Greetings All. I have a request from one of my customers who is willing to deploy Multicast NAT. But he seeks to do : Source IP overwrite , Multicast destination IP overwrite and Multicast destination port overwrite.Cisco Software Discussions, Cisco Software Per my readings , there are some restrictions : Multicast destination address translation is one of them. Do Cisco has solution for that ? or is it code related or HW related? Much appreciated. ... View more

MPLS has been the leader in providing VPN service in the past days with the association of LDP for label distribution to achieve the necessary operation for traffic forwarding (not to forget that BGP is used in some cases for label assignment, but the focus in this example is LDP). We will be using to the below topology to demonstrate the scope of this document and we will be starting with normal MPLS L3VPN service with dependence on LDP for label distribution. Let us describe the topology in brief: We have two CEs that needs to communicate over MPLS backbone and they are using BGP as their protocol with AS # 10. As well, we have two MPLS service PEs who are handling the transport of the prefixes of concern with flat ISIS level 2 as the IGP running inside the backbone. The relations involved in setting up the communication path are illustrated simply in the below figure: Talking from design perspective and choosing the running protocols assuming unmanaged CE option and direct communication between MPLS service PEs , please refer to the below figure: Now, let us dig deep in the label assignments (for the sake of demonstration, I have changed the label allocation range for each device following the scheme: PE1 (16100 – 16199), PE2 (16200 – 16299) and so on. Note: IOS XR label assignment range starts with 16000, on contrary IOS software starts from the range of 16. RP/0/0/CPU0:PE1#show cef vrf MSSK 10.10.7.0 Tue Apr  9 06:59:44.570 UTC 10.10.7.0/24, version 7, internal 0x1000001 0x0 (ptr 0xa13b0f74) [1], 0x0 (0x0), 0x200 (0xa152c0f0)  Updated Apr  8 13:21:40.189  local adjacency 172.16.17.7  Prefix Len 24, traffic index 0, precedence n/a, priority 3    via 172.16.17.7, 2 dependencies, recursive, bgp-ext [flags 0x6020]     path-idx 0 NHID 0x0 [0xa13b0ef4 0x0]     next hop 172.16.17.7 via 172.16.17.7/32      local label 16100      next hop 172.16.17.7/32 Gi0/0/0/2    labels imposed {None}   RP/0/0/CPU0:PE1# show bgp vpnv4 unicast labels Tue Apr  9 08:34:32.380 UTC BGP router identifier 1.1.1.1, local AS number 1 BGP generic scan interval 60 secs Non-stop routing is enabled BGP table state: Active Table ID: 0x0   RD version: 0 BGP main routing table version 7 BGP NSR Initial initsync version 3 (Reached) BGP NSR/ISSU Sync-Group versions 0/0 BGP scan interval 60 secs   Status codes: s suppressed, d damped, h history, * valid, > best               i - internal, r RIB-failure, S stale, N Nexthop-discard Origin codes: i - IGP, e - EGP, ? - incomplete    Network            Next Hop        Rcvd Label      Local Label Route Distinguisher: 1:1 (default for vrf MSSK) *> 10.10.7.0/24       172.16.17.7     nolabel         16100 *>i10.10.8.0/24       2.2.2.2         16200           nolabel   RP/0/0/CPU0:PE1#show mpls forwarding Tue Apr  9 06:59:03.893 UTC Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes Label  Label       or ID              Interface                    Switched ------ ----------- ------------------ ------------ --------------- ------------ 16100  Unlabelled  10.10.7.0/24[V]    Gi0/0/0/2    172.16.17.7     17330 16101  Pop         3.3.3.3/32         Gi0/0/0/0    192.168.13.3    115899 16102  Pop         192.168.36.0/24    Gi0/0/0/0    192.168.13.3    0 16103  Pop         192.168.34.0/24    Gi0/0/0/0    192.168.13.3    0 16104  16302       4.4.4.4/32         Gi0/0/0/0    192.168.13.3    0 16105  16303       192.168.24.0/24    Gi0/0/0/0    192.168.13.3    0 16106  16304       2.2.2.2/32         Gi0/0/0/0    192.168.13.3    97699        16504       2.2.2.2/32         Gi0/0/0/1    192.168.15.5    668 16107  16305       192.168.26.0/24    Gi0/0/0/0    192.168.13.3    0        16507       192.168.26.0/24    Gi0/0/0/1    192.168.15.5    0 16108  Pop         192.168.56.0/24    Gi0/0/0/1    192.168.15.5    0 16109  16307       6.6.6.6/32         Gi0/0/0/0    192.168.13.3    0        16509       6.6.6.6/32         Gi0/0/0/1    192.168.15.5    0 16110  Pop         5.5.5.5/32         Gi0/0/0/1    192.168.15.5    71344   RP/0/0/CPU0:PE2#show mpls forwarding Tue Apr  9 07:04:02.402 UTC Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes Label  Label       or ID              Interface                    Switched ------ ----------- ------------------ ------------ --------------- ------------ 16200  Unlabelled  10.10.8.0/24[V]    Gi0/0/0/2    172.16.28.8     18514 16201  Pop         4.4.4.4/32         Gi0/0/0/0    192.168.24.4    115664 16202  Pop         192.168.34.0/24    Gi0/0/0/0    192.168.24.4    0 16203  16400       3.3.3.3/32         Gi0/0/0/0    192.168.24.4    0 16600       3.3.3.3/32         Gi0/0/0/1    192.168.26.6    0 16204  16403       1.1.1.1/32         Gi0/0/0/0    192.168.24.4    107684        16606       1.1.1.1/32         Gi0/0/0/1    192.168.26.6    14204 16205  Pop         192.168.36.0/24    Gi0/0/0/1    192.168.26.6    0 16206  16602       192.168.15.0/24    Gi0/0/0/1    192.168.26.6    0 16207  16402       192.168.13.0/24    Gi0/0/0/0    192.168.24.4    1032        16604       192.168.13.0/24    Gi0/0/0/1    192.168.26.6    1432 16208  Pop         192.168.56.0/24    Gi0/0/0/1    192.168.26.6    0 16209  Pop         6.6.6.6/32         Gi0/0/0/1    192.168.26.6    1980 16210  16608       5.5.5.5/32         Gi0/0/0/1    192.168.26.6    0   RP/0/0/CPU0:XR6-P4#show mpls forwarding Tue Apr  9 07:06:42.561 UTC Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes Label  Label       or ID              Interface                    Switched ------ ----------- ------------------ ------------ --------------- ------------ 16600  Pop         3.3.3.3/32         Gi0/0/0/2    192.168.36.3    2216 16601  Pop         2.2.2.2/32         Gi0/0/0/1    192.168.26.2    13237 16602  Pop         192.168.15.0/24    Gi0/0/0/0    192.168.56.5    0 16603  Pop         192.168.34.0/24    Gi0/0/0/2    192.168.36.3    0 16604  Pop         192.168.13.0/24    Gi0/0/0/2    192.168.36.3    1392 16605  Pop         192.168.24.0/24    Gi0/0/0/1    192.168.26.2    0 16606  16500       1.1.1.1/32         Gi0/0/0/0    192.168.56.5    9214        16300       1.1.1.1/32         Gi0/0/0/2    192.168.36.3    1026 16607  16201       4.4.4.4/32         Gi0/0/0/1    192.168.26.2    0        16302       4.4.4.4/32         Gi0/0/0/2    192.168.36.3    0 16608  Pop         5.5.5.5/32         Gi0/0/0/0    192.168.56.5    145824   CE1#traceroute 10.10.8.8 source lo1 numeric Type escape sequence to abort. Tracing the route to 10.10.8.8 VRF info: (vrf in name/id, vrf out name/id)   1 172.16.17.1 12 msec 12 msec 8 msec   2 192.168.13.3 [MPLS: Labels 16304/16200 Exp 0] 28 msec 20 msec 20 msec   3 192.168.36.6 [MPLS: Labels 16601/16200 Exp 0] 20 msec 20 msec 20 msec   4 192.168.26.2 [MPLS: Label 16200 Exp 0] 20 msec 20 msec 20 msec   5 172.16.28.8 20 msec *  20 msec   Now as we have a converged network and communication is in place between the CEs, we will now start with the migration process from LDP to SR (Segment-Routing).   Let us follow the steps one by one, but before moving forward it is worthy to mention that we have two migration strategies:   Ships in the night: in which we will replace LDP by SR. Interworking: In which interaction between LDP and SR to take place (SR will exist and LDP will still be running in some parts of the network).   What we will start with is ships in the night migration strategy.   The basic lines needed to enable segment-routing are (not to forget that wide metrics are needed):   router isis 1  address-family ipv4 unicast   segment-routing mpls   Monitoring the console screen, I have faced the below log message:   RP/0/0/CPU0:PE1#RP/0/0/CPU0:Apr  9 07:26:58.288 : isis[1006]: %ROUTING-ISIS-4-SRGB_ALLOC_FAIL : SRGB allocation failed: 'SRGB reservation not successful for [16000,23999], srgb=(16000 23999, SRGB_ALLOC_CONFIG_PENDING, 0x2) (So far 64 attempts). Make sure label range is free'   That means we are facing some issues in the SRBG range used by segment routing.   RP/0/0/CPU0:PE1(config-isis)#segment-routing global-block ?   <16000-1048574>  The lower bound of the SRGB   As we can see from the above command, the SRGB block assignments starts with 16000   It is recommended to use the same range of SRGB among all devices within a network, so the command to use for this purpose is:   router isis 1 segment-routing global-block 90000 99000   RP/0/0/CPU0:PE1#show isis database verbose | include SRGB Tue Apr  9 09:28:00.491 UTC     Segment Routing: I:1 V:0, SRGB Base: 90000 Range: 9001     Segment Routing: I:1 V:0, SRGB Base: 90000 Range: 9001     Segment Routing: I:1 V:0, SRGB Base: 90000 Range: 9001     Segment Routing: I:1 V:0, SRGB Base: 90000 Range: 9001     Segment Routing: I:1 V:0, SRGB Base: 90000 Range: 9001     Segment Routing: I:1 V:0, SRGB Base: 90000 Range: 9001   The status now is that both LDP and SR are working together inside the network and the communication is still in place , what next to be done is to instruct the routers to prefer SR label assignments/bindings over the already used ones generated by LDP.   router isis 1 address-family ipv4 unicast   segment-routing mpls sr-prefer   Let us check now the MPLS forwarding table to see the result:   RP/0/0/CPU0:PE1#show mpls forwarding Tue Apr  9 09:30:36.650 UTC Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes Label  Label       or ID              Interface                    Switched ------ ----------- ------------------ ------------ --------------- ------------ 16100  Unlabelled  10.10.7.0/24[V]    Gi0/0/0/2    172.16.17.7     35514 16101  Pop         3.3.3.3/32         Gi0/0/0/0    192.168.13.3    1020 16102  Pop         192.168.36.0/24    Gi0/0/0/0    192.168.13.3    0 16103  Pop         192.168.34.0/24    Gi0/0/0/0    192.168.13.3    0 16104  16302       4.4.4.4/32         Gi0/0/0/0    192.168.13.3    0 16105  16303       192.168.24.0/24    Gi0/0/0/0    192.168.13.3    0 16106  16304       2.2.2.2/32         Gi0/0/0/0    192.168.13.3    189        16504       2.2.2.2/32         Gi0/0/0/1    192.168.15.5    0 16107  16305       192.168.26.0/24    Gi0/0/0/0    192.168.13.3    0        16507       192.168.26.0/24    Gi0/0/0/1    192.168.15.5    0 16108  Pop         192.168.56.0/24    Gi0/0/0/1    192.168.15.5    0 16109  16307       6.6.6.6/32         Gi0/0/0/0    192.168.13.3    0        16509       6.6.6.6/32         Gi0/0/0/1    192.168.15.5    0 16110  Pop         5.5.5.5/32         Gi0/0/0/1    192.168.15.5    0 16111  Pop         No ID              Gi0/0/0/0    192.168.13.3    0 16112  Pop         No ID              Gi0/0/0/1    192.168.15.5    0 90200  90200       No ID              Gi0/0/0/0    192.168.13.3    5312        90200       No ID              Gi0/0/0/1    192.168.15.5    0 90400  90400       No ID              Gi0/0/0/0    192.168.13.3    0 90500  Pop         No ID              Gi0/0/0/0    192.168.13.3    450 90600  90600       No ID              Gi0/0/0/0    192.168.13.3    0        90600       No ID              Gi0/0/0/1    192.168.15.5    0   Checking from the CE side:   CE1#traceroute 10.10.8.8 source lo1 numeric Type escape sequence to abort. Tracing the route to 10.10.8.8 VRF info: (vrf in name/id, vrf out name/id)   1 172.16.17.1 4 msec 8 msec 12 msec   2 192.168.13.3 [MPLS: Labels 90200/16200 Exp 0] 24 msec 20 msec 20 msec   3 192.168.36.6 [MPLS: Labels 90200/16200 Exp 0] 20 msec 20 msec 20 msec   4 192.168.26.2 [MPLS: Label 16200 Exp 0] 20 msec 20 msec 20 msec   5 172.16.28.8 20 msec *  20 msec   RP/0/0/CPU0:PE1#show cef vrf MSSK 10.10.8.0 Tue Apr  9 09:32:25.053 UTC 10.10.8.0/24, version 12, internal 0x5000001 0x0 (ptr 0xa13b11f4) [1], 0x0 (0x0), 0x208 (0xa152c118)  Updated Apr  9 09:22:50.843  Prefix Len 24, traffic index 0, precedence n/a, priority 3    via 2.2.2.2, 3 dependencies, recursive [flags 0x6000]     path-idx 0 NHID 0x0 [0xa1594674 0x0]     recursion-via-/32     next hop VRF - 'default', table - 0xe0000000     next hop 2.2.2.2 via 90200/0/21      next hop 192.168.13.3/32 Gi0/0/0/0    labels imposed {90200 16200}      next hop 192.168.15.5/32 Gi0/0/0/1    labels imposed {90200 16200}   Let us now remove LDP from the network to make sure that everything is working as expected and running a continuous reachability test between the CEs to check.   CE1#ping 10.10.8.8 source lo1 repeat 1000000 Type escape sequence to abort. Sending 1000000, 100-byte ICMP Echos to 10.10.8.8, timeout is 2 seconds: Packet sent with a source address of 10.10.7.7 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! We are great! No packet loss and we have successfully migrated without any caveats.   RP/0/0/CPU0:PE1#show mpls forwarding Tue Apr  9 09:38:14.609 UTC Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes Label  Label       or ID              Interface                    Switched ------ ----------- ------------------ ------------ --------------- ------------ 16100  Unlabelled  10.10.7.0/24[V]    Gi0/0/0/2    172.16.17.7     295262 16111  Pop         No ID              Gi0/0/0/0    192.168.13.3    0 16112  Pop         No ID              Gi0/0/0/1    192.168.15.5    0 90200  90200       No ID              Gi0/0/0/0    192.168.13.3    285240        90200       No ID              Gi0/0/0/1    192.168.15.5    0 90400  90400       No ID              Gi0/0/0/0    192.168.13.3    0 90500  Pop         No ID              Gi0/0/0/0    192.168.13.3    1221 90600  90600       No ID              Gi0/0/0/0    192.168.13.3    0        90600       No ID              Gi0/0/0/1    192.168.15.5    0   The below flow diagram briefly describe what we have done to migrate successfully from LDP to SR:   Relevant configurations:   XR1: router isis 1  is-type level-2-only  net 49.0001.0000.0000.0001.00  segment-routing global-block 90000 99000  address-family ipv4 unicast   metric-style wide   segment-routing mpls sr-prefer  !  interface Loopback0   address-family ipv4 unicast    prefix-sid index 1001   !  !  interface GigabitEthernet0/0/0/0   address-family ipv4 unicast   !  !  interface GigabitEthernet0/0/0/1   address-family ipv4 unicast ... View more

In this post, we are going to examine the flexibility the MPLS TE auto-tunnel feature adds to networks where MPLS TE generally is needed.   Not going deeply into the basics of MPLS TE, one of the common design considerations for MPLS TE is the number of tunnels to be configured to achieve certain requirement: Scalability.   To give more clearance, let us have a look at the topology we are going to use for this post. In the above topology, we have two CEs that needs to communicate with each other.   RIPv2 is the running PE to CE routing protocol.   As we know, MPLS TE tunnels are unidirectional tunnels, taking into consideration the number of MPLS PEs in our network, how many tunnels needed to be established? In our case the number is reasonable as depicted in the below diagram. But what if the network has 20 PEs for example? Even if we considered P to P tunnels, the number is still countable which affects one of the design aspect mentioned above: Scalability. So, whatever the option to follow (PE to PE tunnels or P to P tunnels), we are running into high management burden and remarkable OpEx.   Let us start diving into the configuration aspects of this, and not to forget we are running OSPF area 0 as our IGP (and it is already known that the two link-state routing protocols that support MPLS TE extensions are OSPF and ISIS).   R1-CE1: interface Loopback0  ip address 1.1.1.1 255.255.255.255   interface FastEthernet1/0  ip address 192.168.12.1 255.255.255.0   router rip  version 2  network 1.0.0.0  network 192.168.12.0  no auto-summary   R2-PE1: interface Loopback0  ip address 2.2.2.2 255.255.255.255   interface FastEthernet1/0  ip address 192.168.23.2 255.255.255.0  mpls traffic-eng tunnels   interface FastEthernet1/1  ip address 192.168.24.2 255.255.255.0  mpls traffic-eng tunnels   ip vrf MSSK  rd 1:1  route-target export 1:1  route-target import 1:1   interface FastEthernet2/0  ip vrf forwarding MSSK  ip address 192.168.12.2 255.255.255.0   mpls traffic-eng tunnels mpls traffic-eng auto-tunnel mesh (We need to globally enable the feature).   router ospf 1  router-id 2.2.2.2  network 2.2.2.2 0.0.0.0 area 0  network 192.168.23.2 0.0.0.0 area 0  network 192.168.24.2 0.0.0.0 area 0  mpls traffic-eng router-id Loopback0  mpls traffic-eng area 0  mpls traffic-eng mesh-group 10 Loopback0 area 0 (We need to ensure proper IGP signaling).   router rip  address-family ipv4 vrf MSSK   redistribute bgp 1 metric 2   network 192.168.12.0   no auto-summary   version 2  exit-address-family   router bgp 1  bgp log-neighbor-changes  no bgp default ipv4-unicast  neighbor 6.6.6.6 remote-as 1  neighbor 6.6.6.6 update-source Loopback0    address-family vpnv4   neighbor 6.6.6.6 activate   neighbor 6.6.6.6 send-community both  exit-address-family    address-family ipv4 vrf MSSK   redistribute rip  exit-address-family   interface Auto-Template1  ip unnumbered Loopback0  tunnel mode mpls traffic-eng  tunnel destination mesh-group 10  tunnel mpls traffic-eng autoroute announce (Forcing the traffic into the tunnels).  tunnel mpls traffic-eng path-option 10 dynamic   The above auto-template interface is similar to the interface usually we create when establishing unidirectional tunnels (manual) with the respective parameters in use as well.   R3-P1: interface Loopback0  ip address 3.3.3.3 255.255.255.255   interface FastEthernet1/0  ip address 192.168.23.3 255.255.255.0  mpls traffic-eng tunnels   interface FastEthernet1/1  ip address 192.168.36.3 255.255.255.0  mpls traffic-eng tunnels   interface FastEthernet2/0  ip address 192.168.35.3 255.255.255.0  mpls traffic-eng tunnels   mpls traffic-eng tunnels mpls traffic-eng auto-tunnel mesh   router ospf 1  router-id 3.3.3.3  network 3.3.3.3 0.0.0.0 area 0  network 192.168.23.3 0.0.0.0 area 0  network 192.168.35.3 0.0.0.0 area 0  network 192.168.36.3 0.0.0.0 area 0  mpls traffic-eng router-id Loopback0  mpls traffic-eng area 0  mpls traffic-eng mesh-group 10 Loopback0 area 0   R4-P2: interface Loopback0  ip address 4.4.4.4 255.255.255.255   interface FastEthernet1/0  ip address 192.168.24.4 255.255.255.0  mpls traffic-eng tunnels   interface FastEthernet1/1  ip address 192.168.45.4 255.255.255.0  mpls traffic-eng tunnels   mpls traffic-eng tunnels mpls traffic-eng auto-tunnel mesh   router ospf 1  router-id 4.4.4.4  network 4.4.4.4 0.0.0.0 area 0  network 192.168.24.4 0.0.0.0 area 0  network 192.168.45.4 0.0.0.0 area 0  mpls traffic-eng router-id Loopback0  mpls traffic-eng area 0  mpls traffic-eng mesh-group 10 Loopback0 area 0   R5-P2: interface Loopback0  ip address 5.5.5.5 255.255.255.255   interface FastEthernet1/0  ip address 192.168.56.5 255.255.255.0  mpls traffic-eng tunnels   interface FastEthernet1/1  ip address 192.168.45.5 255.255.255.0  mpls traffic-eng tunnels   interface FastEthernet2/0  ip address 192.168.35.5 255.255.255.0  mpls traffic-eng tunnels   mpls traffic-eng tunnels mpls traffic-eng auto-tunnel mesh   router ospf 1  router-id 5.5.5.5  network 5.5.5.5 0.0.0.0 area 0  network 192.168.35.5 0.0.0.0 area 0  network 192.168.45.5 0.0.0.0 area 0  network 192.168.56.5 0.0.0.0 area 0  mpls traffic-eng router-id Loopback0  mpls traffic-eng area 0  mpls traffic-eng mesh-group 10 Loopback0 area 0   R6-PE2: interface Loopback0  ip address 6.6.6.6 255.255.255.255   interface FastEthernet1/0  ip address 192.168.36.6 255.255.255.0  mpls traffic-eng tunnels   interface FastEthernet1/1  ip address 192.168.56.6 255.255.255.0  mpls traffic-eng tunnels   ip vrf MSSK  rd 1:1  route-target export 1:1  route-target import 1:1   interface FastEthernet2/0  ip vrf forwarding MSSK  ip address 192.168.67.6 255.255.255.0   mpls traffic-eng tunnels mpls traffic-eng auto-tunnel mesh   router ospf 1  router-id 6.6.6.6  network 6.6.6.6 0.0.0.0 area 0  network 192.168.36.6 0.0.0.0 area 0  network 192.168.56.6 0.0.0.0 area 0  mpls traffic-eng router-id Loopback0  mpls traffic-eng area 0  mpls traffic-eng mesh-group 10 Loopback0 area 0   router rip  address-family ipv4 vrf MSSK   redistribute bgp 1 metric 2   network 192.168.67.0   no auto-summary   version 2  exit-address-family   router bgp 1  bgp log-neighbor-changes  no bgp default ipv4-unicast  neighbor 2.2.2.2 remote-as 1  neighbor 2.2.2.2 update-source Loopback0    address-family vpnv4   neighbor 2.2.2.2 activate   neighbor 2.2.2.2 send-community both  exit-address-family    address-family ipv4 vrf MSSK   redistribute rip  exit-address-family   interface Auto-Template1  ip unnumbered Loopback0  tunnel mode mpls traffic-eng  tunnel destination mesh-group 10  tunnel mpls traffic-eng autoroute announce  tunnel mpls traffic-eng path-option 10 dynamic   R7-CE2: interface Loopback0  ip address 7.7.7.7 255.255.255.255   interface FastEthernet1/0  ip address 192.168.67.7 255.255.255.0   router rip  version 2  network 7.0.0.0  network 192.168.67.0  no auto-summary   Verifications:   Let us check CE1 routing table and test connectivity to CE2:   R1-CE1#sh ip route rip Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP        D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2        E1 - OSPF external type 1, E2 - OSPF external type 2        i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2        ia - IS-IS inter area, * - candidate default, U - per-user static route        o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP        + - replicated route, % - next hop override   Gateway of last resort is not set         7.0.0.0/32 is subnetted, 1 subnets R        7.7.7.7 [120/2] via 192.168.12.2, 00:00:16, FastEthernet1/0 R     192.168.67.0/24 [120/2] via 192.168.12.2, 00:00:16, FastEthernet1/0   R1-CE1#ping 7.7.7.7 source loopback 0 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 7.7.7.7, timeout is 2 seconds: Packet sent with a source address of 1.1.1.1 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 76/88/104 ms   As can be seen from the below output, we are able to see all the network elements in the network (P or PE):   R2-PE1#show mpls traffic-eng topology brief My_System_id: 2.2.2.2 (ospf 1  area 0)   Signalling error holddown: 10 sec Global Link Generation 18   IGP Id: 2.2.2.2, MPLS TE Id:2.2.2.2 Router Node  (ospf 1  area 0)       link[0]: Broadcast, DR: 192.168.23.2, nbr_node_id:1, gen:8       frag_id: 2, Intf Address: 192.168.23.2       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None         link[1]: Broadcast, DR: 192.168.24.2, nbr_node_id:2, gen:8       frag_id: 3, Intf Address: 192.168.24.2       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None   IGP Id: 3.3.3.3, MPLS TE Id:3.3.3.3 Router Node  (ospf 1  area 0) Area mg-id's: : mg-id 10    3.3.3.3 :       link[0]: Broadcast, DR: 192.168.23.2, nbr_node_id:1, gen:11       frag_id: 2, Intf Address: 192.168.23.3       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None         link[1]: Broadcast, DR: 192.168.36.6, nbr_node_id:4, gen:11       frag_id: 3, Intf Address: 192.168.36.3       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None         link[2]: Broadcast, DR: 192.168.35.3, nbr_node_id:3, gen:11       frag_id: 4, Intf Address: 192.168.35.3       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None   IGP Id: 4.4.4.4, MPLS TE Id:4.4.4.4 Router Node  (ospf 1  area 0) Area mg-id's: : mg-id 10    4.4.4.4 :       link[0]: Broadcast, DR: 192.168.24.2, nbr_node_id:2, gen:13       frag_id: 2, Intf Address: 192.168.24.4       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None         link[1]: Broadcast, DR: 192.168.45.4, nbr_node_id:5, gen:13       frag_id: 3, Intf Address: 192.168.45.4       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None   IGP Id: 5.5.5.5, MPLS TE Id:5.5.5.5 Router Node  (ospf 1  area 0) Area mg-id's: : mg-id 10    5.5.5.5 :       link[0]: Broadcast, DR: 192.168.56.6, nbr_node_id:6, gen:16       frag_id: 2, Intf Address: 192.168.56.5       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None         link[1]: Broadcast, DR: 192.168.45.4, nbr_node_id:5, gen:16       frag_id: 3, Intf Address: 192.168.45.5       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None         link[2]: Broadcast, DR: 192.168.35.3, nbr_node_id:3, gen:16       frag_id: 4, Intf Address: 192.168.35.5       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None   IGP Id: 6.6.6.6, MPLS TE Id:6.6.6.6 Router Node  (ospf 1  area 0) Area mg-id's: : mg-id 10    6.6.6.6 :       link[0]: Broadcast, DR: 192.168.36.6, nbr_node_id:4, gen:18       frag_id: 2, Intf Address: 192.168.36.6       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None         link[1]: Broadcast, DR: 192.168.56.6, nbr_node_id:6, gen:18       frag_id: 3, Intf Address: 192.168.56.6       TE metric: 1, IGP metric: 1, attribute flags: 0x0       SRLGs: None   IGP Id: 192.168.23.2, Network Node  (ospf 1  area 0)       link[0]: Broadcast, Nbr IGP Id: 2.2.2.2, nbr_node_id:7, gen:1         link[1]: Broadcast, Nbr IGP Id: 3.3.3.3, nbr_node_id:8, gen:1   IGP Id: 192.168.24.2, Network Node  (ospf 1  area 0)       link[0]: Broadcast, Nbr IGP Id: 2.2.2.2, nbr_node_id:7, gen:2         link[1]: Broadcast, Nbr IGP Id: 4.4.4.4, nbr_node_id:9, gen:2   IGP Id: 192.168.35.3, Network Node  (ospf 1  area 0)       link[0]: Broadcast, Nbr IGP Id: 3.3.3.3, nbr_node_id:8, gen:3         link[1]: Broadcast, Nbr IGP Id: 5.5.5.5, nbr_node_id:10, gen:3   IGP Id: 192.168.36.6, Network Node  (ospf 1  area 0)       link[0]: Broadcast, Nbr IGP Id: 6.6.6.6, nbr_node_id:11, gen:4         link[1]: Broadcast, Nbr IGP Id: 3.3.3.3, nbr_node_id:8, gen:4   IGP Id: 192.168.45.4, Network Node  (ospf 1  area 0)       link[0]: Broadcast, Nbr IGP Id: 4.4.4.4, nbr_node_id:9, gen:5         link[1]: Broadcast, Nbr IGP Id: 5.5.5.5, nbr_node_id:10, gen:5   IGP Id: 192.168.56.6, Network Node  (ospf 1  area 0)       link[0]: Broadcast, Nbr IGP Id: 6.6.6.6, nbr_node_id:11, gen:6         link[1]: Broadcast, Nbr IGP Id: 5.5.5.5, nbr_node_id:10, gen:6   And we can see the dynamic tunnels created per the configuration done:   R2-PE1# sh ip int bri | ex Down Interface              IP-Address      OK? Method Status                Protocol FastEthernet0/0        unassigned      YES unset  administratively down down FastEthernet1/0        192.168.23.2    YES manual up                    up FastEthernet1/1        192.168.24.2    YES manual up                    up FastEthernet2/0        192.168.12.2    YES manual up                    up FastEthernet2/1        unassigned      YES unset  administratively down down Auto-Template1         2.2.2.2         YES TFTP   up                    up Loopback0              2.2.2.2         YES manual up                    up Tunnel64336            2.2.2.2         YES TFTP   up                    up Tunnel64337            2.2.2.2         YES TFTP   up                    up Tunnel64338            2.2.2.2         YES TFTP   up                    up Tunnel64339            2.2.2.2         YES TFTP   up                    up R2-PE1#show mpls forwarding-table Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop Label      Label      or Tunnel Id     Switched      interface 16         No Label   192.168.12.0/24[V]   \                                        0             aggregate/MSSK 17         No Label   1.1.1.1/32[V]    3768          Fa2/0      192.168.12.1   R3-P1#show mpls forwarding-table Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop Label      Label      or Tunnel Id     Switched      interface 16         Pop Label  2.2.2.2 64338 [7768]   \                                        0             Fa2/0      192.168.35.5 17         Pop Label  6.6.6.6 64336 [2762]   \                                        6801          Fa1/0      192.168.23.2 18         Pop Label  2.2.2.2 64339 [3399]   \                                        4961          Fa1/1      192.168.36.6   R2-PE1#show ip route | inc Tunnel O        3.3.3.3 [110/2] via 3.3.3.3, 00:19:55, Tunnel64336 O        4.4.4.4 [110/2] via 4.4.4.4, 00:19:55, Tunnel64337 O        5.5.5.5 [110/3] via 5.5.5.5, 00:19:45, Tunnel64338 O        6.6.6.6 [110/3] via 6.6.6.6, 00:19:45, Tunnel64339 O     192.168.35.0/24 [110/2] via 3.3.3.3, 00:19:55, Tunnel64336 O     192.168.36.0/24 [110/2] via 3.3.3.3, 00:19:55, Tunnel64336 O     192.168.45.0/24 [110/2] via 4.4.4.4, 00:19:55, Tunnel64337 O     192.168.56.0/24 [110/3] via 6.6.6.6, 00:19:45, Tunnel64339                                   [110/3] via 5.5.5.5, 00:19:45, Tunnel64338   R2-PE1#show mpls traffic-eng auto-tunnel mesh   Auto-Template1:    Using mesh-group 10 to clone the following tunnel interfaces:     Destination         Interface   -----------         ---------     3.3.3.3             Tunnel64336   4.4.4.4             Tunnel64337   5.5.5.5             Tunnel64338   6.6.6.6             Tunnel64339   Mesh tunnel interface numbers: min 64336 max 65335   R6-PE2#show mpls traffic-eng auto-tunnel mesh   Auto-Template1:    Using mesh-group 10 to clone the following tunnel interfaces:     Destination         Interface   -----------         ---------     2.2.2.2             Tunnel64336   3.3.3.3             Tunnel64337   4.4.4.4             Tunnel64338   5.5.5.5             Tunnel64339   Mesh tunnel interface numbers: min 64336 max 65335   If we checked the OSPF database for one of the PE routers:     LS age: 1695   Options: (No TOS-capability, DC)   LS Type: Opaque Area Link   Link State ID: 4.0.0.0   Opaque Type: 4   Opaque ID: 0   Advertising Router: 2.2.2.2   LS Seq Number: 80000001   Checksum: 0xE129   Length: 32       Capability Type: Mesh-group     Length: 8     Value:       0000 000A 0202 0202     LS age: 1686   Options: (No TOS-capability, DC)   LS Type: Opaque Area Link   Link State ID: 4.0.0.0   Opaque Type: 4   Opaque ID: 0   Advertising Router: 3.3.3.3   LS Seq Number: 80000001   Checksum: 0xF50D   Length: 32       Capability Type: Mesh-group     Length: 8     Value:       0000 000A 0303 0303     LS age: 1681   Options: (No TOS-capability, DC)   LS Type: Opaque Area Link   Link State ID: 4.0.0.0   Opaque Type: 4   Opaque ID: 0   Advertising Router: 4.4.4.4   LS Seq Number: 80000001   Checksum: 0xAF0   Length: 32       Capability Type: Mesh-group     Length: 8     Value:       0000 000A 0404 0404     LS age: 1678   Options: (No TOS-capability, DC)   LS Type: Opaque Area Link   Link State ID: 4.0.0.0   Opaque Type: 4   Opaque ID: 0   Advertising Router: 5.5.5.5   LS Seq Number: 80000001   Checksum: 0x1ED4   Length: 32       Capability Type: Mesh-group     Length: 8     Value:       0000 000A 0505 0505     LS age: 1661   Options: (No TOS-capability, DC)   LS Type: Opaque Area Link   Link State ID: 4.0.0.0   Opaque Type: 4   Opaque ID: 0   Advertising Router: 6.6.6.6   LS Seq Number: 80000001   Checksum: 0x32B8   Length: 32       Capability Type: Mesh-group     Length: 8     Value:       0000 000A 0606 0606   As can be seen the 0000 000A refers to the TLV which when decoded back to decimal equals to 10 (which is the mesh group number configured in the command mpls traffic-eng mesh-group 10 Loopback0 area 0 under the OSPF process).   A little note to refer to is that we have lowered down the OpEx as the needed tunnels has been created automatically, but that does not mean scalability has been resolved. ... View more

Continuing our journey through diving in the available options for providing Internet access to customers through MPLS L3VPN service. The second option is still utilizing non-MP-BGP relation between our edge device (ASBR) and the serving PE as depicted in the below figure: Design Option 2: What this option is all about having multiple connections (logical or physical) between the CE and the PE , one of them is still serving for WAN connectivity to other branches/HQ and the other one will be a non-VRF link that is used solely for Internet access. Not going deeply into the technical routing details, what will be added to the PE is an extra role for handling the Internet routes through the new assigned attached circuit. What we have relied on in this design instance is establishing an IPv4 BGP session between the PE device and the ASBR device to transport the prefix which the customer will use to reach the destination (Internet). Checking the relevant configuration on some devices:   PE: interface FastEthernet2/0.46  encapsulation dot1Q 46  ip vrf forwarding MSSK  ip address 192.168.46.4 255.255.255.0   interface FastEthernet2/0.146  encapsulation dot1Q 146  ip address 62.215.1.1 255.255.255.0   router bgp 1  bgp log-neighbor-changes  no bgp default ipv4-unicast  neighbor 2.2.2.2 remote-as 1  neighbor 2.2.2.2 update-source Loopback0    address-family ipv4   network 62.215.1.0 mask 255.255.255.0   neighbor 2.2.2.2 activate  exit-address-family   ASBR: router bgp 1  bgp log-neighbor-changes  no bgp default ipv4-unicast  neighbor 4.4.4.4 remote-as 1  neighbor 4.4.4.4 update-source Loopback0  neighbor 212.118.23.3 remote-as 3  !  address-family ipv4   neighbor 4.4.4.4 activate   neighbor 4.4.4.4 next-hop-self   neighbor 212.118.23.3 activate  exit-address-family   R2-ASBR#show ip bgp BGP table version is 23, local router ID is 212.118.23.2 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found        Network          Next Hop            Metric LocPrf Weight Path  *>  3.3.3.3/32       212.118.23.3             0             0 3 i  r>i 62.215.1.0/24    4.4.4.4                  0    100      0 i R6-CE#ping 3.3.3.3 source 62.215.1.10 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds: Packet sent with a source address of 62.215.1.10 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 40/60/76 ms Checking the new roles per the new considerations: ... View more

One of the applications that MPLS (Multi-Protocol Label Switching) provide is WAN connectivity for enterprises (generally speaking) that seeks secure communication among its entities and remote locations.   The demand for the customers expand beyond just only WAN connectivity to gain Internet access utilizing the same last mile , but is the service provider infrastructure capable of supporting such a setup? Sure it does and this is one of the main design aspect MPLS technology supports: flexibility.   Now as it is assured that MPLS supports Internet access over the provided service (MPLS L3VPN), let us examine the available options from a technical perspective and highlight some design concerns among the available options Before starting the dive into the available options, we will categorize from high level the options into:   MP-BGP non-MP-BGP What is meant by that is that L3VPN service rely solely on establishing a VPNv4 session between the serving PEs Where from we will get the Internet routes? Usually through our GW or what so called ASBR (Autonomous System Boundary Router).   How this device will be connected? This varies from a network to another and in our case we will add a P router to whom the ASBR will be connected (just to raise the complexity a little bit and fulfil the design goal for which this document is written).   Note: The design options are listed in the CCDE study guide, but some ideas and highlights are added Design Option 1: In the first option which is relying on non MP-BGP with default route pointing to a next-hop within the global routing table.   In the topology depicted above, we are serving two customers (one with only one location to serve because the main idea is to serve this customer with Internet access and not maintaining access to another branch or location).   As well and mentioned earlier, we have a P router that is acting as a RR for the VPNv4 AF and is connected to the ASBR which in turn is connected to the Internet Service Provider.   The PE-CE routing protocol is RIPv2 and OSPF is the IGP inside the network and for sure BGP IPv4 is the running protocol between the ASes.   What we will do is to give Internet access to customers who are part of different VRFs.   The Internet destination is represented by a loopback interface configured on INET router which are advertised to the ASBR via BGP IPv4 unicast.   Currently (in this design option), the customers are terminated via physical connection (no logical segmentation).   As the customers need Internet access (and currently they are using private IP addressing scheme for the WAN connectivity), some public IP addressing scheme should be implemented.   For the sake of this document, a public IP subnet is used for NATting the traffic and enable the customers to gain Internet connectivity.   But where the NAT process should take place? In the first scenario, the P router will handle the role of this translation. Now the question arises, the P router do not have any VRF configuration implemented, should we define the VRF? Actually we will have to configure it as the NAT statements are attached to the VRFs of concern.   This example assumes every VRF is assigned a public IP address block (Class C) just to illustrate more clearly the translation process.   But how the routes will be imported to into the specific VRFs? In design option 1 we are relying on the global routing table to gain Internet access, so a static route is pointing to the next-hop router (ASBR) inside the respective VRF.   Now, as mentioned earlier, we have public IP subnet per VRF (in our demonstration example, we have two VRFs) and the NAT process will be configured on the P router, so how the subnets will be learned by the INET router? One of the options is to configure an IPv4 iBGP session between our P router (NAT translator) and the ASBR.   The question that arise, is that really the role of the P router? No, it should handle the role for switching labels but technically is viable solution and we will examine other scenarios for the same option.   The below figure shows the different BGP instances running to achieve the ultimate goal for our customers: Internet access. As the P router is the main component in our scenario, we will list the relevant configurations:   P: ip access-list standard ABC_TRAFFIC  permit 10.10.8.0 0.0.0.255   ip access-list standard MSSK_TRAFFIC  permit 10.10.6.0 0.0.0.255  permit 10.10.7.0 0.0.0.255   ip nat pool MSSK_POOL 62.215.1.0 62.215.1.254 prefix-length 24 ip nat pool ABC_POOL 62.215.2.0 62.215.2.254 prefix-length 24   ip nat inside source list ABC_TRAFFIC pool ABC_POOL vrf ABC ip nat inside source list MSSK_TRAFFIC pool MSSK_POOL vrf MSSK   ip route 62.215.1.0 255.255.255.0 Null0 ip route 62.215.2.0 255.255.255.0 Null0   ip route vrf MSSK 0.0.0.0 0.0.0.0 192.168.12.2 global ip route vrf ABC 0.0.0.0 0.0.0.0 192.168.12.2 global   router bgp 1  bgp log-neighbor-changes  no bgp default ipv4-unicast  neighbor 2.2.2.2 remote-as 1  neighbor 2.2.2.2 update-source Loopback0  neighbor 4.4.4.4 remote-as 1  neighbor 4.4.4.4 update-source Loopback0  neighbor 5.5.5.5 remote-as 1  neighbor 5.5.5.5 update-source Loopback0    address-family ipv4   network 62.215.1.0 mask 255.255.255.0   network 62.215.2.0 mask 255.255.255.0   neighbor 2.2.2.2 activate  exit-address-family    address-family vpnv4   neighbor 4.4.4.4 activate   neighbor 4.4.4.4 send-community both   neighbor 4.4.4.4 route-reflector-client   neighbor 5.5.5.5 activate   neighbor 5.5.5.5 send-community both   neighbor 5.5.5.5 route-reflector-client  exit-address-family    address-family ipv4 vrf ABC   network 0.0.0.0  exit-address-family    address-family ipv4 vrf MSSK   network 0.0.0.0  exit-address-family    Verification:   Trying to ping from our CEs to check the connectivity and the NAT translations on the P router   R6-CE#ping 3.3.3.3 source loopback 1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds: Packet sent with a source address of 10.10.6.6 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 40/47/56 ms   R7-CE#ping 3.3.3.3 source loopback 1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds: Packet sent with a source address of 10.10.7.7 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 44/59/68 ms   R8-CE#ping 3.3.3.3 source loopback 1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds: Packet sent with a source address of 10.10.8.8 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 48/52/60 ms   R1-P#sh ip nat translations Pro Inside global      Inside local       Outside local      Outside global icmp 62.215.1.1:3      10.10.6.6:3        3.3.3.3:3          3.3.3.3:3 --- 62.215.1.1         10.10.6.6          ---                --- icmp 62.215.1.2:2      10.10.7.7:2        3.3.3.3:2          3.3.3.3:2 --- 62.215.1.2         10.10.7.7          ---                --- icmp 62.215.2.2:1      10.10.8.8:1        3.3.3.3:1          3.3.3.3:1 --- 62.215.2.2         10.10.8.8          ---                ---   R1-P#sh ip nat translations vrf MSSK Pro Inside global      Inside local       Outside local      Outside global icmp 62.215.1.1:4      10.10.6.6:3        3.3.3.3:4          3.3.3.3:4 --- 62.215.1.1         10.10.6.6          ---                --- icmp 62.215.1.2:3      10.10.7.7:2        3.3.3.3:3          3.3.3.3:3 --- 62.215.1.2         10.10.7.7          ---                ---   The below figure illustrates the devices roles with respect to different aspects of the setup:   Note: Redistribution is meant for the PE to CE relationship.   A caveat has to be cleared which is the next-hop-self which has to be defined (or redistribution to take place):   ASBR: router bgp 1  bgp log-neighbor-changes  no bgp default ipv4-unicast  neighbor 1.1.1.1 remote-as 1  neighbor 1.1.1.1 update-source Loopback0  neighbor 212.118.23.3 remote-as 3  !  address-family ipv4   neighbor 1.1.1.1 activate   neighbor 1.1.1.1 next-hop-self   neighbor 212.118.23.3 activate  exit-address-family ... View more

Hi all I want to connect all of my branches via MPLS service from one of the available providers What am thinking of is using VPLS for branches connectibvity Now my concern is two things : security (how to protect from my side even though am using only IP only , and how to propose or force the provider to deploy certain features) The second thing is to use QoS as am using voice , video and data , should I deploy QoS from my side , or from the provider side and if from provider side what best technique to follow BR, Mohammad ... View more

Hi all Am trying to examine OSPF MTR , I have used two different images : c7200-adventerprisek9-mz.152-4.S2 c7200-advipservicesk9-mz.152-4.S7 R1(config)#policy-map type class-routing ipv4 unicast MAP % Can't provision policies of type 2 Any ideas guys? Thanks BR, Mohammad ... View more

In this post , we will simulate how to configure segment routing (basic configuration) The running IGP is ISIS level 2  R1#ping 192.168.203.20 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.203.20, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) CSR1#show mpls forwarding-table Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop Label      Label      or Tunnel Id     Switched      interface 16         No Label   192.168.101.0/24[V]   \                                        0             aggregate/MSSK CSR2#show mpls forwarding-table no MPLS apps enabled or MPLS not enabled on any interfaces CSR3#show mpls forwarding-table Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop Label      Label      or Tunnel Id     Switched      interface 16         No Label   192.168.203.0/24[V]   \                                        0             aggregate/MSSK CSR1: segment-routing mpls  connected-prefix-sid-map   address-family ipv4    1.1.1.1/32 index 100   exit-address-family router isis 1 segment-routing mpls CSR2: segment-routing mpls  connected-prefix-sid-map   address-family ipv4    2.2.2.2/32 index 200   exit-address-family router isis 1 segment-routing mpls CSR3: segment-routing mpls  connected-prefix-sid-map   address-family ipv4    3.3.3.3/32 index 300   exit-address-family router isis 1 segment-routing mpls CSR1#show mpls forwarding-table Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop Label      Label      or Tunnel Id     Switched      interface 16         No Label   192.168.101.0/24[V]   \                                        570           aggregate/MSSK 17         Pop Label  0000.0000.0002-Gi1-192.168.12.2   \                                        0             Gi1        192.168.12.2 16200      Pop Label  2.2.2.2/32       0             Gi1        192.168.12.2 16300      16300      3.3.3.3/32       0             Gi1        192.168.12.2 CSR2#show mpls forwarding-table Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop Label      Label      or Tunnel Id     Switched      interface 16         Pop Label  0000.0000.0001-Gi1-192.168.12.1   \                                        0             Gi1        192.168.12.1 17         Pop Label  0000.0000.0003-Gi2-192.168.23.3   \                                        0             Gi2        192.168.23.3 16100      Pop Label  1.1.1.1/32       1098          Gi1        192.168.12.1 16300      Pop Label  3.3.3.3/32       1098          Gi2        192.168.23.3 CSR3#show mpls forwarding-table Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop Label      Label      or Tunnel Id     Switched      interface 16         No Label   192.168.203.0/24[V]   \                                        570           aggregate/MSSK 17         Pop Label  0000.0000.0002-Gi1-192.168.23.2   \                                        0             Gi1        192.168.23.2 16100      16100      1.1.1.1/32       0             Gi1        192.168.23.2 16200      Pop Label  2.2.2.2/32       0             Gi1        192.168.23.2 CSR1#show ip cef 3.3.3.3/32 3.3.3.3/32   nexthop 192.168.12.2 GigabitEthernet1 label 16300() CSR3#show ip cef 1.1.1.1/32 1.1.1.1/32   nexthop 192.168.23.2 GigabitEthernet1 label 16100() CSR1#show isis segment-routing  ISIS protocol is registered with MFI  ISIS MFI Client ID:0x63  Tag 1 - Segment-Routing:    SR State:SR_ENABLED    Number of SRGB:1    SRGB Start:16000, Range:8000, srgb_handle:0x7F25A007F490, srgb_state: created    Address-family IPv4 unicast SR is configured      Operational state:Enabled      Receive is enabled      Advertise local is disabled      Explicit null is disabled      SR label preferred is disabled CSR3#show isis segment-routing  ISIS protocol is registered with MFI  ISIS MFI Client ID:0x63  Tag 1 - Segment-Routing:    SR State:SR_ENABLED    Number of SRGB:1    SRGB Start:16000, Range:8000, srgb_handle:0x7FBE8DB056F8, srgb_state: created    Address-family IPv4 unicast SR is configured      Operational state:Enabled      Receive is enabled      Advertise local is disabled      Explicit null is disabled      SR label preferred is disabled CSR1#show segment-routing mpls state  Segment Routing MPLS State : ENABLED CSR3#show segment-routing mpls state  Segment Routing MPLS State : ENABLED CSR1#show isis database level-2 verbose Tag 1: IS-IS Level-2 Link State Database: LSPID                 LSP Seq Num  LSP Checksum  LSP Holdtime      ATT/P/OL CSR1.00-00          * 0x00000005   0xECC1        383               0/0/0   Area Address: 49.0001   NLPID:        0xCC   Router CAP:   1.1.1.1, D:0, S:0     Segment Routing: I:1 V:0, SRGB Base: 16000 Range: 8000   Hostname: CSR1   Metric: 10         IS-Extended CSR2.01     Lan Adjacency SID:       SID Value:17, CSR2, F:0 B:0 V:1 L:1 S:0 Weight:0   IP Address:   1.1.1.1   Metric: 10         IP 1.1.1.1/32     Prefix-SID Index: 100, Algorithm:0, R:0 N:1 P:0 E:0 V:0 L:0   Metric: 10         IP 192.168.12.0/24   Metric: 10         IP 192.168.22.0/24 CSR2.00-00            0x00000006   0xFD8D        1181              0/0/0   Area Address: 49.0001   NLPID:        0xCC   Router CAP:   2.2.2.2, D:0, S:0     Segment Routing: I:1 V:0, SRGB Base: 16000 Range: 8000   Hostname: CSR2   Metric: 10         IS-Extended CSR2.01     Lan Adjacency SID:       SID Value:16, CSR1, F:0 B:0 V:1 L:1 S:0 Weight:0   Metric: 10         IS-Extended CSR3.01     Lan Adjacency SID:       SID Value:17, CSR3, F:0 B:0 V:1 L:1 S:0 Weight:0   IP Address:   2.2.2.2   Metric: 10         IP 2.2.2.2/32     Prefix-SID Index: 200, Algorithm:0, R:0 N:1 P:0 E:0 V:0 L:0   Metric: 10         IP 192.168.12.0/24   Metric: 10         IP 192.168.122.0/24   Metric: 10         IP 192.168.23.0/24 CSR2.01-00            0x00000002   0x7C4C        934               0/0/0   Metric: 0          IS-Extended CSR2.00   Metric: 0          IS-Extended CSR1.00 CSR3.00-00            0x00000005   0x0B43        1157              0/0/0   Area Address: 49.0001   NLPID:        0xCC   Router CAP:   3.3.3.3, D:0, S:0     Segment Routing: I:1 V:0, SRGB Base: 16000 Range: 8000   Hostname: CSR3   Metric: 10         IS-Extended CSR3.01     Lan Adjacency SID:       SID Value:17, CSR2, F:0 B:0 V:1 L:1 S:0 Weight:0   IP Address:   3.3.3.3   Metric: 10         IP 3.3.3.3/32     Prefix-SID Index: 300, Algorithm:0, R:0 N:1 P:0 E:0 V:0 L:0   Metric: 10         IP 192.168.23.0/24   Metric: 10         IP 192.168.133.0/24 CSR3.01-00            0x00000002   0x9134        882               0/0/0   Metric: 0          IS-Extended CSR3.00   Metric: 0          IS-Extended CSR2.00   R1#ping 192.168.203.20 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.203.20, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 28/56/72 ms ... View more

The topology will be used to demonstrate this feature and the proof of function The setup consists of 5 routers each participating in its own AS # with each router advertising its loopback 0 network into BGP (each router loopback 0 interface follow the criteria x.x.x.x/32 where x is the router number) Checking the BGP table for the prefixes received R1#sh ip bgp BGP table version is 6, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,              x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network         Next Hop           Metric LocPrf Weight Path *> 1.1.1.1/32       0.0.0.0                 0        32768 i *> 2.2.2.2/32       192.168.12.2             0             0 2 i *> 3.3.3.3/32       192.168.13.3             0             0 3 i *   4.4.4.4/32       192.168.13.3                           0 3 4 i *>                   192.168.12.2                          0 2 4 i *   5.5.5.5/32       192.168.13.3                           0 3 4 5 i *>                   192.168.12.2                           0 2 4 5 i As we can see from the output above that R1 is learning 4.4.4.4/32 and 5.5.5.5/32 from two different paths , it prefers the path through R2 because R2 has the lowest BGP router ID R1#show ip bgp 5.5.5.5 255.255.255.255 BGP routing table entry for 5.5.5.5/32, version 6 Paths: (2 available, best #2, table default) Advertised to update-groups:      1 Refresh Epoch 1 3 4 5    192.168.13.3 from 192.168.13.3 (3.3.3.3)      Origin IGP, localpref 100, valid, external      rx pathid: 0, tx pathid: 0 Refresh Epoch 1 2 4 5    192.168.12.2 from 192.168.12.2 (2.2.2.2)      Origin IGP, localpref 100, valid, external, best      rx pathid: 0, tx pathid: 0x0 R1#show ip cef 5.5.5.5 255.255.255.255 5.5.5.5/32 nexthop 192.168.12.2 FastEthernet1/0 Through FIB, only one entry is installed which is the best route to reach that destination Now, let us turn on prefix-independent convergence on R1 R1 R1(config)#router bgp 1 R1(config-router)#address-family ipv4 unicast R1(config-router-af)#bgp additional-paths install R1#sh ip bgp BGP table version is 11, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,              x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network         Next Hop           Metric LocPrf Weight Path *> 1.1.1.1/32       0.0.0.0                 0         32768 i *> 2.2.2.2/32       192.168.12.2             0            0 2 i *> 3.3.3.3/32       192.168.13.3             0             0 3 i *b 4.4.4.4/32       192.168.13.3                           0 3 4 i *>                   192.168.12.2                           0 2 4 i *b 5.5.5.5/32       192.168.13.3                          0 3 4 5 i *>                   192.168.12.2                           0 2 4 5 i R1#sh ip bgp 5.5.5.5 255.255.255.255 BGP routing table entry for 5.5.5.5/32, version 11 Paths: (2 available, best #2, table default) Additional-path-install Advertised to update-groups:      1 Refresh Epoch 1 3 4 5    192.168.13.3 from 192.168.13.3 (3.3.3.3)      Origin IGP, localpref 100, valid, external, backup/repair, recursive-via-connected      rx pathid: 0, tx pathid: 0 Refresh Epoch 1 2 4 5    192.168.12.2 from 192.168.12.2 (2.2.2.2)      Origin IGP, localpref 100, valid, external, best , recursive-via-connected      rx pathid: 0, tx pathid: 0x0 R1#sh ip cef 5.5.5.5 255.255.255.255 detail 5.5.5.5/32, epoch 0, flags rib only nolabel, rib defined all labels recursive via 192.168.12.2    attached to FastEthernet1/0 recursive via 192.168.13.3, repair    attached to FastEthernet1/1 ... View more

R2 is the route reflector for the network R1 , R3 and R4 all are PEs serving customers (customers are simulated by loopback interfaces) R1 has four VRFs : VRF1,VRF2,VRF3,VRF4 R3 has one VRF : VRF1 R4 has one VRF : VRF2 Configurations R1 interface Loopback0  ip address 1.1.1.1 255.255.255.255 mpls label protocol ldp mpls ldp router-id Loopback0 force interface FastEthernet1/0  ip address 192.168.12.1 255.255.255.0  speed 100  full-duplex  mpls ip  no shut router ospf 1  router-id 1.1.1.1  log-adjacency-changes  network 1.1.1.1 0.0.0.0 area 0  network 192.168.12.1 0.0.0.0 area 0 ip vrf VRF1  rd 1:1  route-target export 1:1  route-target import 1:1 ip vrf VRF2  rd 2:2  route-target export 2:2  route-target import 2:2 ip vrf VRF3  rd 3:3  route-target export 3:3  route-target import 3:3 ip vrf VRF4  rd 4:4  route-target export 4:4  route-target import 4:4 interface Loopback1  ip vrf forwarding VRF1  ip address 172.16.1.1 255.255.255.255 interface Loopback2  ip vrf forwarding VRF2  ip address 172.16.2.1 255.255.255.255 interface Loopback3  ip vrf forwarding VRF3  ip address 172.16.3.1 255.255.255.255 interface Loopback4  ip vrf forwarding VRF4  ip address 172.16.4.1 255.255.255.255 router bgp 1  no bgp default ipv4-unicast  bgp log-neighbor-changes  neighbor 2.2.2.2 remote-as 1  neighbor 2.2.2.2 update-source Loopback0  address-family vpnv4   neighbor 2.2.2.2 activate   neighbor 2.2.2.2 send-community both  exit-address-family  address-family ipv4 vrf VRF4   no synchronization   network 172.16.4.1 mask 255.255.255.255  exit-address-family  address-family ipv4 vrf VRF3   no synchronization   network 172.16.3.1 mask 255.255.255.255  exit-address-family  address-family ipv4 vrf VRF2   no synchronization   network 172.16.2.1 mask 255.255.255.255  exit-address-family  address-family ipv4 vrf VRF1   no synchronization   network 172.16.1.1 mask 255.255.255.255  exit-address-family R2 interface Loopback0  ip address 2.2.2.2 255.255.255.255 mpls label protocol ldp mpls ldp router-id Loopback0 force interface FastEthernet1/0  ip address 192.168.12.2 255.255.255.0  speed 100  full-duplex  mpls ip  no shut interface FastEthernet1/1  ip address 192.168.23.2 255.255.255.0  speed 100  full-duplex  mpls ip  no shut interface FastEthernet2/0  ip address 192.168.24.2 255.255.255.0  speed 100  full-duplex  mpls ip  no shut router ospf 1  router-id 2.2.2.2  log-adjacency-changes  network 2.2.2.2 0.0.0.0 area 0  network 192.168.12.2 0.0.0.0 area 0  network 192.168.23.2 0.0.0.0 area 0  network 192.168.24.2 0.0.0.0 area 0 router bgp 1  no bgp default ipv4-unicast  bgp log-neighbor-changes  neighbor 1.1.1.1 remote-as 1  neighbor 1.1.1.1 update-source Loopback0  neighbor 3.3.3.3 remote-as 1  neighbor 3.3.3.3 update-source Loopback0  neighbor 4.4.4.4 remote-as 1  neighbor 4.4.4.4 update-source Loopback0  address-family vpnv4   neighbor 1.1.1.1 activate   neighbor 1.1.1.1 send-community both   neighbor 1.1.1.1 route-reflector-client   neighbor 3.3.3.3 activate   neighbor 3.3.3.3 send-community both   neighbor 3.3.3.3 route-reflector-client   neighbor 4.4.4.4 activate   neighbor 4.4.4.4 send-community both   neighbor 4.4.4.4 route-reflector-client  exit-address-family R3 interface Loopback0  ip address 3.3.3.3 255.255.255.255 mpls label protocol ldp mpls ldp router-id Loopback0 force interface FastEthernet1/0  ip address 192.168.23.3 255.255.255.0  speed 100  full-duplex  mpls ip  no shut  exit ip vrf VRF1  rd 1:1  route-target export 1:1  route-target import 1:1 interface Loopback1  ip vrf forwarding VRF1  ip address 10.10.3.3 255.255.255.255 router ospf 1  router-id 3.3.3.3  log-adjacency-changes  network 3.3.3.3 0.0.0.0 area 0  network 192.168.23.3 0.0.0.0 area 0 router bgp 1  no bgp default ipv4-unicast  bgp log-neighbor-changes  neighbor 2.2.2.2 remote-as 1  neighbor 2.2.2.2 update-source Loopback0  address-family vpnv4   neighbor 2.2.2.2 activate   neighbor 2.2.2.2 send-community both  exit-address-family  address-family ipv4 vrf VRF1   no synchronization   network 10.10.3.3 mask 255.255.255.255  exit-address-family R4 interface Loopback0  ip address 4.4.4.4 255.255.255.255 mpls label protocol ldp mpls ldp router-id Loopback0 force interface FastEthernet1/0  ip address 192.168.24.4 255.255.255.0  speed 100  full-duplex  mpls ip  no shut ip vrf VRF2  rd 2:2  route-target export 2:2  route-target import 2:2 interface Loopback1  ip vrf forwarding VRF2  ip address 10.10.4.4 255.255.255.255 router ospf 1  router-id 4.4.4.4  log-adjacency-changes  network 4.4.4.4 0.0.0.0 area 0  network 192.168.24.4 0.0.0.0 area 0 router bgp 1  no bgp default ipv4-unicast  bgp log-neighbor-changes  neighbor 2.2.2.2 remote-as 1  neighbor 2.2.2.2 update-source Loopback0  !  address-family vpnv4   neighbor 2.2.2.2 activate   neighbor 2.2.2.2 send-community both  exit-address-family  !  address-family ipv4 vrf VRF2   no synchronization   network 10.10.4.4 mask 255.255.255.255  exit-address-family Now , let us check the BGP VPNv4 table and updates R1#sh bgp vpnv4 unicast all BGP table version is 9, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 1:1 (default for vrf VRF1)  *>i 10.10.3.3/32     3.3.3.3                  0    100      0 i  *>  172.16.1.1/32    0.0.0.0                  0         32768 i Route Distinguisher: 2:2 (default for vrf VRF2)  *>i 10.10.4.4/32     4.4.4.4                  0    100      0 i  *>  172.16.2.1/32    0.0.0.0                  0         32768 i Route Distinguisher: 3:3 (default for vrf VRF3)  *>  172.16.3.1/32    0.0.0.0                  0         32768 i Route Distinguisher: 4:4 (default for vrf VRF4)  *>  172.16.4.1/32    0.0.0.0                  0         32768 i R1#ping vrf VRF1 10.10.3.3 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.3.3, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 188/226/280 ms R1#ping vrf VRF2 10.10.4.4 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.10.4.4, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 168/210/248 ms R3#sh bgp vpnv4 unicast all BGP table version is 4, local router ID is 3.3.3.3 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 1:1 (default for vrf VRF1)  *>  10.10.3.3/32     0.0.0.0                  0         32768 i  *>i 172.16.1.1/32    1.1.1.1                  0    100      0 i R3#ping vrf VRF1 172.16.1.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 164/198/224 ms R4#sh bgp vpnv4 unicast all BGP table version is 4, local router ID is 4.4.4.4 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 2:2 (default for vrf VRF2)  *>  10.10.4.4/32     0.0.0.0                  0         32768 i  *>i 172.16.2.1/32    1.1.1.1                  0    100      0 i R4#ping vrf VRF2 172.16.2.1 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.2.1, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 176/215/292 ms We have connectivity between all active loopback interfaces (each in its own VRF) Let us now check what R2 (the RR) is advertising to R3 R2#sh bgp vpnv4 unicast all neighbors 3.3.3.3 advertised-routes BGP table version is 7, local router ID is 2.2.2.2 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 1:1  *>i 10.10.3.3/32     3.3.3.3                  0    100      0 i  *>i 172.16.1.1/32    1.1.1.1                  0    100      0 i Route Distinguisher: 2:2  *>i 10.10.4.4/32     4.4.4.4                  0    100      0 i  *>i 172.16.2.1/32    1.1.1.1                  0    100      0 i Route Distinguisher: 3:3  *>i 172.16.3.1/32    1.1.1.1                  0    100      0 i Route Distinguisher: 4:4  *>i 172.16.4.1/32    1.1.1.1                  0    100      0 i Total number of prefixes 6 Even though , the only active network in the VRF defined on R3 (VRF1) is 172.16.1.1 R2#sh bgp vpnv4 unicast all neighbors 4.4.4.4 advertised-routes BGP table version is 7, local router ID is 2.2.2.2 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 1:1  *>i 10.10.3.3/32     3.3.3.3                  0    100      0 i  *>i 172.16.1.1/32    1.1.1.1                  0    100      0 i Route Distinguisher: 2:2  *>i 10.10.4.4/32     4.4.4.4                  0    100      0 i  *>i 172.16.2.1/32    1.1.1.1                  0    100      0 i Route Distinguisher: 3:3  *>i 172.16.3.1/32    1.1.1.1                  0    100      0 i Route Distinguisher: 4:4  *>i 172.16.4.1/32    1.1.1.1                  0    100      0 i Total number of prefixes 6 The same applies for R4 which needs to communicate only with the loopback interface 172.16.2.1 which belongs to VRF2 Let us turn on debugging on R3 and see what is happening R3#debug bgp vpnv4 unicast updates BGP updates debugging is on for address family: VPNv4 Unicast R3#clear bgp vpnv4 unicast * soft in R3# *May 24 11:10:07.927: BGP: nbr_topo global 2.2.2.2 VPNv4 Unicast:base (0x687739D8:1) rcvd Refresh Start-of-RIB *May 24 11:10:07.927: BGP: nbr_topo global 2.2.2.2 VPNv4 Unicast:base (0x687739D8:1) refresh_epoch is 2 *May 24 11:10:08.047: BGP: 2.2.2.2 Next hop is our own address 3.3.3.3 *May 24 11:10:08.051: BGP: 2.2.2.2 Local router is the Originator; Discard update *May 24 11:10:08.055: BGP(4): 2.2.2.2 rcv UPDATE w/ attr: nexthop 3.3.3.3, origin i, localpref 100, metric 0, originator 3.3.3.3, clusterlist 2.2.2.2, merged path , AS_PATH , community , extended community RT:1:1, SSA attribute *May 24 11:10:08.067: BGPSSA ssacount is 0 *May 24 11:10:08.067: BGP(4): 2.2.2.2 rcv UPDATE about 1:1:10.10.3.3/32 -- DENIED due to: ORIGINATOR is us; MP_REACH NEXTHOP is our own address;, label 21 *May 24 11:10:08.075: BGP(4): 2.2.2.2 rcvd UPDATE w/ attr: nexthop 1.1.1.1, origin i, localpref 100, metric 0, originator 1.1.1.1, clusterlist 2.2.2.2, extended community RT:1:1 *May 24 11:10:08.087: BGP(4): 2.2.2.2 rcvd 1:1:172.16.1.1/32, label 21...duplicate ignored *May 24 11:10:08.091: BGP(4): 2.2.2.2 rcvd UPDATE w/ attr: nexthop 4.4.4.4, origin i, localpref 100, metric 0, originator 4.4.4.4, clusterlist 2.2.2.2, extended community RT:2:2 *May 24 11:10:08.099: BGP(4): 2.2.2.2 rcvd 2:2:10.10.4.4/32, label 21 -- DENIED due to:  extended community not supported; *May 24 11:10:08.107: BGP(4): 2.2.2.2 rcvd UPDATE w/ attr: nexthop 1.1.1.1, origin i, localpref 100, metric 0, originator 1.1.1.1, clusterlist 2.2.2.2, extended community RT:2:2 *May 24 11:10:08.115: BGP(4): 2.2.2.2 rcvd 2:2:172.16.2.1/32, label 22 -- DENIED due to: R3#  extended community not supported; *May 24 11:10:08.123: BGP(4): 2.2.2.2 rcvd UPDATE w/ attr: nexthop 1.1.1.1, origin i, localpref 100, metric 0, originator 1.1.1.1, clusterlist 2.2.2.2, extended community RT:3:3 *May 24 11:10:08.131: BGP(4): 2.2.2.2 rcvd 3:3:172.16.3.1/32, label 23 -- DENIED due to:  extended community not supported; *May 24 11:10:08.139: BGP(4): 2.2.2.2 rcvd UPDATE w/ attr: nexthop 1.1.1.1, origin i, localpref 100, metric 0, originator 1.1.1.1, clusterlist 2.2.2.2, extended community RT:4:4 *May 24 11:10:08.147: BGP(4): 2.2.2.2 rcvd 4:4:172.16.4.1/32, label 24 -- DENIED due to:  extended community not supported; *May 24 11:10:08.151: BGP: nbr_topo global 2.2.2.2 VPNv4 Unicast:base (0x687739D8:1) rcvd Refresh End-of-RIB We can see the DENIED due to:  extended community not supported message , which means it will never get imported in the BGP VPNv4 table due to the missing Route-target (not configured due to lack of need) Let us now turn our feature R2 router bgp 1  address-family rtfilter unicast   neighbor 1.1.1.1 activate   neighbor 1.1.1.1 send-community extended   neighbor 1.1.1.1 route-reflector-client   neighbor 1.1.1.1 default-originate   neighbor 3.3.3.3 activate   neighbor 3.3.3.3 send-community extended   neighbor 3.3.3.3 route-reflector-client   neighbor 3.3.3.3 default-originate   neighbor 4.4.4.4 activate   neighbor 4.4.4.4 send-community extended   neighbor 4.4.4.4 route-reflector-client   neighbor 4.4.4.4 default-originate R1 router bgp 1  address-family rtfilter unicast   neighbor 2.2.2.2 activate   neighbor 2.2.2.2 send-community extended R3 router bgp 1  address-family rtfilter unicast   neighbor 2.2.2.2 activate   neighbor 2.2.2.2 send-community extended R4 router bgp 1  address-family rtfilter unicast   neighbor 2.2.2.2 activate   neighbor 2.2.2.2 send-community extended R1#sh bgp vpnv4 unicast all BGP table version is 39, local router ID is 1.1.1.1 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 1:1 (default for vrf VRF1)  *>i 10.10.3.3/32     3.3.3.3                  0    100      0 i  *>  172.16.1.1/32    0.0.0.0                  0         32768 i Route Distinguisher: 2:2 (default for vrf VRF2)  *>i 10.10.4.4/32     4.4.4.4                  0    100      0 i  *>  172.16.2.1/32    0.0.0.0                  0         32768 i Route Distinguisher: 3:3 (default for vrf VRF3)  *>  172.16.3.1/32    0.0.0.0                  0         32768 i Route Distinguisher: 4:4 (default for vrf VRF4)  *>  172.16.4.1/32    0.0.0.0                  0         32768 i R3#sh bgp vpnv4 unicast all BGP table version is 19, local router ID is 3.3.3.3 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 1:1 (default for vrf VRF1)  *>  10.10.3.3/32     0.0.0.0                  0         32768 i  *>i 172.16.1.1/32    1.1.1.1                  0    100      0 i R4#sh bgp vpnv4 unicast all BGP table version is 22, local router ID is 4.4.4.4 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 2:2 (default for vrf VRF2)  *>  10.10.4.4/32     0.0.0.0                  0         32768 i  *>i 172.16.2.1/32    1.1.1.1                  0    100      0 i R2#sh bgp vpnv4 unicast all neighbors 3.3.3.3 advertised-routes BGP table version is 47, local router ID is 2.2.2.2 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 1:1  *>i 10.10.3.3/32     3.3.3.3                  0    100      0 i  *>i 172.16.1.1/32    1.1.1.1                  0    100      0 i Total number of prefixes 2 R2#sh bgp vpnv4 unicast all neighbors 4.4.4.4 advertised-routes BGP table version is 47, local router ID is 2.2.2.2 Status codes: s suppressed, d damped, h history, * valid, > best, i - internal,               r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,               x best-external, a additional-path, c RIB-compressed, Origin codes: i - IGP, e - EGP, ? - incomplete RPKI validation codes: V valid, I invalid, N Not found      Network          Next Hop            Metric LocPrf Weight Path Route Distinguisher: 2:2  *>i 10.10.4.4/32     4.4.4.4                  0    100      0 i  *>i 172.16.2.1/32    1.1.1.1                  0    100      0 i Total number of prefixes 2 Let us now turn the debugging again R3#debug bgp vpnv4 unicast updates BGP updates debugging is on for address family: VPNv4 Unicast R3#clear bgp vpnv4 unicast * soft in R3# *May 24 11:20:24.547: BGP: nbr_topo global 2.2.2.2 VPNv4 Unicast:base (0x68918044:1) rcvd Refresh Start-of-RIB *May 24 11:20:24.547: BGP: nbr_topo global 2.2.2.2 VPNv4 Unicast:base (0x68918044:1) refresh_epoch is 2 *May 24 11:20:24.559: BGP: 2.2.2.2 Next hop is our own address 3.3.3.3 *May 24 11:20:24.559: BGP: 2.2.2.2 Local router is the Originator; Discard update *May 24 11:20:24.563: BGP(4): 2.2.2.2 rcv UPDATE w/ attr: nexthop 3.3.3.3, origin i, localpref 100, metric 0, originator 3.3.3.3, clusterlist 2.2.2.2, merged path , AS_PATH , community , extended community RT:1:1, SSA attribute *May 24 11:20:24.575: BGPSSA ssacount is 0 R3# *May 24 11:20:24.579: BGP(4): 2.2.2.2 rcv UPDATE about 1:1:10.10.3.3/32 -- DENIED due to: ORIGINATOR is us; MP_REACH NEXTHOP is our own address;, label 21 *May 24 11:20:24.583: BGP(4): 2.2.2.2 rcvd UPDATE w/ attr: nexthop 1.1.1.1, origin i, localpref 100, metric 0, originator 1.1.1.1, clusterlist 2.2.2.2, extended community RT:1:1 *May 24 11:20:24.595: BGP(4): 2.2.2.2 rcvd 1:1:172.16.1.1/32, label 21...duplicate ignored *May 24 11:20:24.599: BGP: nbr_topo global 2.2.2.2 VPNv4 Unicast:base (0x68918044:1) rcvd Refresh End-of-RIB R3#sh ip bgp vpnv4 all neighbors 2.2.2.2 | inc RT Filter     Address family RT Filter: advertised and received   RT Filter activate  For address family: RT Filter R2#show ip bgp vpnv4 all nei 1.1.1.1 received rtfilters Address family: VPNv4 Unicast Extended community filter has: 4 entries with default filtering disabled Incremental refresh walk mode Status codes: * valid, S Stale > installed      Route-Target Outbound Filter *> Extended Community RT:4:4 *> Extended Community RT:3:3 *> Extended Community RT:2:2 *> Extended Community RT:1:1 R2#show ip bgp vpnv4 all nei 3.3.3.3 received rtfilters Address family: VPNv4 Unicast Extended community filter has: 1 entries with default filtering disabled Incremental refresh walk mode Status codes: * valid, S Stale > installed      Route-Target Outbound Filter *> Extended Community RT:1:1 R2#show ip bgp vpnv4 all nei 4.4.4.4 received rtfilters Address family: VPNv4 Unicast Extended community filter has: 1 entries with default filtering disabled Incremental refresh walk mode Status codes: * valid, S Stale > installed      Route-Target Outbound Filter *> Extended Community RT:2:2 ... View more

Hi all I was reading in one of Cisco Live sessions about this feature , I want to implement this feature for VPLS autodiscovery and Manual MPLS L2VPN I have tried the commands (global and under service instance) , but if anyone implemented this in production , it will be great to share Thanks BR, Mohammad ... View more

Hi all I have the below topology: CE1 -- CSR1 -- CSR2 -- CE2     |  ----     \  CSR3  / I have configured full mesh iBGP between the CSR routers under the l2vpn vpls address-family Below is the respective VPN configuration: CSRs: l2vpn vfi context MSSK  vpn id 100  autodiscovery bgp signaling ldp bridge-domain 100  member GigabitEthernet3 service-instance 100  member vfi MSSK interface GigabitEthernet3 service instance 100 ethernet encapsulation dot1q 100 CEs: interface FastEthernet1/1 switchport trunk encapsulation dot1q switchport mode trunk interface vlan 100 ip address 10.10.100.1 255.255.255.0 (CE2 is configured with 10.10.100.2) Now , the issue is that when I shutdown CSR3 G3 interface (Connected to CE1) , I lose connectivity between the CEs even though the L2VPN is established among all PEs , as well , when I check the show bgp l2vpn vpls all I cannot figure out which one is preferred Thanks BR, Mohammad Now , the issu ... View more