localpref 100, valid, internal, best
      Extended Community: RT:0:1
      mpls labels in/out nolabel/17
      rx pathid: 0, tx pathid: 0x0

R2 tries to send the ICMP packet to R4. It is able to resolve the next hop via the Global RIB but not beeing configured with MPLS, it is not able to send the packet with the service label.

Is my reasoning corect?

[Harold Ritter]

Hi @bassomarco1998 ,

Your reasoning is indeed correct. 

Regards,

[MHM Cisco World]

OK, your Q is confuse but I will answer you 
first VPNv4 mandatory need MPLS.
second there are two table MPLS forwarding and RIB VRF
which one the PE will start to lookup ?

[bassomarco1998]

> first VPNv4 mandatory need MPLS.

Ok, i was trying to not use MPLS. I thought it would be possible to use VPNv4 address family without MPLS.

> which one the PE will start to lookup ?

show commands refers to R2

[MHM Cisco World]

PE to forward traffic do two lookup in two table 
MPLS table and RIB VRF table 
MPLS table come first and traffic immediatly labeld and forward to destiation using label not IP source/destiantion 
that why we dont care about next-hop of prefix in RIB VRF of PE BUT it must reach via MPLS table.