MPLS Part 4.ppt

MPLS Part 4

© 2003, Cisco Systems, Inc. All rights reserved. SECUR 1.0—3-2

Configuring BGP as theRouting Protocol Between PE and CE Routers


Configuring per-VRF BGP Routing Context

• Select per-VRF BGP context with the address-family command.• Configure CE EBGP neighbors in the VRF context, not in the global BGP configuration.• CE neighbors have to be activated with the neighbor activate command.


Configuring per-VRF BGP Routing Context


Limiting the Number of Prefixes Received from a BGP Neighbor

• Controls how many prefixes can be received from a neighbor• Optional threshold parameter specifies the percentage where a warning message is logged (default is 75 percent)• Optional warning-only keyword specifies the action on exceeding the maximum number (default is to drop peering)


Limiting the Total Number of VRF Routes

• The VRF maximum routes limit command limits the number of routes that are imported into a VRF:– Routes coming from CE routers– Routes coming from other PE routers (imported routes)

• The route limit is configured for each VRF.• If the number of routes exceeds the route limit:– A syslog message is generated.– The Cisco IOS software can be configured to reject routes (optional).


Limiting the Total Number of VRF Routes (Cont.)

• This command configures the maximum number of routes accepted into a VRF:– The limit parameter is the route limit for the VRF.– The warn-threshold parameter is the percentage value over which a warning message is sent to syslog.– The warn-only option creates a syslog error message when the maximum number of routes exceeds the threshold.• Syslog messages generated by this command are rate-limited.


Limiting the Total Number of VRF Routes (Cont.)


AS-Override:The Issue

The customer wants to reuse the same AS number on severalsites:• CE-BGP-A1 announces network 10.1.0.0/16 to PE-Site-X.• The prefix announced by CE-BGP-A1 is propagated to PE-Site-Y as aninternal route through MP-BGP.• PE-Site-Y prepends AS 65115 to the AS path and propagates the prefix toCE-BGP-A2.• CE-BGP-A2 drops the update because AS 65213 is already in the AS path.


AS-Override:Implementation

• With AS-override configured, the AS path update procedure on the PE router is as follows:– If the first AS number in the AS path is equal to the neighboring AS, it is replaced with the provider AS number.– If the first AS number has multiple occurrences (because of AS path prepend), all occurrences are replaced with the provider AS number.– After this operation, the provider AS number is prepended to the AS path.


AS-Override:Command

• This command configures the AS-override AS path update procedure for the specified neighbor.• AS-override is configured for CE EBGP neighbors in the VRF address family of the BGP process.


AS-Override:Example

PE-Site-Y replaces AS 65213 with AS 65115 in the AS path, prepends another copy of AS 65115 to the AS path, and propagates the prefix.


AS-Override:AS-Path Prepending

PE-Site-Y replaces all occurrences of AS 65213 with AS 65115 in the AS path, prepends another copy of AS 65115 to the AS path, and propagates the prefix.


Allowas-in:The Issue

• Customer site links two VPNs• Not a usual setup (traffic between VPNs should not flow over the customer site)• Sometimes used for enhanced security


Allowas-in:The Issue (Cont.)

• VPN perspective: VPN-A is connected to VPN-B via CE-AB.• Physical topology: The CE-AB router is dual-connected to the PE routers.• MPLS VPN perspective: The CE-AB router has two links into the P-network.• BGP perspective shows issue: The CE-AB router has two connections to AS 65115.


Allowas-in:The Issue (Cont.)

• PE-1 announces network 10.1.0.0/16 to CE-AB.• CE-AB prepends its AS number to the AS path and propagates the prefix to PE-2.• PE-2 drops the update because its AS number is already in the AS path.• AS-override is needed on CE-AB, which may require a Cisco IOS softwareupgrade on the CE router.


Allowas-in:Implementation

The allowas-in BGP option disables the AS path check on the PE router:• The number of occurrences of the PE router AS number is limited to suppress real routing loops.• The limit has to be configured.• The PE router will reject the update only if its AS number appears in the AS path more often than the configured limit.


Allowas-in:Command

• This command disables the traditional BGP AS path check.• An incoming update is rejected only if the AS number of the PE router appears in the AS path more often than the configured limit.


Implementing SOO for Loop Prevention

AS path-based BGP loop prevention is bypassed with the AS-override and allowas-in features.


Implementing SOO for Loop Prevention(Cont.)

• The SOO attribute (extended BGP community) can be used to prevent loops in these scenarios.• The SOO attribute is needed only for multihomed sites.• When EBGP is run between PE and CE routers, the SOO attribute is configured through a route-map command.• For other routing protocols, the SOO attribute can be applied to routes learned through a particular VRF interface during the redistribution into BGP.



Inbound EBGP Update

• Creates a route map that sets the SOO attribute

• Applies an inbound route map to the CE EBGP neighbor



Other Inbound Routing Updates

• Applies a route map that sets the SOO extended community attribute to inbound routing updates received from this interface



• Defines a route map that discards routes with the desired SOO value

• Applies the route map to outbound updates sent to the EBGP CE neighbor


Complex MPLS VPNs


Advanced VRF Features

Selective import• This features allows you to specify additional criteria for importing routes into the VRF.

Selective export• This features allows you to specify additional RTs attached to exported routes.

VRF route limit• This features allows you to specify the maximum number of routes in a VRF to prevent memory exhaustion on PE routers or denial-of-service attacks.


Configuring Selective VRF Import

• VRF import criteria might be more specific than just the match on the RT—for example:– Import only routes with specific BGP attributes (community, and so on).– Import routes with specific prefixes or subnet masks (only loopback addresses).

• A route map can be configured in a VRF to make the route import more specific.


Configuring Selective VRF Import (Cont.)

• This command attaches a route map to the VRF import process.• A route is imported into the VRF only if at least one RT attached to the route matches one RT configured in the VRF and the route is accepted by the route map.


Configuring Selective VRF Import (Cont.)


Configuring Selective VRF Export

Routes from a VRF might have to be exported with different RTs.• An example would be export management routes with particular RTs.

An export route map can be configured on a VRF:• This route map can set extended community RTs.• No other set operations can be performed by this route map.


Configuring Selective VRF Export (Cont.)

• This command creates a route map that matches routes based on any route map conditions and sets RTs.



• This command attaches a route map to the VRF export process.• All exported routes always get RTs configured with the route-target export command in the VRF.• A route that is matched by the export route map will have additional RTs attached.




Introducing Central Services VPNs


Central Services VPN

• Clients need access to central servers.• Servers can communicate with each other.• Clients can communicate with all servers but not with each other.


Central Services VPN Routing

• Client routes need to be exported to the server site.• Server routes need to be exported to client and server sites.• No routes are exchanged between client sites.


Central Services VPN Data Flow Model

• Client VRFs contain server routes; clients can talk to servers.• Server VRFs contain client routes; servers can talk to clients.• Client VRFs do not contain routes from other clients; clients cannot communicate.• Make sure that there is no client-to-client leakage across server sites.


Steps for Configuring a Central Services VPN

Client sites:• Use a separate VRF per client site.• Use a unique RD on each client site.• Import and export routes with an RT that is the same value as the RD for each client site (VPN of client).• Export routes with an RT (clients-to-server) associated with the server site.• Import routes with the RT (server-to-clients) into client VRFs.


Steps for Configuring a Central Services VPN (Cont.)

Server sites:• Use one VRF for each service type.• Use a unique RD on each service type.• Import and export routes with an RT that is the same value as the RD for each server site (VPN of server).• Export server site routes with an RT (server-to-client).• Import routes with the RT (clients-to-server) into the server VRFs.


Configuring a Central Services VPN


End!

Date post:	26-Dec-2015
Category:	Documents
Upload:	xiway
View:	64 times
Download:	8 times

MPLS Part 4.ppt

Documents