MPLS vpn test lab

I am trying to setup a basic lab. I have the following setup:-
CE1->PE1->P1->PE2->CE2. I have attached the relevant configs.
All the CE & PE routers are 2600's and the P1 router is a 7206VXR. I am running OSPF in the MPLS network between the PE & P routers. I am using ldp as the label distribution protocol. BGP is running between the CE & PE routers.
I have a couple of questions:-
1) Basic MPLS setup. I think this is working in that if i ping from the LAN side of the CE1 to the LAN side of the CE2 it works. The P1 router has no knowledge of these subnets. However a "sh mpls forwarding-table" command on the PE routers shows no bytes tag switched and yet if i do a "debug mpls packet" on the P1 router i can see the packets going through. If the P1 router doesn't know the LAN subnets then am i right to assume it must be label switching ?
2) The configs attached are to test a VPN setup. I have the MPLS & VPN architectures book and i have gone through all the show commands to troubleshoot and it all looks right. The routes are in the vrf routing table, the mpls forwarding table looks okay but i cannot ping from CE1 to CE2.
If i debug on the P1 router i can see the packets coming in with 2 labels as expected but i can't see them being transmitted.
I have done some searching and know that 2600's are not officially supported but my understanding is that the features i need are on the routers. I have tried a number of different IOS versions but to no avail.
Any help would be much appreciated
Jon

thanks for your responses
1) yes it's a typo, i do have the "ip vrf forwarding NR_prod" on the fa0/0 interfaces on the PE routers.
2) Basic mpls - i meant no VPN's etc. I have ospf between the PE & P routers. I have MP-BGP between PE1 & PE2. Between the PE & CE routers i am running standard BGP.
3) All 2600 routers are 2621XM's. The IOS i am trying with is c2600-spservicesk9-mz.123-4.T4.bin altho i have also tried c2600-spservicesk9-mz.123-8.T10.bin and c2600-telco-mz.123-7.T12.bin.
4) On the 7200 i'm running c7200-p-mz.123-16.bin and have also tried c7200-p-mz.124-5.bin
5) The packet from PE1 comes into the P1 router labelled as 19/24. The mpls forwarding table on P1 has the entry
19 Untagged 81.144.17.55/32 2137750 Fa0/1 172.16.1.6
which is correct as far as i can see as this is PE2.
I have included the sh mpls output from the P1 router and a sh ver of one of the PE routers ( they are both the same ).
Once again, many thanks for your replies.

Similar Messages

Software Image for c3745 for MPLS/Multicast Test Lab

Looking to find an IOS Image for a c3745 that will support the "address-family ipv4 mdt" under BGP for Multicast. Can anybody assist me here. I have tried the Software Advisor without any success.
Thanks
Derek

Derek,
Sorry, I had read 3750. It is available starting with 12.4(20)T for the 3745.
Regards

Performance end to end testing and comparison between MPLS VPN and VPLS VPN

Hi,
I am student of MSc Network Security and as for my project which is " Comparison between MPLS L3 VPN and VPLS VPN, performance monitoring by end to end testing " I have heard a lot of buzz about VPLS as becoming NGN, I wanted to exppore that and produce a comparison report of which technology is better. To accomplish this I am using GNS3, with respect to the MPLS L3 VPN lab setup that is not a problem but I am stuck at the VPLS part how to setup that ? I have searched but unable to find any cost effective mean, even it is not possible in the university lab as we dont have 7600 series
I would appreciate any support, guidence, advice.
Thanks
Shahbaz

Hi Shahbaz,
I am not completely sure I understand your request.
MPLS VPN and VPLS are 2 technologies meant to address to different needs, L3 VPN as opposed as L2 VPN. Not completely sure how you would compare them in terms of performance. Would you compare the performance of a F1 racing car with a Rally racing car?
From the ISP point of view there is little difference (if we don't want to consider the specific inherent peculiarities of each technology) , as in the very basic scenarios we can boil down to the following basic operations for both:
Ingress PE impose 2 labels (at least)
Core Ps swap top most MPLS label
Egress PE removes last label exposing underlying packet or frame.
So whether the LSRs deal with underlying L2 frames or L3 IP packets there is no real difference in terms of performance (actually the P routers don't even notice any difference).
About simulators, I am not aware of anyone able to simulate a L2 VPN (AtoM or VPLS).
Riccardo

MPLS VPN L3 BGP to Customer CPE

Hello,
I am learning how to setup MPLS VPN L3. I am running OSPF in the MPLS Core and have configured MP-BGP between PE. I am running BGP between the PE and CPE in my lab, and I can see redistributed routes from the CPE in the vrf routing table for that customer on the PE router. My question is how to reditribute the vrf routes into my MPLS core to transmit the traffic to the customer other site on the same vpn. Below is what my config looks like.
PE
ip vrf customerA
rd 100:101
route-target export both 100:1000
int fa0/0
ip vrf forwarding customerA
ip address x.x.x.x x.x.x.x
router ospf 1
loopback in area0
networks in area0
router bgp 65000
neighbor to other PE routers in AS 65000 (MPLS Network)
address family vpn4
neighbor other PE routers activate
neighbor other PE routers send community
ip address ipv4 vrf customerA
neighbor to customerA in AS 55000
CPE
router ospf 1
loopback in area 0
networks in area 0
router bgp 55000
neighbor to PE router in AS 65000
redistribute ospf 1

Hi
You dont have to redistribute your routes into mpls core. The vpnv4 bgp session that you have has already sent your ce routes to the remote pe router, provided you have the vrf configured on the other end.
For more detaiked explanation please check a presentation available in the current running Ask The Expert event in the support community.

MPLS-VPN w/NAT for Internet connectivity.

We have implemented MPLS-VPN and site-to-site connectivity seems to be working fairly well. However, we are having strange issue when trying to access the Internet. For some odd reason, we are not able to get to some sites such as ebay.com, latimes.com, nytimes.com, moviefone.com. We are running dynamic NAT and the topology looks like this:
Laptop----CE-------PE-----NAT------BR-----Internet
This is a simple layout of what we have currently in the lab. NAT router is not running MPLS but we are using VRF to create sub-interfaces on FE connecting PE and NAT router for each customers. I have access-list allowing 10.x.x.x/8.
Laptop-CE - 10.0.0.8/30
CE-PE - 10.0.0.0/30
PE-NAT - 10.0.1.0/30
Also, we are able to ping, trace, ftp, use remote desktop, pcanywhere. It seems to be only affecting http. We've been working on this for couple of days now and we've hit a wall. Any help will be greatly appreciated.
JK

I had a slightly different yet similar problem a few months ago on our mpls network with the CE devices, and turned out the DF bit had to be set to 0 to enable fragmentation _prior_ to traffic entering the core.
Fixed it right up by setting a policy on the ethernet port.
-Jeff

Traceroute issue- MPLS VPN on directly connected interfaces

I have 2 Catalyst 6509 Switches that Im trying to bring up and MPLS VPN connection between. The loopbacks can ping each other, as well as the directly connected interfaces (the interfaces travel through 2 switches, but no routing etc in between). An OSPF neighbor relationship DOES come up, and the routing tables appear normal. However, the MPLS VPN does NOT come up.
After further review, I found that the routing tables are correct on either side for the loopbacks (public addresses X’d out on first 3 octets):
SWITCH A:
Bryan-26th-CAT-2#sh ip route 10.255.2.2
Routing entry for 10.255.2.2/32
Known via "ospf 23532", distance 110, metric 2, type intra area
Last update from X.X.X.70 on Vlan65, 00:10:25 ago
Routing Descriptor Blocks:
* X.X.X.70, from 10.255.2.2, 00:10:25 ago, via Vlan65
Route metric is 2, traffic share count is 1
SWITCH B:
DAL-COLO-6509-1#sh ip route 10.255.2.3
Routing entry for 10.255.2.3/32
Known via "ospf 23532", distance 110, metric 2, type intra area
Last update from X.X.X.69 on Vlan65, 02:26:50 ago
Routing Descriptor Blocks:
* X.X.X.69, from 10.255.2.3, 02:26:50 ago, via Vlan65
Route metric is 2, traffic share count is 1
This is exactly the same for the directly connected interfaces on VLAN65. (X.X.X.69 and X.X.X.70). The ARP cache also shows to be correct:
SWITCH A:
Bryan-26th-CAT-2#sh arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet X.X.X.70 147 0009.b6a4.b800 ARPA Vlan65
Internet X.X.X.69 - 001c.b144.5800 ARPA Vlan65
SWITCH B:
DAL-COLO-6509-1#sh arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet X.X.X.70 - 0009.b6a4.b800 ARPA Vlan65
Internet X.X.X.69 141 001c.b144.5800 ARPA Vlan65
And once again, the OSPF Neighbor relationship does come up:
SWITCH A:
Bryan-26th-CAT-2# sh ip ospf neigh
Neighbor ID Pri State Dead Time Address Interface
10.255.2.2 1 FULL/BDR 00:00:30 X.X.X.70 Vlan65
SWITCH B:
DAL-COLO-6509-1#sh ip ospf neig
Neighbor ID Pri State Dead Time Address Interface
10.255.2.3 1 FULL/DR 00:00:33 X.X.X.69 Vlan65
In the Troubleshooting MPLS VPN manuals- it shows to test trace routes. All of our other connections like this the trace routes work fine. In this case though, I cannot trace route not only between the loopback interfaces, but between the DIRECTLY CONNECTED interfaces. I don’t know what this is. It should simply be a one hop trace route. I believe this is what is keeping the MPLS VPN from coming up. Any ideas? Here are the relevant OSPF configs and interface configs as well:
SWITCH A:
interface Vlan65
description Connection to DAL-COLO-6509-2
mtu 1580
ip address X.X.X.69 255.255.255.252
no ip redirects
no ip unreachables
ip pim sparse-dense-mode
ip ospf mtu-ignore
mpls label protocol ldp
mpls ip
router ospf 23532
log-adjacency-changes
redistribute connected subnets
redistribute static subnets
passive-interface default
no passive-interface Vlan65
network 10.255.2.3 0.0.0.0 area 0
network X.X.X.69 0.0.0.0 area 0
SWITCH B:
interface Vlan65
description Connection to Bryan-26th-CAT-2
mtu 1580
ip address X.X.X.70 255.255.255.252
no ip redirects
no ip unreachables
ip pim sparse-dense-mode
ip ospf mtu-ignore
mpls label protocol ldp
mpls ip
router ospf 23532
log-adjacency-changes
redistribute connected subnets
redistribute static subnets
passive-interface default
no passive-interface Vlan65
network 10.255.2.2 0.0.0.0 area 0
network X.X.X.70 0.0.0.0 area 0
Any ideas would be appreciated.
Thanks
Greg

Greg,
Can you explain more about your issue?. When you say MPLS VPN is not coming up, do you mean the ping (or traffic) from CE connected to one 6509 is not traversing the MPLS cloud to otehr CE connected to remote 6509?.
Do you have VRF enabled with respective RT import/export?. Do you have MP-BGP with VPNv4 AF enabled?.
To confirm if basic MPLS is working fine, Can you check if you have LDP neighborship up and running?. Use "show mpls ldp neighbor" to see the session.
Also do a "ping mpls ipv4 <remote-loopback> <mask>" and see if it works?.
-Nagendra

Centralize internet access in MPLS VPN

Can i implement Centralize internet access (the Hub CE Router to performs NAT) in cisco MPLS VPN solution?
If so, is there any example about that? i can't find it at CCO~
Thanks a lot~

If you run dynamic routing protocol in PE-CE,like rip2,ospf,bgp,do the following task.
1:set a default route in HUB CE;and generate the default route under its dynamic protocol.
2:in other CEs, make sure they can learn this route.
If you run static route and vrf static route between CE and PE,do the following task.
1.set default route in HUB CE, and set default route in other CEs.
2.In all PEs,redistribute the connected and static rotues to address-family ipv4 of customer vrf.
3.set the customer vrf default route in all PE which connected your all CEs.
Note: make sure all PEs can reach the GW address of vrf deafult route. GW IP address is the interface of which HUB CE towards PE.
command: "ip route vrf 0.0.0.0 0.0.0.0 global.
TRY

Selective Route Import/Export in MPLS VPN

Champs
I have multiple brach locations and 3 DC locations.DC locations host my internal applications , DC's also have central Internet breakout for the region. My requirement is to have full mesh MPLS-VPN but at same time brach location Internet access should be from nearest IDC in the region if nearest IDC is not availalbe it should go to second nearest DC for internet.I have decided which are primary and seconday DC for Internet breakout. How can this be achieved in MPLS-VPN scenario.Logically i feel , i have to announce specific LAN subnet and default route(with different BGP attribute like AS Path) from all 3 DCs. Spokes in the specific region should be able to import default route from primary DC and secondary DCs only using some route filter?
Regards
V

Hello Aaron,
the route example works for all routers except the one, where the VRF vpn2 is configured. What you can do for management purposes is either to connect through a neighbor router using packet leaking or configure another Loopback into VRF vpn2.
The last option (and my recommendation) is to establish another separate IP connection from your NMS to the MPLS core. Once VRFs are failing (for whatever reason, f.e. erroneously deleted) you might just not get connectivity to your backbone anymore to repair what went wrong.
So I would create an "interconnection router" with an interface in the VRF vpn2 and one interface in global IP routing table. This way you will still be able to access PEs, even if VRFs or MBGP is gone.
Hope this helps! Please rate all posts.
Regards, Martin

Equipment for building test lab

Hello all,
I'm looking for a little input on the two options I'm weighing for building my virtual test lab. If at all possible, I would rather not have my daily PC running my virtual lab, but I leave that option open. I'm thinking of purchasing a Dell PowerEdge 2950 II
(from ebay), installing Windows Server 2008 R2, installing VM VirtualBox so that I can set up an Active Directory environment to prepare me for the MCITP exams. This option would allow me to conserve the resources of my daily PC. If I were to use my daily
PC (I7 quad, 3GB RAM, 80GB SSD, and 1TB storage with only 200GB of free space) I would more than likely have increase RAM and buy another HDD to store the VMs. How much more trouble would it be to go the PowerEdge 2950 II route?
Thanks.

Hi,
We recommend that you review the Windows Catalog to identify servers that are qualified for use with Hyper-V. You can identify systems that support the x64 architecture and
Hyper-V by searching the Windows Server catalog. Personal advice is you’d better to buy the 2950III
it’s the newer product.
More information:
Requirements and Limits for Virtual Machines and Hyper-V in Windows Server 2008 R2
http://technet.microsoft.com/en-us/library/ee405267(WS.10).aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

UCCX 8.0 in test Lab

Hello Folks,
I'm going to install UCCX 8.0 in a test lab and I'm wondering what hardware other are using?
I'm presuming that it needs ESXi4.0? Do you have to use the full production specification of 2 x vCPU and 4GB RAM? Or can you cut down the resources like you can for Call Manager in VMware?
All advice greatfully received!
LH

Hello fella,
Things are going pretty well at the moment. How about yourself?
I've not seen Daz for a little while now. He's still over at Azzuri though!
I've had a shot at installing UCCX into VMware Server 1.x and ESXi 3.5, but it keeps spitting out "The hardware you are using is not supported for this product". I've had a shot at opening the ISO to have a look at what version of VMware it's expecting, but all of the HWXXXX files in \Cisco\vendor seem to be blank and just show "NULL" or blank when I open them. Maybe that's why my hardware isn't supported if the file is knackered!
Did you do anything special and do you know if those files are ok on your copy of UCCX?
Hope you're not working too hard ;-)
LH

Ask the Expert:Concepts, Configuration and Troubleshooting Layer 2 MPLS VPN – Any Transport over MPLS (AToM)

With Vignesh R. P.
Welcome to the Cisco Support Community Ask the Expert conversation.This is an opportunity to learn and ask questions about concept, configuration and troubleshooting Layer 2 MPLS VPN - Any Transport over MPLS (AToM) with Vignesh R. P.
Cisco Any Transport over MPLS (AToM) is a solution for transporting Layer 2 packets over an MPLS backbone. It enables Service Providers to supply connectivity between customer sites with existing data link layer (Layer 2) networks via a single, integrated, packet-based network infrastructure: a Cisco MPLS network. Instead of using separate networks with network management environments, service providers can deliver Layer 2 connections over an MPLS backbone. AToM provides a common framework to encapsulate and transport supported Layer 2 traffic types over an MPLS network core.
Vignesh R. P. is a customer support engineer in the Cisco High Touch Technical Support center in Bangalore, India, supporting Cisco's major service provider customers in routing and MPLS technologies. His areas of expertise include routing, switching, and MPLS. Previously at Cisco he worked as a network consulting engineer for enterprise customers. He has been in the networking industry for 8 years and holds CCIE certification in the Routing & Switching and Service Provider tracks.
Remember to use the rating system to let Vignesh know if you have received an adequate response.
Vignesh might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the Service Provider sub-community discussion forum shortly after the event. This event lasts through through September 21, 2012. Visit this forum often to view responses to your questions and the questions of other community members.

Hi Tenaro,
AToM stands for Any Transport over MPLS and it is Cisco's terminology used for Layer 2 MPLS VPN or Virtual Private Wire Service. It is basically a Layer 2 Point-to-Point Service. AToM basically supports various Layer 2 protocols like Ethernet, HDLC, PPP, ATM and Frame Relay.
The customer routers interconnect with the service provider routers at Layer 2. AToM eliminates the need for the legacy network from the service provider carrying these kinds of traffic and integrates this service into the MPLS network that already transports the MPLS VPN traffic.
AToM is an open standards-based architecture that uses the label switching architecture of MPLS and can be integrated into any network that is running MPLS. The advantage to the customer is that they do not need to change anything. Their routers that are connecting to the service provider routers can still use the same Layer 2 encapsulation type as before and do not need to run an IP routing protocol to the provider edge routers as in the MPLS VPN solution.
The service provider does not need to change anything on the provider (P) routers in the core of the MPLS network. The intelligence to support AToM sits entirely on the PE routers. The core label switching routers (LSRs) only switch labeled packets, whereas the edge LSRs impose and dispose of labels on the Layer 2 frames.
Whereas pseudowire is a connection between the PE routers and emulates a wire that is carrying Layer 2 frames. Pseudowires use tunneling. The Layer 2 frames are encapsulated into a labeled (MPLS) packet. The result is that the specific Layer 2 service—its operation and characteristics—is emulated across a Packet Switched Network.
Another technology that more or less achieves the result of AToM is L2TPV3. In the case of L2TPV3 Layer 2 frames are encapsulated into an IP packet instead of a labelled MPLS packet.
Hope the above explanation helps you. Kindly revert incase of further clarification required.
Thanks & Regards,
Vignesh R P

GRE with VRF on MPLS/VPN

Hi.
Backbone network is running MPLS/VPN.
I have one VRF (VRF-A) for client VPN network.
One requirement is to configure another VRF (VRF-B) for this client for a separate public VRF connection.
Sub-interfacing not allowed on CE-to-PE due to access provider limitation.
So GRE is our option.
CE config:
Note: CE is running on global. VRF-A is configured at PE.
But will add VRF-B here for the requirement.
interface Tunnel0
ip vrf forwarding VRF-B
ip address 10.12.25.22 255.255.255.252
tunnel source GigabitEthernet0/1
tunnel destination 10.12.0.133
PE1 config:
interface Tunnel0
ip vrf forwarding VRF-B
ip address 10.12.25.21 255.255.255.252
tunnel source Loopback133
tunnel destination 10.12.26.54
tunnel vrf VRF-A
Tunnel works and can ping point-to-point IP address.
CE LAN IP for VRF-B is configured as static route at PE1
PE1:
ip route vrf VRF-B 192.168.96.0 255.255.255.0 Tunnel0 10.12.25.22
But from PE2 which is directly connected to PE1 (MPLS/LDP running), connectivity doesnt works.
From PE2:
- I can ping tunnel0 interface of PE1
- I cant ping tunnel0 interface of CE
Routing is all good and present in the routing table.
From CE:
- I can ping any VRF-B loopback interface of PE1
- But not VRF-B loopback interfaces PE2 (even if routing is all good)
PE1/PE2 are 7600 SRC3/SRD6.
Any problem with 7600 on this?
Need comments/suggestions.

Hi Allan,
what is running between PE1 and PE2 ( what I mean is any routing protocol).
If No, then PE2 has no ways of knowing GRE tunnel IP prefixes and hence I suppose those will not be in its CEF table...
If Yes, then check are those Prefixes available in LDP table...
Regards,
Smitesh

Redundant access from MPLS VPN to global routing table

Several our customers have MPLS VPNs deployed over our infrastructure. Part of them requires access to Internet (global routing table in our case).
As I'm not aware of any methods how to dynamicaly import/export routes between VRF/Global routing tables, at the moment there are static routes configured - one inside VRF pointing to global next hop, another one in global routing table, pointing to interface inside VRF.
Task is to configure redundant access to Internet. By redundancy I mean using several exit points (primary and backup), what physically represents separate boxes.
Here comes tricky part - both global static routes (on both boxes, meaning) are valid and reachable in all cases - no matter if specific prefix is reachable in VRF or not. What I'd like to achieve is that specific static route becomes valid only if specific prefix is reachable inside VRF. Yea, sounds like dynamic routing :), I know
OK, hope U got the idea. Any solutions/recommendations ? Running all Internet routing inside VRF isn't an option, at least for now :(

Hi Andris,
I did not mean to have a VRF on the CE. The CE would have both PVCs in the global routing table - his ONLY routing table in fact. One PVC would be used to announce routes into the customer specific VPN (VRF configured on the PE). The other PVC would allow for internet access through the PE (global IP routing table on the PE).
dot1q will be ok as well.
This way the CE can be a normal BGP peer to the PE, i.e. there is no MPLS VPN involved here. This allows all options of customer-ISP connectivity.
Example:
PE config:
interface Serial0/0
encapsulation frame-relay
interface Serial0/0.1 point-to-point
description customer VPN access
ip vrf customer
ip address 10.1.1.1 255.255.255.252
interface Serial0/0.2 point-to-point
description customer Internet access
ip address 192.168.1.1 255.255.255.252
router rip
address-family ipv4 vrf customer
version 2
network 10.0.0.0
no auto-summary
redistribute bgp 65000 metric 5
router bgp 65000
neighbor 192.168.1.2 remote-as 65001
address-family ipv4 vrf customer
redistribute rip
CE config:
interface Serial0/0
encapsulation frame-relay
interface Serial0.1 point-to-point
description VPN access
ip address 10.1.1.2 255.255.255.252
interface Serial0.2 point-to-point
description Internet access
ip address 192.168.1.2 255.255.255.252
router bgp 65001
neighbor 192.168.1.1 remote-as 65000
router rip
version 2
network 10.0.0.0
no auto-summary
Of course you can replace RIP with whatever is suitable for you. And don´t sue me when you do not apply required BGP filters for internet access... ;-)
The other option ("mini internet") would be feasible as well. Just make sure your BGP filters are NEVER messed up and additionally apply a limit on the numbers of prefixes in your VRF mini-internet.
Regards
Martin

Problem in test lab

Hi everyone,
Just describe what i faced with.
I solved to create CCR Exchange 2007 in my test lab, and faced with if i try to install these roles of exchange:
cas1 - cas/hub
mbx1, mbx2 - CCR MBXes
i got unwork configuration.
Test users cannot send an email to himself, and inboud emails stuck in "Queue" "CAS1\Unreachable\XXX".
But if i install all roles to cas1 and then create the cluster and migrate (or recreate mailboxes) all works find.
Unfortunatelly i cannot to solve that issue myself, i undesrtand that problem maybe in "routing group" or so on, but please show me right way if you know it. Thanks!

Hi
Are you running exchange 2007 with 2003 or 2010?
Hope this helps. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
I am sorry, yes i use 2007 SP3 version.

Is it possible to Publish Exchange 2010 behind TMG in Test Lab

Hi
I have Three Server 1 Domain 2 Exchange 2010 and TMG 2010 installed. All of these server installed on the virtual machine.
This is a test Lab. I trying to Publish OWA behind the TMG Internally. Is it possible? if yes how ?
I installed 2 NIC on TMG.

Yes.
See http://www.microsoft.com/en-us/download/details.aspx?id=8946 for instructions.
Hth, Anders Janson Enfo Zipper

MPLS vpn test lab

Similar Messages

Maybe you are looking for