CHAPTER 10 IP Virtual Routing and Forwarding VRF Provider Edge PE; VRF PE VRF PE Cisco 10000 IP ODAP p.10-5 IP p.10-18 IP Cisco 10000 Virtual Private Network VPN; IP On-demand Address Pool [ODAP] IP p.10-2 ODAP p.10-5 IP p.10-18 Cisco 10000 10-1
10 p.10-2 RADIUS p.10-2 DHCP p.10-3 PE IP Point-to-Point PPP; PPP ID Multiprotocol Label Switching MPLS; VPN VPN VRF VPN VRF VRF VPN 2 IP 2 PE VRF VRF Internet Service Provider ISP; ISP PE PE RADIUS RADIUS / RADIUS Authentication, Authorization, Accounting AAA; RADIUS IP IP 10-2 Cisco 10000
10 Cisco 10000 RADIUS RADIUS RADIUS IP IP RADIUS PE VPN VPN PE RADIUS VPN RADIUS RADIUS IP RADIUS 1 IP RADIUS RADIUS AAA RADIUS IP RADIUS RADIUS RADIUS RADIUS PE RADIUS IP Border Gateway Protocol BGP; PE VRF BGP PE DHCP Dynamic Host Configuration Protocol DHCP IP DHCP DHCP / DHCP DHCP scope IP IP Cisco 10000 10-3
10 DHCP DHCP 1 IP DHCP DHCP 1 DHCP DHCP DHCP RADIUS BGP PE RADIUS p.10-2 10-4 Cisco 10000
10 ODAP ODAP On-demand Address Pool ODAPIP ODAP DHCP RADIUS ODAP 1 ODAP PE Cisco Network Registrar CNR; Cisco DHCP Cisco Access Registrar CAR RADIUS ODAP PE ODAP PE ODAP ODAP ODAP 1 ODAP VRF ODAP ODAP p.10-5 PPP p.10-6 p.10-6 MPLS VPN ODAP p.10-6 ODAP p.10-7 ODAP p.10-7 ODAP p.10-7 ODAP p.10-11 ODAP p.10-13 ODAP p.10-15 ODAP p.10-16 ODAP Cisco IOS PRE 12.2(15)BX Cisco 10000 PRE2 12.3(7)XI1 Cisco IOS Release 12.3(7)XI1 PRE2 12.2(28)SB Cisco IOS Release 12.2(28)SB PRE2 Cisco 10000 10-5
ODAP 10 PPP PPP 2 DHCP IP ODAP PPP IP DHCP DHCP PPP ODAP MPLS VPN ODAP ODAP MPLS VPN ODAP MPLS VPN VPN VRF 1 VRF VPN ODAP ODAP p.10-5 VPN VRF VPN PPP VPN ODAP ODAP PE PPP MPLS VPN ODAP ODAP p.10-5 MPLS VPN MPLS VPN Cisco IOS Switching Services Configuration Guide Release 12.2 MPLS VPN ODAP 10-6 Cisco 10000
10 ODAP ODAP ODAP IP MPLS VPN MPLS VPN ODAP [p.10-6] VPN ODAP ODAP ODAP ODAP VRF VRF ODAP VRF VRF PPP VRF VRF ip vrf forwarding AAA PPP RADIUS VRF AAA Cisco IOS Security Configuration Guide Release 12.2 ODAP ODAP DHCP ODAP p.10-7 ODAP DHCP p.10-8 AAA p.10-9 RADIUS p.10-10 DHCP ODAP ODAP Router(config)# ip address-pool dhcp-pool MPLS VPN PPP IP ODAP VRF DHCP IP Cisco 10000 10-7
ODAP 10 DHCP DHCP PPP PPP p.10-6 10-1 PPP ODAP VRF DHCP Green_pool IP 10-1 DHCP ODAP ip address-pool dhcp-pool ip dhcp pool Green_pool ODAP DHCP DHCP ODAP 1 Router(config)# ip dhcp pool name Cisco IOS DHCP DHCP DHCP 2 Router(config-dhcp)# vrf name VRF 3 Router(config-dhcp)# origin {dhcp aaa ipcp} [subnet size initial size [autogrow size]] 4 5 Router(config-dhcp)# utilizationmark low percentage-number Router(config-dhcp)# utilization mark high percentage-number ODAP 0% 100% 10-2 2 DHCP ODAP green_pool red_poolgreen_pool Green VRF red_pool Red VRF DHCP 10-8 Cisco 10000
10 ODAP 10-2 ODAP DHCP ip dhcp pool green_pool vrf Green utilization mark high 60 utilization mark low 40 origin dhcp subnet size initial /24 autogrow /24 ip dhcp pool red_pool vrf Red origin dhcp ip vrf Green rd 200:1 route-target export 200:1 route-target import 200:1 ip vrf Red rd 300:1 route-target export 300:1 route-target import 300:1 ip address-pool dhcp-pool interface Virtual-Template1 ip vrf forwarding Green ip unnumbered Loopback1 ppp authentication chap interface Virtual-Template4 ip vrf forwarding Red ip unnumbered Loopback2 ppp authentication chap AAA ODAP RADIUS Cisco 10000 AAA 1 Router(config)# aaa new-model AAA 2 Router(config)# aaa authorization configuration default group radius RADIUS AAA 3 Router(config)# aaa accounting network default start-stop radius Router(config)# aaa accounting network default stop-only radius RADIUS AAA start RADIUS AAA stop 4 Router(config)# aaa session-id common AAA ID AAA RADIUS p.10-10 10-3 Cisco 10000 10-9
ODAP 10 RADIUS Cisco10000 RADIUS 1 2 Router(config)# ip radius source-interface subinterface-name Router(config)# radius-server host ip-address auth-port port-number acct-port port-number 3 Router(config)# radius server attribute 32 include-in-access-req 4 Router(config)# radius server attribute 44 include-in-access-req 5 6 Router(config)# radius-server vsa send accounting Router(config)# radius-server vsa send authentication RADIUS Cisco 10000 IP RADIUS RADIUS 32 NAS-Identifier RADIUS 44 Acct-Session-Id Cisco 10000 NAS Cisco 10000 NAS 10-10 Cisco 10000
10 ODAP 10-3 Green Green RADIUS RADIUS IP 172.16.1.1 10-3 AAA RADIUS aaa new-model aaa authorization configuration default group radius aaa accounting network default start-stop group radius aaa session-id common ip subnet-zero ip dhcp ping packets 0 ip dhcp pool Green vrf Green utilization mark high 50 utilization mark low 30 origin aaa subnet size initial /28 autogrow /28 ip vrf Green rd 300:1 route-target export 300:1 route-target import 300:1 interface Ethernet1/1 ip address 172.16.1.12 255.255.255.0 duplex half interface Virtual-Template1 ip vrf forwarding Green no ip address ip radius source-interface Ethernet1/1 IP address of the Radius server host radius-server host 172.16.1.1 auth-port 1645 acct-port 1646 radius-server retransmit 3 radius-server attribute 32 include-in-access-req radius-server attribute 44 include-in-access-req radius-server key cisco radius-server vsa send accounting radius-server vsa send authentication ODAP ODAP ODAP p.10-11 IPCP ODAP p.10-12 ODAP p.10-13 ODAP ODAP Cisco 10000 10-11
ODAP 10 1 Router(config)# interface name 2 Router(config-if)# peer default ip address dhcp-pool ODAP IP MPLS VPN PPP ODAP ODAP IPCP ODAP Customer Premise Equipment CPE; IP CPE DHCP IP ODAP Cisco IOS CPE AAA RADIUS VRF PE IP Control Protocol IPCP; IP ODAP IPCP 1 Router(config)# ip dhcp pool name Cisco IOS DHCP DHCP DHCP 2 Router(config-dhcp)# import all Cisco IOS DHCP 3 Router(config-dhcp)# origin ipcp IPCP ODAP 4 Router(config-dhcp)# exit DHCP 5 Router(config)# interface type 6 Router(Config-if)# ip address pool name IP IPCP 10-12 Cisco 10000
10 ODAP ODAP DHCP ODAP 1 Router(config)# ip dhcp pool name DHCP DHCP 2 Router(config-if)# no origin {dhcp aaa ipcp} ODAP ODAP PPP DHCP 10-4 DHCP test_pool 10-4 ODAP ip dhcp pool test_pool import all no origin ipcp ODAP ODAP EXEC Router# show ip dhcp pool Router# show ip dhcp pool name Router# show ip dhcp binding / VRF / VRF IP VRF 10-5 show ip dhcp pool 2 DHCP Green Global Green Autogrow Subnet size Green origin VRF name Green Green VRF Total addresses Leased addresses Cisco 10000 10-13
ODAP 10 Pending event subnet request Leased addresses Current index 10-5 3 2 Current index 0.0.0.0 Green Global 172.16.0.1 Green Green VRF Global IP address range Leased addresses 10-5 show ip dhcp pool Router# show ip dhcp pool Pool Green : Utilization mark (high/low) : 50 / 30 Subnet size (first/next) : 24 / 24 (autogrow) VRF name : Green Total addresses : 18 Leased addresses : 13 Pending event subnet request 3 subnets are currently in the pool : Current index IP address range Leased addresses 0.0.0.0 178.16.0.1-172.16.0.6 6 0.0.0.0 172.16.0.9-172.16.0.14 6 172.16.0.17 172.l6.0.17-172.16.0.22 1 Pool Global : Utilization mark (high/low) : 100 / 0 Subnet size (first/next) : 24 / 24 (autogrow) Total addresses : 6 Leased addresses : 0 Pending event : none 1 subnet is currently in the pool : Current index IP address range Leased addresses 172.16.0.1 172.16.0.1-172.16.0.6 0 10-6 show ip dhcp binding Green Type On-demand PPP Lease expiration Infinite IP Hardware address PPP ID 10-6 VRF 10-14 Cisco 10000
10 ODAP 10-6 show ip dhcp binding Router# show ip dhcp binding Bindings from all pools not associated with VRF : IP addresshardware addresslease expirationtype Bindings from VRF pool Green : IP address Hardware address Lease expiration Type 172.16.0.1 5674.312d.7465.7374. Infinite On-demand 2d38.3930.39 172.16.0.2 5674.312d.7465.7374. Infinite On-demand 2d38.3839.31 172.16.0.3 5674.312d.7465.7374. Infinite On-demand 2d36.3432.34 172.16.0.4 5674.312d.7465.7374. Infinite On-demand 2d38.3236.34 172.16.0.5 5674.312d.7465.7374. Infinite On-demand 2d34.3331.37 172.16.0.6 5674.312d.7465.7374. Infinite On-demand 2d37.3237.39 172.16.0.9 5674.312d.7465.7374. Infinite On-demand 2d39.3732.36 172.16.0.10 5674.312d.7465.7374. Infinite On-demand 2d31.3637 172.16.0.11 5674.312d.7465.7374. Infinite On-demand 2d39.3137.36 172.16.0.12 5674.312d.7465.7374. Infinite On-demand 2d37.3838.30 172.16.0.13 5674.312d.7465.7374. Infinite On-demand 2d32.3339.37 172.16.0.14 5674.312d.7465.7374. Infinite On-demand 2d31.3038.31 172.16.0.17 5674.312d.7465.7374. Infinite On-demand 2d38.3832.38 172.16.0.18 5674.312d.7465.7374. Infinite On-demand 2d32.3736.31 ODAP DHCP ODAP p.10-15 IPCP ODAP p.10-16 DHCP ODAP 10-7 Virtual-Template1 ODAP Virtual-Template1 ODAP IP 10-7 DHCP ODAP interface Virtual-Template1 ip vrf forwarding green ip unnumbered loopback1 ppp authentication chap peer default ip address dhcp-pool Cisco 10000 10-15
ODAP 10 IPCP ODAP 10-8 DHCP my_pool IPCP ODAP my_pool IP Ethernet0 10-8 IPCP ODAP ip dhcp pool my_pool import all origin ipcp interface Ethernet0 ip address pool my_pool ip verify unicast reverse-path shutdown hold-queue 32 in ODAP ODAP EXEC Router# clear ip dhcp [pool name] binding {* address} Router# clear ip dhcp [pool name] conflict {* address} Router# clear ip dhcp [pool name] subnet {* address} Router# debug dhcp details Router# debug ip dhcp server events Router# show ip dhcp import Router# show ip interface [type number] Router# show ip dhcp pool name DHCP DHCP DHCP DHCP ODAP DHCP DHCP IP DHCP DHCP PPP IP VRF 10-16 Cisco 10000
10 ODAP Cisco IOS DHCP ping DHCP ping ICMP 2 DHCP 2 1 ping ping ping DHCP ODAP DHCP RADIUS 4 PPP EXEC clear ip dhcp pool name subnet * Cisco 10000 10-17
IP 10 IP IP IP Cisco 10000 VPN IP IP IP IP IP IP IP IP Cisco 10000 1 Cisco 10000 IP IP IP IP IP IP L2TP 2 VRF PPP Terminated Aggregation PTA MPLS VPN Remote Access RA IP IP p.10-18 IP p.10-18 IP p.10-18 IP p.10-19 IP p.10-19 IP Cisco IOS PRE 12.2(4)BZ1 Cisco 10000 PRE1 12.3(7)XI1 Cisco IOS Release 12.3(7)XI1 PRE2 12.2(28)SB Cisco IOS Release 12.2(28)SB PRE2 IP IP MPLS VPN IP IP IP 10-18 Cisco 10000
10 IP IP Router(config)# ip local pool pool-name start-ip [end-ip] [group group-name] [cache-size size] IP IP EXEC Router# show ip local pool [pool-name [group group-name]] Router# show ip local pool Router# show ip local pool pool-name Router# show ip local pool group Router# show ip local pool group group-name IP IP IP p.10-19 VPN VRF IP p.10-20 IP 2 grp1 p1_g1 p2_g1 p3_g1 grp2 p1_g2 p2_g2 lp1 lp2 IP 10.1.1.1 grp1 grp2 lp1 lp2 ip local pool p1_g1 10.1.1.1 10.1.1.50 group grp1 ip local pool p2_g1 10.1.1.100 10.1.1.110 group grp1 ip local pool p1_g2 10.1.1.1 10.1.1.40 group grp2 ip local pool lp1 10.1.1.1 10.1.1.10 ip local pool p3_g1 10.1.2.1 10.1.2.30 group grp1 ip local pool p2_g2 10.1.1.50 10.1.1.70 group grp2 ip local pool lp2 10.1.2.1 10.1.2.10 Cisco 10000 10-19
IP 10 VPN VRF IP VPN VRF IP VPN vpn1 p1_vpn1 p2_vpn1 p3_vpn1 vpn2 p1_vpn2 p2_vpn2 lp1 lp2 IP 10.1.1.1 vpn1 vpn2 lp1 lp2 ip local pool p1_vpn1 10.1.1.1 10.1.1.50 group vpn1 ip local pool p2_vpn1 10.1.1.100 10.1.1.110 group vpn1 ip local pool p1_vpn2 10.1.1.1 10.1.1.40 group vpn2 ip local pool lp1 10.1.1.1 10.1.1.10 ip local pool p3_vpn1 10.1.2.1 10.1.2.30 group vpn1 ip local pool p2_vpn2 10.1.1.50 10.1.1.70 group vpn2 ip local pool lp2 10.1.2.1 10.1.2.10 10-20 Cisco 10000