Hi There
I'm trying to do a lab about L3vpn inter AS option C on cisco CML, I'm using the topology below. This option consists of making a BGP-LU ipv4 adjacency between the PEs router and propagating the route-reflectors and PEs loop-backs between AS, and after that, making a VPNv4 adjacency between route-reflectors . I'm configuring one AS with Mpls-LDP a the other with segment routing.
First, I use IOS Xe on both PE and it work .... after I change the PE on the segment routing side for one XR, it did not work anymore, and i think I have the correct label distribution, but the XR is blocking the packets for some reason.
If I check the labels on the RR of the segmen-routing side, It will use the 16101-24004 labels to get on 5.5.5.5 the RR on the MPLS-LDP side.
hear you can see the packet capture , on RR to p1(ping) the MPLS stack is as it was expected 16101-24004
hear you can see the packet capture , on p1 to XR-PE
and finally the packet arrive to XR-PE with the expected label, but this no make any out-put on the packet capture, the packet its just drooped.
and the PE3 on the side mpls-ldp is waiting for the label 3016 as the XR-PE is expected to swap the label
if I do the same from MPLS-LDP side is the same history the lsp is break on XR-PE.
I can't see where is the fail, Can some one help me to find the problem?
here are the configurations.
XR_PE Segment routing side interface Loopback1 ipv4 address 130.130.130.130 255.255.255.255 ! interface MgmtEth0/RP0/CPU0/0 shutdown ! interface GigabitEthernet0/0/0/0 shutdown ! interface GigabitEthernet0/0/0/1 ipv4 address 10.11.101.101 255.255.255.0 ! interface GigabitEthernet0/0/0/2 shutdown ! interface GigabitEthernet0/0/0/3 ipv4 address 10.100.200.2 255.255.255.252 ! route-policy default pass end-policy ! router isis 1 is-type level-2-only net 49.0001.0000.0000.0101.00 address-family ipv4 unicast metric-style wide router-id Loopback1 segment-routing mpls ! interface Loopback1 address-family ipv4 unicast prefix-sid index 101 ! ! interface GigabitEthernet0/0/0/1 point-to-point address-family ipv4 unicast ! ! interface GigabitEthernet0/0/0/3 passive address-family ipv4 unicast ! ! ! router bgp 3000 bgp router-id 130.130.130.130 address-family ipv4 unicast allocate-label all ! neighbor 55.55.55.55 remote-as 3000 update-source Loopback1 address-family ipv4 labeled-unicast next-hop-self ! ! neighbor 10.100.200.1 remote-as 1000 update-source GigabitEthernet0/0/0/3 address-family ipv4 labeled-unicast next-hop-self route-policy default in route-policy default out ! ! ! segment-routing ! end
RR-55 SR SIDE hostname p55 ! ! ! ip cef login on-success log ipv6 unicast-routing ipv6 cef ! ! spanning-tree mode rapid-pvst ! ! interface Loopback1 ip address 55.55.55.55 255.255.255.255 ip router isis ipv6 address 2001:55:55:55::55/128 ipv6 router isis ! interface Ethernet0/0 ip address 10.11.55.55 255.255.255.0 ip router isis ipv6 address 2001:10:100:1155::55/64 ipv6 router isis isis network point-to-point isis adjacency-sid index 551 ! interface Ethernet0/1 ip address 10.22.55.55 255.255.255.0 ip router isis ipv6 address 2001:10:100:2255::55/64 ipv6 router isis isis network point-to-point ! interface Ethernet0/2 ip address 10.44.55.55 255.255.255.0 ip router isis ipv6 address 2001:10:100:4455::55/64 ipv6 router isis isis network point-to-point ! interface Ethernet0/3 ip address 10.33.55.55 255.255.255.0 ip router isis ipv6 address 2001:10:100:3355::55/64 ipv6 router isis isis network point-to-point isis adjacency-sid index 552 ! ! segment-routing mpls ! connected-prefix-sid-map address-family ipv4 55.55.55.55/32 index 55 range 1 exit-address-family ! ! router isis net 49.0001.0000.0000.0055.00 is-type level-2-only router-id Loopback1 metric-style wide log-adjacency-changes segment-routing mpls ! router bgp 3000 bgp router-id 55.55.55.55 bgp log-neighbor-changes no bgp default ipv4-unicast neighbor 5.5.5.5 remote-as 1000 neighbor 5.5.5.5 ebgp-multihop 10 neighbor 5.5.5.5 update-source Loopback1 neighbor 102.102.102.102 remote-as 3000 neighbor 102.102.102.102 update-source Loopback1 neighbor 130.130.130.130 remote-as 3000 neighbor 130.130.130.130 update-source Loopback1 ! address-family ipv4 network 55.55.55.55 mask 255.255.255.255 neighbor 102.102.102.102 activate neighbor 102.102.102.102 route-reflector-client neighbor 102.102.102.102 send-label neighbor 130.130.130.130 activate neighbor 130.130.130.130 route-reflector-client neighbor 130.130.130.130 send-label exit-address-family ! address-family vpnv4 neighbor 5.5.5.5 activate neighbor 5.5.5.5 send-community extended neighbor 102.102.102.102 activate neighbor 102.102.102.102 send-community extended neighbor 102.102.102.102 route-reflector-client neighbor 130.130.130.130 activate neighbor 130.130.130.130 send-community extended neighbor 130.130.130.130 route-reflector-client exit-address-family ! ip forward-protocol nd ! ! ip http server ip http secure-server ip ssh bulk-mode 131072 no logging btrace ip access-list standard 55 10 permit 5.5.5.5 route-map gw permit 10 match ip next-hop 55 set ip next-hop 130.130.130.130 ! ! ! ! control-plane ! ! ! line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 exec-timeout 0 0 login transport input ssh ! ! ! ! end
PE-3 mpls-ldp version 17.3 service timestamps debug datetime msec service timestamps log datetime msec service call-home platform qfp utilization monitor load 80 platform punt-keepalive disable-kernel-core platform console serial ! hostname PE3 ! boot-start-marker boot-end-marker ! ! vrf definition 1000:101 rd 1000:101 ! address-family ipv4 route-target export 1000:101 route-target import 1000:101 exit-address-family ! ! mpls label range 3000 3999 mpls traffic-eng tunnels multilink bundle-name authenticated ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! diagnostic bootup level minimal archive path bootflash: memory free low-watermark processor 71464 ! ! spanning-tree extend system-id ! ! redundancy ! bridge-domain 20 member BD-VIF 20 ! ! ! ! ! ! ! l2 vfi vpls1 manual vpn id 101 bridge-domain 15 neighbor 11.11.11.11 1133 encapsulation mpls ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback1 ip address 33.33.33.33 255.255.255.255 ip ospf 1 area 0 ! interface GigabitEthernet1 ip address 10.100.33.33 255.255.255.0 ip ospf network point-to-point negotiation auto no mop enabled no mop sysid ! interface GigabitEthernet2 ip address 10.100.43.33 255.255.255.0 ip ospf network point-to-point negotiation auto no mop enabled no mop sysid ! interface GigabitEthernet3 ip address 10.100.200.1 255.255.255.252 ip ospf network point-to-point ip ospf 1 area 0 negotiation auto mpls bgp forwarding no mop enabled no mop sysid ! interface GigabitEthernet4 no ip address negotiation auto no mop enabled no mop sysid service instance 10 ethernet description l2 vpn client 1 encapsulation dot1q 10 rewrite ingress tag pop 1 symmetric xconnect 11.11.11.11 1001 encapsulation mpls ! service instance 15 ethernet description manual vpls client 1 encapsulation dot1q 15 rewrite ingress tag pop 1 symmetric bridge-domain 15 ! service instance 20 ethernet description L3 vpn client 1 encapsulation dot1q 20 rewrite ingress tag pop 1 symmetric bridge-domain 20 ! ! interface GigabitEthernet5 no ip address shutdown negotiation auto no mop enabled no mop sysid ! interface GigabitEthernet6 no ip address shutdown negotiation auto no mop enabled no mop sysid ! interface GigabitEthernet7 no ip address shutdown negotiation auto no mop enabled no mop sysid ! interface GigabitEthernet8 no ip address shutdown negotiation auto no mop enabled no mop sysid ! interface BD-VIF20 vrf forwarding 1000:101 ip address 192.168.3.1 255.255.255.248 ip ospf network point-to-point ip ospf 1000 area 0 no mop enabled no mop sysid ! router ospf 1000 vrf 1000:101 router-id 192.168.3.1 area 0 sham-link 10.200.33.33 10.200.11.11 ! router ospf 1 router-id 33.33.33.33 network 10.100.0.0 0.0.0.0 area 0 network 10.100.0.0 0.0.255.255 area 0 mpls ldp sync mpls ldp autoconfig mpls traffic-eng router-id Loopback1 mpls traffic-eng area 0 ! router bgp 1000 bgp router-id interface Loopback1 bgp log-neighbor-changes no bgp default ipv4-unicast neighbor 5.5.5.5 remote-as 1000 neighbor 5.5.5.5 update-source Loopback1 neighbor 10.100.200.2 remote-as 3000 neighbor 10.100.200.2 update-source GigabitEthernet3 ! address-family ipv4 network 33.33.33.33 mask 255.255.255.255 neighbor 5.5.5.5 activate neighbor 5.5.5.5 next-hop-self neighbor 5.5.5.5 send-label neighbor 10.100.200.2 activate neighbor 10.100.200.2 next-hop-self neighbor 10.100.200.2 send-label exit-address-family ! address-family vpnv4 neighbor 5.5.5.5 activate neighbor 5.5.5.5 send-community both exit-address-family ! address-family ipv4 vrf 1000:101 redistribute connected redistribute ospf 1000 exit-address-family ! ip forward-protocol nd no ip http server ip http secure-server ! ! ! ip access-list standard 1 10 deny 10.200.11.11 20 deny 10.200.33.33 30 permit any ip access-list standard 2 10 permit 5.5.5.5 ! ! route-map shamlink-client1 permit 10 match ip address 1 ! route-map inter-as permit 10 match ip address 2 ! route-map inter-as deny 25 ! mpls ldp router-id Loopback1 force ! ! ! control-plane ! ! ! ! ! ! line con 0 exec-timeout 0 0 stopbits 1 line vty 0 exec-timeout 0 0 login transport input ssh line vty 1 exec-timeout 0 0 login length 0 transport input ssh line vty 2 4 exec-timeout 0 0 login transport input ssh ! call-home ! If contact email address in call-home is configured as sch-smart-licensing@cisco.com ! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications. contact-email-addr sch-smart-licensing@cisco.com profile "CiscoTAC-1" active destination transport-method http ! ! ! ! ! end
RR 5 - MPLS-LDP Building configuration... Current configuration : 5578 bytes ! ! Last configuration change at 01:24:11 UTC Sat Aug 23 2025 ! version 17.15 service timestamps debug datetime msec service timestamps log datetime msec ! hostname P5 ! boot-start-marker boot-end-marker ! ! no logging console no aaa new-model ! ! ! ! ! ip cef login on-success log ipv6 unicast-routing ipv6 cef ! ! ! ! ! ! ! ! mpls label range 500 599 mpls traffic-eng tunnels ! ! crypto pki trustpoint TP-self-signed-131184642 enrollment selfsigned subject-name cn=IOS-Self-Signed-Certificate-131184642 revocation-check none rsakeypair TP-self-signed-131184642 hash sha512 ! ! ! memory free low-watermark processor 80093 ! ! spanning-tree mode rapid-pvst ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! interface Loopback1 ip address 5.5.5.5 255.255.255.255 ip ospf 1 area 0 ! interface Tunnel11 ip unnumbered Loopback1 tunnel mode mpls traffic-eng tunnel destination 2.2.2.2 tunnel mpls traffic-eng path-option 1 explicit identifier 11 ! interface Ethernet0/0 ip address 10.100.15.5 255.255.255.0 ip ospf network point-to-point mpls traffic-eng tunnels ip rsvp bandwidth ! interface Ethernet0/1 ip address 10.100.25.5 255.255.255.0 ip ospf network point-to-point mpls traffic-eng tunnels mpls traffic-eng backup-path Tunnel11 ip rsvp bandwidth ! interface Ethernet0/2 ip address 10.100.35.5 255.255.255.0 ip ospf network point-to-point mpls traffic-eng tunnels ip rsvp bandwidth ! interface Ethernet0/3 ip address 10.100.45.5 255.255.255.0 ip ospf network point-to-point mpls traffic-eng tunnels ip rsvp bandwidth ! router ospf 1 network 10.100.0.0 0.0.255.255 area 0 mpls ldp sync mpls ldp autoconfig mpls traffic-eng router-id Loopback1 mpls traffic-eng area 0 ! router bgp 1000 bgp router-id interface Loopback1 bgp log-neighbor-changes bgp listen range 33.33.33.33/32 peer-group pe-group bgp listen range 22.22.22.22/32 peer-group pe-group bgp listen range 11.11.11.11/32 peer-group pe-group no bgp default ipv4-unicast neighbor pe-group peer-group neighbor pe-group remote-as 1000 neighbor pe-group update-source Loopback1 neighbor 55.55.55.55 remote-as 3000 neighbor 55.55.55.55 ebgp-multihop 10 neighbor 55.55.55.55 update-source Loopback1 ! address-family ipv4 network 5.5.5.5 mask 255.255.255.255 neighbor pe-group activate neighbor pe-group route-reflector-client neighbor pe-group send-label exit-address-family ! address-family vpnv4 neighbor pe-group activate neighbor pe-group send-community both neighbor pe-group route-reflector-client neighbor 55.55.55.55 activate neighbor 55.55.55.55 send-community extended exit-address-family ! address-family vpnv6 exit-address-family ! address-family l2vpn vpls neighbor pe-group activate neighbor pe-group send-community both neighbor pe-group route-reflector-client neighbor pe-group suppress-signaling-protocol ldp exit-address-family ! ip forward-protocol nd ! ! ip http server ip http secure-server ip ssh bulk-mode 131072 ! ip explicit-path identifier 11 enable index 1 next-address 1.1.1.1 index 2 next-address 2.2.2.2 no logging btrace ip access-list standard 55 10 permit 55.55.55.55 ip access-list standard 1300 10 permit 130.130.130.130 20 permit 102.102.102.102 30 deny any route-map gw permit 10 match ip next-hop 55 set ip next-hop 33.33.33.33 ! route-map ext-bgp permit 10 match ip address 1300 ! mpls ldp router-id Loopback1 ! ! ! control-plane ! ! ! line con 0 exec-timeout 0 0 logging synchronous line aux 0 line vty 0 4 exec-timeout 0 0 login transport input ssh ! ! ! ! end
1 Accepted Solution
Accepted Solutions
Thanks @Harold Ritter for the answer.
I added the static route and now I can get traffic between PE3 and XR-PE, but the lsp is still broken toward inside the AS 3000
here a packte capture on PE3 XR-PE link (RR-AS3000 pingin to RR as 1000).
Hi @Harold Ritter , thanks for the answers .. has been helpfully.
yes, the log about the route 55.55.55.55 was there.
RP/0/RP0/CPU0:Aug 23 05:56:25.900 UTC: rib_mgr[1256]: %ROUTING-RIB-3-LABEL_ERR_ADD : Add local-label 24002 (2) for table 0xe0000000, prefix 55.55.55.55/128, by proto bgp client 54 bgp node0_RP0_CPU0 - existing label 16055 added by proto-id 6 client 49 first I added the fallowing configuration to the Xr-Pe
route-policy SID($SID)
set label-index $SID
end-policy
!
address-family ipv4 unicast
network 55.55.55.55/32 route-policy SID(55)
after restart BGP process the log error appear again so I delete the prefix-sid configuration, and whala! the RR make the VPNV4 adjacency and of course PE-e2 get the routes of VRF 1000:101, but I can not ping from tha VRF on PE-e2 to the vrf on Pe3 or Pe1.
I fallows the label from PE-e2.
the three label are out as is expected form PE-e2.
link(Pe3 - PEXR) the information get where is expected and the remote vrf respond but the packet are dropped on PE-XR routers
the packet are coming with 24004 that output unlabelled.
I try some thing to fix it, i use the command next-host-unchaged on RR55 and advertised the PE-e2 loopback like the loopback of RR55 but when eliminate the prexi-id on PE-e2 the reachability to RR55 is lost. also use the comas segment-routing mpls on XE router but that does not change anything
some thing more is need to synchronized the labels?
Can you please put the prefix SID configuration I suggested back in place, restart the BGP process and then provide a "show mpls forwarding" from PE3 and XR-PE? yes!!!!
logs after reset
RP/0/RP0/CPU0:ios#process restart bgp
Sun Aug 24 04:14:35.429 UTC
RP/0/RP0/CPU0:Aug 24 04:13:02.784 UTC: bgp[1090]: %ROUTING-BGP-3-RIB_FAIL : [27299] : Failed to Redist since prefix sid is out of SRGB inside calculate origin for TBL:default (1/1) while calling the RIB instance 0: Success
RP/0/RP0/CPU0:Aug 24 04:14:35.466 UTC: sysmgr_control[68661]: %OS-SYSMGR-4-PROC_RESTART_NAME : User cisco (con0_RP0_CPU0) requested a restart of process bgp at 0/RP0/CPU0
RP/0/RP0/CPU0:Aug 24 04:14:37.547 UTC: bgp[1090]: %ROUTING-BGP-3-RIB_FAIL : [11347] : Failed to Redist since prefix sid is out of SRGB inside calculate origin for TBL:default (1/1) while calling the RIB instance 0: Success
RP/0/RP0/CPU0:Aug 24 04:14:37.678 UTC: bgp[1090]: %ROUTING-BGP-5-ASYNC_IPC_STATUS : default, process instance 1:(A)inst-id 0, Connection Establised
RP/0/RP0/CPU0:Aug 24 04:14:38.472 UTC: bgp[1090]: %ROUTING-BGP-5-ASYNC_IPC_STATUS : default:(A)inst-id 0, Initial Config Done
RP/0/RP0/CPU0:Aug 24 04:14:41.155 UTC: bgp[1090]: %ROUTING-BGP-5-ADJCHANGE : neighbor 10.100.200.1 Up (VRF: default) (AS: 1000)
RP/0/RP0/CPU0:Aug 24 04:14:41.159 UTC: bgp[1090]: %ROUTING-BGP-5-NSR_STATE_CHANGE : Changed state to Not NSR-Ready
RP/0/RP0/CPU0:Aug 24 04:14:42.186 UTC: bgp[1090]: %ROUTING-BGP-5-ADJCHANGE : neighbor 55.55.55.55 Up (VRF: default) (AS: 3000)
RP/0/RP0/CPU0:Aug 24 04:14:42.220 UTC: rib_mgr[1256]: %ROUTING-RIB-3-LABEL_ERR_ADD : Add local-label 24004 (2) for table 0xe0000000, prefix 55.55.55.55/128, by proto bgp client 52 bgp node0_RP0_CPU0 - existing label 16055 added by proto-id 7 client 54 show mpls forwarding
here
segment-routing mpls (I had to active SR before be alower to use on bgp)
router bgp 1000
address-family ipv4
segment-routing mpls
Woo now it works !! The label 24004 now have a label for transport on the side of SR
also the the communication end to end on VRF work
@Harold Ritter thank a lot for your time , I was reading the documentation of SR on BGP in IOs XR, but I by pass para that explain the global mus be explicit configure.
Thanks a lot
