MPLS LDP Inbound Label Binding Filtering
Multiprotocol Label Switching (MPLS) Label Distribution Protocol (LDP) supports inbound label binding filtering. You can use the MPLS LDP Inbound Label Binding Filtering feature to configure access control lists (ACLs) for controlling the label bindings a label switch router (LSR) accepts from its peer LSRs.
Finding Support Information for Platforms and Cisco IOS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Contents
•Information about MPLS LDP Inbound Label Binding Filtering
•How to Configure MPLS LDP Inbound Label Binding Filtering
•Configuration Examples for MPLS LDP Inbound Label Binding Filtering
•Additional References
•Command Reference, page 6
•Glossary
Restrictions
Inbound label binding filtering does not support extended ACLs; it only supports standard ACLs.
Information about MPLS LDP Inbound Label Binding Filtering
The MPLS LDP Inbound Label Binding Filtering feature may be used to control the amount of memory used to store LDP label bindings advertised by other routers. For example, in a simple MPLS Virtual Private Network (VPN) environment, the VPN provider edge (PE) routers may require LSPs only to their peer PE routers (that is, they do not need LSPs to core routers). Inbound label binding filtering enables a PE router to accept labels only from other PE routers.
How to Configure MPLS LDP Inbound Label Binding Filtering
This section includes the following tasks:
•Configuring MPLS LDP Inbound Label Binding Filtering (Required)
•Verifying that MPLS LDP Inbound Label Bindings are Filtered (Optional)
Configuring MPLS LDP Inbound Label Binding Filtering
Perform this task to configure a router for inbound label filtering. The following configuration allows the router to accept only the label for prefix 25.0.0.2 from LDP neighbor router 10.12.12.12.
SUMMARY STEPS
1. enable
2. configure terminal
3. ip access-list standard access-list-number
4. permit {source [source-wildcard] | any} [log]
5. exit
6. mpls ldp neighbor [vrf vpn-name] nbr-address labels accept acl
7. end
DETAILED STEPS
|
|
|
Step 1 |
enable
Router> enable |
Enables privileged EXEC mode. •Enter your password if prompted. |
Step 2 |
configure terminal
Router# configure terminal |
Enters global configuration mode. |
Step 3 |
ip access-list standard access-list-number
Router(config)# ip access-list standard 1 |
Defines a standard IP access list with a number. |
Step 4 |
permit {source [source-wildcard] | any} [log]
Router(config-std-nacl)# permit 10.0.0.0 |
Specifies one or more prefixes permitted by the access list. |
Step 5 |
exit
Router(config-std-nacl)# exit |
Exits the current mode and goes to the next higher level. |
Step 6 |
mpls ldp neighbor [vrf vpn-name] nbr-address labels accept acl
Router(config)# mpls ldp neighbor 10.12.12.12 labels accept 1 |
Specifies the ACL to be used to filter label bindings for the specified LDP neighbor. |
Step 7 |
end
Router(config)# end |
Exits the current mode and enters privileged Exec mode. |
Verifying that MPLS LDP Inbound Label Bindings are Filtered
If inbound filtering is enabled, perform the following steps to verify that inbound label bindings are filtered:
Step 1 Enter the show mpls ldp neighbor command to show the status of the LDP session, including the name or number of the ACL configured for inbound filtering.
show mpls ldp neighbor [vrf vpn-name][address | interface] [detail]
Note To display information about inbound label binding filtering, you must enter the detail keyword.
Following is sample output from the show mpls ldp neighbor command.
Router# show mpls ldp neighbor 10.12.12.12 detail
Peer LDP Ident: 10.12.12.12:0; Local LDP Ident 10.13.13.13:0
TCP connection: 10.12.12.12.646 - 10.13.13.13.12592
State: Oper; Msgs sent/rcvd: 49/45; Downstream; Last TIB rev sent 1257
Up time: 00:32:41; UID: 1015; Peer Id 0;
Serial1/0; Src IP addr: 25.0.0.2
holdtime: 15000 ms, hello interval: 5000 ms
Addresses bound to peer LDP Ident:
10.0.0.129 10.12.12.12 10.0.0.2
Peer holdtime: 180000 ms; KA interval: 60000 ms; Peer state: estab
LDP inbound filtering accept acl: 1
Step 2 Enter the show ip access-list command to display the contents of all current IP access lists or of a specified access list.
show ip access-list [access-list-number | access-list-name]
Note It is important that you enter this command to see how the access list is defined; otherwise, you cannot verify inbound label binding filtering.
The following command output shows the contents of IP access list 1:
Standard IP access list 1
permit 10.0.0.0, wildcard bits 0.0.0.255 (1 match)
Step 3 Enter the show mpls ldp bindings command to verify that the LSR has remote bindings only from a specified peer for prefixes permitted by the access list.
Router# show mpls ldp bindings
tib entry: 10.0.0.0/8, rev 4
local binding: tag: imp-null
tib entry: 10.2.0.0/16, rev 1137
tib entry: 10.2.0.0/16, rev 1139
tib entry: 10.12.12.12/32, rev 1257
tib entry: 10.13.13.13/32, rev 14
local binding: tag: imp-null
tib entry: 10.10.0.0/16, rev 711
local binding: tag: imp-null
tib entry: 10.0.0.0/8, rev 1135
local binding: tag: imp-null
remote binding: tsr: 12.12.12.12:0, tag: imp-null
tib entry: 10.0.0.0/8, rev 8
local binding: tag: imp-null
Configuration Examples for MPLS LDP Inbound Label Binding Filtering
In the following example, the mpls ldp neighbor labels accept command is configured with an access control list to filter label bindings received on sessions with the neighbor 10.110.0.10.
Label bindings for prefixes that match 10.b.c.d are accepted, where b is less than or equal to 63, and c and d can be any integer between 0 and 128. Other label bindings received from 10.110.0.10 are rejected.
Router# configure terminal
Router(config)# access-list 1 permit 10.63.0.0 0.63.255.255
Router(config)# mpls ldp neighbor 10.110.0.10 labels accept 1
In the following example, the show mpls ldp bindings neighbor command displays label bindings that were learned from 10.110.0.10. This example verifies that the LIB does not contain label bindings for prefixes that have been excluded.
Router# show mpls ldp bindings neighbor 10.110.0.10
tib entry: 10.2.0.0/16, rev 4
remote binding: tsr: 10.110.0.10:0, tag: imp-null
tib entry: 10.43.0.0/16, rev 6
remote binding: tsr: 10.110.0.10:0, tag: 16
tib entry: 10.52.0.0/16, rev 8
remote binding: tsr: 10.110.0.10:0, tag: imp-null
Additional References
Related Documents
|
|
MPLS Label Distribution Protocol (LDP) |
MPLS Label Distribution Protocol |
Standards
MIBs
|
|
LDP Specification, draft-ietf-mpls-ldp-08.txt |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs |
RFCs
Technical Assistance
|
|
The Cisco Technical Support website contains thousands of pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content. |
http://www.cisco.com/techsupport |
Feature Information for MPLS LDP Inbound Label Binding Filtering Feature
Table 1 lists the release history for this feature.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 1 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Table 1 Feature Information for MPLS LDP Inbound Label Binding Filtering Feature
|
|
|
MPLS LDP Inbound Label Binding Filtering Feature |
12.0(26)S 12.2(25)S 12.3(14)T 12.2(18)SXE |
You can use the MPLS LDP Inbound Label Binding Filtering feature to configure access control lists (ACLs) for controlling the label bindings a label switch router (LSR) accepts from its peer LSRs. In Cisco IOS Release 12.0(26)S, this feature was introduced on the Cisco 7200. This feature was integrated into Cisco IOS Release 12.2(25)S for the Cisco 7500 series router. This feature was integrated into Cisco IOS Release 12.3(14)T. This feature was integrated into Cisco IOS Release 12.2(18)SXE for the Cisco 7600 series router. The following commands were introduced or modified: •clear mpls ldp neighbor •mpls ldp neighbor labels accept •show mpls ldp neighbor |
Glossary
carrier supporting carrier—A situation where one service provider allows another service provider to use a segment of its backbone network. The service provider that provides the segment of the backbone network to the other provider is called the backbone carrier. The service provider that uses the segment of the backbone network is called the customer carrier.
CE router—customer edge router. A router that is part of a customer network and that interfaces to a provider edge (PE) router.
inbound label binding filtering—Allows LSRs to control which label bindings it will accept from its neighboring LSRs. Consequently, an LSR does not accept or store some label bindings that its neighbors advertise.
label—A short fixed-length identifier that tells switching nodes how to forward data (packets or cells).
label binding—An association between a destination prefix and a label.
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2007 Cisco Systems, Inc. All rights reserved.