R1
===
!
mpls label protocol ldp
!
mpls ldp router-id Loopback0 force
!
pseudowire-class ATOM
encapsulation mpls
!
connect ATOM Serial1/0 100 l2transport
xconnect 3.3.3.3 67 pw-class ATOM
!
!
R3
===
!
mpls label protocol ldp
!
mpls ldp router-id Loopback0 force
!
pseudowire-class ATOM
encapsulation mpls
!
connect ATOM Serial1/0 100 l2transport
xconnect 1.1.1.1 67 pw-class ATOM
!
!
========================================
R1#sh mpls forwarding
Local Outgoing Prefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
16 Pop Label 2.2.2.2/32 0 Fa2/0 12.0.0.2
17 Pop Label 23.0.0.0/24 0 Fa2/0 12.0.0.2
18 17 3.3.3.3/32 0 Fa2/0 12.0.0.2
19 No Label l2ckt(67) 22782 Se1/0 point2point
R3#sh mpls for
Local Outgoing Prefix Bytes Label Outgoing Next Hop
Label Label or Tunnel Id Switched interface
16 Pop Label 2.2.2.2/32 0 Fa2/0 23.0.0.2
17 16 1.1.1.1/32 0 Fa2/0 23.0.0.2
18 Pop Label 12.0.0.0/24 0 Fa2/0 23.0.0.2
19 No Label l2ckt(67) 25768 Se1/0 point2point
R1#sh xconnect all detail
Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State
UP=Up DN=Down AD=Admin Down IA=Inactive
SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
UP ac Se1/0:100(FR DLCI) UP mpls 3.3.3.3:67 UP
Interworking: none Local VC label 19
Remote VC label 19
pw-class: ATOM
R3#sh xconnect all detail
Legend: XC ST=Xconnect State S1=Segment1 State S2=Segment2 State
UP=Up DN=Down AD=Admin Down IA=Inactive
SB=Standby HS=Hot Standby RV=Recovering NH=No Hardware
XC ST Segment 1 S1 Segment 2 S2
------+---------------------------------+--+---------------------------------+--
UP ac Se1/0:100(FR DLCI) UP mpls 1.1.1.1:67 UP
Interworking: none Local VC label 19
Remote VC label 19
pw-class: ATOM
========================================================================
R6
===
R6#sh run | s ospf|Serial0/0|Loopback0
interface Loopback0
ip address 6.6.6.6 255.255.255.255
ipv6 address 2000:6::6/128
ipv6 ospf 1 area 0
interface Serial0/0
ip address 67.0.0.6 255.255.255.0
encapsulation frame-relay
ip ospf network point-to-point
ipv6 address 2000:67::6/64
ipv6 address FE80::6 link-local
ipv6 ospf network point-to-point
ipv6 ospf 1 area 0
clock rate 2000000
frame-relay map ipv6 FE80::7 200 broadcast
frame-relay map ip 67.0.0.7 200 broadcast
frame-relay map ipv6 2000:67::7 200 broadcast
no frame-relay inverse-arp
router ospf 1
router-id 6.6.6.6
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
ipv6 router ospf 1
log-adjacency-changes
R7#sh run | s ospf|Serial0/0|Loopback0
interface Loopback0
ip address 7.7.7.7 255.255.255.255
ipv6 address 2000:7::7/128
ipv6 ospf 1 area 0
interface Serial0/0
ip address 67.0.0.7 255.255.255.0
encapsulation frame-relay
ip ospf network point-to-point
ipv6 address 2000:67::7/64
ipv6 address FE80::7 link-local
ipv6 ospf network point-to-point
ipv6 ospf 1 area 0
clock rate 2000000
frame-relay map ipv6 FE80::6 200 broadcast
frame-relay map ip 67.0.0.6 200 broadcast
frame-relay map ipv6 2000:67::6 200 broadcast
no frame-relay inverse-arp
router ospf 1
router-id 7.7.7.7
log-adjacency-changes
network 0.0.0.0 255.255.255.255 area 0
ipv6 router ospf 1
log-adjacency-changes
================================================
R6#sh ip ospf nei
Neighbor ID Pri State Dead Time Address Interface
7.7.7.7 0 FULL/ - 00:00:37 67.0.0.7 Serial0/0
R6#
R6#sh ipv6 ospf nei
Neighbor ID Pri State Dead Time Interface ID Interface
7.7.7.7 1 FULL/ - 00:00:33 6 Serial0/0
R6#
R6#sh ip ro os
7.0.0.0/32 is subnetted, 1 subnets
O 7.7.7.7 [110/65] via 67.0.0.7, 00:22:34, Serial0/0
R6#
R6#sh ipv6 ro os
IPv6 Routing Table - 6 entries
Codes: C - Connected, L - Local, S - Static, R - RIP, B - BGP
U - Per-user Static route
I1 - ISIS L1, I2 - ISIS L2, IA - ISIS interarea, IS - ISIS summary
O - OSPF intra, OI - OSPF inter, OE1 - OSPF ext 1, OE2 - OSPF ext 2
ON1 - OSPF NSSA ext 1, ON2 - OSPF NSSA ext 2
O 2000:7::7/128 [110/64]
via FE80::7, Serial0/0
R6#
R6#ping 7.7.7.7 so lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 7.7.7.7, timeout is 2 seconds:
Packet sent with a source address of 6.6.6.6
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/64/84 ms
R6#
R6#trace 7.7.7.7 so lo0
Type escape sequence to abort.
Tracing the route to 7.7.7.7
1 67.0.0.7 100 msec * 96 msec
R6#
R6#ping 2000:7::7 so lo0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 2000:7::7, timeout is 2 seconds:
Packet sent with a source address of 2000:6::6
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 44/61/72 ms
R6#trace 2000:7::7
Type escape sequence to abort.
Tracing the route to 2000:7::7
1 2000:7::7 80 msec 76 msec 76 msec
HTH...
Deepak Arora
Evil CCIE
It's been quite a while since CCIE R&S Ver 4 blueprint came out. But still almost two years later I see lots of people still have issues not only with MPLS VPN Troubleshooting but also with MPLS VPN configuration. So I thought to start a series on basic MPLS Layer 3 VPNs configuration and troubleshooting. Initially I'll start with some very basic scenario and will configure all CCIE R&S PE-CE Protocols such RIP, EIGRP, OSPF & BGP. Later we will introduce some more complex topology to get some CCIE R&S Lab TS Section feeling. Along the way we will be doing some troubleshooting labs and most importantly will try to develop troubleshooting strategy as well.
So lets first talk about problem with building MPLS Layer 3 VPNs. Basically the problem people usually encounter with MPLS VPNs is that it's basically collection of many many technologies working together which makes it look alike complex technology. But no matter how much complex something looks alike, it's just collection of different technologies/pieces working together. And as long as you can break complex things into pieces, it makes it easy.
So lets try to list down different technologies you need to master in prior in order to make MPLS Layer 3 VPN work:
> Layer 2 Technologies ( Ethernet, Switching & Bridging, PPP, Frame-Relay)
> IGPs (RIP, EIGRP, OSPF)
> EGP (BGP)
> REDISTRIBUTION
> Cisco Express Forwarding (CEF)
> MPLS
> MPLS Label Distribution Protocols (TDP, LDP, BGP, RSVP)
> Multi Protocol BGP (MPBGP)
> Basics of Virtualization (Concept)
So you see there are many technologies working together. And most importantly you need to master all this stuff before you start working on MPLS layer 3 VPNs.
On the flip side, if you really know and understand all technologies mentioned above, The MPLS Layer 3 VPNs is nothing but making all these technologies work together.
In next post I'll start with Building the Service Provider Core network to get it ready for running MPLS VPNn. Below is the topology we will be using. Stay tuned.....
IPSEC LAN TO LAN VPN USING CRYPTOMAP (With host to host routing configured)
***************************************************************************
R1
===
!
crypto isakmp policy 10
encr aes
authentication pre-share
group 5
lifetime 3600
hash sha
!
crypto isakmp key cisco address 23.23.23.3
!
crypto ipsec transform-set PHASE2 esp-3des esp-sha-hmac
!
access-list 100 permit ip 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
crypto map CRYPTOMAP 10 ipsec-isakmp
set peer 23.23.23.3
set transform-set PHASE2
match address 100
!
!
interface FastEthernet0/0
crypto map CRYPTOMAP
!
=========================
R3
===
!
crypto isakmp policy 10
enc aes
hash sha
gr 5
life 3600
authen pre
exit
!
crypto isakmp key cisco address 12.12.12.1
!
crypto ipsec transform-set PHASE2 esp-3des esp-sha-hmac
!
access-l 100 per ip 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.255
!
crypto map CRYPTOMAP 10 ipsec-isakmp
set peer 12.12.12.1
set transform PHASE2
match add 100
!
int f0/0
crypto map CRYPTOMAP
!
==========================
###########################################################
IPSEC OVER GRE ( With No host to host routing )
****************************************
R1
===
!
router ospf 1
no network 14.14.14.1 0.0.0.0 area 0
!
interface Tunnel0
ip address 13.13.13.1 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 23.23.23.3
!
router eigrp 1
no au
net 14.14.14.1 0.0.0.0
net 13.13.13.1 0.0.0.0
!
no access-list 100 permit ip 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
access-list 100 permit gre 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
no access-list 100 permit gre 14.14.14.0 0.0.0.255 35.35.35.0 0.0.0.255
!
access-list 100 permit gre ho 12.12.12.1 ho 23.23.23.3
!
R3
===
!
router ospf 1
no network 35.35.35.3 0.0.0.0 area 0
!
interface Tunnel0
ip address 13.13.13.3 255.255.255.0
tunnel source FastEthernet0/0
tunnel destination 12.12.12.1
!
router eigrp 1
no au
net 35.35.35.3 0.0.0.0
net 13.13.13.3 0.0.0.0
!
no access-list 100 permit ip 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.255
!
access-list 100 permit gre 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.25
!
no access-list 100 permit gre 35.35.35.0 0.0.0.255 14.14.14.0 0.0.0.255
!
access-list 100 permit gre ho 23.23.23.3 ho 12.12.12.1
!
=========================================================================
#############################################################################
IPSEC LAN TO LAN Using IPSEC Profile (No host to host routing)
*****************************************************
R1
==
!
crypto ipsec profile IPSEC-PROFILE
set transform-set PHASE2
!
int f0/0
no crypto map CRYPTOMAP
!
int tu0
tunnel protection ipsec profile IPSEC-PROFILE
!
R3
==
!
crypto ipsec profile IPSEC-PROFILE
set transform-set PHASE2
!
int f0/0
no crypto map CRYPTOMAP
!
int tu0
tunnel protection ipsec profile IPSEC-PROFILE
!
=========================================================================
#########################################################################
IPSEC LAN TO LAN Using Static VTI (No host to host routing)
**************************************************
R1
==
!
int tu0
tunnel mode ipsec ipv4
!
no access-list 100 permit gre host 12.12.12.1 host 23.23.23.3
!
R3
==
!
int tu0
tunnel mode ipsec ipv4
!
no access-list 100 permit gre host 23.23.23.3 host 12.12.12.1
!
=========================================================================
HTH...
Deepak Arora
Evil CCIE
