config b/n PE to CE

• create vrf & apply to interfaces
• create ip vrf by command
•  ip vrf A  in global mode
• Route Distinguishers
• goal is to make the prefix unique in entire mpls network
• formate of RD changed based on service provider
• AS followed by locally significant number
• router-id followed by locally significant number
•  rd config
• rd 200:1  /** config under ip vrf A
• rd 200:2
• apply vrfs to interfaces 
• int e0/0
•    ip vrf forwarding A
•    ip address 1.1.1.1 255.255.255.0    /** reenter ip add because enabling of vrf on interface remove the ip add of the interface
• sh ip route    /*** global routing table shows the separate tables for the each customer
• sh route | in interface | in ip address
• under the igp process enable seperate address family
• router eigrp    /**under given igp route process
•   address-family ipv4 vrf A
• sh ip vrf detail
• sh ip route vrf *    /** sh all vrf routing tables
• address-family ip v4 vrf / vpv4

MPLS configuration

• MPLS also called Dynamic Label Switching
• Before configuring first enable the CEF
• command used is ip cef in global mode
• Verify by show command show ip cef
• It increases the packet switching speed.
• main
• Enable MPLS forwarding of ipv4 packets along the routed paths( also called Dynamic Label Switching
• must be enable on interface & device
• command: mpls ip
• 
  
• unique router-id important in MPLS
• As a router-id loopback address is more advantage than interface address 
• command used to router-id as loopback is
• mpls ldp router-id loopback0 force
• In sometimes loopback ip address used as router-id cannot be reachable
• at that time an interface is used as router-id, to this use the following command under interface
•  mpls ldp discovery transport-address interface
• enable mpls on routing protocol enabled interfaces
• mpls ldp autoconfig under routing process.
• enable mpls authentication globally.
• mpls ldp password required  in global mode
• mpls ldp neighbour 150.1.5.55 password CISCO
• to show mpls neighbours
• show mpls ldp neighbors
• to show mpls enabled interfaces
• show mpls interfaces
• to show mpls authentication
• show mpls ldp neighbor password
• to show LFIB table
• show mpls forwarding-table
• to check the packets are forwarding by MPLS
• traceroute 150.1.5.5
• normally LDP will generate & adverties labels for every prefix found in the local routing table
• to avoid this & enable only on some prefixes uses the access control list
• exampls:

                                access-list 10 permit 150.1.0.0 0.0.255.255

                                 no mpls ldp advertise-labels

                                 mpls ldp advertise-labels for 10

• PE configuration
• in mpls network full mesh of PEs was created using ibgp peerings
• for example

router bgp 100

    neighbor 155.1.5.5 remote-as 1oopback0

    neighbor 155.1.5.5 update-source loopback0

    address-family vpv4 unicast         /** activating vpv4 address family

    neighbor 150.1.5.5 activate 

    neighbor 150.1.5.5 send-community extended

   neighbor 150.1.5.5 route-reflector-client

•   to define VRF use command
• ip vrf vrf-name
• 
  

MP-BGP VPNv4

• VRF lite is the USING VRF without MPLS.
• VRF lite main problem is scalability issue.
• this scalability problem will be overcomed by "dynamic tunneling"
• For dynamic tunneling MPLS technology is used.
• there are remote customers.
• they were connected via cloud.
• Remote customers are connected to cloud via Provider edge routers.
• Provider edger routers are connected with full mesh of label switching routers.
• These Label switching packets are used for tunneling VPN packets.
• When packet switching via tunnel between & to reach the customer uses the 2 types of Labels
• one for switch between 2 provider edge routers(outer label)
• 2nd one for selecting the correct vrf on outgoing provider edge(inner label)
• This label is also known as VPN label
• MPLS label switching routers are unidirectional.
• MPLS LSR are not used normal IGP protocols.
• send from source udp port number 646  to destination tcp add 224.0.0.2
• 
  

MPLS VPN Data Plane

• To support the forwarding of packets, 
• ingress PEs need appropriate FIB entries, 
• Ps & PEs needing appropriate LFIB entries
• The outer label identifies the segments of the LSP between between the ingress PE & the egress PE,
• but it doesn't identify how the egress PE should forward the packet.
• The inner label identifies the egress PE's forwarding details, in particular the outgoing interface for the unlabeled packet.
• Building the Inner (VPN) label:
• The inner label called VPN label
• VPN label must be allocated for each route added to each customer VRF.
• More specifically, a CE will advertise routes to the PE, 
• PE stores these routes in the corresponding customer's VRF
• In order to prepare to forward packets to those customer subnets, 
• the PE needs to allocate a new local label 
• That local label contain the prefix & the route's next-hop ip address & outgoing interface  & stores this information in LFIB.
• Steps in LSRs fill the FIB & LFIB when using MPLS VPNs
• An unlabeled packet arrives on an interface assigned to VRF, 
• which will cause ingress PE to use VRF's FB to make a forwarding decision.
• At ingress PEs VRF, FIB shows the outgoing interface for destination ip &
• Add a label stack with 2 labes
• an inner label(having original destination IP address)
• an outer label
• Then ingress PE forwards the packet to next Ps
• P uses the LFIB entry for incoming  label (outer label), swap this label.

MPLS VPN Configuration

• Main steps in configuring MPLS VPN configuration:
• Creating each VRF, RD, & RT, plus associating the customer-facing PE interfaces with the correct VRF
• Configuring the IGP between PE & CE
• Configuring mutual redistribution between the IGP & BGP
• Configuring MP-BGP between PEs

• VPNs are configured only on PE routers only.
• The customer routers no need to know about VPNs
• P routers no need to know about the MPLS VPN features
• VRFs allow PEs to store routes learned from various CEs, even if the prefixes overlap.
• RD allows PEs to store routes as unique prefixes.
• RT tells the PEs which routes should be added to each VRF
• which provides greater control & ability to allow sites to be reachable from multiple VPNs.
• VRF configuration on PE use the following commands:
• Configure the VRF using command:
• ip vrf <vrf-name>
• Configure the RD under VRF sub-command using
• rd <rd-value>
• Configure the RT under VRF sub-command using
• rt {import|export} <rt-value>
• Associating an interface with the VRF under interface sub-command using
• ip vrf forwarding <vrf-name>
• Each VRF has:
• One RD
• At least one import & export routing tag.
• If we give unique RD to every VRF, overlapping of prefixes will be overcomes.
• Configuring the IGP between PE & CE:
• Configure a routing protocol between PE & CE.
• This allows the PE router to learn the customer routes & CE to learn the other customer routes learned by PE from other PE in the MPLS cloud.
• Any IGP or even BGP can be used as the routing protocol.
• Show Commands:
• sh ip route vrf cust-A
• shows connected route on PE router & router learned from CE.
• Configuring Redistribution between PE-CE IGP & MP-BGP
• PE have no ability to advertise these routes across the MPLS VPN cloud.
• Then redistribute the IGP learned routes from CE into BGP table contain other CE routes learned from remaining PEs & vice-versa.
• 2 methods to add new routes to BGP table are
• Using network command
• Redistribution
• The BGP network command works well when adding small number of predictable prefixes.
• The Redistribution process works best when 
• the prefixes are not predictable
• there may be many no.of prefixes,... etc.
• So MPLS VPN BGP configurations uses the Redistribution process for adding new routes.
• MPLS VPN mutual redistribution configuration requires specific VRF told by both IGP & BGP.
• Redistribution command under the IGP & BGP process is
•  address-family ipv4 vrf  <vrf-name>
• Configuring MP-BGP between PFs
• To configure each peer, commands used are in normal BGP in non-MPLS configurations & others occur inside a new VPNv4 address family.
• Compare MPLS VPN BGP  & traditional BGP configuration. 
• The PE neighbors are defined under the main BGP process, not for particular address family.
• In MPLS VPN designs loopback is used as update source on the PE routers.
• In that case, the neighbor update-source command is also under the mail BGP process.
• The PE neighbors are then activated, using the neighbor activate command, under the VPNv4 address family process (address-family vpnv4).
• BGP must be told to send the community PA (neighbor send-community) command, under the address-family vpnv4 command.
• The VPNv4 address family does not refer to any particular VRF.
• Thre is no need of iBGP neighbor per VRF on each remote VRF.