All Cisco-Network Study Notes

Creating VRF FIB Entries for the Admission PE

The aftermost allotment of the abstracts even assay focuses on the admission PE. In particular, the admission PE uses

the afterward argumentation back processing an admission unlabeled packet:

1. Action the admission packet application the VRF associated with the admission interface (statically

configured).

2. Advanced the packet application that VRF’s FIB.

The FIB access needs to accept two labels to abutment MPLS VPNs: an alien characterization that identifies the

LSP with which to ability the departure PE, and an close characterization that identifies the departure PE’s LFIB entry

that includes the actual approachable interface on the departure PE. Although it ability be accessible by now,

for completeness, the admission PE learns the alien and close characterization ethics as follows:

■ The alien characterization is based on the LIB entry, accurately for the LIB access for the prefix that

matches the BGP-learned next-hop IP address—not the packet’s destination IP address.

■ The close characterization is based on the BGP table access for the avenue in the VRF that matches the

packet’s destination address.

Figure 19-21 completes the advancing archetype by assuming the action by which PE1 adds the

correct FIB access into VRF-A for the 10.3.3.0/24 prefix. The amount picks up the adventure at the point

at which PE1 has abstruse all appropriate BGP and LDP information, and it is accessible to abide the

VRF acquisition table and FIB.

732 Affiliate 19: Multiprotocol Characterization Switching

Figure 19-21 Creating the Admission PE (PE1) FIB Access for VRF-A

PE1’s BGP table holds the VPN characterization (3333), while PE1’s LIB holds the two labels abstruse from

PE1’s two LDP neighbors (P1 and P2, labels 2222 and 5555, respectively). In this case, PE1’s best

route that matches BGP next-hop 3.3.3.3 happens to point to P1 instead of P2, so this archetype uses

label 1111, abstruse from P1.

The accomplish in the amount are explained as follows:

1. PE1 redistributes the avenue from BGP into the VRF-A acquisition table (based on the acceptation RT).

2. PE1 builds a VRF-A FIB access for the avenue aloof added to the VRF-A acquisition table.

3. This new FIB access needs to accommodate the VPN-label, which PE1 finds in the associated BGP

table entry.

4. This new FIB access additionally needs to accommodate the alien label, the one acclimated to ability the BGP nexthop

IP abode (3.3.3.3), so PE1 looks in the LIB for the best LIB access that matches 3.3.3.3,

and extracts the characterization (1111).

5. Admission PE1 inserts the MPLS attack including the two-label characterization stack.

PE1

VRF-A

Routing Table

Source

BGP

Next-Hop

3.3.3.3

Prefix

10.3.3.0/24

FIB

Prefix

10.3.3.0/24

Out. Labels

1111, 3333

Next-Hop

3.3.3.3

Out Int

S0/0/1

NLRI

1:111:10.3.3.0/24

2:222:10.3.3.0/24

Label

3333

4444

Next-Hop

3.3.3.3

BGP Table

1:100

2:200

Prefix

3.3.3.3/32

LIB

Out Label

1111

5555

Out Int.

S0/0/1

S0/1/1

Outer:

1111

Inner:

3333

S0/0/1

MPLS VPNs 733

At this point, back PE1 receives a packet in an interface assigned to VRF-A, PE1 will attending in the

VRF-A FIB. If the packet is destined for an abode in prefix 10.3.3.0/24, PE1 will bout the entry

shown in the figure, and PE1 will advanced the packet out S0/0/1, with labels 1111 and 3333.

Penultimate Hop Popping

The operation of the MPLS VPN abstracts even works well, but the action on the departure PE can be

a bit inefficient. The disability relates to the actuality that the departure PE charge do two lookups in the

LFIB afterwards accepting the packet with two labels in the characterization stack. For example, the abstracts plane

forwarding archetype acclimated throughout this affiliate has been again in Amount 19-22, with a

summary description of the processing argumentation on anniversary router. Note that the departure PE (PE2) must

consider two entries in its LFIB.

Figure 19-22 Two LFIB Lookups Appropriate on the Departure PE

To abstain this added assignment on the actual aftermost (ultimate) LSR, MPLS uses a affection alleged penultimate

hop bustling (PHP). (Penultimate artlessly agency “1 beneath than the ultimate.”) So the penultimate

hop is not the actual aftermost LSR to action a labeled packet, but the second-to-last LSR to action a

labeled packet. PHP causes the penultimate-hop LSR to pop the alien label, so that the aftermost LSR—

the ultimate hop if you will—receives a packet that alone has the VPN characterization in it. With alone this

single label, the departure PE needs to attending up alone one access in the LFIB. Amount 19-23 shows the

revised abstracts even breeze with PHP enabled.

Figure 19-23 Single LFIB Lookup on Departure PE Due to PHP

PE1 P1 PE2

1 2 3

Per the VRF-A FIB,

push labels 1111 and

3333 into the packet

Per the LFIB:

1) Pop characterization 2222

2) Pop characterization 3333, and

forward out S0/1/1

Per the LFIB, swap

label 1111 for 2222,

and accelerate out S0/1/0

IP 1111 3333 IP 2222 3333 IP IP

S0/0/1 S0/1/0 S0/0/1

PE1 P1 PE2

Penultimate

(Next-to-Last)

MPLS Hop

Ultimate (Last)

MPLS Hop

1 2 3

Per the VRF-A FIB,

push labels 1111 and

3333 into the packet

Per the LFIB, pop

label 3333, and

forward out S0/1/1

Per the LFIB, Pop

label 1111, and

send out S0/1/0

IP 1111 3333 IP 3333 IP IP

S0/0/1 S0/1/0 S0/0/1

Creating LFIB Entries to Forward Packets to the Egress PE

Creating LFIB Entries to Forward Packets to the Egress PE
The outer label defines the LSP from the ingress PE to the egress PE. More specifically, it defines
an LSP used to forward packets to the BGP next-hop address as advertised in BGP Updates. In
concept, the ingress PE adds the outer label to make a request of the core of the MPLS network to
“deliver this packet to the egress PE—which advertised this particular BGP next-hop address.”
MPLS VPNs use an IGP and LDP to learn routes and labels, specifically to learn the label values
to use in the outer label. To link the concepts together, it can be helpful to think of the full control
plane process related to the LSP used for the outer label, particularly Step 4 onward:
1. A PE, which will be an egress PE for this particular route, learns routes from some CE.
2. The egress PE uses IBGP to advertise the routes to an ingress PE.
3. The learned IBGP routes list some next-hop IP address.
4. For MPLS VPNs to work, the PE and P routers must have advertised a route to reach the BGP
next-hop addresses.
5. Likewise, for MPLS VPNs to work, the PE and P routers must have advertised labels with
LDP for the routes to reach the BGP next-hop addresses.
730 Chapter 19: Multiprotocol Label Switching
6. Each P and PE router adds its part of the full end-to-end LSP into its LFIB, supporting the
ingress PE’s ability to send a packet to the egress PE.
For example, Figure 19-19 shows PE2 advertising two routes to PE1, both with BGP next-hop IP
address 3.3.3.3. For MPLS to work, the collective PE and P routers need to advertise an IGP route
to reach 3.3.3.3, with LDP advertising the labels, so that packets can be label switched toward the
egress PE. Figure 19-20 shows the basic process; however, note that this part of the process works
exactly like the simple IGP and LDP process shown for unicast IP forwarding in the first half of
this chapter.
Figure 19-20 Creating the LFIB Entries to Reach the Egress PE’s BGP Next Hop
The steps in the figure focus on the LFIB entries for prefix 3.3.3.3/32, which matches PE2’s BGP
next-hop IP address, as follows. Note that the figure does not show all LDP advertisements but
only those that are particularly interesting to the example.
1. PE2, upon learning a route for prefix 3.3.3.3/32, allocates a local label of 2222.
2. PE2 updates its LFIB for the local label, listing a pop action.
3. As normal, PE2 advertises to its LDP neighbors the label binding of prefix 3.3.3.3/32 with
label 2222.
P1
P2
PE1 PE2
S0/1/0
S0/1/1
S0/0/1
4
3 1
In Label
1111
Out Label
2222
Out Int.
S0/1/0
P1 LFIB
Action
swap
4 In Label
5555
Out Label
2222
Out Int.
S0/1/1
P2 LFIB
Action
swap
2
In Label
2222
PE2 LFIB
Action
pop
Out Int.
Loop0
LDP:
3.3.3.3/32,
Label 2222
3 LDP:
3.3.3.3/32,
Label 2222
5 LDP:
3.3.3.3/32,
Label 5555
5 LDP:
3.3.3.3/32,
Label 1111
Loopback0:
3.3.3.3/32
Allocate a local
label (2222) for
route 3.3.3.3/32
4. P1 and P2 both independently learn about prefix 3.3.3.3/32 with the IGP, allocate a local label
(1111 on P1 and 5555 on P2), and update their LFIBs.
5. P1 and P2 advertise the binding of 3.3.3.3/32, along with their respective local labels, to their
peers.
Figure 19-18 showed the FIB and LFIB entries required for forwarding a packet from CE-A1 to
CE-A2, specifically into subnet 10.3.3.0/24. Figures 19-19 and 19-20, and their associated text,
explained how all the LFIB entries were created. Next, the focus turns to the FIB entry required
on PE1.

Building the (Inner) VPN Label

The close characterization identifies the approachable interface out which the departure PE should advanced the

unlabeled packet. This close label, alleged the VPN label, charge be allocated for anniversary avenue added to

each chump VRF. More specifically, a chump CE will acquaint routes to the PE, with the PE

storing those routes in that customer’s VRF. In adjustment to adapt to advanced packets to those

customer subnets, the PE needs to admeasure a new bounded label, accessory the characterization with the prefix

(and the route’s next-hop IP abode and approachable interface), and abundance that advice in the

LFIB.

Figure 19-19 shows PE2’s routes for 10.3.3.0/24 in both VRF-A and VRF-B and the resulting

LFIB entries. The amount shows the after-effects of PE2’s action of allocating a bounded characterization for anniversary of

the two routes and again additionally announcement those labels application BGP. (Note that the LFIB is not a per-

VRF table; the LFIB is the one and alone LFIB for PE2.)

Figure 19-19 Creating the VPN Characterization LFIB Access on the Departure PE

NOTE As was the case with the archetype apparent in Amount 19-13, the capacity at Accomplish 3 and 4

will alter hardly in practice, as a aftereffect of the PHP feature, which is explained about Figure

19-23 at the end of this chapter.

CE-A2

CE-B2

PE2

In Label

3333

4444

Next-Hop

192.168.37.7

192.168.38.8

Out Int.

S0/1/0

S0/1/1

LFIB

Action

pop

NLRI

1:111:10.3.3.0/24

2:222:10.3.3.0/24

Label

3333

4444

Next-Hop

3.3.3.3

BGP Table

1:100

2:200

Source

RIP

Next-Hop

192.168.37.7

Out Int.

S0/1/0

VRF-A Routing Table

Prefix

10.3.3.0/24

Source

RIP

Next-Hop

192.168.38.8

Out Int.

S0/1/1

VRF-B Routing Table

Prefix

10.3.3.0/24

1 3

S0/1/0 —VRF-A

S0/1/1 —VRF-B

Subnet

10.3.3.0/24

Subnet

10.3.3.0/24

IBGP to PE1

The accomplish apparent in the amount are as follows:

1. After abacus a avenue for 10.3.3.0/24 to VRF-A, PE2 allocates a bounded characterization (3333) to associate

with the route. PE2 again food the bounded characterization and agnate abutting hop and outgoing

interface from VRF-A’s avenue for 10.3.3.0/24 into the LIB (not shown) and LFIB.

2. PE2 repeats the argumentation in Footfall 1 for anniversary avenue in anniversary VRF, including the avenue in VRF-B

shown at Footfall 2. After acquirements a avenue for 10.3.3.0/24 in VRF-B, PE2 allocates a different

label amount (4444), assembly that route’s next-hop IP abode and approachable interface with the

new label, and adds the advice to a new LFIB entry.

3. PE2 adds the bounded labels to the BGP table access for the routes, respectively, when

redistributing routes into BGP.

4. PE2 uses IBGP to acquaint the routes to PE1, with the BGP Update including the VPN label.

As a aftereffect of the aboriginal two accomplish in the figure, if PE3 receives a labeled packet and analyzes a label

value of 3333, PE2 would be able to advanced the packet accurately to CE-A2. Similarly, PE2 could

correctly advanced a accustomed labeled packet with characterization 4444 to CE-B2.

NOTE Accomplish 3 and 4 in Amount 19-19 do annihilation to aid PE2 to advanced packets; these steps

were included to be referenced at an accessible footfall after in this section.

The MPLS VPN Abstracts Plane

The explanations of the VRF, RD, and RT appearance explain best of the capacity of the MPLS VPN

control plane. VRFs acquiesce PEs to abundance routes abstruse from assorted CEs, alike if the prefixes

overlap. The RD allows PEs to acquaint routes as different prefixes, alike if the IPv4 prefixes happen

to overlap. Finally, the RT tells the PEs which routes should be added to anniversary VRF, which provides

greater ascendancy and the adeptness to acquiesce sites to be attainable from assorted VPNs.

MPLS VPNs 727

At the end of the process, however, to abutment the forwarding of packets, admission PEs charge appropriate

FIB entries, with Ps and PEs defective adapted LFIB entries. This area focuses on

explaining how LSRs ample the FIB and LFIB back application MPLS VPNs.

As accepted for this chapter, this area focuses on how to advanced packets to subnet 10.3.3.0/24 in

the chump A VPN. To activate this assay of the MPLS VPN abstracts plane, accede Amount 19-

18. This amount repeats the aforementioned forwarding archetype in Amount 19-13 but now shows a few details

about the FIB in the admission PE and the LFIB entries in the P and departure PE routers.

Figure 19-18 The Admission PE FIB and Other Routers’ LFIBs

The numbered accomplish in the amount are as follows:

1. An unlabeled packet arrives on an interface assigned to VRF-A, which will account admission PE1

to use VRF-A’s FIB to accomplish a forwarding decision.

2. Admission PE1’s VRF-A FIB access for 10.3.3.0/24 lists an approachable interface of S0/0/1, and a

label assemblage with two labels—an close characterization of 3333 and an alien characterization of 1111. So PE1

forwards the packet with these two labels pushed in advanced of the IP header.

3. P1 uses the LFIB access for admission (local) characterization 1111, swapping this alien characterization amount to

2222.

4. PE2 does two LFIB lookups. PE2 finds characterization 2222 in the table and ancestor that label, abrogation the

inner label. Then PE2 looks up the close characterization 3333 in the LFIB, acquainted the pop activity as well,

along with the approachable interface. So PE2 assiduously the unlabeled packet out interface S0/1/0.

PE1 P1 PE2

CE-A1 CE-A2

Inner: IP

3333

Inner: IP

3333

Outer:

1111

Outer:

1111

Int. In

VRF-A

S0/0/1 S0/1/0

Int. In S0/0/1

VRF-A

2 3

In Label

2222

3333

Action

pop

Out Int.

N/A

S0/1/0

PE2 LFIB

In Label

1111

Out Label

2222

Out Int.

S0/1/0

P1 LFIB

Prefix

10.3.3.0/24

Out Int.

S0/0/1

CEF FIB — VRF-A

Out Label(s)

1111, 3333

The archetype shows the mechanics of what happens in the abstracts alike already the actual FIB and

LFIB entries accept been added. The blow of this affair about the MPLS VPN abstracts alike examines

how MPLS VPN LSRs body these actual entries. While account this section, it is accessible to keep

in apperception a brace of capacity about the purpose of the close and alien characterization acclimated for MPLS VPNs:

■ The alien characterization identifies the segments of the LSP amid the admission PE and the departure PE,

but it does not analyze how the departure PE should advanced the packet.

■ The close characterization identifies the departure PE’s forwarding details, in accurate the outgoing

interface for the unlabeled packet.

NOTE As was the case with the archetype apparent in Amount 19-13, the capacity at Accomplish 3 and 4

will alter hardly in practice, as a aftereffect of the PHP feature, which is explained about Figure

19-23 at the end of this chapter.

Route Targets

One of the best abstract concepts for engineers, back aboriginal acquirements about MPLS VPNs, is the

concept of Avenue Targets. Understanding the basal catechism of what RTs do is almost easy, but

understanding why MPLS needs RTs and how to best accept the absolute ethics to use for RTs, can

be a affair for continued chat back architecture an MPLS VPN. In fact, MPLS RTs accredit MPLS

to abutment all sorts of circuitous VPN topologies—for example, acceptance some sites to be reachable

from assorted VPNs, a abstraction alleged overlapping VPNs.

PEs acquaint RTs in BGP Updates as BGP Continued Community aisle attributes (PAs). Generally

speaking, BGP continued communities are 8 bytes in length, with the adaptability to be acclimated for a

wide array of purposes. Added specifically, MPLS defines the use of the BGP Extended

Community PA to encode one or added RT values.

RT ethics chase the aforementioned basal architecture as the ethics of an RD. However, agenda that while a

particular prefix can accept alone one RD, that aforementioned prefix can accept one or added RTs assigned to it.

724 Affiliate 19: Multiprotocol Label Switching

To best accept how MPLS uses RTs, aboriginal accede a added accepted analogue of the purpose of

RTs, followed by an archetype of the mechanics by which PEs use the RT:

MPLS uses Avenue Targets to actuate into which VRFs a PE places IBGP-learned

routes.

Figure 19-16 shows a assiduity of the aforementioned archetype in Figures 19-14 and 19-15, now focusing

on how the PEs use the RTs to actuate into which VRFs a avenue is added. In this case, the figure

shows an consign RT—a agreement ambience in VRF agreement mode—with a altered value

configured for VRF-A and VRF-B, respectively. PE1 shows its acceptation RT for anniversary VRF—again a

configuration ambience in VRF agreement mode—which allows PE1 to accept which BGP table

entries it pulls into anniversary VRF’s RIB.

Figure 19-16 The Mechanics of the MPLS Avenue Target

The amount has a lot of details, but the all-embracing breeze of concepts is not awfully difficult. Pay particular

attention to the aftermost two steps. Following the achieve in the figure:

1. The two VRFs on PE2 are configured with an consign RT value.

2. Redistribution out of the VRF into BGP occurs.

3. This footfall artlessly addendum that the consign process—the redistribution out of the VRF into BGP—

sets the adapted RT ethics in PE2’s BGP table.

4. PE2 advertises the routes with IBGP.

NLRI

1:111:10.3.3.0/24

2:222:10.3.3.0/24

BGP Table

Router PE2

1:100

2:200

VRF-A

Next-Hop

192.168.37.7

Prefix

10.3.3.0/24

Label

S0/1/0

Source

RIP

Next-Hop

192.168.38.8

Prefix

10.3.3.0/24

Label

S0/1/1

IBGP

Source

RIP

Redist.

VRF-A

RD 1:111

Export RT 1:100

VRF-B

RD 2:222

Export RT 2:200

VRF-B

BGP

Process

NLRI

1:111:10.3.3.0/24

2:222:10.3.3.0/24

BGP Table

Router PE1

1:100

2:200

VRF-A Routing Table

Next-Hop

3.3.3.3

Prefix

10.3.3.0/24

Source

RIP

Next-Hop

3.3.3.3

Prefix

10.3.3.0/24

Source

BGP

VRF-A

RD 1:111

Import RT 1:100

VRF-B

RD 2:222

Import RT 2:200

VRF-B Routing Table

MPLS VPNs 725

5. PE1 examines the new BGP table entries and compares the RT ethics to the configured import

RT values, which identifies which BGP table entries should go into which VRF.

6. PE1 redistributes routes into the corresponding VRFs, accurately the routes whose RTs match

the acceptation RT configured in the VRFs, respectively.

Each VRF needs to consign and acceptation at atomic one RT. The archetype in Amount 19-16 shows only

one direction: exporting on the appropriate (PE2) and importing on the larboard (PE1). However, PE2 needs

to apperceive the routes for the subnets affiliated to CE-A1 and CE-B1, so PE1 needs to apprentice those

routes from the CEs, redistribute them into BGP with some exported RT value, and acquaint them

to PE2 application IBGP, with PE2 again importing the actual routes (based on PE2’s acceptation RTs) into

PE2’s VRFs.

In fact, for simple VPN implementations, in which anniversary VPN consists of all sites for a single

customer, best configurations artlessly use a distinct RT value, with anniversary VRF for a chump both

importing and exporting that RT value.

Overlapping VPNs

MPLS can abutment overlapping VPNs by advantage of the RT concept. An overlapping VPN occurs

when at atomic one CE armpit needs to be attainable by CEs in altered VPNs.

Many variations of overlapping VPNs exist. An SP may accommodate casework to abounding customers, so

the SP absolutely accouterments CE sites that charge to be accomplished by a subset of customers. Some SP

customers may appetite connectivity to one of their ally through the MPLS network—for

example, chump A may appetite some of its sites to be able to accelerate packets to some of customer

B’s sites.

Regardless of the business goals, the RT abstraction allows an MPLS arrangement to aperture routes from

multiple VPNs into a accurate VRF. BGP supports the accession of assorted Continued Community

PAs to anniversary BGP table entry. By accomplishing so, a distinct prefix can be exported with one RT that

essentially agency “make abiding all VRFs in VPN-A accept this route,” while allotment accession RT

value to that aforementioned prefix—an RT that agency “leak this avenue into the VRFs of some overlapping

VPN.”

NOTE It is sometimes accessible to anticipate of the appellation consign to beggarly “redistribute out of the VRF

into BGP” and the appellation acceptation to beggarly “redistribute into the VRF from BGP.”

NOTE The examples in this affiliate appearance altered numbers for the RD and RT values, so that

it is bright what anniversary cardinal represents. In practice, you can set a VRF’s RD and one of its RTs

to the aforementioned value.

Figure 19-17 shows an archetype of the concepts abaft overlapping MPLS VPNs, in particular, a

design alleged a axial casework VPN. As usual, all chump A sites can accelerate packets to all other

customer A sites, and all chump B sites can accelerate packets to all added chump B sites. Also,

none of the chump A sites can acquaint with the chump B sites. However, in accession to

these accepted conventions, CE-A1 and CE-B2 can acquaint with CE-Serv, which connects to a

set of centralized servers.

Figure 19-17 Axial Casework VPN

To achieve these architecture goals, anniversary PE needs several VRFs, with several VRFs exporting and

importing assorted RTs. For example, PE1 needs two VRFs to abutment chump A—one VRF that

just imports routes for chump A, and a additional VRF that imports chump A routes as able-bodied as

routes to ability the axial casework VPN. Similarly, PE2 needs a VRF for the axial casework VPN,

which needs to acceptation some of the routes in VPN-A and VPN-B.

CE-A1

CE-A4

CE-B1

Customer A

Customer B

CE-Serv

Subnet

Centralized 10.4.4.0/24

Servers

CE-A2

Customer A

Subnet

10.3.3.0/24

CE-B2

Customer B

Subnet

10.3.3.0/24

PE1 PE2