SLB with MPLS VPN, is ti possible ?

Hi to all, is it possible to configure IOS SLB (on 7200 or 6500 platform) to be able to balance server inside a configured vrf ?
anyone already tested it ?
many thanks
max

Hi Max,
the IOS SLB code on the C6k platform is not VRF aware at the moment (can only speak of c6k - never tried c7200). It is 'interface-aware' - which means that you can run IOS SLB on a VRF-lite box where the client and real-server facing interfaces are both in the same VRF.
However IOS SLB currently does not support incoming packets with MPLS labels since the corresponding TCAM filter only matches on pure IP packets - so no support on PE boxes :-(
To make it work on a PE we did some nasty workaround:
Loop back a port on the c6k PE and configure the both ends with different VRFs. Route between them and you have a VRF-lite box 'behind' a PE in the same chassis. Not too straight forward though but works as an interim solution ;-)
hth
cheers,
Stefan

Similar Messages

  • MPLS TE with MPLS VPN

    Hi there,
    I'm looking for some basic configuration to turn on mpls te over existing mpls vpn. Worried to effect mpls vpn customers.
    Perhaps a link would be great!
    thanks in advance.
    maher

    There is many scenarios involving TE and MPLS VPN.
    If you have MPLS TE from ingress to egress PE, the lsp used to go from one PE to the other is signalled using RSVP instead of LDP/TDP.
    If you configure TE between the core routers then you need to runn LDP/TDP on the tunnel interface for LDP to learn labels via that pseudo interface. This second scenario involves that at some point up to 3 labels (TE lsp label, IGP label, service label) might be applied to the MPLS packets instead of your regular 2 label (IGP label, service label).
    Hope this helps,

  • Filtering methods inside a VRF in MPLS VPN

    Hi,
    we have a network with MPLS VPN and several VRFs involved.
    Inside a certain VRF I need to avoid that two particular networks can talk to each other.
    Can you give me a hint of what can be a solution to implement this ?
    Thanks
    Regards
    Marco

    Hi Marco,
    To prevent connectivity between two networks where a MPLS VPN is involved you can apply the same methods as in a "normal" router network. Just think of the complete MPLS VPN (PE to PE) as being one big "router simulator".
    You could either implement ACLs on the interfaces connecting to the PE or filter routing updates between sites - depending on your topology. When filtering routing updates seems the way to go, you should also have a look into selective import or export. With the help of a route-map one can selectively insert single networks into a VPN by selectively attaching route-targets to BGP updates.
    Regards, Martin

  • GRE with VRF on MPLS/VPN

    Hi.
    Backbone network is running MPLS/VPN.
    I have one VRF (VRF-A) for client VPN network.
    One requirement is to configure another VRF (VRF-B) for this client for a separate public VRF connection.
    Sub-interfacing not allowed on CE-to-PE due to access provider limitation.
    So GRE is our option.
    CE config:
    Note: CE is running on global. VRF-A is configured at PE.
    But will add VRF-B here for the  requirement.
    interface Tunnel0
      ip vrf forwarding VRF-B
    ip address 10.12.25.22 255.255.255.252
    tunnel source GigabitEthernet0/1
    tunnel destination 10.12.0.133
    PE1 config:
    interface Tunnel0
    ip vrf forwarding VRF-B
    ip address 10.12.25.21 255.255.255.252
    tunnel source Loopback133
    tunnel destination 10.12.26.54
    tunnel vrf VRF-A
    Tunnel works and can ping point-to-point IP address.
    CE LAN IP for VRF-B  is configured as static route at PE1
    PE1:
    ip route vrf VRF-B 192.168.96.0 255.255.255.0 Tunnel0 10.12.25.22
    But from PE2 which is directly connected to PE1 (MPLS/LDP running), connectivity doesnt works.
    From PE2:
    - I can ping tunnel0 interface of PE1
    - I cant ping tunnel0 interface of CE
    Routing is all good and present in the routing table.
    From CE:
    - I can ping any VRF-B loopback interface of PE1
    - But not VRF-B loopback interfaces PE2 (even if routing is all good)
    PE1/PE2 are 7600 SRC3/SRD6.
    Any problem with 7600 on this?
    Need comments/suggestions.

    Hi Allan,
    what is running between PE1 and PE2 ( what I mean is any routing protocol).
    If No, then PE2 has no ways of knowing GRE tunnel IP prefixes and hence I suppose those will not be in its CEF table...
    If Yes, then check are those Prefixes available in LDP table...
    Regards,
    Smitesh

  • L3 MPLS-VPN with ATM Interfaces

    Hi
    I tacked a L3 MPLS-VPN from a MPLS service provider.My VPN have three points.
    In first point, I have a PA-A3-OC3 over cisco router 7206. how can I config to place PVC1/2 into VPN?

    You need that pvc to be under a separate sub-interface and then you can configure "ip vrf for " under that sub-interface.
    Hope this helps,

  • Performance end to end testing and comparison between MPLS VPN and VPLS VPN

    Hi,
    I am student of MSc Network Security and as for my project which is " Comparison between MPLS L3 VPN and VPLS VPN, performance monitoring by end to end testing " I have heard a lot of buzz about VPLS as becoming NGN, I wanted to exppore that and produce a comparison report of which technology is better. To accomplish this I am using GNS3, with respect to the MPLS L3 VPN lab setup that is not a problem but I am stuck at the VPLS part how to setup that ? I have searched but unable to find any cost effective mean, even it is not possible in the university lab as we dont have 7600 series
    I would appreciate any support, guidence, advice.
    Thanks
    Shahbaz

    Hi Shahbaz,
    I am not completely sure I understand your request.
    MPLS VPN and VPLS are 2 technologies meant to address to different needs, L3 VPN as opposed as L2 VPN. Not completely sure how you would compare them in terms of performance. Would you compare the performance of a F1 racing car with a Rally racing car?
    From the ISP point of view there is little difference (if we don't want to consider the specific inherent peculiarities of each technology) , as in the very basic scenarios we can boil down to the following basic operations for both:
    Ingress PE impose 2 labels (at least)
    Core Ps swap top most MPLS label
    Egress PE removes last label exposing underlying packet or frame.
    So whether the LSRs deal with underlying L2 frames or L3 IP packets there is no real difference in terms of performance (actually the P routers don't even notice any difference).
    About simulators, I am not aware of anyone able to simulate a L2 VPN (AtoM or VPLS).
    Riccardo

  • MPLS VPN load sharing when multihoming

    Any one know of best practices for outbound load balancing when multihoming to 2 different service providers in an mpls vpn.
    I have referred to this document (http://www.cisco.com/warp/public/459/40.html) which states the only way to do this is by assigning metrics/weights to a certain range of prefixes learned from one provider, hence load sharing.
    Turning up bgp multipath on the CE would be optimal but since AS PATHs are different the best path selection will be different. Could we possibly turn of best path selection for AS paths (bgp bestpath as-path ignore) and make multipath work? Would that install 2 routes for the same prefix in the RIB?
    Thanks
    Ariful Huq

    Yes you can turn off best path selection for AS path and have multipath work. For a route to be populated in routing table BGP has various metrics for its selection. AS path is one of the metrics it uses for best route selection, so I dont think there should be any problem with it.

  • L2 MPLS VPN between different branches

    Dear Experts ,
    I want to have my different offices to use same IP address range (from a centrally managed DHCP server)  . Is this scenario possible with MPLS L2 VPN ?
    I know that we can do L2 between two branches by using xconnect  but what if i have multiple branches ?
    regards
    haris

    Hi,
    You purpose can be solved using VPLS.
    You can also create multiple Pseudowires from the HUB to different branches, however, all PWs will use different IP address range- which goes against your requirement.
    HTH.
    Regards,
    Amit.

  • MPLS VPN without Signalling Protocol in CORE

    Hi,
    I heard its possible to run L3 MPLS VPN between two sites across SP core without having any Signalling protocol (TDP/LDP)enabled on the core,the only constraint is running two TE tunnels between the two PE routers connected to CE. Is it possible. Can someone explain elaborately, pls?

    Some more details regarding the behavior as to why LDP/TDP is not required in case of end-to-end TE tunnel between the PE's.
    Using TE also the LSP is dynamically built untill and unless you are using explicitly defined TE tunnels.
    Also do note that when you have TE tunnels end to end your egress PE receives the packet with the VPN label only and then takes the appropriate action as per the VPN forwarding table.
    In case you dont have end to end TE tunnels you will have to enable LDP on the tunnels to carry the VPN labels untouched till the egress PE.( As in case if the tunnels are not end to end and are terminating on a P' which doesnt have any VPN information the packet would be dropped, so enabling LDP becomes a must.)
    Here is a detailed document explaining the beahaviour in more detail and explains when LDP should be enabled or disabled with illustrations.
    http://www.cisco.com/en/US/tech/tk436/tk428/technologies_tech_note09186a0080125b01.shtml
    HTH-Cheers,
    Swaroop

  • Central Site Internet Connectivity for MPLS VPN User

    What are the solutions of Central site Internet connectivity for a MPLS VPN user, and what is the best practice?

    Hello,
    Since you mentioned that Internet Access should be through a central site, it is clear that all customer sites (except the central) will somehow have a default (static/dynamic) to reach the central site via the normal VPN path for unknown destinations. Any firewall that might be needed, would be placed at the central site (at least). So, the issue is how the central site accesses the Internet.
    Various methods exist to provide Internet Access to an MPLS VPN. I am not sure if any one of them is considered the best. Each method has its pros and cons, and since you have to balance various factors, those factors might conflict at some point. It is hard to get simplicity, optimal routing, maximum degree of security (no matter how you define "security"), reduced memory demands and cover any other special requirements (such as possibility for overlapping between customer addresses) from a single solution. Probably the most secure VPN is the one which is not open to the Internet. If you open it to the Internet, some holes also open inevitably.
    One method is to create a separate Internet_Access VPN and have other VPNs create an extranet with that Internet_Access VPN. This method is said to be very secure (at least in terms of backbone exposure). However, if full routing is a requirement, the increased memory demands of this solution might lead you to prefer to keep the internet routing table in the Global Routing Table (GRT). You might have full routing in the GRT of PEs and Ps or in PEs only (second is probably better).
    Some names for solutions that exist are: static default routing, dynamic default routing, separate BGP session between PE and CE (via separate interface, subinterface or tunnel), extranet with internet VRF (mentioned earlier), extranet with internet VRF + VRF-aware NAT.
    The choice will depend on the requirements of your environment. I cannot possibly describe all methods here and I do not know of a public document that does. If you need an analysis of MPLS VPN security, you may want to take a look at Michael Behringer's great book with M.Morrow "MPLS VPN Security". Another book that describes solutions is "MPLS and VPN Architectures" by Ivan Pepelnjak. There is a Networkers session on MPLS VPNs that lists solutions. There is also a relevant document in CCO:
    http://www.cisco.com/en/US/tech/tk436/tk428/technologies_configuration_example09186a00801445fb.shtml (covering static default routing option).
    Kind Regards,
    M.

  • Injecting Global default Routes into a MPLS VPN

    Hi,
    I have a PE router running MPBGP which receives two default routes to the internet through an IPV4 BGP session. I need to import these routes in to a VRF and export them to different customer VRFs so that these VRFs are able to access Internet.
    I have used the feature called "BGP Support for IP Prefix Import from Global Table into a VRF Table" (URL:http://www.cisco.com/en/US/products/sw/iosswrel/ps5207/products_feature_guide09186a00803b8db9.html#wp1063870)
    and imported these routes into a VRF.
    The issue is these routes are not propagated to any of the other PE routers which has customer VRFs configured.
    Has anybody tried this or a similar method to inject a dynamic default route into a MPLS VPN.
    Any suggestions would be highly appreciated.
    Thanks
    Subhash

    Hi Subhash,
    is there anything preventing you from terminating your internet BGP sessions in a VRF? Then everything should go smoothly, i.e. standard VRF import/export.
    So possibility A) create a VRF Internet, move bgp neighbor commands there and use filters preventing anything but the default route, then use route targets to distribute the default route into other VRFs.
    Possibility B) use static routing with packet leaking. Could look like this:
    ip route vrf Internet 0.0.0.0 0.0.0.0 global
    ip route vrf Internet 0.0.0.0 0.0.0.0 global 250
    ip route Serial0/0 !assuming this is where the customer router connects.
    Note: the BGP peer IP does not have to be directly connected! There has to be a LDP label for it though. so include your BGP peers network into your IGP and the backup will work, when you loose the link to the peer.
    Hope this helps! Please rate all posts.
    Regards, Martin

  • Selective Route Import/Export in MPLS VPN

    Champs
    I have multiple brach locations and 3 DC locations.DC locations host my internal applications , DC's  also have central Internet breakout for the region. My requirement is to have full mesh MPLS-VPN but at same time brach location Internet access should be from nearest IDC in the region  if nearest IDC is not availalbe it should go to second nearest DC for internet.I have decided which are primary and seconday DC for Internet breakout. How can this be achieved in MPLS-VPN scenario.Logically i feel , i have to announce specific LAN subnet and default route(with different BGP attribute like AS Path)  from all 3 DCs. Spokes in the specific region should be able to import default route  from primary DC and secondary DCs only  using some route filter?
    Regards
    V

    Hello Aaron,
    the route example works for all routers except the one, where the VRF vpn2 is configured. What you can do for management purposes is either to connect through a neighbor router using packet leaking or configure another Loopback into VRF vpn2.
    The last option (and my recommendation) is to establish another separate IP connection from your NMS to the MPLS core. Once VRFs are failing (for whatever reason, f.e. erroneously deleted) you might just not get connectivity to your backbone anymore to repair what went wrong.
    So I would create an "interconnection router" with an interface in the VRF vpn2 and one interface in global IP routing table. This way you will still be able to access PEs, even if VRFs or MBGP is gone.
    Hope this helps! Please rate all posts.
    Regards, Martin

  • Ask the Expert:Concepts, Configuration and Troubleshooting Layer 2 MPLS VPN – Any Transport over MPLS (AToM)

    With Vignesh R. P.
    Welcome to the Cisco Support Community Ask the Expert conversation.This is an opportunity to learn and ask questions about  concept, configuration and troubleshooting Layer 2 MPLS VPN - Any Transport over MPLS (AToM) with Vignesh R. P.
    Cisco Any Transport over MPLS (AToM) is a solution for transporting Layer 2 packets over an MPLS backbone. It enables Service Providers to supply connectivity between customer sites with existing data link layer (Layer 2) networks via a single, integrated, packet-based network infrastructure: a Cisco MPLS network. Instead of using separate networks with network management environments, service providers can deliver Layer 2 connections over an MPLS backbone. AToM provides a common framework to encapsulate and transport supported Layer 2 traffic types over an MPLS network core.
    Vignesh R. P. is a customer support engineer in the Cisco High Touch Technical Support center in Bangalore, India, supporting Cisco's major service provider customers in routing and MPLS technologies. His areas of expertise include routing, switching, and MPLS. Previously at Cisco he worked as a network consulting engineer for enterprise customers. He has been in the networking industry for 8 years and holds CCIE certification in the Routing & Switching and Service Provider tracks.
    Remember to use the rating system to let Vignesh know if you have received an adequate response. 
    Vignesh might not be able to answer each question due to the volume expected during this event. Remember that you can continue the conversation on the  Service Provider sub-community discussion forum shortly after the event. This event lasts through through September 21, 2012. Visit this forum often to view responses to your questions and the questions of other community members.

    Hi Tenaro,
    AToM stands for Any Transport over MPLS and it is Cisco's terminology used for Layer 2 MPLS VPN or Virtual Private Wire Service. It is basically a Layer 2 Point-to-Point Service. AToM basically supports various Layer 2 protocols like Ethernet, HDLC, PPP, ATM and Frame Relay.
    The customer routers interconnect with the service provider routers at Layer 2. AToM eliminates the need for the legacy network from the service provider carrying these kinds of traffic and integrates this service into the MPLS network that already transports the MPLS VPN traffic.
    AToM is an open standards-based architecture that uses the label switching architecture of MPLS and can be integrated into any network that is running MPLS. The advantage to the customer is that they do not need to change anything. Their routers that are connecting to the service provider routers can still use the same Layer 2 encapsulation type as before and do not need to run an IP routing protocol to the provider edge routers as in the MPLS VPN solution.
    The service provider does not need to change anything on the provider (P) routers in the core of the MPLS network. The intelligence to support AToM sits entirely on the PE routers. The core label switching routers (LSRs) only switch labeled packets, whereas the edge LSRs impose and dispose of labels on the Layer 2 frames.
    Whereas pseudowire is a connection between the PE routers and emulates a wire that is carrying Layer 2 frames. Pseudowires use tunneling. The Layer 2 frames are encapsulated into a labeled (MPLS) packet. The result is that the specific Layer 2 service—its operation and characteristics—is emulated across a Packet Switched Network.
    Another technology that more or less achieves the result of AToM is L2TPV3. In the case of L2TPV3 Layer 2 frames are encapsulated into an IP packet instead of a labelled MPLS packet.
    Hope the above explanation helps you. Kindly revert incase of further clarification required.
    Thanks & Regards,
    Vignesh R P

  • Redundant access from MPLS VPN to global routing table

    Several our customers have MPLS VPNs deployed over our infrastructure. Part of them requires access to Internet (global routing table in our case).
    As I'm not aware of any methods how to dynamicaly import/export routes between VRF/Global routing tables, at the moment there are static routes configured - one inside VRF pointing to global next hop, another one in global routing table, pointing to interface inside VRF.
    Task is to configure redundant access to Internet. By redundancy I mean using several exit points (primary and backup), what physically represents separate boxes.
    Here comes tricky part - both global static routes (on both boxes, meaning) are valid and reachable in all cases - no matter if specific prefix is reachable in VRF or not. What I'd like to achieve is that specific static route becomes valid only if specific prefix is reachable inside VRF. Yea, sounds like dynamic routing :), I know
    OK, hope U got the idea. Any solutions/recommendations ? Running all Internet routing inside VRF isn't an option, at least for now :(

    Hi Andris,
    I did not mean to have a VRF on the CE. The CE would have both PVCs in the global routing table - his ONLY routing table in fact. One PVC would be used to announce routes into the customer specific VPN (VRF configured on the PE). The other PVC would allow for internet access through the PE (global IP routing table on the PE).
    dot1q will be ok as well.
    This way the CE can be a normal BGP peer to the PE, i.e. there is no MPLS VPN involved here. This allows all options of customer-ISP connectivity.
    Example:
    PE config:
    interface Serial0/0
    encapsulation frame-relay
    interface Serial0/0.1 point-to-point
    description customer VPN access
    ip vrf customer
    ip address 10.1.1.1 255.255.255.252
    interface Serial0/0.2 point-to-point
    description customer Internet access
    ip address 192.168.1.1 255.255.255.252
    router rip
    address-family ipv4 vrf customer
    version 2
    network 10.0.0.0
    no auto-summary
    redistribute bgp 65000 metric 5
    router bgp 65000
    neighbor 192.168.1.2 remote-as 65001
    address-family ipv4 vrf customer
    redistribute rip
    CE config:
    interface Serial0/0
    encapsulation frame-relay
    interface Serial0.1 point-to-point
    description VPN access
    ip address 10.1.1.2 255.255.255.252
    interface Serial0.2 point-to-point
    description Internet access
    ip address 192.168.1.2 255.255.255.252
    router bgp 65001
    neighbor 192.168.1.1 remote-as 65000
    router rip
    version 2
    network 10.0.0.0
    no auto-summary
    Of course you can replace RIP with whatever is suitable for you. And don´t sue me when you do not apply required BGP filters for internet access... ;-)
    The other option ("mini internet") would be feasible as well. Just make sure your BGP filters are NEVER messed up and additionally apply a limit on the numbers of prefixes in your VRF mini-internet.
    Regards
    Martin

  • Managing Route-Map based MPLS VPN

    1) How to derive the VPN information of the MPLS VPN configured using route-maps? As I understand, stitching route-maps information to derive VPN is complex as it is difficult to derive & correlate the filters tied to each of the route-maps that are tied to a VRF :(
    2) Is there any MIB to get from the MIB
    a) Route-maps tied to each VRF
    b) What is the filter associated with each route-map?
    c) Definition of each of the above filter
    It would have been nice if the route-maps' name had global-significance within AS, so that we could have treated route-maps, pretty much like the route-tragets. Alas, I doubt it is :(
    It should be noted here that if the MPLS VPN is configured using route targets, the VPN information derivation is fairly straight forward throught MplsVpn MIB.
    So, the question is what is the simplest way to derive the MPLS VPN info given that they are configured using route-maps in BGP for labelled-route-distribution & for the pkt association with the VRFs.
    Thanks,
    Suresh R

    Each CE in a customer VPN is also added to the management VPN by selecting the Join the management VPN option in the service request user interface.
    The function of the management route map is to allow only the routes to the specific CE into the management VPN. The Cisco IOS supports only one export route map and one import route map per VRF.
    http://www.cisco.com/en/US/products/sw/netmgtsw/ps4748/products_user_guide_chapter09186a0080353ac3.html

Maybe you are looking for