Inter-AS Options

I'm looking into extending the mpls network by NNI with other SPs. For scalability reason, most dosc recommended to use Option B (MP-eBGP for VPNv4) for the Inter-AS connectivity.
However, it seems that most SPs that i talked to prefer Option A (back-to-back vrf). Reasons being:
- setup is easier, does not require standardization of RT
- provisioning & fault isolation is easier, as each customer is under a separate vrf at the ASBR. Also, when there is configuration mistake, it will be less likely to affect other customers that is on the same NNI.
- traffic control (eg. shaping) per customer is possible across the NNI
Not sure if Option A is the norm in the industry. Hope to hear some input from your guys. Thanks :)

thats the one thing that stops me from advising implementing option C. The security headache + politics of two different companies security teams actually agreeing just doesnt make it worth the extra hassle. I agree with Harry that option C is by far the best scalable solution but because of the issues I have already said I ONLY use option B. The thing that I also do differently is I do not turn off route-target filtering and instead create a vrf with only having a RT import on it. This way the PE-ASBR only has to hold the vpnv4 routing tables that it is really interested in. The other neat "in the middle" solution is to connect between ASBRs with two gig connections and peer between loopbacks. This way you can load balance the traffic over the two gig links. The command to do this is mpls bgp forwarding on the actual interfaces and you also need to create a static route pointing the other providers loopback address. You then redistribute this static into your IGP. Yes, I hear Harry shouting whats the difference from doing that to option C. For some really odd reason the security chappies are happier with this single IP address and find it easier on their brains to secure. Dont ask me why - I just go for the solution of simple life.

Similar Messages

Inter-AS option B statistics

Hello,
we would like to measure the traffic per vrf in case of Inter-AS option B on the interconnecting links between the providers.
How can we do it? AFAIK bgp-policy accounting supports only standard community-list, if it could support extcommunity-list, then we would have a solution.
BR, Attila

Fly,
I am not sure what you mean by VRF interface. You don't really need a VRF interface. You only need to create a VRF context with the same RT import export as the VPN in question. The aggregation would be done at the "address-family ipv4 vrf xxx" level, not at the vpnv4 level. The aggregate will cause an aggregate label to be installed in the LFIB and advertised to the remote PEs via BGP vpnv4. The more specific routes will be installed in the FIB for the specific VRF context. When packets arrive at the ASBR with the aggregate label, the label will be removed and a second lookup will be performed against the FIB for the VRF context.
Regards

Inter-as option B summary vpnv4 route at ASBR boundary

inter-as option B, can i summary vpnv4 route at asbr boundary.
i create VRF at boundary asbr, and summary vpnv4 route from upstream PE, but i can't ping destination vrf pc.
i trace,the traffic end at ASBR VRF interface. and ASBR vrf can't forward traffic back to destion PE.
is there any solution i can summary vpn route at boundary ASBR.
thank you!
fly

Fly,
I am not sure what you mean by VRF interface. You don't really need a VRF interface. You only need to create a VRF context with the same RT import export as the VPN in question. The aggregation would be done at the "address-family ipv4 vrf xxx" level, not at the vpnv4 level. The aggregate will cause an aggregate label to be installed in the LFIB and advertised to the remote PEs via BGP vpnv4. The more specific routes will be installed in the FIB for the specific VRF context. When packets arrive at the ASBR with the aggregate label, the label will be removed and a second lookup will be performed against the FIB for the VRF context.
Regards

VPLS BGP signaling configuration for L2VPN Inter-AS Option A

Hi All,
does someone confirm with me for VPLS BGP Signaling feature is available on Cisco ASR 9K XR version right now ? or coming soon ?
if not, did someone have a fully configuration example ( from end to end, and including MPLS setup ) under IOS version for L2VPN Inter-AS Option A?
it would be much appreciated if you could share with me !
Eric

hello belalcciejo,
has your problem been resolved already ? since I am starting work on same setup right now. could you mind share your Cisco end configuration to me without your confidential information?
thanks, please let me know if possible.
Eric

InterAS MPLS Option C (BGP IPv4 + Labels) IOS XR with eBGP multihop session

Hello,
Right now we have InterAS MPLS Option C configured between 2 autonomous systems.
Now we need to add more bandwith and would like to add another interface between the two routers establishing a multihop session using loopbacks to load share traffic.
I know that IOS-XR does not automatically learn directly connected host routes so for the XR router to assign labels you'll need to configure a static host route to ensure MPLS forwarding to the neighboring AS.
This works with directly connected neighbors but when I try to enable the multihop session, the XR does not assign labels even configuring the staic host route.
Does anybody has a configuration like that working?
Thanks!!
Jose.

Hello Jose
There are basically two options in Option C L3VPN setup. I will discuss the first option for Multihop.
Following are the key points that distinguish the InterAS Option C from previous options.
1) External Multihop BGP address families are invoked between two different autonomous systems; however, these eBGP sessions are invoked between the route reflectors in each AS and not on the ASBR. The route reflector in each AS thus passes labeled ipv4 unicast VPN routes to the other AS. Note:- The route reflector in this case will have PE clients in the vpnv4 address family within that Autonomous System.
2) ASBRs facilitate the creation of InterAS LSP by providing labeled /32s for PE and Route Reflector loopback.
3) This option enhances scalability because ASBRs do not handle VPNv4 routes in fact this option gets rid of the extra L3VPN LFIB that is created as a result of option B . The LFIB size is minimal as we control the redistribution to the only 2 needed loopback addresses (remote ASBR and remote RR)
Sample config of the RR:
router bgp 102
address-family ipv4 unicast
address-family vpnv4 unicast
neighbor-group ibgp
remote-as 102
update-source Loopback0
address-family ipv4 unicast
   route-reflector-client
address-family vpnv4 unicast
   route-reflector-client
neighbor 192.168.253.3
remote-as 101
ebgp-multihop 255
description eBGP-RR-PEER-AS101
update-source Loopback0
address-family vpnv4 unicast
   route-policy allow-all in
   route-policy allow-all out
   next-hop-unchanged
neighbor 192.168.254.1
use neighbor-group ibgp
neighbor 192.168.254.3
use neighbor-group ibgp
neighbor 192.168.254.4
use neighbor-group ibgp
On the PE router, the config will look something like this:
router bgp 102
address-family ipv4 unicast
redistribute ospf 1 metric 3333 route-policy interAS-optionc-out
allocate-label route-policy interAS-optionc-out
neighbor 65.10.20.1
remote-as 101
address-family ipv4 labeled-unicast
   route-policy interAS-optionc-in in
   route-policy interAS-optionc-out out
neighbor 192.168.254.2
remote-as 102
update-source Loopback0
address-family ipv4 unicast
router static
address-family ipv4 unicast
65.10.20.1/32 TenGigE0/0/0/1
192.0.2.0/24 Null0 tag 10
route-policy interAS-optionc-in
if destination in remote-RR-PE then
    pass
else
    drop
endif
end-policy
route-policy interAS-optionc-out
if destination in local-RR-PE then
    pass
else
    drop
endif
end-policy
prefix-set local-RR-PE
192.168.254.2/32,
192.168.253.6/32,
192.168.253.5/32
end-set
prefix-set remote-RR-PE
192.168.253.2/32,
192.168.253.3/32,
192.168.253.3/32
end-set
Just for your clarification, 192.168.253.0/24 is the Remote AS networks and 192.168.254.0/24 is the local AS networks.
Hope this clarifies your doubts.
Cheers ... !!!
Vinit

L3VPN Inter-AS Option B with Inter-AS TE

Is it possible to route L3VPN traffic through a Inter-AS TE tunnel when Option B is the configuration? If you can please post sample configs with explanations.

can you try to usedestination IP in the hean end that point to the tail-end IP
and use static route that for this IP point to the TE tunnel
e.g.
tunnelx
tunnel destination 2.2.2.2
ip route 2.2.2.2 255.255.255.255 tunnel x
then you may staticaly route traffic to TE tunnel for Layer 3 VPN traffic or autoroute once the next hope is chnaged to 2.2.2.2
To change the next hope of L3VPN MP-iBGP using route-map by making it using the tailend IP (2.2.2.2 ) under the relevant bgp address-family/VPNv4 at the ASBR/RR toward the desired PE ( head end )
e.g
ASBR/RR
bgp xx
address-family vpnv4neighbor [head-end/PE IP] route-map map1 out
route-map map1 permit
set ip next-hope 2.2.2.2
in the path option you should have both your AS ASBR and the remote AS ASBR IPs
in the ASBR of both ends in te phsycial interface facing the other AS:
int x/x
mpls traffic-eng passive-interface nbr-te-id [next-hop ASBR IP ] nbr-igp-id ospf [next-hop ASBR IP]
and let us know if this help !
Message was edited by: Marwan

When i inter to options and set the font in the content tab to larger number like 20 or another number and click ok it not respond and the font stell as it is what i can do for solving that problem ?

when opening the firefox page and go to search the font is small and when try to make it large throught the content tab it not respond

Hi Gaurav
I already locked for a OSS note, but i could not find the answer
Please, Could you tell me how you solve the problem?
Thanks
Ariel

Option A, 2 PE pair per Provider, Redundancy

Hi All,
Requesting suggestions for the following scenario, let's say we have 2 service providers (SP) offering MPLS VPNs through Option A (Back to Back VRF).
These SPs are connecting through two PE/ASBRs each, like SP As, PE_A1 and PE_A2 and SP Bs, PE_B1 and PE_B2.
PE_A1 is connected to PE_B1 and PE_A2 is connected to PE_B2, this configuration is to offer PE redundancy.
I am thinking of having HSRP between these different PEs. But reckon there has to be a better way to do this.
Any suggestions?
Thanks
Cheers
~sultan

Hi Sultan,
You seem to like challenges and thrilling changes ;-)
Well,
I guess what might also be interesting to you: "MPLS VPN - Inter-AS Option AB"
http://www.cisco.com/en/US/docs/ios/mpls/configuration/guide/mp_vpn_ias_optab.html
With this option you have VRF back-to-back, but only 1 MP-BGP session between ASBRs.
Gernerally potential issues are similar to a normal PE-CE situation
- protection from too many routes
- scalability in general
- PE security
- There was something I saw about BGP router-ID being the same for different VRFs and issues arising from this, but can neither remember the details nor find the reference.
Hope this helps!
Regards,
Martin

TE and Inter AS material ???

Hi,
I am confuse in TE and Inter AS topics,please any one explain me these and give me easy material if have ????
I found something for Inter AS option A,B,C but was tuff and confusing couldnt clearly understand all
specially where to use "send-lable","next-hop unchanged"!!!!
Bye,

Hi,
"send-label" and "next-hop-unchanged" are not related to TE. They are related to InterAS.
By default, when BGP advertise a VPNv4 prefix with nexthop as self, it will assign a local label and advertise to neighbors. But with any otehr address-family, it needs to be explicitly mentioned. SO when a label needs to be advertised via BGP (for IPv6 Unicast or IPv4 unicast), we need to use "send-label" to instruct BGP to assign a local label.
"next-hop-unchaned" is used in Option C. Inter-As Option C is something used in operators where both AS opeators agrees to exchange their internal address details (can be limited to just the edge PE node loopback address). This is commonly seen in merge scenarios.
In such scenarios, we establish a VPNv4 session between RRs on each AS and mark it as next-hop-unexchanged. For example, assume the below simple scenario,
(PE1-AS1)-----(RR-AS1)-----(Edge-AS1)--------(Edge-AS2)------(RR-AS2)------(PE1-AS2)
Assume x-AS1 are in AS1 and x-AS2 are in AS2.
When Option C is used, PE1-AS1 address will be advertised to RR-AS1 adn Edge-AS1 via IGP used in AS1 (say IGP1) and PE1-AS2 address will be advertised to RR-AS2 and Edge-AS2 via IGP used in AS2 (say IGP2).
Now edge PE node details needs to be exchanged between AS. To be more specific, PE1-AS1 should be advertised to AS2 and PE1-AS2 to be advertised by AS1. This is simply done by BGP unicast session between Edge-AS1 and Edge-AS2 (this helps avoid anotehr instance of IGP between edge nodes). As mentioned by default only VPNv4 session assign and adveritise label while the session between Edge-AS1 and Edge-AS2 is IPv4 Unicast. So we need to explicitly mention "send-label".
All VPNv4 prefixes from PE nodes will be advertised to RR and in turn will be advertised to RR-AS2. eBGP will set the nexthop as self before advertiing. To overrule this, we use "nexthop-unchanged".
When VPN1 prefix is adverised by PE1-AS1 to RR-AS1, it set nexthop as self. RR-AS1 while advertising to RR-AS2 will NOT change teh nexthop (due to nexthop-unchanged). RR-AS2 will inturn advertise to PE1-AS2 without changing the nexthop (follows traditional iBGP behaviour).
PE1-AS2 will have in its local table the label advertised by PE1-AS1 and push it as bottom label. On top of it, it include the label to reach PE1-AS1 whcih was advertised by Edge-AS2 and middle label and top of it the IGP label to reach Edge-AS2.
HTH,
Nagendra

Cisco ASA 5520 (asa 8.2) hairpinning

Hi All,
We have a ASA 5520 (redundant) in our network which we are using for different customers. For every new customer we create a new VLAN and place their servers in this VLAN. On the ASA we create a new subinterface for every customer which is connected to the corresponding VLAN.
Most customers get a private ip-range (e.g. 192.168.x.x/24) on which they should configure their servers. Because most customers don't need to be to access eachothers server all VLAN interfaces have the same security-level of 50. I haven't enable the "same-security-traffic permit inter-interface" option, so traffic between those interfaces is blocked, as expected.
Some customers (e.g. customer A) need public webmail of smtp access to there servers. So we use both NAT and PAT to make that happen.
So, recently we've got a customer (customer B) who placed their webservers behind our ASA. Because we didn't want to use NAT statements all the time, we dediced to configure a public /29 subnet on their VLAN. Because the website on this customer's servers need to be visible for everybody, we've lowered the security-level of this VLAN interface to 40 (instead of 50) and applied some ACL's. So other customers (e.g. customer A) are also able to reach the websites of customer B. So everything is just working fine.
Now, customer A decided that they want to run their website on their own servers as well. So, I created a static PAT for TCP 80. So the website is accessible from the outside world. But.....customer B is not able to reach customer A's website on the translated address. So, I've created a second PAT (using the same public address) but this time to customer B's interface. But still, we're not able to reach customer A's website.
I've also enabled the "same-security-traffic permit intra-interface", but still the website is unreachable to customer B.
Here's a small drawing of the situation:
The ip-addresses are, of course, not real.
Can anybody place help me with this issue?

That's a very cool command that I didn't know about.
I see that the packet is drop at phase 7 (NAT-EXEMPT).
Phase: 7
Type: NAT-EXEMPT
Subtype: rpf-check
Result: DROP
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x74455b60, priority=6, domain=nat-exempt-reverse, deny=false
        hits=61, user_data=0x744558f0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip=Cust_B_LAN, mask=255.255.255.240, port=0
        dst ip=Cust_A_LAN, mask=255.255.255.0, port=0, dscp=0x0
Result:
input-interface: Cust_B
input-status: up
input-line-status: up
output-interface: Cust_A
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
I seemed that I had a nonat rule messing the communication between these interfaces. After removing it, the traffic was flowing just fine.
Thanks for your support.
Ron

BGP Best Practice / Private-AS vs. Public-AS in the MPLS Core

Dears,
We have recently aquired a large network with ASR9K as Internet Gateways and non-Cisco devices in the MPLS Core.
We would liike to know which is the best recommended solution to use Private MP-BGP AS in the MPLS Core or extend the IGW Public AS, knowing that the IGW will be in a VRF and not the global routing table. Moreover, the clients of the MPLS Core have their own BGP Public AS and would need to connect to the MPLS Core to obtain internet services from the IGW.
(Cust1)------EBGP------[VRF_Cust_1](MPLS CORE AS_2)[VRF_IGW]------EBGP-----(IGW AS_1) in the case of having a private BGP AS in the core
(Cust1)------EBGP------[VRF_Cust_1](MPLS CORE AS_1)[VRF_IGW]------iBGP-----(IGW AS_1) in the case of having same public BGP AS in the core
Waiting for your feedback and thoughts.
Thanks,
Michel.

Michel,
if your mpls core is also used for internet transit, then it is best to be a public AS.
if not, then you can leave it be and remove the private AS at your border routers.
If oyu are connecting multiple MPLS networks together to link L2 or L3 VPN services, I think it is easiest to have it all one AS, otherwise you end up with complex designs such as Carrier supporting Carrier (CSC) or Inter-AS option A (vrf lite), B (using vpnv4 at the inter AS gateay) or C (using vpnv4 at the interAS gateway with route reflectors in each AS peering with each other).
regards
xander
Xander Thuijs CCIE #6775
Principal Engineer
ASR9000, CRS, NCS6000 & IOS-XR

OSPF design for branch offices across MPLS

Hello fellow networking engineers,
I want to implement OSPF in our network. We have multiple branch offices, all linked to an MPLS backbone.
I know that in order to get linked areas, I would need to setup GRE tunnels between them, but I want to avoid static/manual configurations as much as possible. With multiple sites, it would become cumbersome to create a mesh real fast.
Is running OSPF independent areas at each site, and simply redistributing over eBGP a valid solution? This will host voice and data, and will failover to VPN connection (Cisco ASAs) if the MPLS goes down.
For the VPN backup links, I thought of two options. Either simply using the default route to send everything to the ASA in case of MPLS "death", or inject routes using IP SLA...
Any input would be appreciated.

Marc
You don't GRE tunnels to link your areas if that is what you want to do.
If the SP supports it then you can exchange your OSPF routes between areas and they will still be seen as inter area routes rather than OSPF externals which they would if you simply treated each area as isolated from each other.
In effect the MPLS network becomes an OSPF super backbone area and your main site would also be part of the backbone area with all your other sites having an area each.
You still redistribute your OSPF routes into BGP but with some extra configuration on both your CEs and the SP PE devices.
Like I say you would need to check with your SP but it is possible.
Whether or not you need or want it I don't know.
Your other option is as you have proposed to treat each OSPF area as an isolated one and simply redistribute into OSPF at each CE. Then within each site all non local routes would be seen as OSPF external routes.
Either way in terms of backup I would keep it simple and use a default route at each site pointing to the ASA device. I can't see what you gain from IP SLA because if the main MPLS link goes down at any site the only other path they have out is via the ASA so there is nothing really worth tracking.
The only other thing I would mention is remote site to remote site traffic. If there is any then presumably with your VPN tunnels you would be doing a sort of hub and spoke where the hub is the main site so you may need to think about traffic coming in from one VPN tunnel and going out to another VPN tunnel on the main site ASA.
This would only really be needed if two or more sites had to use their backup links at the same time.
In terms of which is better ie. OSPF inter area across the MPLS cloud or OSPF externals I can't really say to be honest. With the MPLS networks i have worked on we ran EIGRP and simply treated each remote site as an isolated AS.
If you are already running OSPF then you may want to preserve your existing areas so it would make sense to go with the inter area option.
If it is a new setup then I don't really know the pros and cons of either so can't really comment.
Perhaps others may add to the thread with their thoughts.
Jon

My Internal Speaker`s aren`t working

After my laptop was really hot i opened it and for some reason the volume wasn`t working and their is no red light and no inter speaker option in my prefrence

Hopefully one of these steps should solve the problem.
1. System Preference > Sound > Output > Internal Speakers
    Highlight Internal Speakers
    Make sure that Mute is not enabled
2. Reset PRAM. http://support.apple.com/kb/PH4405
3. Reset SMC.     http://support.apple.com/kb/HT3964
    Choose the method for:
    "Resetting SMC on portables with a battery you should not remove on your own".
4. Applications > Utilities > Audio MIDI Setup
    Audio Devices window
    Side Bar
    Click the Built-in Output.
    Under "Mute" any of the boxes checked? If so, uncheck it.
5. If this does not help, contact Apple.

Optimizing / compressing video for web with Quicktime

I have a ~70mb (3 minutes long) m4v video that I need to get to a much more reasonable file size for playing on a site that will primarily be accessed via iPad.
I don't know if it matters, but the video will need to play automatically upon page load.
I've read through a few tutorials for doing this with Quicktime, however I think I'm missing something..
From the Export pop-up menu, there should seemingly be an option to choose "Movie to QuickTime Movie." I have only 480p and iPod/iPhone/iPad options(which I believe would result in a viewing frame that is too small).
How can I proceed with web-optimizing this file in Quicktime? (Or is there a better solution? I tried Sorenson Squeeze, but that had a large watermark..)

I have a ~70mb (3 minutes long) m4v video that I need to get to a much more reasonable file size for playing on a site that will primarily be accessed via iPad.
File size is directly proportional to the combined total data rate of your file. If you want a smaller file, then you need to reduce the audio + video data rate of the file. Unfortunately, overly reducing the data rate can adversely affect the audio/video quality of the file. Depending on the encode settings (data rate, encode matrix dimensions, display dimensions, entropy option, intra/inter frame options, number of encode passes, etc.), user tolerance for minimum quality level, the specific target ISP speeds required, application to be used, etc., the possibilities are relatively endless. Basically, the file you describe above has a combined total data rate on the order of 3.1 Mbps. Such a data rate might be considered low for a full 1080p file, adequate for a 720p file, or excessive for a VGA file depending on the graphic complexity of the file. In short, it is difficult to properly answer your question without additional information or actually seeing the file in question. (I.e., proper encoding of content is as much an art as a science.)
I don't know if it matters, but the video will need to play automatically upon page load.
It may matter depending on how the web site is coded and/or how the content is to be accessed by the target iPad device.
From the Export pop-up menu, there should seemingly be an option to choose "Movie to QuickTime Movie." I have only 480p and iPod/iPhone/iPad options(which I believe would result in a viewing frame that is too small).
The option and tutorial you reference require the use of QT 7 Pro which the option you reference sounds nore like a QT X player export option. (Once, again, what you can do will depend on the software you are trying to use to create your file and a 480p file could normally be anything from an 853x480 (16:9 aspect) file to a 640x480 (4:3 aspect) file or an anamorphic 720x480 file displaying in either the 16:9 or 4:3 aspect. So I really don't know what you consider a "small" viewing frame.
How can I proceed with web-optimizing this file in Quicktime? (Or is there a better solution? I tried Sorenson Squeeze, but that had a large watermark..)
As previously mentioned, there are many applications that can be used here—QT 7 Pro, MPEG Streamclip, QT X, HandBrake, etc. to name just a few. I personally would recommend the free HandBrake app since it offers both manual and automatic preset options, as well as, allowing you to create anamorphic or non-anamorphic encodes targeting either a fixed level of quality or a target file size depening on your needs. Unfortunately, the more options you have, the more decisions you need to make which means the more you need to critically analyze your target needs/requirements—which is frequently something many video users are trying to avoid.
Basically, if you want more specific advice, you will first have to better define your specific needs here.

Connecting 2 MPLS networks together

Need some advice on connecting 2 MPLS networks together from two different ISPs. The compnay I am working with is using AT&T MPLS and they aquired a smaller company using SBC MPLS. We want to connect the two networks together for the shorterm and eventually the goal would be to add te new sites to the AT&T MPLS.

You have two options here,
1) you can talk to you SP regarding the situation and they should be able to put across a inter-AS solution for you, and this should be possible looking at the close ties between ATnT and SBC.
2) If you plan to go ahead with this on your own, since its only a transitionary situation, you can think of interconnecting both the networks core at the closest possible location terming them as border gateway routers. And then keep migrating the smaller companies sites to the your existing SP's network.
But do note that if there are overlapping IP addresses between both the networks then you may have to consider a NAT gateway in addition to the border gw routers. If you plan to use the Inter-as option, the SP would have a NAT gw solution for the same.
Overall you need a crystal clear plan before you go ahead with any of the options.
HTH-Cheers,
Swaroop

Inter-AS Options

Similar Messages

Maybe you are looking for