CHAPTER 9 IP Virtual Routing and Forwarding VRF Provider Edge PE; VRF PE VRF PE Cisco 10000 ESR IP ODAP p.9-5 IP p.9-17 IP Cisco 10000 ESR Virtual Private Network VPN; IP ODAP IP Cisco 10000 ESR 9-1
9 p.9-2 RADIUS p.9-2 DHCP p.9-3 PE IP PPP PPP ID MPLS VPN VPN VRF VPN VRF VRF VPN 2 IP 2 PE VRF VRF ISP ISP PE PE RADIUS RADIUS / RADIUS Authentication, Authorization, Accounting AAA; RADIUS IP IP 9-2 Cisco 10000 ESR
9 Cisco 10000 ESR RADIUS RADIUS RADIUS IP IP RADIUS PE VPN VPN PE RADIUS VPN RADIUS RADIUS IP RADIUS 1 IP RADIUS RADIUS AAA RADIUS IP RADIUS RADIUS RADIUS RADIUS PE RADIUS IP Border Gateway Protocol BGP PE VRF BGP PE DHCP Dynamic Host Configuration Protocol DHCP IP DHCP DHCP / DHCP DHCP scope IP IP Cisco 10000 ESR 9-3
9 DHCP DHCP 1 IP DHCP DHCP 1 DHCP DHCP DHCP RADIUS BGP PE RADIUS p.9-2 9-4 Cisco 10000 ESR
9 ODAP ODAP Cisco 10000 ESR Cisco IOS 12.2(15)BX On-demand Address Pool ODAP; ODAP IP ODAP DHCP RADIUS ODAP 1 ODAP PE Cisco Network Registrar CNR DHCP Cisco Access Registrar CAR RADIUS ODAP PE ODAP PE ODAP ODAP ODAP 1 ODAP VRF PPP PPP 2 DHCP IP ODAP PPP IP DHCP DHCP PPP ODAP Cisco 10000 ESR 9-5
ODAP 9 MPLS VPN ODAP ODAP Multiprotocol Label Switching MPLS; VPN ODAP MPLS VPN VPN VRF 1 VRF VPN ODAP ODAP p.9-5 VPN VRF VPN PPP VPN ODAP ODAP PE PPP MPLS VPN ODAP ODAP p.9-5 MPLS VPN MPLS VPN Cisco IOS Switching Services Configuration Guide Release 12.2 ODAP ODAP IP MPLS VPN MPLS VPN ODAP [p.9-6] VPN ODAP ODAP Cisco 10000 ESR ODAP Cisco IOS 12.2(15)BX ODAP VRF VRF ODAP VRF VRF PPP VRF VRF ip vrf forwarding AAA PPP RADIUS VRF AAA Cisco IOS Security Configuration Guide Release 12.2 9-6 Cisco 10000 ESR
9 ODAP ODAP DHCP ODAP p.9-7 ODAP DHCP p.9-7 AAA p.9-9 RADIUS p.9-9 DHCP ODAP ODAP Router(config)# ip address-pool dhcp-pool MPLS VPN PPP IP ODAP VRF DHCP IP DHCP DHCP PPP PPP p.9-5 9-1 PPP ODAP VRF DHCP Green_pool IP 9-1 DHCP ODAP ip address-pool dhcp-pool ip dhcp pool Green_pool ODAP DHCP DHCP ODAP 1 Router(config)# ip dhcp pool name Cisco IOS DHCP DHCP DHCP 2 Router(config-dhcp)# vrf name VRF Cisco 10000 ESR 9-7
ODAP 9 3 Router(config-dhcp)# origin {dhcp aaa ipcp} [subnet size initial size [autogrow size]] 4 Router(config-dhcp)# utilization mark low percentage-number 5 Router(config-dhcp)# utilization mark high percentage-number ODAP 0 % 100 % 9-2 2 DHCP ODAP green_pool red_pool green_pool Green VRF red_pool pred VRF DHCP 9-2 ODAP DHCP ip dhcp pool green_pool vrf Green utilization mark high 60 utilization mark low 40 origin dhcp subnet size initial /24 autogrow /24 ip dhcp pool red_pool vrf Red origin dhcp ip vrf Green rd 200:1 route-target export 200:1 route-target import 200:1 ip vrf Red rd 300:1 route-target export 300:1 route-target import 300:1 ip cef ip address-pool dhcp-pool interface Virtual-Template1 ip vrf forwarding Green ip unnumbered Loopback1 ppp authentication chap interface Virtual-Template4 ip vrf forwarding Red ip unnumbered Loopback2 ppp authentication chap 9-8 Cisco 10000 ESR
9 ODAP AAA ODAP RADIUS Cisco 10000 ESR AAA 1 Router(config)# aaa new-model AAA 2 Router(config)# aaa authorization RADIUS AAA configuration default group radius 3 Router(config)# aaa accounting network RADIUS default start-stop radius AAA start Router(config)# aaa accounting network default stop-only radius RADIUS AAA stop 4 Router(config)# aaa session-id common AAA ID AAA RADIUS p.9-99-3 RADIUS Cisco10000 ESR RADIUS 1 Router(config)# ip radius source-interface subinterface-name 2 Router(config)# radius-server host ip-address auth-port port-number acct-port port-number 3 Router(config)# radius server attribute 32 include-in-access-req 4 Router(config)# radius server attribute 44 include-in-access-req 5 Router(config)# radius-server vsa send accounting 6 Router(config)# radius-server vsa send authentication RADIUS Cisco 10000 ESR IP RADIUS RADIUS 32 NAS-Identifier RADIUS 44 Acct-Session-Id Cisco 10000 ESR Network Access Server NAS Cisco 10000 ESR NAS Cisco 10000 ESR 9-9
ODAP 9 9-3 Green RADIUS RADIUS IP 172.16.1.1 9-3 AAA RADIUS aaa new-model aaa authorization configuration default group radius aaa accounting network default start-stop group radius aaa session-id common ip subnet-zero ip dhcp ping packets 0 ip dhcp pool Green vrf Green utilization mark high 50 utilization mark low 30 origin aaa subnet size initial /28 autogrow /28 ip vrf Green rd 300:1 route-target export 300:1 route-target import 300:1 interface Ethernet1/1 ip address 172.16.1.12 255.255.255.0 duplex half interface Virtual-Template1 ip vrf forwarding Green no ip address ip radius source-interface Ethernet1/1 IP address of the Radius server host radius-server host 172.16.1.1 auth-port 1645 acct-port 1646 radius-server retransmit 3 radius-server attribute 32 include-in-access-req radius-server attribute 44 include-in-access-req radius-server key cisco radius-server vsa send accounting radius-server vsa send authentication ODAP ODAP p.9-10 IPCP ODAP p.9-11 ODAP p.9-12 ODAP ODAP 9-10 Cisco 10000 ESR
9 ODAP 1 Router(config)# interface name 2 Router(config-if)# peer default ip ODAP IP address dhcp-pool MPLS VPN PPP ODAP ODAP IPCP ODAP Customer Premise Equipment CPE; IP CPE DHCP IP ODAP Cisco IOS CPE AAA RADIUS VRF PE IP Control Protocol IPCP ODAP IPCP 1 Router(config)# ip dhcp pool name Cisco IOS DHCP DHCP DHCP 2 Router(config-dhcp)# import all Cisco IOS DHCP 3 Router(config-dhcp)# origin ipcp IPCP ODAP 4 Router(config-dhcp)# exit DHCP 5 Router(config)# interface type 6 Router(Config-if)# ip address pool name IP IPCP Cisco 10000 ESR 9-11
ODAP 9 ODAP DHCP ODAP Router(config)# ip dhcp pool name Router(config-dhcp)# no origin {dhcp aaa ipcp} DHCP DHCP ODAP ODAP PPP DHCP 9-4 DHCP test_pool 9-4 ODAP ip dhcp pool test_pool import all no origin ipcp ODAP ODAP EXEC Router# show ip dhcp pool Router# show ip dhcp pool name Router# show ip dhcp binding / VRF / VRF IP VRF 9-5 show ip dhcp pool 2 DHCP Green Global Green Autogrow Subnet size Green origin VRF name Green Green VRF 9-12 Cisco 10000 ESR
9 ODAP Total addresses Leased addresses Pending event subnet request Leased addresses Current index 9-5 3 2 Current index 0.0.0.0 Green Global 172.16.0.1 Green Green VRF Global IP address range Leased addresses 9-5 show ip dhcp pool Router# show ip dhcp pool Pool Green : Utilization mark (high/low) : 50 / 30 Subnet size (first/next) : 24 / 24 (autogrow) VRF name : Green Total addresses : 18 Leased addresses : 13 Pending event subnet request 3 subnets are currently in the pool : Current index IP address range Leased addresses 0.0.0.0 178.16.0.1-172.16.0.6 6 0.0.0.0 172.16.0.9-172.16.0.14 6 172.16.0.17 172.l6.0.17-172.16.0.22 1 Pool Global : Utilization mark (high/low) : 100 / 0 Subnet size (first/next) : 24 / 24 (autogrow) Total addresses : 6 Leased addresses : 0 Pending event : none 1 subnet is currently in the pool : Current index IP address range Leased addresses 172.16.0.1 172.16.0.1-172.16.0.6 0 9-6 show ip dhcp binding Green Type On-demand PPP Lease expiration Infinite IP Hardware address PPP ID 9-6 VRF Cisco 10000 ESR 9-13
ODAP 9 9-6 show ip dhcp binding Router# show ip dhcp binding Bindings from all pools not associated with VRF : IP address Hardware address Lease expiration Type Bindings from VRF pool Green : IP address Hardware address Lease expiration Type 172.16.0.1 5674.312d.7465.7374. Infinite On-demand 2d38.3930.39 172.16.0.2 5674.312d.7465.7374. Infinite On-demand 2d38.3839.31 172.16.0.3 5674.312d.7465.7374. Infinite On-demand 2d36.3432.34 172.16.0.4 5674.312d.7465.7374. Infinite On-demand 2d38.3236.34 172.16.0.5 5674.312d.7465.7374. Infinite On-demand 2d34.3331.37 172.16.0.6 5674.312d.7465.7374. Infinite On-demand 2d37.3237.39 172.16.0.9 5674.312d.7465.7374. Infinite On-demand 2d39.3732.36 172.16.0.10 5674.312d.7465.7374. Infinite On-demand 2d31.3637 172.16.0.11 5674.312d.7465.7374. Infinite On-demand 2d39.3137.36 172.16.0.12 5674.312d.7465.7374. Infinite On-demand 2d37.3838.30 172.16.0.13 5674.312d.7465.7374. Infinite On-demand 2d32.3339.37 172.16.0.14 5674.312d.7465.7374. Infinite On-demand 2d31.3038.31 172.16.0.17 5674.312d.7465.7374. Infinite On-demand 2d38.3832.38 172.16.0.18 5674.312d.7465.7374. Infinite On-demand 2d32.3736.31 DHCP ODAP p.9-14 IPCP ODAP p.9-15 DHCP ODAP 9-7 Virtual-Template1 ODAP Virtual-Template1 ODAP IP 9-7 DHCP ODAP interface Virtual-Template1 ip vrf forwarding green ip unnumbered loopback1 ppp authentication chap peer default ip address dhcp-pool 9-14 Cisco 10000 ESR
9 ODAP IPCP ODAP 9-8 DHCP my_pool IPCP ODAP my_pool IP Ethernet0 9-8 IPCP ODAP ip dhcp pool my_pool import all origin ipcp interface Ethernet0 ip address pool my_pool ip verify unicast reverse-path shutdown hold-queue 32 in ODAP ODAP EXEC Router# clear ip dhcp [pool name] binding {* address} Router# clear ip dhcp [pool name] conflict {* address} Router# clear ip dhcp [pool name] subnet {* address} Router# debug dhcp details Router# debug ip dhcp server events Router# show ip dhcp import Router# show ip interface [type number] Router# show ip dhcp pool name DHCP DHCP DHCP DHCP ODAP DHCP DHCP IP DHCP DHCP PPP IP VRF Cisco 10000 ESR 9-15
ODAP 9 Cisco IOS DHCP ping DHCP ping ICMP 2 DHCP 2 1 ping ping ping DHCP ODAP DHCP RADIUS 4 PPP EXEC clear ip dhcp pool name subnet * 9-16 Cisco 10000 ESR
9 IP IP Cisco 10000 ESR Cisco IOS 12.2(4)BZ1 IP IP Cisco 10000 ESR VPN IP IP IP IP IP IP IP IP Cisco 10000 ESR 1 Cisco 10000 ESR IP IP IP IP IP IP L2TP VRF PPP Terminated Aggregation PTA;PPP MPLS VPN RA IP IP MPLS VPN IP IP IP Router(config)# ip local pool pool-name start-ip [end-ip] [group group-name] [cache-size size] IP Cisco 10000 ESR 9-17
IP 9 IP EXEC Router# show ip local pool [pool-name [group group-name]] Router# show ip local pool Router# show ip local pool pool-name Router# show ip local pool group Router# show ip local pool group group-name IP IP p.9-18 VPN VRF IP p.9-19 IP 2 grp1 p1_g1 p2_g1 p3_g1 grp2 p1_g2 p2_g2 lp1 lp2 IP 10.1.1.1 grp1 grp2 lp1 lp2 ip local pool p1_g1 10.1.1.1 10.1.1.50 group grp1 ip local pool p2_g1 10.1.1.100 10.1.1.110 group grp1 ip local pool p1_g2 10.1.1.1 10.1.1.40 group grp2 ip local pool lp1 10.1.1.1 10.1.1.10 ip local pool p3_g1 10.1.2.1 10.1.2.30 group grp1 ip local pool p2_g2 10.1.1.50 10.1.1.70 group grp2 ip local pool lp2 10.1.2.1 10.1.2.10 9-18 Cisco 10000 ESR
9 IP VPN VRF IP VPN VRF IP VPN vpn1 p1_vpn1 p2_vpn1 p3_vpn1 vpn2 p1_vpn2 p2_vpn2 lp1 lp2 IP 10.1.1.1 vpn1 vpn2 lp1 lp2 ip local pool p1_vpn1 10.1.1.1 10.1.1.50 group vpn1 ip local pool p2_vpn1 10.1.1.100 10.1.1.110 group vpn1 ip local pool p1_vpn2 10.1.1.1 10.1.1.40 group vpn2 ip local pool lp1 10.1.1.1 10.1.1.10 ip local pool p3_vpn1 10.1.2.1 10.1.2.30 group vpn1 ip local pool p2_vpn2 10.1.1.50 10.1.1.70 group vpn2 ip local pool lp2 10.1.2.1 10.1.2.10 Cisco 10000 ESR 9-19
IP 9 9-20 Cisco 10000 ESR