MPLS VPN v4

[feroz syed]

i am trying to ping from Customer A to Customer B via vpnv4, but it not went success,

Lab story:-

First i configured OSPF inside the provider network, and make connectivity from one PE to other PE.

Second configured MPLS on all internal router inside provider network.

(R2#sh mpls ldp ne
Peer LDP Ident: 4.4.4.4:0; Local LDP Ident 20.2.4.2:0
TCP connection: 4.4.4.4.646 - 20.2.4.2.19819
State: Oper; Msgs sent/rcvd: 99/60; Downstream
Up time: 01:13:31
LDP discovery sources:
FastEthernet0/1, Src IP addr: 20.2.4.4
Addresses bound to peer LDP Ident:
20.2.4.4 4.4.4.4 20.3.4.4)

Third try to configure static route between PE to directly Customer then i remove the static route configured Eigrp between PE to directly connected customer.

Fourth state, verified the VRF import and export statement, all look fine.

R2#sh ip vrf
Name Default RD Interfaces
A 1:1 Fa0/0
Lo0

Finally for VPN v4 to work configured BGP between PE to PE

R2#sh run | sec router bg
router bgp 6500
bgp log-neighbor-changes
neighbor 19.19.19.19 remote-as 6500
neighbor 19.19.19.19 update-source Loopback0
!
address-family ipv4
network 2.2.2.2 mask 255.255.255.255
neighbor 19.19.19.19 activate
exit-address-family
!
address-family vpnv4
neighbor 19.19.19.19 activate
neighbor 19.19.19.19 send-community extended
exit-address-family
!
address-family ipv4 vrf A
neighbor 19.19.19.19 remote-as 6400
neighbor 19.19.19.19 activate
exit-address-family

R2#sh ip route vrf A

Routing Table: A
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override

Gateway of last resort is not set

1.0.0.0/32 is subnetted, 1 subnets
D 1.1.1.1 [90/156160] via 10.1.2.1, 01:10:11, FastEthernet0/0
2.0.0.0/32 is subnetted, 1 subnets
C 2.2.2.2 is directly connected, Loopback0
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.1.2.0/24 is directly connected, FastEthernet0/0
L 10.1.2.2/32 is directly connected, FastEthernet0/0

R2#sh run | sec router eigr
router eigrp 1
network 10.1.2.0 0.0.0.0
router eigrp 100
!
address-family ipv4 vrf A autonomous-system 100
network 2.2.2.2 0.0.0.0
network 10.1.2.0 0.0.0.255
exit-address-family

R01#sh run | sec router bg
router bgp 6500
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 6500
neighbor 2.2.2.2 update-source Loopback0
!
address-family ipv4
network 19.19.19.19 mask 255.255.255.255
neighbor 2.2.2.2 activate
exit-address-family
!
address-family vpnv4
neighbor 2.2.2.2 activate
neighbor 2.2.2.2 send-community extended
exit-address-family
!
address-family ipv4 vrf B
redistribute connected
redistribute eigrp 11
neighbor 2.2.2.2 remote-as 6400
neighbor 2.2.2.2 activate
exit-address-family
R01#
R01#sh ip vrf
Name Default RD Interfaces
B 1:2 Fa0/0
Lo0
R01#sh run | sec router eigr
router eigrp 1
!
address-family ipv4 vrf B autonomous-system 11
network 10.19.20.0 0.0.0.255
network 19.0.0.0
network 19.19.19.19 0.0.0.0
exit-address-family
router eigrp 11
redistribute bgp 6500 metric 10000 1 255 1 1500
R01#
R01#sh bgp vpnv4 uni all
BGP table version is 4, local router ID is 19.19.19.19
Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,
r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,
x best-external, a additional-path, c RIB-compressed,
Origin codes: i - IGP, e - EGP, ? - incomplete
RPKI validation codes: V valid, I invalid, N Not found

Network Next Hop Metric LocPrf Weight Path
Route Distinguisher: 1:2 (default for vrf B)
*> 10.19.20.0/24 0.0.0.0 0 32768 ?
*> 19.19.19.19/32 0.0.0.0 0 32768 ?
*> 22.22.22.22/32 10.19.20.2 156160 32768 ?
R01#
R01#
R01#sh ip ei
R01#sh ip eigrp vrf A ne
%VRF A does not exist.
R01#sh ip eigrp vrf B ne
EIGRP-IPv4 Neighbors for AS(11) VRF(B)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.19.20.2 Fa0/0 10 02:00:50 79 474 0 3

R2#sh ip eigrp vrf A neighbors
EIGRP-IPv4 Neighbors for AS(100) VRF(A)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.1.2.1 Fa0/0 14 01:16:31 56 336 0 3

but not work as i expected.

Any help would be for this issue much appreciated.

[Giuseppe Larosa · Accepted solution]

Hello @feroz syed ,

first of all,  the loopback addresses must be advertised in OSPF and not in BGP AF ipv4   (GRT).

What is the loop0 R1 address ?  19.19.19.19/32   or 1.1.1.1/32 ?

You advertise in OSPF the loop0 addresses or loop1 what you prefer, but OSPF must be used to build stable MP i BGP sessions.

on R2 we see  you have configured peering with address 19.19.19.19  in AF ipv4 unicast, in AF vpnv4 and in AF vrf A

On one PE router the mapped EIGRP instance is 100 so you should redistribute eigrp 100 and not 11 in that vrf.

Start by fixing these

Edit:

you need also to configure route targets for import and export in your VRFs and values must match if you want to create end to end connectivity.

Route targets are used in AF VPNv4

Hope to help

Giuseppe

[feroz syed]

R2#sh run int lo 0
Building configuration...

Current configuration : 84 bytes
!
interface Loopback0
ip vrf forwarding A
ip address 2.2.2.2 255.255.255.255
end

R2#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R2(config)#int lo 0
R2(config-if)#no ip vrf forwarding A
% Interface Loopback0 IPv4 disabled and address(es) removed due to disabling VRF
R2(config-if)# ip address 2.2.2.2 255.255.255.255
R2(config-if)#ip os 1 ar 0
R2(config-if)#end
R2#
*Mar 8 14:53:53.570: %SYS-5-CONFIG_I: Configured from console by console
R2#
R2#
R2#
*Mar 8 14:54:06.746: %BGP-5-ADJCHANGE: neighbor 19.19.19.19 Up

-------------------------------------------------------------------

R01#sh run int lo 0
Building configuration...

Current configuration : 88 bytes
!
interface Loopback0
ip vrf forwarding B
ip address 19.19.19.19 255.255.255.255
end

R01#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R01(config)#int lo 0
R01(config-if)#ip os 1 ar 0
%VRF specified does not match existing router
R01(config-if)#int lo 0
R01(config-if)#no ip vrf forwarding B
% Interface Loopback0 IPv4 disabled and address(es) removed due to disabling VRF
R01(config-if)#
R01(config-if)# ip address 19.19.19.19 255.255.255.255
R01(config-if)#ip os 1 ar 0
R01(config-if)#end
R01#
*Mar 8 14:52:32.330: %SYS-5-CONFIG_I: Configured from console by console
R01#
*Mar 8 14:53:05.666: ICMP: dst (19.19.19.19) host unreachable rcv from 20.5.19.5
R01#
*Mar 8 14:53:07.610: ICMP: dst (19.19.19.19) host unreachable rcv from 20.5.19.5
R01#
*Mar 8 14:53:16.458: %BGP-5-ADJCHANGE: neighbor 2.2.2.2 Up

-------------------------------------------------------------------------------

R01#sh run | sec router ei
router eigrp 1
!
address-family ipv4 vrf B autonomous-system 11
network 10.19.20.0 0.0.0.255
network 19.0.0.0
network 19.19.19.19 0.0.0.0
exit-address-family
router eigrp 11
redistribute bgp 6500 metric 10000 1 255 1 1500

--------------------------------------------------

R01#sh run | sec router bgp
router bgp 6500
bgp log-neighbor-changes
neighbor 2.2.2.2 remote-as 6500
neighbor 2.2.2.2 update-source Loopback0
!
address-family ipv4
network 19.19.19.19 mask 255.255.255.255
neighbor 2.2.2.2 activate
exit-address-family
!
address-family vpnv4
neighbor 2.2.2.2 activate
neighbor 2.2.2.2 send-community extended
exit-address-family
!
address-family ipv4 vrf B
redistribute connected
redistribute eigrp 11
neighbor 2.2.2.2 remote-as 6400
neighbor 2.2.2.2 activate
exit-address-family
R01#
R01#sh ip ei vrf A ne
%VRF A does not exist.
R01#
R01#sh ip ei vrf B ne
EIGRP-IPv4 Neighbors for AS(11) VRF(B)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.19.20.2 Fa0/0 14 02:41:23 73 438 0 4
R01#sh ip ei vrf B ne
EIGRP-IPv4 Neighbors for AS(11) VRF(B)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.19.20.2 Fa0/0 12 02:41:30 73 438 0 4

--------------------------------------------------------------

R2#sh run | sec router ei
router eigrp 100
!
address-family ipv4 vrf A autonomous-system 100
redistribute bgp 6500 metric 1000 1 1 1 1500
network 2.2.2.2 0.0.0.0
network 10.1.2.0 0.0.0.255
exit-address-family
R2#
R2#sh run | sec router bg
router bgp 6500
bgp log-neighbor-changes
neighbor 19.19.19.19 remote-as 6500
neighbor 19.19.19.19 update-source Loopback0
!
address-family ipv4
network 2.2.2.2 mask 255.255.255.255
neighbor 19.19.19.19 activate
exit-address-family
!
address-family vpnv4
neighbor 19.19.19.19 activate
neighbor 19.19.19.19 send-community extended
exit-address-family
!
address-family ipv4 vrf A
redistribute eigrp 100
neighbor 19.19.19.19 remote-as 6400
neighbor 19.19.19.19 activate
exit-address-family
R2#
R2#sh ip ei vrf A ne
EIGRP-IPv4 Neighbors for AS(100) VRF(A)
H Address Interface Hold Uptime SRTT RTO Q Seq
(sec) (ms) Cnt Num
0 10.1.2.1 Fa0/0 14 00:03:51 36 216 0 7
R2#

[feroz syed]

R01#sh ip route vrf B

Routing Table: B
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override

Gateway of last resort is not set

1.0.0.0/32 is subnetted, 1 subnets
B 1.1.1.1 [200/156160] via 2.2.2.2, 00:07:07
10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
B 10.1.2.0/24 [200/0] via 2.2.2.2, 00:07:07
C 10.19.20.0/24 is directly connected, FastEthernet0/0
L 10.19.20.1/32 is directly connected, FastEthernet0/0
22.0.0.0/32 is subnetted, 1 subnets
D 22.22.22.22 [90/156160] via 10.19.20.2, 00:16:45, FastEthernet0/0
R01#ping 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
..
Success rate is 0 percent (0/2)
R01#ping 1.1.1.1 so lo 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 19.19.19.19
...
Success rate is 0 percent (0/3)
R01#ping 1.1.1.1 so lo 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 19.19.19.19
...
Success rate is 0 percent (0/3)

------------------------------------------------------

R2#sh run | sec router eigr
router eigrp 100
!
address-family ipv4 vrf A autonomous-system 100
redistribute bgp 6500 metric 1000 1 1 1 1500
network 2.2.2.2 0.0.0.0
network 10.1.2.0 0.0.0.255
exit-address-family
R2#
R2#sh ip route vrf a ei
% IP routing table vrf a does not exist
R2#
R2#sh ip route vrf A ei

Routing Table: A
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override

Gateway of last resort is not set

1.0.0.0/32 is subnetted, 1 subnets
D 1.1.1.1 [90/156160] via 10.1.2.1, 00:08:35, FastEthernet0/0
R2#
R2#
R2#
R2#deb
R2#debug ip icm
ICMP packet debugging is on
R2#ping vrf A 1.1.1.1 so lo 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2

*Mar 8 15:11:57.966: ICMP: dst (2.2.2.2) host unreachable sent to 1.1.1.1.
*Mar 8 15:11:59.938: ICMP: dst (2.2.2.2) host unreachable sent to 1.1.1.1.
*Mar 8 15:12:01.926: ICMP: dst (2.2.2.2) host unreachable sent to 1.1.1.1.
*Mar 8 15:12:03.946: ICMP: dst (2.2.2.2) host unreachable sent to 1.1.1.1.
*Mar 8 15:12:05.954: ICMP: dst (2.2.2.2) host unreachable sent to 1.1.1.1.
Success rate is 0 percent (0/5)

[feroz syed]

Finally it get work, i made some mistakes on vrf and redistribution.  Thanks lot for notify the mistakes. i will re-do the lab. i have some confusion, once it cleared, i will mark this post Answered.

R01#sh run | sec router eigr
router eigrp 1
!
address-family ipv4 vrf B autonomous-system 11
network 10.19.20.0 0.0.0.255
network 19.0.0.0
network 19.19.19.19 0.0.0.0
exit-address-family
router eigrp 11
redistribute bgp 6500 metric 10000 1 255 1 1500
R01#
R01#
R01#
R01#conf t
Enter configuration commands, one per line. End with CNTL/Z.
R01(config)#router ei 1
R01(config-router)# address-family ipv4 vrf B autonomous-system 11
R01(config-router-af)# redistribute bgp 6500 metric 10000 1 255 1 1500
R01(config-router-af)#end
R01#sh r
*Mar 8 15:23:47.762: %SYS-5-CONFIG_I: Configured from console by console
R01#sh run | sec router ei
router eigrp 1
!
address-family ipv4 vrf B autonomous-system 11
redistribute bgp 6500 metric 10000 1 255 1 1500
network 10.19.20.0 0.0.0.255
network 19.0.0.0
network 19.19.19.19 0.0.0.0
exit-address-family
router eigrp 11
redistribute bgp 6500 metric 10000 1 255 1 1500
R01#
R01#
R01#
R01#
R01#
R01#ping vrf B 1.1.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 152/171/196 ms
R01#
*Mar 8 15:25:49.162: ICMP: echo reply rcvd, src 1.1.1.1, dst 10.19.20.1, topology BASE, dscp 0 topoid 1
*Mar 8 15:25:49.350: ICMP: echo reply rcvd, src 1.1.1.1, dst 10.19.20.1, topology BASE, dscp 0 topoid 1
*Mar 8 15:25:49.514: ICMP: echo reply rcvd, src 1.1.1.1, dst 10.19.20.1, topology BASE, dscp 0 topoid 1
*Mar 8 15:25:49.714: ICMP: echo reply rcvd, src 1.1.1.1, dst 10.19.20.1, topology BASE, dscp 0 topoid 1
*Mar 8 15:25:49.878: ICMP: echo reply rcvd, src 1.1.1.1, dst

[Giuseppe Larosa]

Hello @feroz syed ,

you have made progress.

Now when you test ping in VRF you need:

a) to use ping vr<vrf-name>  A.A.A:A

b) the source must be an interface on the local router that belongs to the same VRF

Do you realize that now Loop0 is in global routing table for the changes you have done ?

ping vrf A 1.1.1.1 so lo 0

this cannot work now as lo0 is now in GRT and as the debug shows

use a suitable interface in VRF A to test.

removing the network commands for the loopbacks IP addresses may be useful to have a clean config.

Hope to help

Giuseppe

[feroz syed]

As you can see below trace-routes, why R5 not remove it's label (pop) when the packet forward to last hop address.

In the first trace R5 remove only vpnv4 label, in the second trace it still send its own label even next hop address is final destination.

R2#traceroute vrf A 22.22.22.22
Tracing the route to 22.22.22.22
VRF info: (vrf in name/id, vrf out name/id)
1 20.2.4.4 [MPLS: Labels 403/110 Exp 0] 188 msec 192 msec 152 msec
2 20.3.4.3 [MPLS: Labels 300/110 Exp 0] 196 msec 184 msec 176 msec
3 20.3.6.6 [MPLS: Labels 600/110 Exp 0] 192 msec 188 msec 192 msec
4 20.6.5.5 [MPLS: Labels 500/110 Exp 0] 192 msec 204 msec 144 msec
5 10.19.20.1 [MPLS: Label 110 Exp 0] 180 msec 172 msec 172 msec
6 10.19.20.2 156 msec 192 msec 204 msec

R2#traceroute 19.19.19.19
Tracing the route to 19.19.19.19
VRF info: (vrf in name/id, vrf out name/id)
1 20.2.4.4 [MPLS: Label 403 Exp 0] 116 msec 148 msec 156 msec
2 20.3.4.3 [MPLS: Label 300 Exp 0] 180 msec 164 msec 164 msec
3 20.3.6.6 [MPLS: Label 600 Exp 0] 132 msec 184 msec 144 msec
4 20.6.5.5 [MPLS: Label 500 Exp 0] 136 msec 136 msec 124 msec
5 20.5.19.1 140 msec 168 msec 160 msec

R5#sh mpls forwarding-table
Local Outgoing Prefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
500 Pop Label 19.19.19.19/32 15572 Fa0/0 20.5.19.1
501 Pop Label 6.6.6.6/32 0 Fa0/1 20.6.5.6
502 602 4.4.4.4/32 0 Fa0/1 20.6.5.6
503 603 3.3.3.3/32 0 Fa0/1 20.6.5.6
504 604 2.2.2.2/32 16504 Fa0/1 20.6.5.6
505 Pop Label 20.3.6.0/24 0 Fa0/1 20.6.5.6
506 606 20.3.4.0/24 0 Fa0/1 20.6.5.6
507 607 20.2.4.0/24 1896 Fa0/1 20.6.5.6

Thanks

[Giuseppe Larosa]

Hello @feroz syed ,

I would like to suggest you to study MPLS L3 VPN in more detail as you are missing some key concepts.

R2#traceroute vrf A 22.22.22.22
Tracing the route to 22.22.22.22
VRF info: (vrf in name/id, vrf out name/id)
1 20.2.4.4 [MPLS: Labels 403/110 Exp 0] 188 msec 192 msec 152 msec
2 20.3.4.3 [MPLS: Labels 300/110 Exp 0] 196 msec 184 msec 176 msec
3 20.3.6.6 [MPLS: Labels 600/110 Exp 0] 192 msec 188 msec 192 msec
4 20.6.5.5 [MPLS: Labels 500/110 Exp 0] 192 msec 204 msec 144 msec
5 10.19.20.1 [MPLS: Label 110 Exp 0] 180 msec 172 msec 172 msec
6 10.19.20.2 156 msec 192 msec 204 msec

The VPNv4 label is 110 the interal one the one that does not change at each hop.

R5 as pemultimate hop performs PHP and so the label stack is reduced to only VPNv4 label when it reaches exit PE R01.

>> In the first trace R5 remove only vpnv4 label

It is the opposite the IGP label is removed by PHP   on R5 before exit PE R01.

The second traceroute is performed on GRT and uses the LSP with destination 19.19.19.19 the exit PE loop0

R2#traceroute 19.19.19.19
Tracing the route to 19.19.19.19
VRF info: (vrf in name/id, vrf out name/id)
1 20.2.4.4 [MPLS: Label 403 Exp 0] 116 msec 148 msec 156 msec
2 20.3.4.3 [MPLS: Label 300 Exp 0] 180 msec 164 msec 164 msec
3 20.3.6.6 [MPLS: Label 600 Exp 0] 132 msec 184 msec 144 msec
4 20.6.5.5 [MPLS: Label 500 Exp 0] 136 msec 136 msec 124 msec
5 20.5.19.1 140 msec 168 msec 160 msec

please note the source address of the packet at hop #4 it is 20.6.5.5 that is the IP address of R5 on the link towards R6. In direction of R2 PHP does not happen so it is correct that label 500 appears in this message.

The next-hop #5 has not label and this is coming from final destination router R01 on link between R1 and R5, here we see that PHP happened on R5.

Each router answers to each traceroute probe packet in the direction of the source of the probe that is R2 the PE at the other end in your topology.

This explains why R5 answers to R6 using the locally assigned label of 500 for prefix 19.19.19.19/32, the implicit null that is label 3 for IPv4 is advertised by R01 to R05.

Hope to help

Giuseppe