VRF Routing Context - Lets Make Virtualization Life Easier

VRF aware pings and test are frustrating many times specially during troubleshooting where you try to ping or trace a destination or check routing table and later you notice you forgot to run vrf aware command. To solve this problem Cisco has introduced a cool feature known as VRF Routing Context into IOS and NX-OS which makes life lot easier specially during troubleshooting. Here is a quick example and topology details:

 

 

 

HTH....

Deepak Arora

Evil CCIE

 

Scaling BGP Part 2 - Using Route Target Constrain To Scale PE

One of the common problem with MPLS based L3 VPN services from Service Provider perspective is PE Scalability. Specially If the Implementation in the Core is using VPNv4 Route Reflector (VPNv4 RR).

When VPNv4 RR receives routes from PEs, It's job is to reflect all different customer routes to another PEs without considering the fact that particular Customer VRF might not exist on specific PE. Which is most likely the case in Real world. Which is certainly a problem from PE Perspective.

One of the way PE get rid of this problem itself is that by Default Automatic Route Filtering (ARF) is enabled on all PEs which suggest a rule that if routes are received for particular VRF and that particular VRF doesn't exist on PE locally, it's gonna filter out those routes automatically. However this logic or rule doesn't apply to VPNv4 Route Reflector itself since it doesn't make sense to put it in Data/Forward Plane. And if it's not in Data Plane than creating and mapping VRFs locally doesn't make any sense.

On the flip side , however ARF is good tool to have in pocket from PE perspective. But problem is that routes are still getting received from Route Reflector (RR) and getting filtering after that which means wastage of local resources and bandwidth.

So the question is, How Do We Fix This ?

The Answer lies in something called Route Target Contrain as defined in RFC-4684. I'll talk about AFI and SAFI in next post. But lets assume that this feature signals the RR from PE perspective about which all VRFs locally exist on that particular PE, resulting RR not Reflecting unnecessary routes towards that PE for VRF that doesn't exist locally on it.

Here is a quick example :

In This Particular Example PE-2 doesn't have VRF-B configured locally. So It doesn't need to receive Reflected Routes from RR for VRF-B.

Before RTC: RR Sending All Routes for All VRFs to PE-2

After RTC: RR Sending Only Routes For VRF-A to PE-2

Configuration:

Further Verification:

Pitfall :

From Planning Perspective, you need to understand that this feature is not only IOS dependent but also would require to be enabled not only on VPNv4 RR but also on PE under consideration.


HTH...
Deepak Arora
Evil CCIE

Networking Concepts Video Training - IIT

MPLS Fundamentals

MPLS Traffic Engineering

HTH...
Deepak Arora
Evil CCIE

L2TPv3 Interworking - L2 VPN Saga Continues...

R8#sh ip int b | e una|do
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            89.0.0.8        YES NVRAM  up                    up
Loopback0                  8.8.8.8         YES NVRAM  up                    up

R8#sh run | s r o
router ospf 1
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0


R9#sh ip int b | e una|do
Interface                  IP-Address      OK? Method Status                Protocol
Serial1/0                  89.0.0.9        YES NVRAM  up                    up
Loopback0                  9.9.9.9         YES NVRAM  up                    up

R9#sh run | s r o
router ospf 1
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0

R9#sh run int s1/0
Building configuration...

Current configuration : 132 bytes
!
interface Serial1/0
 ip address 89.0.0.9 255.255.255.0
 encapsulation ppp
 ip ospf network broadcast
 serial restart-delay 0
end


R2#sh ip int b | e una|do
Interface                  IP-Address      OK? Method Status                Protocol
FastEthernet0/0            12.0.0.2        YES NVRAM  up                    up
FastEthernet0/1            23.0.0.2        YES NVRAM  up                    up
Loopback0                  2.2.2.2         YES NVRAM  up                    up

R2#sh run | s r e
router eigrp 100
 network 0.0.0.0
 no auto-summary

R2#sh ip ro e
     1.0.0.0/32 is subnetted, 1 subnets
D       1.1.1.1 [90/409600] via 12.0.0.1, 00:10:30, FastEthernet0/0
     3.0.0.0/32 is subnetted, 1 subnets
D       3.3.3.3 [90/409600] via 23.0.0.3, 00:10:10, FastEthernet0/1

R2#sh mpls forwarding
Tag switching is not operational.
CEF or tag switching has not been enabled.
No TFIB currently allocated.


R1#sh run | s pseudo
pseudowire-class L2TPv3
 encapsulation l2tpv3
 interworking ip
 ip local interface Loopback0

R1#sh run int f2/1
Building configuration...

Current configuration : 124 bytes
!
interface FastEthernet2/1
 no ip address
 speed auto
 duplex auto
 no keepalive
 xconnect 3.3.3.3 13 pw-class L2TPv3
end


R3#sh run | s pseudo
pseudowire-class L2TPv3
 encapsulation l2tpv3
 interworking ip
 ip local interface Loopback0

R3#sh run int s1/1
Building configuration...

Current configuration : 122 bytes
!
interface Serial1/1
 no ip address
 encapsulation ppp
 serial restart-delay 0
 xconnect 1.1.1.1 13 pw-class L2TPv3
end


R8#sh ip ospf nei

Neighbor ID     Pri   State           Dead Time   Address         Interface
9.9.9.9           1   FULL/DR         00:00:37    89.0.0.9        FastEthernet0/0

R8#sh ip ro os
     9.0.0.0/32 is subnetted, 1 subnets
O       9.9.9.9 [110/11] via 89.0.0.9, 00:13:00, FastEthernet0/0

R8#ping 9.9.9.9 so lo0

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 9.9.9.9, timeout is 2 seconds:
Packet sent with a source address of 8.8.8.8
.!!!!
Success rate is 80 percent (4/5), round-trip min/avg/max = 88/120/180 ms


R1#sh l2tp tunnel all

L2TP Tunnel Information Total tunnels 1 sessions 1

Tunnel id 1100418086 is up, remote id is 2518749472, 1 active sessions
  Remotely initiated tunnel
  Tunnel state is established, time since change 00:14:48
  Tunnel transport is IP  (115)
  Remote tunnel name is R3
    Internet Address 3.3.3.3, port 0
  Local tunnel name is R1
    Internet Address 1.1.1.1, port 0
  L2TP class for tunnel is l2tp_default_class
  Counters, taking last clear into account:
    111 packets sent, 107 received
    9008 bytes sent, 8752 received
    Last clearing of counters never
  Counters, ignoring last clear:
    111 packets sent, 107 received
    9008 bytes sent, 8752 received
  Control Ns 9, Nr 13
  Local RWS 1024 (default), Remote RWS 1024
  Control channel Congestion Control is disabled
  Tunnel PMTU checking disabled
  Retransmission time 1, max 1 seconds
  Unsent queuesize 0, max 0
  Resend queuesize 0, max 1
  Total resends 0, ZLB ACKs sent 11
  Total out-of-order dropped pkts 0
  Total out-of-order reorder pkts 0
  Total peer authentication failures 0
  Current no session pak queue check 0 of 5
  Retransmit time distribution: 0 0 0 0 0 0 0 0 0
  Control message authentication is disabled


R1#sh l2tun session all

L2TP Session Information Total tunnels 1 sessions 1

Session id 3278375310 is up, logical session id 65537, tunnel id 1100418086
  Remote session id is 1558878854, remote tunnel id 2518749472
  Remotely initiated session
  Unique ID is 1
Session Layer 2 circuit, type is Ethernet, name is FastEthernet2/1
  Session vcid is 13
  Interworking type is IP
  Circuit state is UP
    Local circuit state is UP
    Remote circuit state is UP
Call serial number is 1168000001
Remote tunnel name is R3
  Internet address is 3.3.3.3
Local tunnel name is R1
  Internet address is 1.1.1.1
IP protocol 115
  Session is L2TP signaled
  Session state is established, time since change 00:15:43
    117 Packets sent, 113 received
    9488 Bytes sent, 9232 received
  Last clearing of counters never
  Counters, ignoring last clear:
    117 Packets sent, 113 received
    9488 Bytes sent, 9232 received
    Receive packets dropped:
      out-of-order:             0
      other:                    0
      total:                    0
    Send packets dropped:
      exceeded session MTU:     0
      other:                    0
      total:                    0
  DF bit off, ToS reflect disabled, ToS value 0, TTL value 255
  Sending UDP checksums are disabled
  Received UDP checksums are verified
  No session cookie information available
  FS cached header information:
    encap size = 24 bytes
    45000014 00000000 ff73b36f 01010101
    03030303 5cea9a86
  Sequencing is off
  Conditional debugging is disabled
  SSM switch id is 4096, SSM segment id is 8193

 Final Config - http://www.4shared.com/rar/T4TwmRG7/Interworking.html 

Further Readings:

http://www.cisco.com/en/US/docs/ios-xml/ios/mp_l2_vpns/configuration/15-2mt/mp-l2vpn-intrntwkg.html#GUID-E774CB40-066C-4B3F-8E1E-BEBCBED1087C

http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/fsinterw.html#wp1057606

http://blog.ine.com/2008/01/28/poor-mans-vpls/


HTH...
Deepak Arora
Evil CCIE

Converting IP VRF To VRF Defination Using IOS

Earlier
=====

R1#sh run | s vrf

ip vrf ABC

 rd 1:1

 route-target export 1:1

 route-target import 1:1

####################

R1(config)#vrf upgrade-cli multi-af-mode ?

  common-policies      IPv4 VRF policies are moved to common VRF policies

  non-common-policies  IPv4 VRF policies are not moved to common VRF

                       policies,but kept as ipv4 only VRF policies.

R1(config)#vrf upgrade-cli multi-af-mode common-policies

You are about to upgrade to the multi-AF VRF syntax commands.

You will lose any IPv6 address configured on interfaces

belonging to upgraded VRFs.

Are you sure ? [yes]: yes

Number of VRFs upgraded: 1

Later

====

R1#sh run | s vrf

vrf definition ABC

 rd 1:1

 route-target export 1:1

 route-target import 1:1

 !

 address-family ipv4

 exit-address-family

The prime reason you would want to do this possibly IPv6 introduction for PE-CE (6PE or 6VPE) since traditional " ip vrf " syntax doesn't natively support IPv6.

HTH...

Deepak Arora

Evil CCIE

ISIS Route-Leaking On IOS - Tricky Part

Task - Leak The L-2 Routes into ISIS Level-1 Domain with minimal commands.

Initial Configuration
=============


R1
===

!
en
!
conf t
!
no ip do lo
!
line con 0
 no exec-time
 logging syn
 exit
!
ho R1
!
int lo1
 ip add 1.1.1.1 255.255.255.255
 exit
!
int p1/0
 ip add 12.0.0.1 255.255.255.0
 no sh
 exit
!
int p2/0
 ip add 13.0.0.1 255.255.255.0
 no sh
 exit
!
ipv6 unicast-routing
!
router isis
 net 49.0111.0000.0000.1111.00
 metric-style wide
 add ipv6
 multi
 exit
exit
!
int lo1
 ip router isis
 isis circuit-type level-2
 exit
!
int p1/0
 ip router isis
 isis circuit-type level-2
 exit
!
int p2/0
 ip router isis
 isis circuit-type level-2
 exit
!
end
!
wr
!
=============================

R2
===

!
en
!
conf t
!
no ip do lo
!
line con 0
 no exec-time
 logging syn
 exit
!
ho R2
!
int lo2
 ip add 2.2.2.2 255.255.255.255
 exit
!
int p1/0
 ip add 12.0.0.2 255.255.255.0
 no sh
 exit
!
int p2/0
 ip add 24.0.0.2 255.255.255.0
 no sh
 exit
!
ipv6 unicast-routing
!
router isis
 net 49.0122.0000.0000.2222.00
 metric-style wide
 add ipv6
 multi
 exit
exit
!
int lo2
 ip router isis
 isis circuit-type level-2
 exit
!
int p1/0
 ip router isis
 isis circuit-type level-2
 exit
!
int p2/0
 ip router isis
 isis circuit-type level-2
 exit
!
end
!
wr
!

=============================

R3
===

!
en
!
conf t
!
no ip do lo
!
line con 0
 no exec-time
 logging syn
 exit
!
ho R3
!
int lo3
 ip add 3.3.3.3 255.255.255.255
 exit
!
int p1/0
 ip add 34.0.0.3 255.255.255.0
 no sh
 exit
!
int p2/0
 ip add 13.0.0.3 255.255.255.0
 no sh
 exit
!
int p3/0
 ip add 35.0.0.3 255.255.255.0
 no sh
 exit
!
ipv6 unicast-routing
!
router isis
 net 49.0133.0000.0000.3333.00
 metric-style wide
 add ipv6
 multi
 exit
exit
!
int lo3
 ip router isis
 isis circuit-type level-2
 exit
!
int p1/0
 ip router isis
 isis circuit-type level-2
 exit
!
int p2/0
 ip router isis
 isis circuit-type level-2
 exit
!
int p3/0
 ip router isis
 isis circuit-type level-1
 exit
!
end
!
wr
!

=============================

R4
===

!
en
!
conf t
!
no ip do lo
!
line con 0
 no exec-time
 logging syn
 exit
!
ho R4
!
int lo4
 ip add 4.4.4.4 255.255.255.255
 exit
!
int p1/0
 ip add 34.0.0.4 255.255.255.0
 no sh
 exit
!
int p2/0
 ip add 24.0.0.4 255.255.255.0
 no sh
 exit
!
ipv6 unicast-routing
!
router isis
 net 49.0144.0000.0000.4444.00
 metric-style wide
 add ipv6
 multi
 exit
exit
!
int lo4
 ip router isis
 isis circuit-type level-2
 exit
!
int p1/0
 ip router isis
 isis circuit-type level-2
 exit
!
int p2/0
 ip router isis
 isis circuit-type level-2
 exit
!
end
!
wr
!


=============================

R5
===

!
en
!
conf t
!
no ip do lo
!
line con 0
 no exec-time
 logging syn
 exit
!
ho R5
!
int lo5
 ip add 5.5.5.5 255.255.255.255
 exit
!
int p3/0
 ip add 35.0.0.5 255.255.255.0
 no sh
 exit
!
ipv6 unicast-routing
!
router isis
 net 49.0133.0000.0000.5555.00
 metric-style wide
 add ipv6
 multi
 exit
exit
!
int lo5
 ip router isis
 isis circuit-type level-1
 exit
!
int p3/0
 ip router isis
 isis circuit-type level-1
 exit
!
end
!
wr
!

Simple Trick

=========

Earlier on R5

=========

On R3
=====

Redistribute level-2 into level-1 with a Dummy Access list that doesn't exist.

Later on R5
========

HTH...
Deepak Arora
Evil CCIE

OSPFv2/v3 Over MPLS L2 VPN Using Frame Relay - ATOM

R1
===
!
mpls label protocol ldp
!
mpls ldp router-id Loopback0 force
!
pseudowire-class ATOM
 encapsulation mpls
!
connect ATOM Serial1/0 100 l2transport
 xconnect 3.3.3.3 67 pw-class ATOM
 !
!

R3
===
!
mpls label protocol ldp
!
mpls ldp router-id Loopback0 force
!
pseudowire-class ATOM
 encapsulation mpls
!
connect ATOM Serial1/0 100 l2transport
 xconnect 1.1.1.1 67 pw-class ATOM
 !
!

========================================

R1#sh mpls forwarding
Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id     Switched      interface
16         Pop Label  2.2.2.2/32       0             Fa2/0      12.0.0.2
17         Pop Label  23.0.0.0/24      0             Fa2/0      12.0.0.2
18         17         3.3.3.3/32       0             Fa2/0      12.0.0.2
19         No Label   l2ckt(67)        22782         Se1/0      point2point


R3#sh mpls for
Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop
Label      Label      or Tunnel Id     Switched      interface
16         Pop Label  2.2.2.2/32       0             Fa2/0      23.0.0.2
17         16         1.1.1.1/32       0             Fa2/0      23.0.0.2
18         Pop Label  12.0.0.0/24      0             Fa2/0      23.0.0.2
19         No Label   l2ckt(67)        25768         Se1/0      point2point

R1#sh xconnect all detail
Legend:    XC ST=Xconnect State  S1=Segment1 State  S2=Segment2 State
  UP=Up       DN=Down            AD=Admin Down      IA=Inactive
  SB=Standby  HS=Hot Standby     RV=Recovering      NH=No Hardware
XC ST  Segment 1                         S1 Segment 2                         S2
------+---------------------------------+--+---------------------------------+--
UP     ac   Se1/0:100(FR DLCI)           UP mpls 3.3.3.3:67                   UP
            Interworking: none                   Local  VC label 19
                                                 Remote VC label 19
                                                 pw-class: ATOM


R3#sh xconnect all detail
Legend:    XC ST=Xconnect State  S1=Segment1 State  S2=Segment2 State
  UP=Up       DN=Down            AD=Admin Down      IA=Inactive
  SB=Standby  HS=Hot Standby     RV=Recovering      NH=No Hardware
XC ST  Segment 1                         S1 Segment 2                         S2
------+---------------------------------+--+---------------------------------+--
UP     ac   Se1/0:100(FR DLCI)           UP mpls 1.1.1.1:67                   UP
            Interworking: none                   Local  VC label 19
                                                 Remote VC label 19
                                                 pw-class: ATOM

========================================================================


R6
===

R6#sh run | s ospf|Serial0/0|Loopback0
interface Loopback0
 ip address 6.6.6.6 255.255.255.255
 ipv6 address 2000:6::6/128
 ipv6 ospf 1 area 0
interface Serial0/0
 ip address 67.0.0.6 255.255.255.0
 encapsulation frame-relay
 ip ospf network point-to-point
 ipv6 address 2000:67::6/64
 ipv6 address FE80::6 link-local
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 clock rate 2000000
 frame-relay map ipv6 FE80::7 200 broadcast
 frame-relay map ip 67.0.0.7 200 broadcast
 frame-relay map ipv6 2000:67::7 200 broadcast
 no frame-relay inverse-arp
router ospf 1
 router-id 6.6.6.6
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0
ipv6 router ospf 1
 log-adjacency-changes


R7#sh run | s ospf|Serial0/0|Loopback0
interface Loopback0
 ip address 7.7.7.7 255.255.255.255
 ipv6 address 2000:7::7/128
 ipv6 ospf 1 area 0
interface Serial0/0
 ip address 67.0.0.7 255.255.255.0
 encapsulation frame-relay
 ip ospf network point-to-point
 ipv6 address 2000:67::7/64
 ipv6 address FE80::7 link-local
 ipv6 ospf network point-to-point
 ipv6 ospf 1 area 0
 clock rate 2000000
 frame-relay map ipv6 FE80::6 200 broadcast
 frame-relay map ip 67.0.0.6 200 broadcast
 frame-relay map ipv6 2000:67::6 200 broadcast
 no frame-relay inverse-arp
router ospf 1
 router-id 7.7.7.7
 log-adjacency-changes
 network 0.0.0.0 255.255.255.255 area 0
ipv6 router ospf 1
 log-adjacency-changes
================================================

R6#sh ip ospf nei
Neighbor ID     Pri   State           Dead Time   Address         Interface
7.7.7.7           0   FULL/  -        00:00:37    67.0.0.7        Serial0/0
R6#
R6#sh ipv6 ospf nei
Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
7.7.7.7           1   FULL/  -        00:00:33    6               Serial0/0
R6#
R6#sh ip ro os
     7.0.0.0/32 is subnetted, 1 subnets
O       7.7.7.7 [110/65] via 67.0.0.7, 00:22:34, Serial0/0
R6#
R6#sh ipv6 ro os
IPv6 Routing Table - 6 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
       U - Per-user Static route
       I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary
       O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
       ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
O   2000:7::7/128 [110/64]
     via FE80::7, Serial0/0
R6#
R6#ping 7.7.7.7 so lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 7.7.7.7, timeout is 2 seconds:
Packet sent with a source address of 6.6.6.6
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/64/84 ms
R6#
R6#trace 7.7.7.7 so lo0
Type escape sequence to abort.
Tracing the route to 7.7.7.7
  1 67.0.0.7 100 msec *  96 msec
R6#
R6#ping 2000:7::7 so lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2000:7::7, timeout is 2 seconds:
Packet sent with a source address of 2000:6::6
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 44/61/72 ms
R6#trace 2000:7::7
Type escape sequence to abort.
Tracing the route to 2000:7::7
  1 2000:7::7 80 msec 76 msec 76 msec


HTH...
Deepak Arora
Evil CCIE

Multilink Frame Relay ---- FRF.16

 

Configuration

==========

 

 

 

Verification

=========

 

 

 

Further Readings

=============

http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/17s_mfr.html

http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/dmfr.html

 

HTH...
Deepak Arora
Evil CCIE