MPLS VPN Data Plane

• To support the forwarding of packets, 
• ingress PEs need appropriate FIB entries, 
• Ps & PEs needing appropriate LFIB entries
• The outer label identifies the segments of the LSP between between the ingress PE & the egress PE,
• but it doesn't identify how the egress PE should forward the packet.
• The inner label identifies the egress PE's forwarding details, in particular the outgoing interface for the unlabeled packet.
• Building the Inner (VPN) label:
• The inner label called VPN label
• VPN label must be allocated for each route added to each customer VRF.
• More specifically, a CE will advertise routes to the PE, 
• PE stores these routes in the corresponding customer's VRF
• In order to prepare to forward packets to those customer subnets, 
• the PE needs to allocate a new local label 
• That local label contain the prefix & the route's next-hop ip address & outgoing interface  & stores this information in LFIB.
• Steps in LSRs fill the FIB & LFIB when using MPLS VPNs
• An unlabeled packet arrives on an interface assigned to VRF, 
• which will cause ingress PE to use VRF's FB to make a forwarding decision.
• At ingress PEs VRF, FIB shows the outgoing interface for destination ip &
• Add a label stack with 2 labes
• an inner label(having original destination IP address)
• an outer label
• Then ingress PE forwards the packet to next Ps
• P uses the LFIB entry for incoming  label (outer label), swap this label.

MPLS VPN Configuration

• Main steps in configuring MPLS VPN configuration:
• Creating each VRF, RD, & RT, plus associating the customer-facing PE interfaces with the correct VRF
• Configuring the IGP between PE & CE
• Configuring mutual redistribution between the IGP & BGP
• Configuring MP-BGP between PEs

• VPNs are configured only on PE routers only.
• The customer routers no need to know about VPNs
• P routers no need to know about the MPLS VPN features
• VRFs allow PEs to store routes learned from various CEs, even if the prefixes overlap.
• RD allows PEs to store routes as unique prefixes.
• RT tells the PEs which routes should be added to each VRF
• which provides greater control & ability to allow sites to be reachable from multiple VPNs.
• VRF configuration on PE use the following commands:
• Configure the VRF using command:
• ip vrf <vrf-name>
• Configure the RD under VRF sub-command using
• rd <rd-value>
• Configure the RT under VRF sub-command using
• rt {import|export} <rt-value>
• Associating an interface with the VRF under interface sub-command using
• ip vrf forwarding <vrf-name>
• Each VRF has:
• One RD
• At least one import & export routing tag.
• If we give unique RD to every VRF, overlapping of prefixes will be overcomes.
• Configuring the IGP between PE & CE:
• Configure a routing protocol between PE & CE.
• This allows the PE router to learn the customer routes & CE to learn the other customer routes learned by PE from other PE in the MPLS cloud.
• Any IGP or even BGP can be used as the routing protocol.
• Show Commands:
• sh ip route vrf cust-A
• shows connected route on PE router & router learned from CE.
• Configuring Redistribution between PE-CE IGP & MP-BGP
• PE have no ability to advertise these routes across the MPLS VPN cloud.
• Then redistribute the IGP learned routes from CE into BGP table contain other CE routes learned from remaining PEs & vice-versa.
• 2 methods to add new routes to BGP table are
• Using network command
• Redistribution
• The BGP network command works well when adding small number of predictable prefixes.
• The Redistribution process works best when 
• the prefixes are not predictable
• there may be many no.of prefixes,... etc.
• So MPLS VPN BGP configurations uses the Redistribution process for adding new routes.
• MPLS VPN mutual redistribution configuration requires specific VRF told by both IGP & BGP.
• Redistribution command under the IGP & BGP process is
•  address-family ipv4 vrf  <vrf-name>
• Configuring MP-BGP between PFs
• To configure each peer, commands used are in normal BGP in non-MPLS configurations & others occur inside a new VPNv4 address family.
• Compare MPLS VPN BGP  & traditional BGP configuration. 
• The PE neighbors are defined under the main BGP process, not for particular address family.
• In MPLS VPN designs loopback is used as update source on the PE routers.
• In that case, the neighbor update-source command is also under the mail BGP process.
• The PE neighbors are then activated, using the neighbor activate command, under the VPNv4 address family process (address-family vpnv4).
• BGP must be told to send the community PA (neighbor send-community) command, under the address-family vpnv4 command.
• The VPNv4 address family does not refer to any particular VRF.
• Thre is no need of iBGP neighbor per VRF on each remote VRF.

Loop Back Address in MPLS

• Enable Loopback interfaces on all P & PE routers.
• These loopback addresses must be in  the core IGP.
• Establish MP-BGP sessions with these loopback addresses on all PE routers.
• These loopback interfaces will be used & referred as BGP next-hop address which carries MPLS VPN traffic.
• A BGP next-hop address must be an IGP route.
• 
  

MPLS Route Targets

• MPLS uses Route Targets to determine in which VRFs, a PE places IBGP-learned routes.
• It is 64-bit extended BGP community.
• It is attached to a VPNv4 BGP route to indicate its VPN membership
• Any number of RTs attached to a single route up to the BGP update packet size of 4096 bits.
• Export RTs
• Attached to a route when it is converted into a VPN4 route.
• Identify the VPN membership by associating routes to a VRF
• Import RTs
• Used to select VPNv4 routes for insertion into matching VRF tables.
• On the receiving PE router, a route is imported into a vrf only if at least one RT attached to the route matches at least one import RT configured in that VRF(route map condition must be met if configured).
• An import or export map allows route control on a per-route basis.
• 
  

MP-BGP & Routing Distinguishers

• Routes learned from the CE router are advertised to other PE routers uses the IBGP from all the routes, from all the different VRFs.
• If use normal BGP is used, may overlapping of prefixes will be occurred.
• MPLS deals this problem by
• Add another number in front of the original BGP NLRI.
• Each different number can represent a different customer.
• To do this MPLS uses the MultiProtocol BGP.
• MP BGP  allows re-define the NLRI filed in BGP updates.
• This re-defination allows for an additional variable-length umber, called Address family
• This address family added at, in front of the prefix. 
• MPLS RFC 4363, "BGP/MPLS IP Virtual Private Networks(VPNs)," defines a specific new address family to support IPv4 MPLS VPNs--named as an MP-BGP address family called  Route Distinguishers (RDs)
• RDs allow BGp to advertise & distinguish between duplicate IPv4 prefixes.
• The concept is simple:
• Advertise each NLRI as the traditional IPv4 prefix, but add another number (the RD)
• RD uniquely identifies the route.
• In the new NLRI format, called VPN-V4, has 2 parts:
• 64-bit RD
• 32-bit IPv4 prefix
• example: 1:111:10.2.2.0/24
• Every VRF must be configured with an RD.
•