cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
326
Views
10
Helpful
3
Replies
Beginner

MPLS VPN Traceroute

I have started noticing that the MPLS VPN exit nodes respond to traceroute with the VRF address, and not the ingress address as I typically expect. From web searches I can find people mentioning this in passing. Does anyone know where this behavior is officially documented?

 

mpls.png

 

As an example, a traceroute through the network above produces the following output:

PE1 responds with 10.0.0.2 (ingress address)

PE2 responds with 10.0.0.9 (VRF address)

CE2 responds with 10.0.0.10 (ingress address)

 

I've been looking for official documentation of this behavior but can't find it.

Everyone's tags (4)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Cisco Employee

Re: MPLS VPN Traceroute

Hi,

 

The use of Ingress interface address on remote PE will result in leaking internal network information. So it uses the VRF address.

 

HTH,

Nagendra

3 REPLIES 3
Highlighted
Cisco Employee

Re: MPLS VPN Traceroute

Hi,

 

The use of Ingress interface address on remote PE will result in leaking internal network information. So it uses the VRF address.

 

HTH,

Nagendra

Beginner

Re: MPLS VPN Traceroute

Thanks for the reply! Any chance you know of specific documentation somewhere? I was hoping to be able to point to it when discussing this.

Re: MPLS VPN Traceroute

 

On this post you will find helpful information:-https://community.cisco.com/t5/networking-documents/mpls-and-traceroute/ta-p/3165500

 

This is my understanding: On the ingress PE router, the ICMP TTL-expired message is sourced from the ingress interface. Also on the P routers, the ICMP TTL-expired messages are sourced from the ingress interfaces. However, on the exit PE router, the ICMP TTL-expired message is sourced from the interface associated with the customer VRF because of the VPN Label (not the Transport Label); the traffic will be pushed to the customer VRF table where the egress interface is the available interface to respond (with ICMP TTL-expired message).

 

HTH,

Meheretab

CreatePlease to create content
Content for Community-Ad
July's Community Spotlight Awards