This document provides a sample configuration of a Multiprotocol Label Switching (MPLS) Virtual Private Network (VPN) over ATM when Open Shortest Path First (OSPF) is present on the customer side, with area 0.
For more information on document conventions, see the Cisco Technical Tips Conventions.
The letters below represent the different types of routers and switches used:
P: Provider's core router
PE: Provider's edge router
CE: Customer's edge router
C: Customer's router
This diagram shows a typical configuration using these conventions:
There are no specific prerequisites for this document.
The information in this document is based on the software and hardware versions below.
PE routers:
Software - Cisco IOS® Software Release 12.1(3)T . The MPLS VPN features appear in Release 12.0(5)T. The OSPF as PE-CE routing protocol appears in Release 12.0(7)T.
Hardware - The Cisco 3660 or 7206 routers. For details of other hardware you can use, refer to the Designing MPLS for ATM guide.
CE routers: Any router able to exchange routing information with its PE router can be used.
P routers and switches: The MPLS VPN integration function resides only on the edge of the MPLS network, so any MPLS-capable switch can be used. In this sample configuration, the MPLS cloud is composed of an 8540 Multiservice ATM Switch Router (MSR) and a LightStream 1010. If you are using the Cisco LightStream 1010, we recommend that you use software version WA4.8d or later. You can also use other ATM switches like the Cisco BPX 8650 or MGX 8850 in the ATM core network.
The information presented in this document was created from devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If you are working in a live network, ensure that you understand the potential impact of any command before using it.
The VPN feature, when used with MPLS, allows several sites to transparently interconnect through a service provider's network. One service provider network can support several different IP VPNs. Each of these appears to its users as a private network, separate from all other networks. Within a VPN, each site can send IP packets to any other site in the same VPN.
Each VPN is associated with one or more VPN Routing or Forwarding Instances (VRFs). A VRF consists of an IP routing table, a derived Cisco Express Forwarding (EF) table and a set of interfaces that use this forwarding table.
The router maintains a separate routing and Cisco EF table for each VRF. This prevents information being sent outside the VPN and allows the same subnet to be used in several VPNs without causing duplicate IP address problems.
The router using Border Gateway Protocol (BGP) distributes the VPN routing information using the BGP extended communities.
For more information regarding the propagation of updates through a VPN, see the following URLs:
Traditionally, an elaborate OSPF network consists of a backbone area (area 0) and a number of areas connected to this backbone through an Area Border Router (ABR).
By using an MPLS backbone for VPN with OSPF on the customer's site, you can introduce a third level in the hierarchy of the OSPF model. This third level is called the MPLS VPN Super Backbone.
In simple cases, the MPLS VPN Super Backbone is combined with the traditional area 0 backbone. This means that there is no area 0 backbone on the customer network, since the MPLS VPN Super Backbone plays the same role as the area 0 backbone. This is shown in the diagram below:
In this diagram:
The PE routers are ABR and Autonomous System Boundary Routers (ASBR).
The CE routers are simple OSPF routers.
The VPN information is transported using BGP extended communities from PEs to other PEs and is re-injected into the OSPF areas as Summary Network (type 3) Link-State Advertisements (LSAs).
The MPLS VPN Super Backbone also enables customers to use multiple area 0 backbones on their sites. Each site can have a separate area 0 as long as it is connected to the MPLS VPN Super Backbone. The result is the same as a partitioned area 0 backbone. This is shown in the diagram below:
In this case:
The PE routers are ABR and ASBR routers.
The CE routers are ABR routers.
The LSAs containing VPN information are transported using BGP extended communities from PEs to other PEs. In Summary Network (type 3) LSAs, information is transported between PEs and CEs.
This sample configuration is based on the second setup shown above. You can find a sample configuration that uses the first setup in MPLS VPN over ATM: with OSPF on the Customer Side (without Area 0).
OSPF information is transported with BGP extended community attributes (including one that identifies the OSPF network). Each VPN must have its own OSPF process. To specify this, issue the following command:
router ospf <process ID> vrf <VPN routing or forwarding instance name>
In this section, you are presented with the information to configure the features described in this document.
Note: To find additional information on the commands used in this document, use the Command Lookup Tool (registered customers only) .
This document uses the network setup shown in the diagram below.
The Cisco IOS documentation (MPLS Virtual Private Networks) also describes this configuration procedure.
Make sure that ip cef is enabled. If you are using a Cisco 7500 router, ensure that ip cef distributed is enabled. On the PEs, once MPLS is set up:
Create one VRF for each VPN connected using the ip vrf <VPN routing/forwarding instance name> command. When doing this:
Issue the command below to specify the correct route distinguisher used for that VPN. This is used to extend the IP address so that you can identify which VPN it belongs to.
rd <VPN route distinguisher>
Set up the import and export properties for the BGP extended communities. These are used for filtering the import and export process.
route-target [export|import|both] <target VPN extended community>
Configure the forwarding details for the respective interfaces by issuing this command:
ip vrf forwarding <table name>
Remember to set up the IP address after doing this.
Depending on the PE-CE routing protocol you are using, you should now do one or more of the following:
Configure the static routes as follows:
ip route vrf vrf-name prefix mask [next-hop-address] [interface {interface-number}]
Configure the Routing Information Protocol (RIP) by issuing the command:
address-family ipv4 vrf <VPN routing/forwarding instance name>
Once this is done, enter the normal RIP configuration commands.
Note that:
This is only applied to the forwarding interfaces for the current VRF.
It is necessary to redistribute the correct BGP into RIP. When doing this, remember to also specify the metric used.
Declare the BGP neighbor information.
Configure the OSPF by issuing the new Cisco IOS command:
router ospf <process ID> vrf <VPN routing/forwarding instance name>.
Note that:
This is only applied to the forwarding interfaces for the current VRF.
It is necessary to redistribute the correct BGP into OSPF. When doing this, remember to also specify the metric used.
Once the OSPF process is attributed to a VRF, this process number is always used for this particular VRF. This applies even if you do not specify it in the command line.
Configure BGP between the PE routers. There are several ways to configure BGP, such as using the route reflector or confederation methods. The method used here – direct neighbor configuration – is the simplest and the least scalable.
Declare the different neighbors.
Enter the address-family ipv4 vrf <VPN routing/forwarding instance name> for each VPN present at this PE router. Carry out one or more of the following steps, as necessary:
Redistribute the static routing information.
Redistribute the RIP routing informations.
Redistribute the OSPF routing information.
Activate BGP neighboring with the CE routers.
Enter the address-family vpnv4 Mode, and:
Activate the neighbors.
Specify that extended community must be used. This is mandatory.
Note: Only the relevant parts of the following output are included here.
Alcazaba |
---|
ip cef ! ip vrf vpn1 rd 1:101 route-target export 1:101 route-target import 1:101 ! interface Loopback0 ip address 223.0.0.3 255.255.255.255 ! interface Loopback1 ip vrf forwarding vpn1 ip address 222.0.0.10 255.255.255.255 ! interface Ethernet1/1 ip vrf forwarding vpn1 ip address 150.150.0.1 255.255.255.0 no ip mroute-cache ! interface ATM4/0 no ip address no ip mroute-cache no atm ilmi-keepalive ! interface ATM4/0.1 tag-switching ip address 10.0.0.13 255.255.255.252 tag-switching atm vpi 2-4 tag-switching ip ! router ospf 1 log-adjacency-changes network 10.0.0.0 0.0.0.255 area 0 network 150.150.0.0 0.0.0.255 area 0 network 223.0.0.3 0.0.0.0 area 0 ! router ospf 2 vrf vpn1 log-adjacency-changes redistribute bgp 1 metric-type 1 subnets network 150.150.0.0 0.0.0.255 area 0 network 222.0.0.0 0.0.0.255 area 0 ! router bgp 1 neighbor 223.0.0.21 remote-as 1 neighbor 223.0.0.21 update-source Loopback0 ! address-family ipv4 vrf vpn1 redistribute ospf 2 no auto-summary no synchronization exit-address-family ! address-family vpnv4 neighbor 223.0.0.21 activate neighbor 223.0.0.21 send-community extended exit-address-family ! |
Kozel |
---|
! ip cef ! ip vrf vpn1 rd 1:101 route-target export 1:101 route-target import 1:101 ! interface Loopback0 ip address 223.0.0.21 255.255.255.255 ! interface Loopback1 ip vrf forwarding vpn1 ip address 222.0.0.30 255.255.255.255 ! interface Ethernet1/1 ip vrf forwarding vpn1 ip address 69.69.0.1 255.255.255.252 no ip mroute-cache tag-switching ip ! interface ATM4/0 no ip address no atm scrambling cell-payload no atm ilmi-keepalive pvc qsaal 0/5 qsaal ! pvc ilmi 0/16 ilmi ! ! interface ATM4/0.1 tag-switching ip address 11.0.0.6 255.255.255.252 tag-switching atm vpi 2-4 tag-switching ip ! router ospf 1 log-adjacency-changes network 11.0.0.0 0.0.0.255 area 0 network 223.0.0.21 0.0.0.0 area 0 ! router ospf 2 vrf vpn1 log-adjacency-changes redistribute bgp 1 metric-type 1 subnets network 69.69.0.0 0.0.0.255 area 0 network 222.0.0.0 0.0.0.255 area 0 ! router bgp 1 neighbor 223.0.0.3 remote-as 1 neighbor 223.0.0.3 update-source Loopback0 neighbor 223.0.0.11 remote-as 1 neighbor 223.0.0.11 update-source Loopback0 ! address-family ipv4 vrf vpn1 redistribute ospf 2 no auto-summary no synchronization exit-address-family ! address-family vpnv4 neighbor 223.0.0.3 activate neighbor 223.0.0.3 send-community extended neighbor 223.0.0.11 activate neighbor 223.0.0.11 send-community extended exit-address-family ! |
Rapid |
---|
! interface Loopback0 ip address 222.0.0.1 255.255.255.255 ! interface Loopback2 ip address 7.7.7.7 255.255.255.0 ! interface FastEthernet0/0 ip address 7.7.8.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet0/1 ip address 150.150.0.2 255.255.255.0 duplex auto speed auto ! router ospf 1 network 7.7.7.7 0.0.0.0 area 1 network 150.150.0.0 0.0.0.255 area 0 network 222.0.0.1 0.0.0.0 area 1 ! |
Pivrnec |
---|
! interface Loopback0 ip address 222.0.0.3 255.255.255.255 ! interface Loopback1 ip address 6.6.6.6 255.255.255.255 ! interface FastEthernet0/0 ip address 6.6.7.1 255.255.255.0 duplex auto speed auto ! interface FastEthernet0/1 ip address 69.69.0.2 255.255.255.252 duplex auto speed auto ! router ospf 1 log-adjacency-changes network 6.6.6.6 0.0.0.0 area 3 network 69.69.0.0 0.0.0.255 area 0 network 222.0.0.3 0.0.0.0 area 3 ! |
Guilder |
---|
! interface Loopback0 ip address 222.0.0.11 255.255.255.255 ! interface Ethernet0/1 ip address 7.7.8.2 255.255.255.0 ! router ospf 2 network 7.7.8.0 0.0.0.255 area 1 network 222.0.0.0 0.0.0.255 area 1 ! |
Ischia |
---|
! interface Loopback0 ip address 222.0.0.22 255.255.255.255 ! interface Ethernet1/4 ip address 6.6.7.2 255.255.255.0 ! router ospf 1 log-adjacency-changes network 6.6.7.0 0.0.0.255 area 3 network 222.0.0.0 0.0.0.255 area 3 ! |
This section provides information you can use to confirm your configuration is working properly.
Certain show commands are supported by the Output Interpreter Tool (registered customers only) , which allows you to view an analysis of show command output.
show ip route vrf <VPN routing or forwarding instance name>
show ip bgp vpnv4 vrf <VPN routing or forwarding instance name> <A.B.C.D>
show ip ospf <process ID number>
show ip ospf <process ID number> interface
show ip ospf <process ID number> database
show tag-switching forwarding-table vrf <VPN routing or forwarding instance name>
Issue the first two commands above to show the VRF for a particular VPN at the PE router.
The following commands show OSPF information for the corresponding VRF. The most important parts of the output below are shown in bold text.
Note: You do not have to specify the VRF when issuing these commands.
Alcazaba#show ip ospf 2 Routing Process "ospf 2" with ID 222.0.0.10 Supports only single TOS(TOS0) routes Supports opaque LSA Connected to MPLS VPN Superbackbone It is an area border and autonomous system boundary router Redistributing External Routes from, bgp 1, includes subnets in redistribution SPF schedule delay 5 secs, Hold time between two SPFs 10 secs Minimum LSA interval 5 secs. Minimum LSA arrival 1 secs Number of external LSA 0. Checksum Sum 0x0 Number of opaque AS LSA 0. Checksum Sum 0x0 Number of DCbitless external and opaque AS LSA 0 Number of DoNotAge external and opaque AS LSA 0 Number of areas in this router is 1. 1 normal 0 stub 0 nssa External flood list length 0 Area BACKBONE(0) Number of interfaces in this area is 2 Area has no authentication SPF algorithm executed 4 times Area ranges are Number of LSA 13. Checksum Sum 0x715C5 Number of opaque link LSA 0. Checksum Sum 0x0 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0 Flood list length 0 Alcazaba#show ip ospf 2 database OSPF Router with ID (222.0.0.10) (Process ID 2) Router Link States (Area 0) Link ID ADV Router Age Seq# Checksum Link count 222.0.0.1 222.0.0.1 272 0x80000009 0xCA39 1 222.0.0.10 222.0.0.10 197 0x80000003 0xFCFF 2 Net Link States (Area 0) Link ID ADV Router Age Seq# Checksum 150.150.0.1 222.0.0.10 197 0x80000002 0xEA6E Summary Net Link States (Area 0) Link ID ADV Router Age Seq# Checksum 6.6.6.6 222.0.0.10 197 0x80000002 0x4768 6.6.7.0 222.0.0.10 750 0x80000001 0xD4D7 7.7.7.7 222.0.0.1 272 0x80000002 0x72CC 7.7.8.0 222.0.0.1 1003 0x80000003 0x635 69.69.0.0 222.0.0.10 197 0x80000002 0x2228 222.0.0.1 222.0.0.1 272 0x80000002 0x5A21 222.0.0.3 222.0.0.10 197 0x80000004 0xE8FA 222.0.0.11 222.0.0.1 1010 0x80000001 0x5C0C 222.0.0.22 222.0.0.10 752 0x80000001 0x9435 222.0.0.30 222.0.0.10 199 0x80000002 0x795B Alcazaba#show ip ospf 2 interface Loopback1 is up, line protocol is up Internet Address 222.0.0.10/32, Area 0 Process ID 2, Router ID 222.0.0.10, Network Type LOOPBACK, Cost: 1 Loopback interface is treated as a stub Host Ethernet1/1 is up, line protocol is up Internet Address 150.150.0.1/24, Area 0 Process ID 2, Router ID 222.0.0.10, Network Type BROADCAST, Cost: 10 Transmit Delay is 1 sec, State DR, Priority 1 Designated Router (ID) 222.0.0.10, Interface address 150.150.0.1 Backup Designated router (ID) 222.0.0.1, Interface address 150.150.0.2 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5 Hello due in 00:00:08 Index 1/1, flood queue length 0 Next 0x0(0)/0x0(0) Last flood scan length is 6, maximum is 6 Last flood scan time is 0 msec, maximum is 0 msec Neighbor Count is 1, Adjacent neighbor count is 1 Adjacent with neighbor 222.0.0.1 (Backup Designated Router) Suppress hello for 0 neighbor(s)
In this case, the CE router is an ABR because it is also connected to another area. If this router was only to have interfaces in area 0, it would be an ordinary router, not an ABR or ASBR.
rapid#show ip ospf Routing Process "ospf 1" with ID 222.0.0.1 Supports only single TOS(TOS0) routes Supports opaque LSA It is an area border router SPF schedule delay 5 secs, Hold time between two SPFs 10 secs Minimum LSA interval 5 secs. Minimum LSA arrival 1 secs Number of external LSA 0. Checksum Sum 0x0 Number of opaque AS LSA 0. Checksum Sum 0x0 Number of DCbitless external and opaque AS LSA 0 Number of DoNotAge external and opaque AS LSA 0 Number of areas in this router is 2. 2 normal 0 stub 0 nssa External flood list length 0 Area BACKBONE(0) Number of interfaces in this area is 1 Area has no authentication SPF algorithm executed 14 times Area ranges are Number of LSA 13. Checksum Sum 0x715C5 Number of opaque link LSA 0. Checksum Sum 0x0 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0 Flood list length 0 Area 1 Number of interfaces in this area is 3 Area has no authentication SPF algorithm executed 48 times Area ranges are Number of LSA 16. Checksum Sum 0x8CCBE Number of opaque link LSA 0. Checksum Sum 0x0 Number of DCbitless LSA 0 Number of indication LSA 0 Number of DoNotAge LSA 0 Flood list length 0 rapid#show ip ospf database OSPF Router with ID (222.0.0.1) (Process ID 1) Router Link States (Area 0) Link ID ADV Router Age Seq# Checksum Link count 222.0.0.1 222.0.0.1 331 0x80000009 0xCA39 1 222.0.0.10 222.0.0.10 259 0x80000003 0xFCFF 2 Net Link States (Area 0) Link ID ADV Router Age Seq# Checksum 150.150.0.1 222.0.0.10 259 0x80000002 0xEA6E Summary Net Link States (Area 0) Link ID ADV Router Age Seq# Checksum 6.6.6.6 222.0.0.10 259 0x80000002 0x4768 6.6.7.0 222.0.0.10 812 0x80000001 0xD4D7 7.7.7.7 222.0.0.1 331 0x80000002 0x72CC 7.7.8.0 222.0.0.1 1062 0x80000003 0x635 69.69.0.0 222.0.0.10 259 0x80000002 0x2228 222.0.0.1 222.0.0.1 331 0x80000002 0x5A21 222.0.0.3 222.0.0.10 260 0x80000004 0xE8FA 222.0.0.11 222.0.0.1 1069 0x80000001 0x5C0C 222.0.0.22 222.0.0.10 813 0x80000001 0x9435 222.0.0.30 222.0.0.10 260 0x80000002 0x795B Router Link States (Area 1) Link ID ADV Router Age Seq# Checksum Link count 222.0.0.1 222.0.0.1 1078 0x80000029 0x658E 3 222.0.0.10 222.0.0.10 2962 0x80000003 0xFCFF 2 222.0.0.11 222.0.0.11 1080 0x80000003 0xA97F 2 Net Link States (Area 1) Link ID ADV Router Age Seq# Checksum 7.7.8.2 222.0.0.11 1081 0x80000001 0x93DA 150.150.0.1 222.0.0.10 2962 0x80000002 0xEA6E Summary Net Link States (Area 1) Link ID ADV Router Age Seq# Checksum 6.6.6.6 222.0.0.1 332 0x80000002 0x69C5 6.6.6.6 222.0.0.10 2720 0x80000002 0x4768 6.6.7.0 222.0.0.1 820 0x80000001 0xF635 69.69.0.0 222.0.0.1 341 0x80000002 0x4485 150.150.0.0 222.0.0.1 341 0x80000004 0x57CB 222.0.0.3 222.0.0.1 341 0x80000002 0xF56 222.0.0.3 222.0.0.10 2727 0x80000002 0xECF8 222.0.0.10 222.0.0.1 341 0x80000002 0x6404 222.0.0.22 222.0.0.1 820 0x80000001 0xB692 222.0.0.30 222.0.0.1 341 0x80000002 0x9BB8 Summary ASB Link States (Area 1) Link ID ADV Router Age Seq# Checksum 222.0.0.10 222.0.0.1 341 0x80000002 0x4C1C
Issue the following command to show the IP routing table:
Guilder#show ip route Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area * - candidate default, U - per-user static route, o - ODR P - periodic downloaded static route Gateway of last resort is not set 69.0.0.0/30 is subnetted, 1 subnets O IA 69.69.0.0 [110/21] via 7.7.8.1, 00:06:33, Ethernet0/1 222.0.0.0/32 is subnetted, 6 subnets O IA 222.0.0.30 [110/21] via 7.7.8.1, 00:06:33, Ethernet0/1 O IA 222.0.0.22 [110/41] via 7.7.8.1, 00:06:33, Ethernet0/1 O IA 222.0.0.10 [110/21] via 7.7.8.1, 00:06:33, Ethernet0/1 C 222.0.0.11 is directly connected, Loopback0 O IA 222.0.0.3 [110/31] via 7.7.8.1, 00:06:33, Ethernet0/1 O 222.0.0.1 [110/11] via 7.7.8.1, 00:06:33, Ethernet0/1 6.0.0.0/8 is variably subnetted, 2 subnets, 2 masks O IA 6.6.6.6/32 [110/31] via 7.7.8.1, 00:06:34, Ethernet0/1 O IA 6.6.7.0/24 [110/40] via 7.7.8.1, 00:06:34, Ethernet0/1 7.0.0.0/8 is variably subnetted, 2 subnets, 2 masks O 7.7.7.7/32 [110/11] via 7.7.8.1, 00:06:35, Ethernet0/1 C 7.7.8.0/24 is directly connected, Ethernet0/1 10.0.0.0/22 is subnetted, 1 subnets C 10.200.8.0 is directly connected, Ethernet0/0 150.150.0.0/24 is subnetted, 1 subnets O IA 150.150.0.0 [110/20] via 7.7.8.1, 00:06:35, Ethernet0/1
Confirm that there are two labels on the label stack on the entry Label Switch Router (LSR) as follows:
Alcazaba#show tag-switching forwarding-table vrf vpn1 6.6.7.2 detail Local Outgoing Prefix Bytes tag Outgoing Next Hop tag tag or VC or Tunnel Id switched interface None 2/41 6.6.7.0/24 0 AT4/0.1 point2point MAC/Encaps=4/12, MTU=4466, Tag Stack{2/41(vcd=10) 29} 000A8847 0000A0000001D000
Now, confirm that they appear on the exit LSR:
Kozel#show tag-switching forwarding-table vrf vpn1 6.6.7.2 detail Local Outgoing Prefix Bytes tag Outgoing Next Hop tag tag or VC or Tunnel Id switched interface 29 Untagged 6.6.7.0/24[V] 1466 Et1/1 69.69.0.2 MAC/Encaps=0/0, MTU=1500, Tag Stack{} VPN route: vpn1 Per-packet load-sharing
You can now issue the ping command to test that everything is fine:
Ischia#ping 222.0.0.11 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 222.0.0.11, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/3/4 ms Ischia#trac Ischia#traceroute 222.0.0.11 Type escape sequence to abort. Tracing the route to 222.0.0.11 1 6.6.7.1 0 msec 0 msec 0 msec 2 69.69.0.1 0 msec 0 msec 0 msec 3 150.150.0.1 4 msec 4 msec 0 msec 4 150.150.0.2 4 msec 0 msec 0 msec 5 7.7.8.2 4 msec * 0 msec
There is currently no specific troubleshooting information available for this configuration.
Revision | Publish Date | Comments |
---|---|---|
1.0 |
05-Jun-2005 |
Initial Release |