Extend your MPLS Core to CPE

[Jerems]

Hi dear community,

As a SP, would you extend your MPLS network to CPE ? Why or Why not ?

Thanks in advance for your kind comments,

Jerems

[MHM Cisco World]

if CE have multi VRF, then PE must config mutli VRF for each VRF in CE, instead you can only extended MPLS to CE and CE will config with multi VRF and PE will config with global or only one VRF.  

[balaji.bandi]

Its all depends on use case - is the CPE owned by provider ?

Most use case i follow ispace - they done some extensive work on SP and Carrier environment :

https://blog.ipspace.net/2013/01/extending-mplsvpn-to-customer-sites.html

[Jerems]

Hi BB,

I read this article this morning and to be honest it wasn't able to convince me. By the way, at the moment the cpe is owned by the SP, it peers with the route-reflectors and only hosts the customer dedicated vrf, meaning that it is not mutualized across multiple customers (which is obvious). The PE has only GRT and a mgmt VRF.

Regards,

Jerems

[MHM Cisco World]

Did you run MPLS lab before, 
if yes then try following 
Case1 
CE-VRF"red"-PE
Case2
VRF1/VRF2/VRF3-CE-PE <<- here how you will config PE that connect to CE that have multi VRF ??
your lab is answer for your Q.

[Jerems]

If so i would imagine that as aoon as you extend the MPLS core onto a device which is located at the customer premices you would :

• Make sure that nobody else than the SP can access this router.
• You make sure that the router supports the presence of all th IGP routes on which relies MPLS to work properly (possible scalability/performance issues).
• Meaning that the CE - PE link falls into the PE GRT
• Let me know if you see some more possible concerns

Best Regards,

[MHM Cisco World]

your point is correct, special the security, 
CE-PE run LDP and routing, the data traffic must path labeled with MPLS, 
but sure LDP and routing must be secure. 
I will update you about secure config between CE-PE for extended MPLS case. 
thanks  

[smailmilak · Accepted solution]

Hi, 

the CPE should not have the full IGP RT because of scalability reasons. You have multiple options for that.

1. OSPF Area or ISIS L1 on the CPE so that the CPE gets the def. route only and you leak the /32 only to the CPE.

2. Another IGP between the PE and CPE, no redistribution of the Core IGP and PE-CPE IGP. Use BGP LU for label distribution and end to end LSP.

[balaji.bandi]

Sure if it the Owns by SP, there is no reason I see holding anything and CPE can handle all requirements. 

even in some use cases, SP needs to install in other co-location. so that is possible as you mentioned with additional notes in your recent reply.