Cisco MPC-273 User Manual
Note This feature is available on the Cisco XR 12000 Series Router only.
Contents
Implementing MPLS VPNs over IP Tunnels on
Cisco IOS XR Software
The MPLS VPNs over IP Tunnels feature lets you deploy Layer 3 Virtual Private Network (L3VPN)
services, over an IP core network, using L2TPv3 multipoint tunneling instead of MPLS. This allows
L2TPv3 tunnels to be configured as multipoint tunnels to transport IP VPN services across the core
IP network.
Feature History for Implementing MPLS VPNs over IP Tunnels on Cisco IOS XR
Release Modification
Release 3.5.0 This feature was introduced on the Cisco XR 12000 Series Router.
Release 3.6.0 No modification.
OL-12284-01
• Prerequisites for Configuring MPLS VPNs over IP Tunnels, page MPC-274
• Restrictions for Configuring MPLS VPNs over IP Tunnels, page MPC-274
• Information About MPLS VPNs over IP Tunnels, page MPC-274
• How to Configure MPLS VPNs over IP Tunnels, page MPC-277
• Configuration Examples for MPLS VPNs over IP Tunnels, page MPC-293
• Additional References, page MPC-294
Cisco IOS XR MPLS Configuration Guide
MPC-273
Implementing MPLS VPNs over IP Tunnels on Cisco IOS XR Software
Prerequisites for Configuring MPLS VPNs over IP Tunnels
Prerequisites for Configuring MPLS VPNs over IP Tunnels
The following prerequisites are required to implement MPLS VPNs over IP Tunnels:
• You must be in a user group associated with a task group that includes the proper task IDs for
–
BGP commands
–
MPLS commands (generally)
–
MPLS Layer 3 VPN commands
For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS
XR Software module of Cisco IOS XR System Security Configuration Guide.
Restrictions for Configuring MPLS VPNs over IP Tunnels
The following restrictions apply when you configure MPLS VPNs over IP tunnels:
• MPLS forwarding cannot be enabled on a provider edge (PE) router.
Information About MPLS VPNs over IP Tunnels
To implement MPLS VPNs over IP Tunnels, you must understand the following concepts:
• Overview: MPLS VPNs over IP Tunnels, page MPC-274
• Advertising Tunnel Type and Tunnel Capabilities Between PE Routers—BGP, page MPC-275
• PE Routers and Address Space, page MPC-275
• Packet Validation Mechanism, page MPC-276
• Quality of Service Using the Modular QoS CLI, page MPC-276
• BGP Multipath Load Sharing for MPLS VPNs over IP Tunnels, page MPC-276
• Inter-AS and CSC Support over IP Tunnels, page MPC-277
Overview: MPLS VPNs over IP Tunnels
Traditionally, VPN services are deployed over IP core networks using MPLS, or L2TPv3 tunnels using
point-to-point links. However, an L2TPv3 multipoint tunnel network allows L3VPN services to be
carried through the core without the configuration of MPLS.
L2TPv3 multipoint tunneling supports multiple tunnel endpoints, which creates a full-mesh topology
that requires only one tunnel to be configured on each PE router. This permits VPN traffic to be carried
from enterprise networks across cooperating service provider core networks to remote sites.
Figure 24 illustrates the topology used for the configuration steps.
MPC-274
Cisco IOS XR MPLS Configuration Guide
OL-12284-01
Implementing MPLS VPNs over IP Tunnels on Cisco IOS XR Software
Figure 24 Basic MPLS VPN over IP Topology
Information About MPLS VPNs over IP Tunnels
1.1.1.1
V4: 100.1.10.0/24
V6: 100.1.10.0/64
Prefix Advertised
V4: 110.0.0.1/18
V6: 110::1/120
PE-1 PE-2
IPv4
Network
(w/ ISIS)
3.3.3.3
V4: 200.1.10.0/24
V6: 200.1.10.0/64
Prefix Advertised
V4: 210.0.0.1/18
V6: 210::1/120
210625
Advertising Tunnel Type and Tunnel Capabilities Between PE Routers—BGP
Border Gateway Protocol (BGP) is used to advertise the tunnel endpoints and the subaddress family
identifier (SAFI) specific attributes (which contains the tunnel type, and tunnel capabilities). This
feature introduces the tunnel SAFI and the BGP SAFI-Specific Attribute (SSA) attribute.
These attributes allow BGP to distribute tunnel encapsulation information between PE routers. VPNv4
traffic is routed through these tunnels. The next hop, advertised in BGP VPNv4 updates, determines
which tunnel to use for routing tunnel traffic.
SAFI
The tunnel SAFI defines the tunnel endpoint and carries the endpoint IPv4 address and next hop. It is
identified by the SAFI number 64.
BGP SSA
The BGP SSA carries the BGP preference and BGP flags. It also carries the tunnel cookie, tunnel cookie
length, and session ID. It is identified by attribute number 19.
PE Routers and Address Space
One multipoint L2TPv3 tunnel must be configured on each PE router. To create the VPN, you must
configure a unique Virtual Routing and Forwarding (VRF) instance. The tunnel that transports the VPN
traffic across the core network resides in its own address space. A special purpose VRF called a Resolve
in VRF (RiV) is created to manage the tunnel address space. You also configure the address space under
the RiV that is associated with the tunnel and a static route in the RiV to route outgoing traffic through
the tunnel.
OL-12284-01
Cisco IOS XR MPLS Configuration Guide
MPC-275
Implementing MPLS VPNs over IP Tunnels on Cisco IOS XR Software
Information About MPLS VPNs over IP Tunnels
Packet Validation Mechanism
The MPLS VPNs over IP Tunnels feature provides a simple mechanism to validate received packets
from appropriate peers. The multipoint L2TPv3 tunnel header is automatically configured with a 64-bit
cookie and L2TPv3 session ID. This packet validation mechanism protects the VPN from illegitimate
traffic sources. The cookie and session ID are not user-configurable, but they are visible in the packet as
it is routed between the two tunnel endpoints. Note that this packet validation mechanism does not
protect the VPN from hackers who are able to monitor legitimate traffic between PE routers.
Quality of Service Using the Modular QoS CLI
To configure the bandwidth on the encapsulation and decapsulation interfaces, use the modular QoS CLI
(MQC).
Note This task is optional.
Use the MQC to configure the IP precedence or Differentiated Services Code Point (DSCP) value set in
the IP carrier header during packet encapsulation. To set these values, enter a standalone set command
or a police command using the keyword tunnel. In the input policy on the encapsulation interface, you
can set the precedence or DSCP value in the IP payload header by using MQC commands without the
keyword tunnel.
Note You must attach a QoS policy to the physical interface—not to the tunnel interface.
If Modified Deficit Round Robin (MDRR)/Weighted Random Early Detection (WRED) is configured
for the encapsulation interface in the input direction, the final value of the precedence or DSCP field in
the IP carrier header is used to determine the precedence class for which the MDRR/WRED policy is
applied. On the decapsulation interface in the input direction, you can configure a QoS policy based on
the precedence or DSCP value in the IP carrier header of the received packet. In this case, an MQC policy
with a class to match on precedence or DSCP value will match the precedence or DSCP value in the
received IP carrier header. Similarly, the precedence class for which the MDRR/WRED policy is applied
on the decapsulation input direction is also determined by precedence or DSCP value in the IP carrier
header.
BGP Multipath Load Sharing for MPLS VPNs over IP Tunnels
BGP Multipath Load Sharing for EBGP and IBGP lets you configure multipath load balancing with both
external BGP and internal BGP paths in BGP networks that are configured to use MPLS VPNs. (When
faced with multiple routes to the same destination, BGP chooses the best route for routing traffic toward
the destination so that no individual router is overburdened.)
BGP Multipath Load Sharing is useful for multihomed autonomous systems and PE routers that import
both EBGP and IBGP paths from multihomed and stub networks.
MPC-276
Cisco IOS XR MPLS Configuration Guide
OL-12284-01
Implementing MPLS VPNs over IP Tunnels on Cisco IOS XR Software
How to Configure MPLS VPNs over IP Tunnels
Inter-AS and CSC Support over IP Tunnels
The L3VPN Inter-AS feature provides a method of interconnecting VPNs between different VPN service
providers. Inter-AS supports connecting different VPN service providers to provide native IP L3VPN
services. For more information about Inter-AS, see Implementing MPLS Layer 3 VPNs on
Cisco IOS XR Software.
Carrier Supporting Carrier (CSC) is implemented in circumstances in which one service provider needs
to use the transport services provided by another service provider. The service provider that provides the
transport is called the backbone carrier. The service provider, which uses the services provided by the
backbone carrier, is called a customer carrier. Backbone carriers with CSC, bridge two or more customer
carrier sites through an MPLS VPN/MPLS VPN over IP tunnels backbone. For more information about
CSC, see Implementing MPLS VPNs over IP Tunnels on Cisco IOS XR Software.
How to Configure MPLS VPNs over IP Tunnels
The following procedures are required to configure MPLS VPN over IP:
• Configuring the Global VRF Definition, page MPC-277 (required)
• Configuring a Route-Policy Definition, page MPC-279 (required)
• Configuring a Static Route, page MPC-280 (required)
• Configuring an IPv4 Loopback Interface, page MPC-281 (required)
• Configuring a CFI VRF Interface, page MPC-283 (required)
• Configuring the Core Network, page MPC-284 (required)
• Configuring Inter-AS and CSC support over IP Tunnels, page MPC-285
• Verifying MPLS VPN over IP, page MPC-292 (optional)
Note All procedures occur on the local PE (PE1). Corresponding procedures must be configured on the remote
PE (PE2).
Configuring the Global VRF Definition
Perform this task to configure the global VRF definition.
SUMMARY STEPS
1. configure
2. vrf vrf-name
3. address-family ipv4 unicast
OL-12284-01
4. import route-target [0-65535.0-65535:0-65535 | as-number:nn | ip-address:nn]
5. export route-target [0-65535.0-65535:0-65535 | as-number:nn | ip-address:nn]
6. exit
7. address-family ipv6 unicast
8. import route-target [0-65535.0-65535:0-65535 | as-number:nn | ip-address:nn]
Cisco IOS XR MPLS Configuration Guide
MPC-277
How to Configure MPLS VPNs over IP Tunnels
9. export route-target [0-65535.0-65535:0-65535 | as-number:nn | ip-address:nn]
10. end
or
commit
DETAILED STEPS
Command or Action Purpose
Step 1
configure
Example:
RP/0/RP0/CPU0:router# configure
Step 2
vrf vrf-name
Example:
RP/0/RP0/CPU0:router(config)# vrf vrf-name
Step 3
address-family ipv4 unicast
Implementing MPLS VPNs over IP Tunnels on Cisco IOS XR Software
Enters global configuration mode.
Specifies a name assigned to a VRF.
Specifies an IPv4 address-family address.
Step 4
Step 5
Step 6
Step 7
Example:
RP/0/RP0/CPU0:router(config-vrf)#
address-family ipv4 unicast
import route-target [0-65535.0-65535:0-65535 |
as-number:nn | ip-address:nn]
Example:
RP/0/RP0/CPU0:router(config-vrf-af)# import
route-target 500:99
export route-target [0-65535.0-65535:0-65535 |
as-number:nn | ip-address:nn]
Example:
RP/0/RP0/CPU0:router(config-vrf-af)# export
route-target 700:44
exit
Example:
RP/0/RP0/CPU0:router(config-vrf-af)# exit
address-family ipv6 unicast
Example:
RP/0/RP0/CPU0:router(config-vrf)#
address-family ipv6 unicast
Configures a VPN routing and forwarding (VRF) import
route-target extended community.
Configures a VPN routing and forwarding (VRF) export
route-target extended community.
Exits interface configuration mode.
Specifies an IPv6 address-family address.
MPC-278
Cisco IOS XR MPLS Configuration Guide
OL-12284-01
Implementing MPLS VPNs over IP Tunnels on Cisco IOS XR Software
Command or Action Purpose
Step 8
import route-target [0-65535.0-65535:0-65535 |
as-number:nn | ip-address:nn]
Example:
RP/0/RP0/CPU0:router(config-vrf-af)# import
route-target 500:99
Step 9
export route-target [0-65535.0-65535:0-65535 |
as-number:nn | ip-address:nn]
Example:
RP/0/RP0/CPU0:router(config-vrf-af)# import
route-target 700:88
Step 10
end
or
commit
Example:
RP/0/RP0/CPU0:router(config-vrf-af)# end
or
RP/0/RP0/CPU0:router(config-vrf-af)# commit
How to Configure MPLS VPNs over IP Tunnels
Configures a VPN routing and forwarding (VRF) import
route-target extended community.
Configures a VPN routing and forwarding (VRF) export
route-target extended community.
Saves configuration changes.
• When you issue the end command, the system prompts
you to commit changes:
Uncommitted changes found, commit them before
exiting(yes/no/cancel)?
[cancel]:
–
Entering yes saves configuration changes to the
running configuration file, exits the configuration
session, and returns the router to EXEC mode.
Configuring a Route-Policy Definition
Perform this task to configure a route-policy definition for CE-PE EBGP.
SUMMARY STEPS
1. configure
2. route-policy name pass
3. end policy
–
Entering no exits the configuration session and
returns the router to EXEC mode without
committing the configuration changes.
–
Entering cancel leaves the router in the current
configuration session without exiting or
committing the configuration changes.
• Use the commit command to save the configuration
changes to the running configuration file and remain
within the configuration session.
OL-12284-01
Cisco IOS XR MPLS Configuration Guide
MPC-279
How to Configure MPLS VPNs over IP Tunnels
DETAILED STEPS
Command or Action Purpose
Step 1
configure
Example:
RP/0/RP0/CPU0:router# configure
Step 2
route-policy name pass
Example:
RP/0/RP0/CPU0:router(config)# route-policy
ottawa_admin pass
Step 3
end policy
Example:
RP/0/RP0/CPU0:router(config-rpl)# end policy
Implementing MPLS VPNs over IP Tunnels on Cisco IOS XR Software
Enters global configuration mode.
Defines and passes a route policy.
End of route-policy definition.
Configuring a Static Route
Perform this task to add more than 4K static routes (Global/VRF).
SUMMARY STEPS
1. configure
2. router static
3. maximum path ipv4 1-140000
4. maximum path ipv6 1-140000
5. end
or
commit
DETAILED STEPS
Command or Action Purpose
Step 1
Step 2
configure
Example:
RP/0/RP0/CPU0:router# configure
router static
Enters global configuration mode.
Enters static route configuration subcommands.
MPC-280
Example:
RP/0/RP0/CPU0:router(config)# router static
Cisco IOS XR MPLS Configuration Guide
OL-12284-01
Loading...