Solved: Re: pe ce l3vpn ospf

networkinblood · ‎07-17-2021

I hv doubt related to pe ce ospf l3vpn , in case of address
family ipv4 when we redistribute any route in to OSPF it will be by default
LSA 5 ( external LSA ) ..so why in case of address family vpnv4 its not by
default LSA 5 ???
Thnks in advance for revert

Giuseppe Larosa · ‎07-18-2021

Hello @networkinblood ,

when using OSPF as PE-CE the configuration / design allows for the emulation of a super bacbkbone area.

Even if the OSPF routes are redistributed into MP BGP to reach the remote PE, some OSPF attributes are are carried within as extended community attributes.

One of the most important of this extended communities attribute is the OSPF domain ID. When not configured explicitly the OSPF domain-id = OSPF process-id.

if the local PE and the remote PE nodes are using the same OSPF domain-ID or simply the same OSPF process-id , then the imported routes are not created as external routes, if they were internal routes O or O IA in the originator VRF site they are converted to LSA type 3.

This gives to the remote CE the impression of the existance of a backbone area that is only emulated by the PE nodes.

To be noted external routes in the original VRF site are rebuild as external routes.

So the impact of emulation is only on internal routes.

If the OSPF prccess-ids are different or different OSPF domain ID are configured all internal routes coming from the original site are injected as LSA type 5 that is like external routes.

The LSAs created by PE nodes have the DN bit set Down bit this is a simple loop avoidance mechanism that allows a PE to avoid to accept an LSA with DN bit set. This behaviour can be disabled with capability vrf lite.

Finally, in special cases if there are direct links in the same area between sites, in order to make use of the MPLS L3 VPN path a SHAM Link can be created betweeen the PE nodes.

The SHAM link acts a logical link in area 0 between two endpoints in VRF advertised in MP BGP only ( they are typically loopbacks in VRF). The rule of the sham link is to allow to have O routes in original site seen as O routes in remote sites and so on.

The SHAM link is used only to exchange OSPF LSAs between PE nodes, traffic forwarding uses the MPLS + VPN label.

In this way the MPLS L3 VPN when having a better metric can be used instead of the direct link between the sites that will become a backup path.

Hope to help

Giuseppe

View solution in original post

Giuseppe Larosa · ‎07-19-2021

Hello @networkinblood ,

I will try to answer to your questions .

1) I may be wrong butt the DN bit should be present also on rebuilt LSA type 5 . The OSPF LSA type 5 can carry a route tag in an extended community attribute.

sse

https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/118800-configure-ospf-00.html

>> The

previously unused bit in the OSPF LSA Options Field is referred to as the DN Bit. This bit is set on Type 3, 5, and 7 LSA when the MP-BGP routes are redistributed into OSPF. When the other PE Router receives the LSA from a CE router Type 3, 5, or 7 LSA with the DN Bit set, the information from that LSA is not used in the OSPF route calculation.

and:

>> The Domain Tag is applicable only for the OSPF Type 5 and Type 7 LSA. When the VPNv4 routes are redistributed from MP-BGP into OSPF on PE Router, the Domain Tag is set for OSPF External Routes. The tag could either be manuallly set with the domain-tag command under OSPF Process or a 32-bit value can be automatically generated:

Looking at the document we can see as the domain-tag for LSA type 5 or type 7 provide an additional mechanism to prevent another PE node from redistributing the route from OSPF into MP BGP even if the DN bit is already set.

2) Routes learned locally from CE node(s) on VRF access links are OSPF routes with AD 110, routes imported from remote PE have AD 200 as they are coming from MP iBGP I agree on this.

>>

3___When we have two process ids of ospf at Ce router one for pe _ce
another ce _ce ( backdoor point to point link ) so get full route in ospf
database on CE , we need to resdribute between these two OSPF processes id
?? If yes we will get lsa5 route after retribution in ospf database??..

Here, you can make different choices depending on what you want to achieve. If you make redistribution between two OSPF process-ids you get LSA type 5 this is correct. To be noted with a dedicated process for the backdoor link you don't need a SHAM link on PE nodes. Because the routes coming from the backdoor link will be treated as LSA type 5 .

However, this is not entirely true so the best move in a case like this is to increase the distance for external routes on the secondary OSPF process.

router ospf 20

distance ospf 105 105 130

with the last number being the AD for external routes . Only in this way you can be sure that the CE will pick the PE provided route when available.

"Ships in the night" competition between different OSPF processes will not take in account the route type . This is the reason why the above command is recommended

4)

>>

4____We are doing retribution at PE routers so on each routers ( PE1
,CE1,CE2,PE2 ) will get ASBR summery LSA 4 as each PE routers will act as
ASBr ???

View solution in original post

MHM Cisco World · ‎07-17-2021

https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/118800-configure-ospf-00.html

check the CE1-PE1 LSA type redistribute and how PE2 handle it.

networkinblood · ‎07-17-2021

Sir , sorry to interrupt you , I have already read that documents . You have not got my question , I m asking when we do redstribution in OSPF by default it will be external LSA (in the case of Address family ipv4) same here we doing redistribution of MPiBGP VPNV4 route in the OSPF VRF PROCESS (irrelevant of domain id ,tag) , it should be LSA 5 only . May be my question is not having any sense but i wanna clear it . If possible pls explain .

networkinblood · ‎07-17-2021

Sir , sorry to interrupt you , I have already read that documents . You have not got my question , I m asking when we do redstribution in OSPF by default it will be external LSA (in the case of Address family ipv4) same here we doing redistribution of MPiBGP VPNV4 route in the OSPF VRF PROCESS (irrelevant of domain id ,tag) , it should be LSA 5 only . May be my question is not having any sense but i wanna clear it . If possible pls explain .

networkinblood · ‎07-17-2021

I hv doubt related to pe ce ospf l3vpn , in case of address
family ipv4 when we redistribute any route in to OSPF it will be by default
LSA 5 ( external LSA ) ..so why in case of address family vpnv4 its not by
default LSA 5 ???
Thnks in advance for revert

Giuseppe Larosa · ‎07-18-2021

Hello @networkinblood ,

when using OSPF as PE-CE the configuration / design allows for the emulation of a super bacbkbone area.

Even if the OSPF routes are redistributed into MP BGP to reach the remote PE, some OSPF attributes are are carried within as extended community attributes.

One of the most important of this extended communities attribute is the OSPF domain ID. When not configured explicitly the OSPF domain-id = OSPF process-id.

if the local PE and the remote PE nodes are using the same OSPF domain-ID or simply the same OSPF process-id , then the imported routes are not created as external routes, if they were internal routes O or O IA in the originator VRF site they are converted to LSA type 3.

This gives to the remote CE the impression of the existance of a backbone area that is only emulated by the PE nodes.

To be noted external routes in the original VRF site are rebuild as external routes.

So the impact of emulation is only on internal routes.

If the OSPF prccess-ids are different or different OSPF domain ID are configured all internal routes coming from the original site are injected as LSA type 5 that is like external routes.

The LSAs created by PE nodes have the DN bit set Down bit this is a simple loop avoidance mechanism that allows a PE to avoid to accept an LSA with DN bit set. This behaviour can be disabled with capability vrf lite.

Finally, in special cases if there are direct links in the same area between sites, in order to make use of the MPLS L3 VPN path a SHAM Link can be created betweeen the PE nodes.

The SHAM link acts a logical link in area 0 between two endpoints in VRF advertised in MP BGP only ( they are typically loopbacks in VRF). The rule of the sham link is to allow to have O routes in original site seen as O routes in remote sites and so on.

The SHAM link is used only to exchange OSPF LSAs between PE nodes, traffic forwarding uses the MPLS + VPN label.

In this way the MPLS L3 VPN when having a better metric can be used instead of the direct link between the sites that will become a backup path.

Hope to help

Giuseppe

networkinblood · ‎07-18-2021

Hi Sir , Thanks for your valuable revert ...I have some query related to same .

1 __Like down bit which is used to avoid loop for LSA 3 similarly we have domain tag for LSA 5 ???

2___ When redistributing MPiBGP route in OSPF Vrf , PE BGP table ( AD 200 )and OSPF VRF Table (AD 110) both will have CE route so which route at PE will install in VRF RIB table ( MIBGP/OSPF ( 110vs 200 )) .

3___When we have two process ids of ospf at Ce router one for pe _ce another ce _ce ( backdoor point to point link ) so get full route in ospf database on CE , we need to resdribute between these two OSPF processes id ?? If yes we will get lsa5 route after retribution in ospf database??..

4____We are doing retribution at PE routers so on each routers ( PE1 ,CE1,CE2,PE2 ) will get ASBR summery LSA 4 as each PE routers will act as ASBr ???

networkinblood · ‎07-18-2021

Hi Sir , Thanks for your valuable revert ...I have some query related to
same .

1 __Like down bit which is used to avoid loop for LSA 3 similarly we have
domain tag for LSA 5 ???

2___ When redistributing MPiBGP route in OSPF Vrf , PE BGP table ( AD 200
)and OSPF VRF Table (AD 110) both will have CE route so which route at PE
will install in VRF RIB table ( MIBGP/OSPF ( 110vs 200 )) .

3___When we have two process ids of ospf at Ce router one for pe _ce
another ce _ce ( backdoor point to point link ) so get full route in ospf
database on CE , we need to resdribute between these two OSPF processes id
?? If yes we will get lsa5 route after retribution in ospf database??..

4____We are doing retribution at PE routers so on each routers ( PE1
,CE1,CE2,PE2 ) will get ASBR summery LSA 4 as each PE routers will act as
ASBr ???

networkinblood · ‎07-19-2021

Hi Sir , Thanks for your valuable revert ...I have some query related to
same .

1 __Like down bit which is used to avoid loop for LSA 3 similarly we have
domain tag for LSA 5 ???

2___ When redistributing MPiBGP route in OSPF Vrf , PE BGP table ( AD 200
)and OSPF VRF Table (AD 110) both will have CE route so which route at PE
will install in VRF RIB table ( MIBGP/OSPF ( 110vs 200 )) .

3___When we have two process ids of ospf at Ce router one for pe _ce
another ce _ce ( backdoor point to point link ) so get full route in ospf
database on CE , we need to resdribute between these two OSPF processes id
?? If yes we will get lsa5 route after retribution in ospf database??..

4____We are doing retribution at PE routers so on each routers ( PE1
,CE1,CE2,PE2 ) will get ASBR summery LSA 4 as each PE routers will act as
ASBr ???

Giuseppe Larosa · ‎07-19-2021

Hello @networkinblood ,

I will try to answer to your questions .

1) I may be wrong butt the DN bit should be present also on rebuilt LSA type 5 . The OSPF LSA type 5 can carry a route tag in an extended community attribute.

sse

https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/118800-configure-ospf-00.html

>> The

previously unused bit in the OSPF LSA Options Field is referred to as the DN Bit. This bit is set on Type 3, 5, and 7 LSA when the MP-BGP routes are redistributed into OSPF. When the other PE Router receives the LSA from a CE router Type 3, 5, or 7 LSA with the DN Bit set, the information from that LSA is not used in the OSPF route calculation.

and:

>> The Domain Tag is applicable only for the OSPF Type 5 and Type 7 LSA. When the VPNv4 routes are redistributed from MP-BGP into OSPF on PE Router, the Domain Tag is set for OSPF External Routes. The tag could either be manuallly set with the domain-tag command under OSPF Process or a 32-bit value can be automatically generated:

Looking at the document we can see as the domain-tag for LSA type 5 or type 7 provide an additional mechanism to prevent another PE node from redistributing the route from OSPF into MP BGP even if the DN bit is already set.

2) Routes learned locally from CE node(s) on VRF access links are OSPF routes with AD 110, routes imported from remote PE have AD 200 as they are coming from MP iBGP I agree on this.

>>

3___When we have two process ids of ospf at Ce router one for pe _ce
another ce _ce ( backdoor point to point link ) so get full route in ospf
database on CE , we need to resdribute between these two OSPF processes id
?? If yes we will get lsa5 route after retribution in ospf database??..

Here, you can make different choices depending on what you want to achieve. If you make redistribution between two OSPF process-ids you get LSA type 5 this is correct. To be noted with a dedicated process for the backdoor link you don't need a SHAM link on PE nodes. Because the routes coming from the backdoor link will be treated as LSA type 5 .

However, this is not entirely true so the best move in a case like this is to increase the distance for external routes on the secondary OSPF process.

router ospf 20

distance ospf 105 105 130

with the last number being the AD for external routes . Only in this way you can be sure that the CE will pick the PE provided route when available.

"Ships in the night" competition between different OSPF processes will not take in account the route type . This is the reason why the above command is recommended

4)

>>

4____We are doing retribution at PE routers so on each routers ( PE1
,CE1,CE2,PE2 ) will get ASBR summery LSA 4 as each PE routers will act as
ASBr ???

networkinblood · ‎07-19-2021

Thanks for the such a wonderful explanation , I learnt lot by your reply . I will come up with much more queries in next post .

Once again thank you so much for clearing my silly doubts .

MHM Cisco World · ‎07-18-2021

....