How does Cisco Egress PE do VPN label lookup against VRF?

[Mustafa Nassef]

Hello everyone,

I need a very specific answer about how egress PE processes the VPN label and get the correct VRF so afterwards it will do another IP lookup for the destination IP address.

Assuming Per-VRF VPN label allocation.

Which table or which decoding method the PE does for the VPN label to get the correct VRF that the traffic destined to it.

[balaji.bandi]

check this document may help you understand:

https://www.ciscopress.com/articles/article.asp?p=1081501&seqNum=4

[Mustafa Nassef]

Thank you for your reply.

This document assumes the other option of VPN label allocation (Per-prefix) as follows:

"Then PE2 looks up the inner label 3333 in the LFIB, noting the pop action as well, along with the outgoing interface. So PE2 forwards the unlabeled packet out interface S0/1/0."

What I was asking about was the other approach of Per-VRF allocation in which the whole VRF including all its routes are assigned to one VPN label.

[MHM Cisco World]

you config RT under VRF 
any VPNv4 from other MP-iBGP or MP-eBGP have RT with prefix 

the router do filter

RT import same MP-iBGP MP-eBGP RT <- prefix use 

RT import not same MP-iBGP MP-eBGP RT <- prefix NOT use 

[Mustafa Nassef]

Thanks for your reply.

What you are mentioning is the control plane and what I asked for was data plane. Traffic forwarding not updates exchanging process.

[MHM Cisco World]

this answer is correct, please find below comment

[Harold Ritter · Accepted solution]

Hi @Mustafa Nassef ,

With per-vrf label allocation, an aggregate label will be installed in the LFIB. When a packet is received with that label, the label is removed and the IP packet is looked up against the appropriate VRF table. Packets are then forwarded accordingly.

RP/0/0/CPU0:PE1#sh mpls for 
Tue May 17 15:02:02.606 UTC
Local Outgoing Prefix Outgoing Next Hop Bytes 
Label Label or ID Interface Switched 
------ ----------- ------------------ ------------ --------------- ------------
24000 Pop 192.168.100.3/32 Gi0/0/0/1 192.168.23.3 7174 
24002 24001 192.168.100.4/32 Gi0/0/0/1 192.168.23.3 10752 
24003 Aggregate test: Per-VRF Aggr[V] \test 520 
RP/0/0/CPU0:PE1#

Regards,

[Mustafa Nassef]

Thank you so much, you hit the nail on the head.

[MHM Cisco World]

good Q friend please find answer from cisco 
""Packet-Forwarding Process

This is the packet-forwarding process in a multi-VRF-CE-enabled network:

• When the switch receives a packet from a VPN, the switch looks up the routing table based on the input policy label number. When a route is found, the switch forwards the packet to the PE.

• When the ingress PE receives a packet from the CE, it performs a VRF lookup. When a route is found, the router adds a corresponding MPLS label to the packet and sends it to the MPLS network.

• When an egress PE receives a packet from the network, it strips the label and uses the label to identify the correct VPN routing table. Then it performs the normal route lookup. When a route is found, it forwards the packet to the correct adjacency.

• When a CE receives a packet from an egress PE, it uses the input policy label to look up the correct VPN routing table. If a route is found, it forwards the packet within the VPN.""

  https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9600/software/release/17-7/configuration_guide/rtng/b_177_rtng_9600_cg/configuring_multi_vrf_ce.html

•  

[Mustafa Nassef]

Hello bro,

I really thank you for the time you make to reply my post.

I fully understand the MPLS label exchange and data traffic forwarding process. From the answer you got there a part that I was asking about " it strips the label and uses the label to identify the correct VPN routing table." This specific part. I wanted to know how exactly this is done, which table it will look and find the VPN label pointing to the correct VRF.

Check the answer for my question and you will get what I mean. Someone answered.

[MHM Cisco World]

@Harold Ritter answer always superior,

And for myself always learning from his comments.

@Harold Ritter big thanks from me.

[MHM Cisco World]

Hi Friend 
your Question make me think and I do LAB and find the answer 
CE1-PE1-P-PE2-CE2

in each of PE1 and PE2 there are two entry type in show mpls forwarding-table 
1- no label [v] this for the CE connect to each of PE 
2- label for LO pf other PE, i.e. PE1 have label for LO of PE2 using for MP-BGP

the trick part there is POP label this confuse me 
but when I do lab I find answer 

when ping from CE1 to CE2 
the PE1 add TWO LABEL 
the upper is Label of LO pf PE2
the lower is Label of destination 

when traffic reach P the label is POP but which one ??
the Upper one, not lower. 
upper one which point to LO of PE2 

NOW PE2 receive traffic with only one Label 
lower label which check it and fins exactly the VRF for it by checking the IP address add to Label entry.

this how PE2 can forward traffic depend on label.