I have started noticing that the MPLS VPN exit nodes respond to traceroute with the VRF address, and not the ingress address as I typically expect. From web searches I can find people mentioning this in passing. Does anyone know where this behavior is officially documented?
As an example, a traceroute through the network above produces the following output:
PE1 responds with 10.0.0.2 (ingress address)
PE2 responds with 10.0.0.9 (VRF address)
CE2 responds with 10.0.0.10 (ingress address)
I've been looking for official documentation of this behavior but can't find it.
Solved! Go to Solution.
On this post you will find helpful information:-https://community.cisco.com/t5/networking-documents/mpls-and-traceroute/ta-p/3165500
This is my understanding: On the ingress PE router, the ICMP TTL-expired message is sourced from the ingress interface. Also on the P routers, the ICMP TTL-expired messages are sourced from the ingress interfaces. However, on the exit PE router, the ICMP TTL-expired message is sourced from the interface associated with the customer VRF because of the VPN Label (not the Transport Label); the traffic will be pushed to the customer VRF table where the egress interface is the available interface to respond (with ICMP TTL-expired message).