COMMAND "no mpls ldp advertise-label for acl to acl" NOT WORKING

[JUANNN]

Hello,

I am doing a LAB with this topology for my network studies, using hardware CISCO 8200 1N 4T

CE1 can communicate with CE2 thanks to basic MPLS configuration on all provider-side interfaces of the routers (AS10000), and vice versa. CE2 and CE3 can communicate too. CE1 and CE3 can't because I don't want to and by default they can't because iBGP split horizon.

So, I am trying to apply LDP Outbound filtering in MPLS, specifically in P router (P2). I have the label binding for address 2.2.2.2/32 which is being advertised to PE3, and the label binding for address 4.4.4.4/32 which is being advertised to P1, among other advertisements.

However, I don't want the label binding for address 2.2.2.2/32 being advertised by P2 to PE3, as is useless because CE3 doesn't communicate with CE1 and the purpose of the lab is to clear as much as possible the LIB and LFIB "useless" entries on all routers. Same for the label binding for address 4.4.4.4/32 being advertised by P2 to P1. I am not using Local-Label Allocation filtering for this addresses on P2, because the advertisement of the label binding for address 2.2.2.2/32 is needed by PE2 and the label binding for address 4.4.4.4/32 is needed by PE2 as well.

So, I created 4 access-lists with the two addresses 

access-list 10 pemit 2.2.2.2 0.0.0.0

access-list 20 permit 4.4.4.4 0.0.0.0

access-list 30 permit 192.168.1.5 0.0.0.0

access-list 40 permit 192.168.1.14 0.0.0.0

and

no mpls ldp advertise-labels for 10 to 40

no mpls ldp advertise-labels for 20 to 30

and the response I get is

%failed to find acl pair

I have tried with prefix-lists, and same problem. But if I enter the command like no mpls ldp advertise-labels for 20 to it says

%Incomplete Command

so I am assuming that the command is supported with both for and to statements.

Anyone knows what's going on, please? Thanks in advance

[Giuseppe Larosa · Accepted solution]

Hello @JUANNN ,

the default configuration is :

mpls ldp advertise-labels

you are trying to remove a command that does not exist in the configuration. As a result of this the command is not accepted.

the normal way to apply MPLS LDP label fltering is the following:

a) negate the default command the one without any ACLs

no mpls ldp advertise-labels

b) add the command with the ACLs what is permitted in the ACL inovked in the for is what receives a label binding

mpls ldp advertise-labels for #ACL

in your case you may need to use multiple lines with for and to to create the desired behaviour .

The logic is what is permiiited in the for ACL will be label bound towards the peers speciified by the to ACL.

Final note: to be verified if for the to ACL you have to refer to IP addresses of the neighbors (physical interfaces addresses) or you have to refer to their LDP Router IDs ( their loopback addresses the ones with which the LDP TCP sessions on port 646 are built).

My guess is I would use LDP RIDs in the to ACL

Hope to help

Giuseppe

[JUANNN]

Thanks very much for the quick response, Giuseppe.

I will try it on the gear tomorrow. I also had the doubt if to put the LSRID or the interface IP address of next hop in the ACL used for to, so I will let you know which one it is when I get it done. Thanks again,

Juan

[Giuseppe Larosa]

Hello @JUANNN ,

nice to hear it worked to be honest in production network I had only used the for ACL option without the to.

It is important to save on MPLS label space because there are only 1,000,000 labels (20 bits ) roughly so usually the acl used describes the loopback addresses block to have MPLS labels binding only for them

Hope to help

Giuseppe

[JUANNN]

Hello Giuseppe,

It worked! Thanks a lot, the command works with for and to at the same time, using ACLs. The to address has to be the LSRID, confirmed. It doesn't work with the next-hop address. 

[MHM Cisco World]

Mpls ldp adv command use only ldp ID, I check this in lab. 

You want to reduce the label start with this 

1-use mpls label range as @Giuseppe Larosa suggested

2-use allocate host <PE LO>

Only PE LO label need in network other not mandatory 

3- use mpls ldp adv acl for/to

This will reduce your label to min

MHM

[MHM Cisco World]

MHM