{"id":1556,"date":"2017-12-23T23:25:07","date_gmt":"2017-12-23T15:25:07","guid":{"rendered":"https:\/\/networkingnotesblog.wordpress.com\/?p=1556"},"modified":"2017-12-23T23:25:07","modified_gmt":"2017-12-23T15:25:07","slug":"mpls-vpn-option-c-using-bgp-label-exchange-with-cisco-and-junos-part1","status":"publish","type":"post","link":"http:\/\/notes4it.com\/?p=1556","title":{"rendered":"MPLS VPN – option C – using bgp label exchange with cisco and Junos -part 1"},"content":{"rendered":"

It has been a while since I have done any labs after getting a new job. This time, I will be building a NNI option C using both Cisco IOS and Juniper MX. The reason I write this is because I do not find many resources on the internet about the inter AS connection using 2 different software at the same time. Hope this can be useful for anyone who is having the same struggle as i do.
\n(the AS# below are randomly picked!!)
\n\"lab-testing-mpls\"
\nBased on the lab diagram (dont feel like copping it up), as the internal VPN service is already running and the intra AS is running OSPF and LDP for MPLS, I will be connecting AS5052 (the green aren in middle) and AS7077 (the orange area at the bottom) together over NNIs to extend the MPLS VPN services.
\nSince the NNIs in this lab will not be running LDP between the ASBRs of AS5052 and AS7077, we will be using BGP to exchange IPv4 plus label information between AS7077 and AS5052 for building end to end LSP as a second option.
\nAlso, we will have the route reflectors to exchange the MPLS VPN route entries between both autonomous system for extending MPLS VPN services.
\nThe objective of this lab would be the following:
\n1. R04 (AS5052 ASBR) has eBGP peering with R25 (AS7077 ASBR) for IPv4 entries plus labelling.
\n2. R06 (AS5052 ASBR) has eBGP peering with R24 (AS7077 ASBR) for IPv4 entries plus labelling.
\n3. R26 (AS7077 RR) has eBGP peering with R08 and R09 (AS5052 RR) for MPLS VPN route entries.
\n4. Route reflector(s) within AS will have iBGP peering to every PE router for giving out the peering AS loop back addresses and as well the VPN route entries.
\nFirst of all, the ASBRs from both AS will have to advertise their internal loop back Addresses to their peers. This is to allow the peering AS network PE routers to recognize the next hop of the VPN traffic, as well as the peering between router reflectors. In order to do so, ASBR will redistribute all of the loop back address from its OSPF database to its peer via eBGP.
\n
\nR04:
\nIn the attached route table below, we can tell the routes are store in the inet.0 table, which is the IPv4 table. But why would the good old IPv4 routes would have a label attach at the end? That is because the label will be used to form an end to end label switching path to carry the mpls encapsulated packets from one AS to another. And some of you might have spot that some route entries does not have MPLS label. That is because R04 is the penultimate router of R25.
\n 
\n <\/p>\n\n\n\n\n\n\n\n\n
Route entries<\/td>\n<\/td>\n<\/tr>\n
netuser@net-AS5052-vMX-R04> show route protocol bgp next-hop 9.9.9.5
\ninet.0: 42 destinations, 62 routes (42 active, 0 holddown, 0 hidden)
\n+ = Active Route, – = Last Active, * = Both
\n10.70.0.24\/32 [BGP\/170] 01:14:47, MED 2, localpref 100
\nAS path: 7077 ?, validation-state: unverified
\n> to 9.9.9.5 via ge-0\/0\/2.3969, Push 19<\/span>
\n10.70.0.25\/32 *[BGP\/170] 01:14:47, MED 0, localpref 100
\nAS path: 7077 ?, validation-state: unverified
\n> to 9.9.9.5 via ge-0\/0\/2.3969
\n10.70.0.26\/32 [BGP\/170] 01:14:47, MED 2, localpref 100
\nAS path: 7077 ?, validation-state: unverified
\n> to 9.9.9.5 via ge-0\/0\/2.3969, Push 17<\/span>
\n10.70.1.0\/31 [BGP\/170] 01:14:47, MED 501, localpref 100
\nAS path: 7077 ?, validation-state: unverified
\n> to 9.9.9.5 via ge-0\/0\/2.3969, Push 18<\/span>
\n10.70.1.2\/31 *[BGP\/170] 01:14:47, MED 0, localpref 100
\nAS path: 7077 ?, validation-state: unverified
\n> to 9.9.9.5 via ge-0\/0\/2.3969
\n10.70.1.4\/31 *[BGP\/170] 01:14:47, MED 0, localpref 100
\nAS path: 7077 ?, validation-state: unverified
\n> to 9.9.9.5 via ge-0\/0\/2.3969
\n10.70.1.6\/31 *[BGP\/170] 01:14:47, MED 0, localpref 100
\nAS path: 7077 ?, validation-state: unverified
\n> to 9.9.9.5 via ge-0\/0\/2.3969<\/td>\n		<\/td>\n<\/tr>\n
\u00a0The syntax for the R04 is listed below:
\n– it is to build an LSP using BGP.
\n– also it exchanges the loopback addresses of router reflector and other P and PE routes to AS7077.<\/td>\n		<\/td>\n<\/tr>\n
set interfaces ge-0\/0\/2 unit 3969 description “Connect to NNI-C AS7077 R25”
\nset interfaces ge-0\/0\/2 unit 3969 vlan-id 3969
\nset interfaces ge-0\/0\/2 unit 3969 family inet mtu 1982<\/span>
\nset interfaces ge-0\/0\/2 unit 3969 family inet address 9.9.9.4\/31
\nset interfaces ge-0\/0\/2 unit 3969 family mpls mtu 1962<\/span>
\nset interfaces ge-0\/0\/2 unit 3969 family mpls maximum-labels 5
\n<\/span>!!! it is always a good practices to <\/span>set interfaces to take as much labels as possible. In this case, it will pass 3 layers of encapulations (1 for MPLS VPN, 1 for internal AS LSP, and 1 for LSP over NNI) to AS7077 !!!
\n<\/span><\/strong><\/td>\n		<\/td>\n<\/tr>\n
set policy-options policy-statement ebgp-AS7077-export term 01-route_reflector from route-filter 10.50.0.8\/32 exact
\nset policy-options policy-statement ebgp-AS7077-export term 01-route_reflector from route-filter 10.50.0.9\/32 exact
\nset policy-options policy-statement ebgp-AS7077-export term 01-route_reflector then accept
\nset policy-options policy-statement ebgp-AS7077-export term 02-loopback from route-filter 10.50.0.0\/24 prefix-length-range \/32-\/32
\nset policy-options policy-statement ebgp-AS7077-export term 02-loopback then accept
\nset policy-options policy-statement ebgp-AS7077-export then reject<\/td>\n		<\/td>\n<\/tr>\n
set protocols bgp group ebgp-AS7077-NNI-C type external
\nset protocols bgp group ebgp-AS7077-NNI-C family inet labeled-unicast<\/span><\/strong>
\n !!! the magic of building an LSP using BGP is “labeled-unicast” !!!<\/span>
\nset protocols bgp group ebgp-AS7077-NNI-C export ebgp-AS7077-export
\nset protocols bgp group ebgp-AS7077-NNI-C peer-as 7077
\nset protocols bgp group ebgp-AS7077-NNI-C neighbor 9.9.9.5<\/td>\n		<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n


\nR25:
\n <\/p>\n\n\n\n\n\n
Route entries<\/td>\n<\/td>\n<\/tr>\n
net-AS7077-vIOS-R25#sho ip route bgp | in 9.9.9.4
\nB 10.50.0.1\/32 [20\/1] via 9.9.9.4, 00:11:10
\nB 10.50.0.4\/32 [20\/0] via 9.9.9.4, 00:11:10
\nB 10.50.0.5\/32 [20\/1] via 9.9.9.4, 00:11:10
\nB 10.50.0.8\/32 [20\/1] via 9.9.9.4, 00:11:10<\/td>\n		<\/td>\n<\/tr>\n
\n\n\n\n\n\n\n\n\n
net-AS7077-vIOS-R25#sho mpls forwarding-table | in 10.50
\n20 320705<\/span> 10.50.0.1\/32 0 Gi0\/2.3969 9.9.9.4
\n21 320753<\/span> 10.50.0.5\/32 0 Gi0\/2.3969 9.9.9.4
\n22 320785<\/span> 10.50.0.8\/32 222125 Gi0\/2.3969 9.9.9.4
\n23 23<\/span> 10.50.0.2\/32 0 Gi0\/1.3973 10.70.1.7
\n24 24<\/span> 10.50.0.3\/32 0 Gi0\/1.3973 10.70.1.7
\n25 27<\/span> 10.50.0.6\/32 0 Gi0\/1.3973 10.70.1.7
\n26 Pop Label 10.50.0.4\/32 0 Gi0\/2.3969 9.9.9.4
\n27 26<\/span> 10.50.0.9\/32 0 Gi0\/1.3973 10.70.1.7
\n28 29 10.50.0.11\/32 0 Gi0\/1.3973 10.70.1.7<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n		<\/td>\n<\/tr>\n
The syntax below for R25 is listed below:
\n– to exchange route entries including<\/td>\n		<\/td>\n<\/tr>\n
interface GigabitEthernet0\/2.3969
\nencapsulation dot1Q 3969
\nip address 9.9.9.5 255.255.255.254
\nmpls mtu 1980
\nmpls traffic-eng tunnels
\n mpls bgp forwarding<\/span>
\nmpls ip
\nip rsvp bandwidth 1500<\/td>\n		<\/td>\n<\/tr>\n
router bgp 7077
\nbgp log-neighbor-changes
\nno bgp default ipv4-unicast
\nneighbor 9.9.9.4 remote-as 5052
\nneighbor 10.70.0.26 remote-as 7077
\nneighbor 10.70.0.26 update-source Loopback0
\n!<\/td>\n		<\/td>\n<\/tr>\n
address-family ipv4
\nredistribute ospf 1
\nneighbor 9.9.9.4 activate
\nneighbor 9.9.9.4 send-community extended
\nneighbor 9.9.9.4 route-map bgp-in in
\nneighbor 9.9.9.4 route-map bgp-out out
\nneighbor 9.9.9.4 send-label<\/span>
\nexit-address-family
\n!<\/td>\n		<\/td>\n<\/tr>\n
route-map bgp-out permit 10
\nset mpls-label
\n!
\nroute-map bgp-in permit 10
\nmatch mpls-label
\n!<\/td>\n		<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n


\nAfter both sides have the route info of the addresses of router s loopback and the router reflector, we can build the ebgp peering between both router reflectors (R8 and R26). The R8 is a logical router.
\n <\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Syntax for R8
\n– applying all of the route type in the same group is not really a good practice, but who cares, it s a lab only eh !!!<\/td>\n		<\/td>\n<\/tr>\n
set logical-systems LS-RR1 protocols bgp group ebgp-NNI-C type external
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C multihop ttl 200
\n!!! since this ebgp connection is not direct peering, and the default ebgp time to live value is 1, so we have to increase the ttl for this connection. !!!<\/span>
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C local-address 10.50.0.8
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C neighbor 10.70.0.26 multihop no-nexthop-change
\n!!! also we need to advertise the route entries to AS7077 without changing the next hop at their end. otherwise, all of the traffic from AS7077 to AS5052 will be routed via the route reflector. !!!<\/span>
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C neighbor 10.70.0.26 family inet-vpn unicast
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C neighbor 10.70.0.26 family inet6-vpn unicast
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C neighbor 10.70.0.26 family l2vpn signaling
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C neighbor 10.70.0.26 family evpn signaling
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C neighbor 10.70.0.26 family inet-mvpn signaling
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C neighbor 10.70.0.26 family inet6-mvpn signaling
\nset logical-systems LS-RR1 protocols bgp group ebgp-NNI-C neighbor 10.70.0.26 peer-as 7077<\/td>\n		<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
Syntax for R26:<\/td>\n<\/td>\n<\/tr>\n
router bgp 7077
\nneighbor 10.50.0.8 remote-as 5052
\nneighbor 10.50.0.8 ebgp-multihop 200<\/span>
\n!!!! the multi hop here is the same as ttl in junos.<\/span>
\nneighbor 10.50.0.8 update-source Loopback0
\nneighbor 10.50.0.9 remote-as 5052
\nneighbor 10.50.0.9 ebgp-multihop 200<\/span>
\n!!!! the multi hop here is the same as ttl in junos.<\/span>
\nneighbor 10.50.0.9 update-source Loopback0
\n!<\/td>\n		<\/td>\n<\/tr>\n
address-family vpnv4
\nneighbor 10.50.0.8 activate
\nneighbor 10.50.0.8 send-community both
\nneighbor 10.50.0.8 next-hop-unchanged<\/span>
\n!!! also we need to advertise the route entries to AS5052 without changing the next hop at their end. otherwise, all of the traffic from AS5052 to AS7077 will be routed via the route reflector. !!!<\/span>
\nneighbor 10.50.0.9 activate
\nneighbor 10.50.0.9 send-community both
\nneighbor 10.50.0.9 next-hop-unchanged<\/span>
\nexit-address-family
\n!<\/td>\n		<\/td>\n<\/tr>\n
address-family vpnv4 multicast
\nneighbor 10.50.0.8 activate
\nneighbor 10.50.0.8 send-community extended
\nneighbor 10.50.0.8 next-hop-unchanged<\/span>
\nneighbor 10.50.0.9 activate
\nneighbor 10.50.0.9 send-community extended
\nneighbor 10.50.0.9 next-hop-unchanged<\/span>
\nexit-address-family<\/td>\n		<\/td>\n<\/tr>\n
address-family vpnv6
\nneighbor 10.50.0.8 activate
\nneighbor 10.50.0.8 send-community extended
\nneighbor 10.50.0.8 next-hop-unchanged<\/span>
\nneighbor 10.50.0.9 activate
\nneighbor 10.50.0.9 send-community extended
\nneighbor 10.50.0.9 next-hop-unchanged<\/span>
\nexit-address-family<\/td>\n		<\/td>\n<\/tr>\n
address-family vpnv6 multicast
\nneighbor 10.50.0.8 activate
\nneighbor 10.50.0.8 send-community extended
\nneighbor 10.50.0.8 next-hop-unchanged<\/span>
\nneighbor 10.50.0.9 activate
\nneighbor 10.50.0.9 send-community extended
\nneighbor 10.50.0.9 next-hop-unchanged<\/span>
\nexit-address-family<\/td>\n		<\/td>\n<\/tr>\n
address-family l2vpn evpn
\nneighbor 10.50.0.8 activate
\nneighbor 10.50.0.8 send-community both
\nneighbor 10.50.0.8 next-hop-unchanged<\/span>
\nneighbor 10.50.0.9 activate
\nneighbor 10.50.0.9 send-community both
\nneighbor 10.50.0.9 next-hop-unchanged<\/span>
\nexit-address-family<\/td>\n		<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Once we have the ebgp connection setup at both AS, we will be able to see the route entries received from R26 to R08, and R08 will redistribute the ebgp routes to other PE nodes within the AS.
\n <\/p>\n\n\n\n\n\n
Route entries at R08:
\n– from\u00a0 the routes below, for route 8.8.8.8\/32 and 10.70.2.0\/30 (located in R25 VRF), there are 2 mpls labes.<\/td>\n		<\/td>\n<\/tr>\n
<\/td>\n<\/tr>\n
If R08 is the ingress router and need to pass a packet to 10.70.2.0\/30, the traffic flow will be listed below:<\/p>\n\n\n\n\n\n\n\n
device<\/td>\nSender<\/td>\nR08<\/td>\nR04<\/td>\nR25<\/td>\nrecepient<\/td>\n<\/tr>\n
Router type<\/td>\n<\/td>\nIngress route<\/td>\nPenultimate router<\/td>\n\u00a0Egress router<\/td>\n<\/td>\n<\/tr>\n
Label header<\/td>\n\u00a0N\/A<\/td>\ninsert the following labels.
\nlv1 – 320881
\nlv2 – 29
\nlv3 – IPv4<\/td>\n		Pop the\u00a0 outter label.
\nlv1 – 29
\nlv2 – IPv4<\/td>\n		Pop the outter label.
\nlv1 – IPv4<\/td>\n		It will not receive any labeled packets.
\nlv1 – IPv4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
If R08 is the ingress router and need to pass a packet to 10.70.90.26\/32, the traffic flow will be listed below:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
device<\/td>\nSender<\/td>\nR08<\/td>\nR04<\/td>\nR25<\/td>\n\u00a0R26<\/td>\nrecepient<\/td>\n<\/tr>\n
Router type<\/td>\n<\/td>\nIngress route<\/td>\nintermediate router<\/td>\nPenultimate router<\/td>\n\u00a0Egress router<\/td>\n<\/td>\n<\/tr>\n
Label header<\/td>\nSending a regular IPv4 packet.
\nIPv4<\/td>\n		Insert the following labels.
\nlv1 – 402033
\nlv2 – 74
\nlv3 – IPv4<\/td>\n		SWAP the outter label.
\nlv1 – 17
\nlv2 – 74
\nlv3 – IPv4<\/td>\n		Pop the outter label.
\nlv1 – 74
\nlv2 – IPv4<\/td>\n		Pop the outter label.
\nlv1 – IPv4<\/td>\n		Receive a regular IPv4 packet.
\nlv1 – IPv4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n		<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n
netuser@net-AS5052-vMX-R04> show route logical-system LS-RR1 table bgp.l3vpn.0
\nbgp.l3vpn.0: 30 destinations, 30 routes (30 active, 0 holddown, 0 hidden)
\n+ = Active Route, – = Last Active, * = Both7077:1025:8.8.8.8\/32
\n*[BGP\/170] 00:42:59, localpref 100, from 10.70.0.26
\nAS path: 7077 ?, validation-state: unverified
\n> to 10.50.1.24 via lt-0\/0\/0.25, Push 29, Push 320881(top)
\n!!! <\/span>
\n7077:1025:10.70.2.0\/30
\n*[BGP\/170] 00:42:59, localpref 100, from 10.70.0.26
\nAS path: 7077 ?, validation-state: unverified
\n> to 10.50.1.24 via lt-0\/0\/0.25, Push 30, Push 320881(top)<\/span>
\n7077:1026:10.70.90.26\/32
\n*[BGP\/170] 04:13:07, MED 0, localpref 100, from 10.70.0.26
\nAS path: 7077 ?, validation-state: unverified
\n> to 10.50.1.24 via lt-0\/0\/0.25, Push 74, Push 402033(top)
\n<\/span><\/td>\n		<\/td>\n<\/tr>\n
netuser@net-AS5052-vMX-R04> show route label 402033
\nmpls.0: 33 destinations, 33 routes (33 active, 0 holddown, 0 hidden)
\n+ = Active Route, – = Last Active, * = Both
\n402033 *[VPN\/170] 00:37:58
\n> to 9.9.9.5 via ge-0\/0\/2.3969, Swap 17<\/span><\/td>\n		<\/td>\n<\/tr>\n
net-AS7077-vIOS-R25#sho mpls forwarding-table labels 17<\/span>
\nLocal Outgoing Prefix Bytes Label Outgoing Next Hop
\nLabel Label or Tunnel Id Switched interface
\n17<\/span> Pop Label 10.70.0.26\/32 747812 Gi0\/1.3972 10.70.1.3
\nPop Label 10.70.0.26\/32 377223 Gi0\/1.3971 10.70.1.5<\/td>\n		<\/td>\n<\/tr>\n
net-AS7077-vIOS-R26#sho mpls forwarding-table labels 74<\/span>
\nLocal Outgoing Prefix Bytes Label Outgoing Next Hop
\nLabel Label or Tunnel Id Switched interface
\n74<\/span> Pop Label 10.70.90.26\/32[V] \\
\n0 aggregate\/cust-A<\/span><\/td>\n		<\/td>\n<\/tr>\n
<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 
\nI think I will stop here for a while. Also this post should cover the basic NNI option C setup for both Cisco IOS and Juniper Junos already. But do let me know what else can be put into this post to make it better.
\n 
\n <\/p>\n\n\n\n\n
1<\/td>\n2<\/td>\n<\/tr>\n
3<\/td>\n4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

It has been a while since I have done any labs after getting a new job. This time, I will be building a NNI option C using both Cisco IOS and Juniper MX. The reason I write this is because I do not find many resources on the internet about the inter AS connection using […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,3],"tags":[16,26,44,67,72,75,90,92,94,108,111,116,128,139,142,157,159,197,205,207,208],"class_list":["post-1556","post","type-post","status-publish","format-standard","hentry","category-networking","category-virtualization","tag-bgp-label-en","tag-cisco-en","tag-ebgp-en","tag-ibgp-en","tag-intermediate-router-en","tag-ios-en","tag-juniper-en","tag-juniper-vmx-en","tag-junos-en","tag-logical-router-en","tag-mpls-en","tag-nni-option-c-en","tag-penultimate-route-en","tag-rfc-4364-en","tag-route-reflector-en","tag-show-mpls-forwarding-table-en","tag-show-route-label-en","tag-virtual-ios-en","tag-vmx-en","tag-vpn-en","tag-vrf-en"],"_links":{"self":[{"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/posts\/1556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/notes4it.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1556"}],"version-history":[{"count":0,"href":"http:\/\/notes4it.com\/index.php?rest_route=\/wp\/v2\/posts\/1556\/revisions"}],"wp:attachment":[{"href":"http:\/\/notes4it.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/notes4it.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1556"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/notes4it.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}