19 - 08 - 2017

L3VPN on Cisco XR - without MPLS enabled switches

You can be put in situation to connect two or more L3 devices using L3VPN. The configuration isn't complex, and will work unless the path between devices invloves the non-MPLS enabled switches. If you connect ASR routers using other devices in the network it can be tricky. BGP sessions is not an issue, but MPLS tags. For L3VPN two labels are required:

  • Outer Label - specifices outgoing interface to reach L3VPN enabled neighbor.
  • Inner Label - provides information about VRF instance for the neighbor

The issue I got was lack of Outer Label because the path toward L3VPN neighor was not MPLS-enabled. It was simply 802.1Q subinterface, on top of bundle-interface. The sessions have been established, but no traffic was seen on opposite site.

 

 

The issue outputs

RP/0/0/CPU0:XRv_1#show bgp vpnv4 unicast su
Mon Jan 19 13:12:46.201 UTC
BGP router identifier 1.1.1.1, local AS number 64677
BGP generic scan interval 60 secs
BGP table state: Active
Table ID: 0x0   RD version: 0
BGP main routing table version 6
BGP scan interval 60 secs

BGP is operating in STANDALONE mode.


Process       RcvTblVer   bRIB/RIB   LabelVer  ImportVer  SendTblVer  StandbyVer
Speaker               6          6          6          6           6           6

Neighbor        Spk    AS MsgRcvd MsgSent   TblVer  InQ OutQ  Up/Down  St/PfxRcd
192.168.255.250   0 64677     607     606        6    0    0 00:10:15          1
RP/0/0/CPU0:XRv_1#show route vrf CUSTOMER_1
Mon Jan 19 13:13:15.779 UTC

Codes: C - connected, S - static, R - RIP, B - BGP, (>) - Diversion path
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - ISIS, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, su - IS-IS summary null, * - candidate default
       U - per-user static route, o - ODR, L - local, G  - DAGR, l - LISP
       A - access/subscriber, a - Application route, (!) - FRR Backup path

Gateway of last resort is not set

C    10.100.100.0/24 is directly connected, 00:04:19, GigabitEthernet0/0/0/3.1000
L    10.100.100.1/32 is directly connected, 00:04:19, GigabitEthernet0/0/0/3.1000
B    10.200.200.0/24 [200/0] via 192.168.255.250 (nexthop in vrf default), 00:04:16
RP/0/0/CPU0:XRv_1#
RP/0/0/CPU0:XRv_1#show mpls for
Mon Jan 19 13:14:19.315 UTC
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
16000  Aggregate   CUSTOMER_1: Per-VRF Aggr[V]   \
RP/0/0/CPU0:XRv_1#ping vrf CUSTOMER_1 10.200.200.1 SOurce 10.100.100.1
Mon Jan 19 13:13:56.136 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.200.200.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
RP/0/0/CPU0:XRv_2#show route vrf CUSTOMER_2
Mon Jan 19 13:14:48.913 UTC

Codes: C - connected, S - static, R - RIP, B - BGP, (>) - Diversion path
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - ISIS, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, su - IS-IS summary null, * - candidate default
       U - per-user static route, o - ODR, L - local, G  - DAGR, l - LISP
       A - access/subscriber, a - Application route, (!) - FRR Backup path

Gateway of last resort is not set

B    10.100.100.0/24 [200/0] via 192.168.255.249 (nexthop in vrf default), 00:05:50
C    10.200.200.0/24 is directly connected, 00:09:14, GigabitEthernet0/0/0/3.2000
L    10.200.200.1/32 is directly connected, 00:09:14, GigabitEthernet0/0/0/3.2000
RP/0/0/CPU0:XRv_2#
From above following conlusions can be made:
  • Both neighbors have BGP and MPLS LDP sessions established
  • Routes are redistributed in proper way
  • ICMP doesn't work because lack of Outer Label for the next-hop address - in our case should be POP label.

Configuration files available in attachments.

To solve this we need just manually assign static MPLS label for our next-hop (192.168.255.250). This will require two  things:
  • Routing entry for 192.168.255.250/32 via 192.168.255.250
  • MPLS POP static label 

Add static route for BGP/LDP neighbor 

It's required to have static routes add on both ASR routers, both of them will need MPLS POP Label pointing to opposite neighbor:

ASR XRv_1: 
router static
 address-family ipv4 unicast
  192.168.255.250/32 GigabitEthernet0/0/0/3.490 192.168.255.250
end
commit

The interface declaration is required, if not set the route will be marked as "quarantined"

And the second router:

ASR XRv_2: 

router static
 address-family ipv4 unicast
  192.168.255.249/32 GigabitEthernet0/0/0/3.490 192.168.255.249
end
commit 

MPLS Static Label for the gateway IP

In this section we will create static mpls labels which will be used in L3VPN.

ASR XRv_1  

mpls static
 interface GigabitEthernet0/0/0/3.490
  address-family ipv4 unicast
   local-label 16000 allocate per-prefix 192.168.255.250/32 forward path 1 nexthop GigabitEthernet0/0/0/3.490 192.168.255.250 out-label pop
end
commit

And the opposite router:

ASR XRv_2 

mpls static
 interface GigabitEthernet0/0/0/3.490
  address-family ipv4 unicast
   local-label 16000 allocate per-prefix 192.168.255.249/32 forward path 1 nexthop GigabitEthernet0/0/0/3.490 192.168.255.249 out-label pop 
end
commit

Changes to take affect requires the restart of MPLS LDP and BGP neighborships

After applying the configuration ICMP and restating services, network connectivity will be working. Below you can find the output results:

RP/0/0/CPU0:XRv_2#SHOW MPLS FOR
Mon Jan 19 13:42:45.181 UTC
Local  Outgoing    Prefix             Outgoing     Next Hop        Bytes
Label  Label       or ID              Interface                    Switched
------ ----------- ------------------ ------------ --------------- ------------
16000  Pop         192.168.255.249/32 Gi0/0/0/3.490 192.168.255.249 9101
16001  Aggregate   CUSTOMER_2: Per-VRF Aggr[V]   \
                                      CUSTOMER_2                   520
RP/0/0/CPU0:XRv_2#ping vrf CUSTOMER_2 10.100.100.1 SOurce 10.200.200.1
Mon Jan 19 13:43:37.977 UTC
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.100.100.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/71/179 ms
RP/0/0/CPU0:XRv_2#

 

Login Form