L3 MPLS-VPN with ATM Interfaces

Hi
I tacked a L3 MPLS-VPN from a MPLS service provider.My VPN have three points.
In first point, I have a PA-A3-OC3 over cisco router 7206. how can I config to place PVC1/2 into VPN?

You need that pvc to be under a separate sub-interface and then you can configure "ip vrf for " under that sub-interface.
Hope this helps,

Similar Messages

MPLS Info with ATM Cloud

Hello. I am not to well versed in MPLS but would like to know if there is something that provides the PRO's and CON's to MPLS plus learning a little something to be able to help. I have a client that just moved into a ATM cloud with an ISP and they have some 75xx, 73xx, and 38xx routers and wants some documentation on cost, feasability, and if it's worth the effort. Anything would be helpful.
Thanks

I think the best thing to do at this point is to familiarize yourself with MPLS. A good starting point would be www.cisco.com/go/mpls, which contains a wealth of information pertaining to MPLS.
Hope this helps,

MPLS VPNs alongwith T1 and sub-rate SONET/SDH connections

Hi,
I know this question might seem out of place in this particular forum, I apologize for that.
We currently offer MPLS VPN services on my Cisco 7600 platform with supported FE/GE modules.
Coming to my question, can I offer DS0/T1 services without adding a new optical (SONET/SDH) box and on the same 7600 (I have enough slots available)
I was thinking of this particular module for delivering the required additional services:
http://www.cisco.com/en/US/docs/routers/7600/install_config/12.2SX_OSM_config/Prtn.html
and
http://www.cisco.com/en/US/docs/routers/7600/install_config/12.2SX_OSM_config/crns.html
Is anyone of you guys doing something similar?
I would request for some inputs w.r.t. stability and/or other factors I should consider before I start to seriously think of them as an alternative option instead of going for separate Optical devices.
P.S.: This is not MPLS VPNs on subrate interfaces but subrate/T1 'IPLC' service by itself.
Thanks
Cheers
~sultan

No, you will need to put an additional module to support DS0/T1 services on your 7600. Following link may help you
http://www.cisco.com/en/US/products/hw/modules/ps2831/products_data_sheet09186a008015cfe9.html

GRE with VRF on MPLS/VPN

Hi.
Backbone network is running MPLS/VPN.
I have one VRF (VRF-A) for client VPN network.
One requirement is to configure another VRF (VRF-B) for this client for a separate public VRF connection.
Sub-interfacing not allowed on CE-to-PE due to access provider limitation.
So GRE is our option.
CE config:
Note: CE is running on global. VRF-A is configured at PE.
But will add VRF-B here for the requirement.
interface Tunnel0
ip vrf forwarding VRF-B
ip address 10.12.25.22 255.255.255.252
tunnel source GigabitEthernet0/1
tunnel destination 10.12.0.133
PE1 config:
interface Tunnel0
ip vrf forwarding VRF-B
ip address 10.12.25.21 255.255.255.252
tunnel source Loopback133
tunnel destination 10.12.26.54
tunnel vrf VRF-A
Tunnel works and can ping point-to-point IP address.
CE LAN IP for VRF-B is configured as static route at PE1
PE1:
ip route vrf VRF-B 192.168.96.0 255.255.255.0 Tunnel0 10.12.25.22
But from PE2 which is directly connected to PE1 (MPLS/LDP running), connectivity doesnt works.
From PE2:
- I can ping tunnel0 interface of PE1
- I cant ping tunnel0 interface of CE
Routing is all good and present in the routing table.
From CE:
- I can ping any VRF-B loopback interface of PE1
- But not VRF-B loopback interfaces PE2 (even if routing is all good)
PE1/PE2 are 7600 SRC3/SRD6.
Any problem with 7600 on this?
Need comments/suggestions.

Hi Allan,
what is running between PE1 and PE2 ( what I mean is any routing protocol).
If No, then PE2 has no ways of knowing GRE tunnel IP prefixes and hence I suppose those will not be in its CEF table...
If Yes, then check are those Prefixes available in LDP table...
Regards,
Smitesh

Traceroute issue- MPLS VPN on directly connected interfaces

I have 2 Catalyst 6509 Switches that Im trying to bring up and MPLS VPN connection between. The loopbacks can ping each other, as well as the directly connected interfaces (the interfaces travel through 2 switches, but no routing etc in between). An OSPF neighbor relationship DOES come up, and the routing tables appear normal. However, the MPLS VPN does NOT come up.
After further review, I found that the routing tables are correct on either side for the loopbacks (public addresses X’d out on first 3 octets):
SWITCH A:
Bryan-26th-CAT-2#sh ip route 10.255.2.2
Routing entry for 10.255.2.2/32
Known via "ospf 23532", distance 110, metric 2, type intra area
Last update from X.X.X.70 on Vlan65, 00:10:25 ago
Routing Descriptor Blocks:
* X.X.X.70, from 10.255.2.2, 00:10:25 ago, via Vlan65
Route metric is 2, traffic share count is 1
SWITCH B:
DAL-COLO-6509-1#sh ip route 10.255.2.3
Routing entry for 10.255.2.3/32
Known via "ospf 23532", distance 110, metric 2, type intra area
Last update from X.X.X.69 on Vlan65, 02:26:50 ago
Routing Descriptor Blocks:
* X.X.X.69, from 10.255.2.3, 02:26:50 ago, via Vlan65
Route metric is 2, traffic share count is 1
This is exactly the same for the directly connected interfaces on VLAN65. (X.X.X.69 and X.X.X.70). The ARP cache also shows to be correct:
SWITCH A:
Bryan-26th-CAT-2#sh arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet X.X.X.70 147 0009.b6a4.b800 ARPA Vlan65
Internet X.X.X.69 - 001c.b144.5800 ARPA Vlan65
SWITCH B:
DAL-COLO-6509-1#sh arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet X.X.X.70 - 0009.b6a4.b800 ARPA Vlan65
Internet X.X.X.69 141 001c.b144.5800 ARPA Vlan65
And once again, the OSPF Neighbor relationship does come up:
SWITCH A:
Bryan-26th-CAT-2# sh ip ospf neigh
Neighbor ID Pri State Dead Time Address Interface
10.255.2.2 1 FULL/BDR 00:00:30 X.X.X.70 Vlan65
SWITCH B:
DAL-COLO-6509-1#sh ip ospf neig
Neighbor ID Pri State Dead Time Address Interface
10.255.2.3 1 FULL/DR 00:00:33 X.X.X.69 Vlan65
In the Troubleshooting MPLS VPN manuals- it shows to test trace routes. All of our other connections like this the trace routes work fine. In this case though, I cannot trace route not only between the loopback interfaces, but between the DIRECTLY CONNECTED interfaces. I don’t know what this is. It should simply be a one hop trace route. I believe this is what is keeping the MPLS VPN from coming up. Any ideas? Here are the relevant OSPF configs and interface configs as well:
SWITCH A:
interface Vlan65
description Connection to DAL-COLO-6509-2
mtu 1580
ip address X.X.X.69 255.255.255.252
no ip redirects
no ip unreachables
ip pim sparse-dense-mode
ip ospf mtu-ignore
mpls label protocol ldp
mpls ip
router ospf 23532
log-adjacency-changes
redistribute connected subnets
redistribute static subnets
passive-interface default
no passive-interface Vlan65
network 10.255.2.3 0.0.0.0 area 0
network X.X.X.69 0.0.0.0 area 0
SWITCH B:
interface Vlan65
description Connection to Bryan-26th-CAT-2
mtu 1580
ip address X.X.X.70 255.255.255.252
no ip redirects
no ip unreachables
ip pim sparse-dense-mode
ip ospf mtu-ignore
mpls label protocol ldp
mpls ip
router ospf 23532
log-adjacency-changes
redistribute connected subnets
redistribute static subnets
passive-interface default
no passive-interface Vlan65
network 10.255.2.2 0.0.0.0 area 0
network X.X.X.70 0.0.0.0 area 0
Any ideas would be appreciated.
Thanks
Greg

Greg,
Can you explain more about your issue?. When you say MPLS VPN is not coming up, do you mean the ping (or traffic) from CE connected to one 6509 is not traversing the MPLS cloud to otehr CE connected to remote 6509?.
Do you have VRF enabled with respective RT import/export?. Do you have MP-BGP with VPNv4 AF enabled?.
To confirm if basic MPLS is working fine, Can you check if you have LDP neighborship up and running?. Use "show mpls ldp neighbor" to see the session.
Also do a "ping mpls ipv4 <remote-loopback> <mask>" and see if it works?.
-Nagendra

Physical interface Default Gateway connecting VPN with AnyConnect

When I connect vpn with AnyConnect, I can't see default gateway on Physical Interface.
before connect vpn
==========================================
C:\WINDOWS\system32>ipconfig
Windows IP Configuration
Ethernet adapter Local Area
        Connection-specific DNS Suffix . :
        IP Address. . . . . . . . . . . . : 10.1.1.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 10.1.1.10
after connect vpn with anyconnect
==========================================
C:\WINDOWS\system32>
C:\WINDOWS\system32>ipconfig
Windows IP Configuration
Ethernet adapter Local Area
        Connection-specific DNS Suffix . :
        IP Address. . . . . . . . . . . . : 10.1.1.100
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . :'Can't see default gateway'
Is this the specification of Anyconnect?

Nyanko,
This will happen when you are using tunnel all as the split tunneling policy, the computer will encrypt all the traffic so the default gateway will be removed from the physical connection and placed into the virtual adapter. If you take a look at the routing table you will see that what really happens is that the original default route's metric will be changed so that it is higher than the one injected by the virtual adapter, once you disconnect it should go back to normal.
Further information on split tunneling:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080975e83.shtml
HTH
Jonnathan

Full mesh VPN solution for on MPLS network with PE and CPEs

Hi,
We are trying to evaluate some best solution for Hub-Spoke mesh vpn solution in a MPLS network. The VPN hub router will be in PE router and all the VPN spoke will be in CPE.
Can someone please let us know what will be the best vpn solution, we understands that there will be some technical limitations going with GETVPN but still we did counld find any documenation for possiblity of using DMVPN.
How about the recent flexvpn, can fex-vpn work on this requirement, where can i get a design/configuration document.?
thanks in advance.

Hello,
GetVPN is intended for (ANY-to-ANY) type of VPN communication, over an MPLS network with Hub and Spoke Topology, your best Option is to look for Cisco (DMVPN) implementation where this type of VPN is primarily designed for Hub & Spoke.
Regards,
Mohamed

MPLS TE with MPLS VPN

Hi there,
I'm looking for some basic configuration to turn on mpls te over existing mpls vpn. Worried to effect mpls vpn customers.
Perhaps a link would be great!
thanks in advance.
maher

There is many scenarios involving TE and MPLS VPN.
If you have MPLS TE from ingress to egress PE, the lsp used to go from one PE to the other is signalled using RSVP instead of LDP/TDP.
If you configure TE between the core routers then you need to runn LDP/TDP on the tunnel interface for LDP to learn labels via that pseudo interface. This second scenario involves that at some point up to 3 labels (TE lsp label, IGP label, service label) might be applied to the MPLS packets instead of your regular 2 label (IGP label, service label).
Hope this helps,

MPLS L2 link on FR encapsulation with DS3 interface

Dear all,
After changing encapsulation to FR on DS3 interface . the sub-interface is not taking xconnect command.
Please help in this matter
NDL-MPL-PE-RTR-00#
interface Serial9/7
description ##
no ip address
mls qos trust dscp
dsu bandwidth 44210
framing c-bit
cablelength 10
no cdp enable
encapsulation frame-relay IETF
frame-relay lmi-type ansi
frame-relay intf-type dce
interface Serial9/7.101 point-to-point
description ##
no ip address
mls qos trust dscp
cablelength 10
no cdp enable
frame-relay interface-dlci 101
xconnect 202.123.47.X 101 encapsulation mpls
Thanks & Regards

Hello Mahesh,
what platform and what release are you using ?
Hope to help
Giuseppe

Selective Route Import/Export in MPLS VPN

Champs
I have multiple brach locations and 3 DC locations.DC locations host my internal applications , DC's also have central Internet breakout for the region. My requirement is to have full mesh MPLS-VPN but at same time brach location Internet access should be from nearest IDC in the region if nearest IDC is not availalbe it should go to second nearest DC for internet.I have decided which are primary and seconday DC for Internet breakout. How can this be achieved in MPLS-VPN scenario.Logically i feel , i have to announce specific LAN subnet and default route(with different BGP attribute like AS Path) from all 3 DCs. Spokes in the specific region should be able to import default route from primary DC and secondary DCs only using some route filter?
Regards
V

Hello Aaron,
the route example works for all routers except the one, where the VRF vpn2 is configured. What you can do for management purposes is either to connect through a neighbor router using packet leaking or configure another Loopback into VRF vpn2.
The last option (and my recommendation) is to establish another separate IP connection from your NMS to the MPLS core. Once VRFs are failing (for whatever reason, f.e. erroneously deleted) you might just not get connectivity to your backbone anymore to repair what went wrong.
So I would create an "interconnection router" with an interface in the VRF vpn2 and one interface in global IP routing table. This way you will still be able to access PEs, even if VRFs or MBGP is gone.
Hope this helps! Please rate all posts.
Regards, Martin

Ask the Expert:Concepts, Configuration and Troubleshooting Layer 2 MPLS VPN – Any Transport over MPLS (AToM)

With Vignesh R. P.
Welcome to the Cisco Support Community Ask the Expert conversation.This is an opportunity to learn and ask questions about concept, configuration and troubleshooting Layer 2 MPLS VPN - Any Transport over MPLS (AToM) with Vignesh R. P.
Cisco Any Transport over MPLS (AToM) is a solution for transporting Layer 2 packets over an MPLS backbone. It enables Service Providers to supply connectivity between customer sites with existing data link layer (Layer 2) networks via a single, integrated, packet-based network infrastructure: a Cisco MPLS network. Instead of using separate networks with network management environments, service providers can deliver Layer 2 connections over an MPLS backbone. AToM provides a common framework to encapsulate and transport supported Layer 2 traffic types over an MPLS network core.
Vignesh R. P. is a customer support engineer in the Cisco High Touch Technical Support center in Bangalore, India, supporting Cisco's major service provider customers in routing and MPLS technologies. His areas of expertise include routing, switching, and MPLS. Previously at Cisco he worked as a network consulting engineer for enterprise customers. He has been in the networking industry for 8 years and holds CCIE certification in the Routing & Switching and Service Provider tracks.
Remember to use the rating system to let Vignesh know if you have received an adequate response.
Vignesh might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Service Provider sub-community discussion forum shortly after the event. This event lasts through through September 21, 2012. Visit this forum often to view responses to your questions and the questions of other community members.

Hi Tenaro,
AToM stands for Any Transport over MPLS and it is Cisco's terminology used for Layer 2 MPLS VPN or Virtual Private Wire Service. It is basically a Layer 2 Point-to-Point Service. AToM basically supports various Layer 2 protocols like Ethernet, HDLC, PPP, ATM and Frame Relay.
The customer routers interconnect with the service provider routers at Layer 2. AToM eliminates the need for the legacy network from the service provider carrying these kinds of traffic and integrates this service into the MPLS network that already transports the MPLS VPN traffic.
AToM is an open standards-based architecture that uses the label switching architecture of MPLS and can be integrated into any network that is running MPLS. The advantage to the customer is that they do not need to change anything. Their routers that are connecting to the service provider routers can still use the same Layer 2 encapsulation type as before and do not need to run an IP routing protocol to the provider edge routers as in the MPLS VPN solution.
The service provider does not need to change anything on the provider (P) routers in the core of the MPLS network. The intelligence to support AToM sits entirely on the PE routers. The core label switching routers (LSRs) only switch labeled packets, whereas the edge LSRs impose and dispose of labels on the Layer 2 frames.
Whereas pseudowire is a connection between the PE routers and emulates a wire that is carrying Layer 2 frames. Pseudowires use tunneling. The Layer 2 frames are encapsulated into a labeled (MPLS) packet. The result is that the specific Layer 2 service—its operation and characteristics—is emulated across a Packet Switched Network.
Another technology that more or less achieves the result of AToM is L2TPV3. In the case of L2TPV3 Layer 2 frames are encapsulated into an IP packet instead of a labelled MPLS packet.
Hope the above explanation helps you. Kindly revert incase of further clarification required.
Thanks & Regards,
Vignesh R P

Redundant access from MPLS VPN to global routing table

Several our customers have MPLS VPNs deployed over our infrastructure. Part of them requires access to Internet (global routing table in our case).
As I'm not aware of any methods how to dynamicaly import/export routes between VRF/Global routing tables, at the moment there are static routes configured - one inside VRF pointing to global next hop, another one in global routing table, pointing to interface inside VRF.
Task is to configure redundant access to Internet. By redundancy I mean using several exit points (primary and backup), what physically represents separate boxes.
Here comes tricky part - both global static routes (on both boxes, meaning) are valid and reachable in all cases - no matter if specific prefix is reachable in VRF or not. What I'd like to achieve is that specific static route becomes valid only if specific prefix is reachable inside VRF. Yea, sounds like dynamic routing :), I know
OK, hope U got the idea. Any solutions/recommendations ? Running all Internet routing inside VRF isn't an option, at least for now :(

Hi Andris,
I did not mean to have a VRF on the CE. The CE would have both PVCs in the global routing table - his ONLY routing table in fact. One PVC would be used to announce routes into the customer specific VPN (VRF configured on the PE). The other PVC would allow for internet access through the PE (global IP routing table on the PE).
dot1q will be ok as well.
This way the CE can be a normal BGP peer to the PE, i.e. there is no MPLS VPN involved here. This allows all options of customer-ISP connectivity.
Example:
PE config:
interface Serial0/0
encapsulation frame-relay
interface Serial0/0.1 point-to-point
description customer VPN access
ip vrf customer
ip address 10.1.1.1 255.255.255.252
interface Serial0/0.2 point-to-point
description customer Internet access
ip address 192.168.1.1 255.255.255.252
router rip
address-family ipv4 vrf customer
version 2
network 10.0.0.0
no auto-summary
redistribute bgp 65000 metric 5
router bgp 65000
neighbor 192.168.1.2 remote-as 65001
address-family ipv4 vrf customer
redistribute rip
CE config:
interface Serial0/0
encapsulation frame-relay
interface Serial0.1 point-to-point
description VPN access
ip address 10.1.1.2 255.255.255.252
interface Serial0.2 point-to-point
description Internet access
ip address 192.168.1.2 255.255.255.252
router bgp 65001
neighbor 192.168.1.1 remote-as 65000
router rip
version 2
network 10.0.0.0
no auto-summary
Of course you can replace RIP with whatever is suitable for you. And don´t sue me when you do not apply required BGP filters for internet access... ;-)
The other option ("mini internet") would be feasible as well. Just make sure your BGP filters are NEVER messed up and additionally apply a limit on the numbers of prefixes in your VRF mini-internet.
Regards
Martin

Managing Route-Map based MPLS VPN

1) How to derive the VPN information of the MPLS VPN configured using route-maps? As I understand, stitching route-maps information to derive VPN is complex as it is difficult to derive & correlate the filters tied to each of the route-maps that are tied to a VRF :(
2) Is there any MIB to get from the MIB
a) Route-maps tied to each VRF
b) What is the filter associated with each route-map?
c) Definition of each of the above filter
It would have been nice if the route-maps' name had global-significance within AS, so that we could have treated route-maps, pretty much like the route-tragets. Alas, I doubt it is :(
It should be noted here that if the MPLS VPN is configured using route targets, the VPN information derivation is fairly straight forward throught MplsVpn MIB.
So, the question is what is the simplest way to derive the MPLS VPN info given that they are configured using route-maps in BGP for labelled-route-distribution & for the pkt association with the VRFs.
Thanks,
Suresh R

Each CE in a customer VPN is also added to the management VPN by selecting the Join the management VPN option in the service request user interface.
The function of the management route map is to allow only the routes to the specific CE into the management VPN. The Cisco IOS supports only one export route map and one import route map per VRF.
http://www.cisco.com/en/US/products/sw/netmgtsw/ps4748/products_user_guide_chapter09186a0080353ac3.html

Filtering methods inside a VRF in MPLS VPN

Hi,
we have a network with MPLS VPN and several VRFs involved.
Inside a certain VRF I need to avoid that two particular networks can talk to each other.
Can you give me a hint of what can be a solution to implement this ?
Thanks
Regards
Marco

Hi Marco,
To prevent connectivity between two networks where a MPLS VPN is involved you can apply the same methods as in a "normal" router network. Just think of the complete MPLS VPN (PE to PE) as being one big "router simulator".
You could either implement ACLs on the interfaces connecting to the PE or filter routing updates between sites - depending on your topology. When filtering routing updates seems the way to go, you should also have a look into selective import or export. With the help of a route-map one can selectively insert single networks into a VPN by selectively attaching route-targets to BGP updates.
Regards, Martin

Configuring MPLS VPN using static routing

Hi,
I am managed to set up a BGP/MPLS VPN in a laboratory using CS3620 routers running IOS 12.2(3) with ISIS. I am thinking of using static routes among the PE and P routers instead of a IGP. Does anyone know if Cisco routers supports static configuration of LSP? I have tried but could not get it work.

You can very well run MPLS with static routing in the core, as in Cisco we have to meet 2 criterias to have a MPLS forwarding Table.
1) Creating the LIB
This thing lies in having LDP neighborship netween two peers and you have Label bindings.
This is irrespective of what is the best next hop to reach the advertising peers LDP_ID.
2) Creating the LFIB
Now after considering all the Label bindings, the LDP_ID which can be reached out an interface
as a next hop, those Label bindings get installed in the LFIB.
So considering the above two points, we have to be careful in static routes
only for interfaces like Ethernet (Multiaccess Segments).
As in CEF when you give a static route pointing to an Ethernet Interface, CEF creates a
GLean Adjacency (Meaning there could be multiple hosts as the next hop on this segement, and it will glean for the right next-hop)
Now you may observe that when you give a static route only pointing to an Ethernet interface,
you LDP adjacency may come up and you may exchange the bindings with each other. But the Label Forarding Table is not created. This is bcos of this being a Multiaccess interface. And you have
Glean For it. If its a Normal WAN interface like Serial or POS, then there is no problem of
GLean and you would have a Valid Cached Adjacency.
So to avoid probelems with Ethernet interfaces you can simply specify the next-hop-ip address.
For Eg: ip route 10.10.31.250 255.255.255.255 10.10.31.226 (Without the Interface)
ip route 10.10.31.250 255.255.255.255 fa0/0 10.10.31.226 (Or with the Interface)
Only Difference in both is in the first one it has to do a recursive lookup for the outgoing interface. Otherwise both work well. And you can have static routes in your network
running MPLS.
And doing this CEF would would work as it should and you would have a Valid Cached Adjacency.
So this is applicable for Cisco devices which use CEF, including 6500 with SUP720.
HTH-Cheers,
Swaroop

L3 MPLS-VPN with ATM Interfaces

Similar Messages

Maybe you are looking for