IP-VPN (BGP MPLS/VPN) InternetWeek 2004 <hishii@asianetcom.net> IP-VPN MPLS IP-VPN VPNL3VPN L2VPN L3VPN 1
IP-VPN Agenda BGP/MPLS-VPN BGP/MPLS-VPN BGP/MPLS-VPN BGPVPN BGP/MPLS-VPN BGP/MPLS-VPN BGP/MPLS-VPN BGP/MPLS-VPN RFC2547bisISP IP-VPN VPN IP MPLS-VPNMPLS() MPLSIP-VPN BGP/MPLS-VPN 2
BGP/MPLS-VPN IFATMHSD (FR IP) (a)ipsec-vpn (b)mpls-vpn IP-NW BGP/MPLS-VPN VPN BGP/MPLS-VPN MPLS(LDP/RSVP) VPN BGP(mpBGP:RFC2858, RFC3107) PeerLayer3 IP-VPN VPN Layer3ISP 3
BGP/MPLS-VPN BGP/MPLS-VPN MPLS MPLS-VPN PEVPN MPLS PA IP PB PE VPN IP IP MPLS PEA PEB PEC IP MPLS IP CE CE CE CE CE CE VPN A 10.0.0.0/24 VPN A 10.1.0.0/24 VPN B 10.0.0.0/24 VPN A 192.168.0.0/24 VPN B 10.1.0.0/24 VPN A 10.2.0.0/16 4
BGP/MPLS-VPN (AP) A B VPNVPN () IP (MPLSIP-Sec) FRATM IP IPv4 VPN FRATM 5
(ISP) IP IP-VPN VPN1 IP-VPN VPN QoS BGP/MPLS-VPN PEProvider Edge Router( MPLS) PProvider Router(MPLS) CECustomer Edge Router(PE ) VPN IP CE PE P P PE CE VPNAA MPLS VPNA:B 6
PE VPN1PE VRFs:VPN Routing and Forwarding tables VPN CE VRF(VPN) VRF ATM/FR PE VPN VR(Virtual Router) Serial1/0/0 ATM2/0/0.1 Ether3/0/0 Serial1/0/1 VPN-A Routing Table VPN-B Routing Table VPN-C Routing Table ISP Global Routing Table IP Backbone PE 7
BGP/MPLS-VPN Shim VPN IP PEPE P (LDPhop by hop) MPLS2 32bit PEPE (mpbgppe) BGP/MPLS-VPN VPN A A Route Dist. VPN PE 12 10.0.0.0/8 192.168.0.1/32 42 12 11.0.0.0/8 989 192.168.0.1/32 42 in 42 PE out 192.168.0.1/32 32 Lo:192.168.0.1/32 CE PE P P PE CE 26 VPNAA MPLS VPNA:B 10.0.0.0/8 8
BGP/MPLS-VPN(cont.) (CE) VPNAB10.0.0.1 Dst:10.0.0.1 Lo:192.168.0.1/32 CE PE P P PE CE 26 VPNAA MPLS VPNA:B 10.0.0.0/8 BGP/MPLS-VPN(cont.) VPN A A PE Route Dist. VPN PE 12 10.0.0.0/8 26 192.168.0.1/32 42 12 11.0.0.0/8 989 192.168.0.1/32 42 Dst:10.0.0.1 Lo:192.168.0.1/32 CE PE P P PE CE 26 VPNAA MPLS VPNA:B 10.0.0.0/8 9
BGP/MPLS-VPN(cont.) PE PEVPNA10.0.0.0/8VPN B (1)VPNA:10.0.0.0/8PEBGP next-hop (2)BGP next-hopa Dst:10.0.0.1 B(26) A(42) Lo:192.168.0.1/32 CE PE P P PE CE 26 VPNAA MPLS VPNA:B 10.0.0.0/8 BGP/MPLS-VPN(cont.) P in 42 PE out 192.168.0.1/32 32 Dst:10.0.0.1 B(26) A(42) Lo:192.168.0.1/32 CE PE P P PE CE 26 VPNAA MPLS VPNA:B 10.0.0.0/8 10
BGP/MPLS-VPN(cont.) P PA Dst:10.0.0.1 B(26) A(32) Lo:192.168.0.1/32 CE PE P P PE CE 26 VPNAA MPLS VPNA:B 10.0.0.0/8 BGP/MPLS-VPN(cont.) P (PHP:Penultimate Hop Popping) in 32 PE 192.168.0.1/32 Dst:10.0.0.1 B(26) A(32) out Lo:192.168.0.1/32 CE PE P P PE CE 26 - VPNAA MPLS VPNA:B 10.0.0.0/8 11
BGP/MPLS-VPN(cont.) PE PEBVPN CE Dst:10.0.0.1 B(26) Lo:192.168.0.1/32 26 CE PE P P PE CE VPNAA MPLS VPNA:B 10.0.0.0/8 BGP/MPLS-VPN(cont.) CE IP CE Dst:10.0.0.1 Lo:192.168.0.1/32 CE PE P P PE CE VPNAA MPLS VPNA:B 10.0.0.0/8 12
BGP/MPLS-VPN PELSPVPN Redistribute(BGP4) Static BGP4 RIP OSPF PE IP mp-bgp VPN Redistribute(BGP4) LSP PELoLSP P P PE Static BGP4 RIP OSPF CE VPNAA MPLS(OSPF) CE VPNA:B BGP/MPLS-VPN PEPOSPF/ISIS (LDP/RSVP-TE) PELoopback VPN Lo:192.168.0.1 PELoLSP PE P P PE LDP() MPLS(OSPF) Lo:192.168.0.2 13
BGP/MPLS-VPN Rd=12 10.0.0.0/24 26 RT=12 NH=PE-B PE-CEVPN PE PE-A mp-bgp (VPN) P P Redistribute PE-B Static VPN-A 10.0.0.0/24 =26 CE VPNAA MPLS CE VPNA:B BGP/MPLS-VPN VPNmp- BGPPEVPN MPLSPE-P,P-P LDPRSVP-TE 14
BGPVPN BGPVPN RFC2858 Multiprotocol extensions for BGP-4 MP_REACH_NLRI(Type Code 14) MP_UNREACH_NLRI(Type Code 15) AFI=1 & SAFI =128 MPLS-labeled VPN-IPv4 address RFC3107 Encoding 15
BGPVPN mp-bgp VPN-IPv4 Address Family IPv48byteRoute Distinguisher(RD)12byte VPN-IPv4 Address(12byte) RD(8byte)+IPv4(4byte) RD IPv4 12byte BGPVPN mp-bgp RD(8byte)Format Type 2byte Value 6byte ISPValue Field Format 16
Extended Community Extended Community Attribute(Type Code 16) Route Target(RT) VRFBGP RT(Export Targets) PEVRF (Import Targets) VPNAS Extended Community RTVPNv4-prefix VPNRouting Table (Import) VPN-A Routing Table ISP VPN-B Global Routing Table Routing Table VPN-C Routing Table (Export) BGP RD:18084:1(VPN-A) 10.0.0.0/24 RT:18084:1(Export) 10.0.1.0/24 RT:18084:1(Export) RD:18084:2(VPN-B) 10.0.0.0/24 RT:18084:2(Export) 10.0.1.0/24 RT:18084:2(Export) RD:18084:3(VPN-C) 10.0.0.0/8 RT:18084:3(Export) 17
AS Override VPNAS PE-CE AS 10.0.0.0/24 AS 65000 VPN-A AS 65000 BGP-4 VPN-A BGP-4 ISP 10.0.0.0/24 AS65000 VPN-A BGP/MPLS-VPN AS 18084 AS65000ISP AS 10.0.0.0/24 AS18084 BGP-4 AS 65000 VPN-A SOO(Site Of Origin) AS Override AS RTExtend Community 10.0.0.0/24 CE-A AS65000 CE-B BGP-4 BGP-4 ISPSOO 10.0.0.0/24 AS65000 From CE-A SOO=65000:1 10.0.0.0/24 AS65000 From CE-B SOO=65000:1 VPN-A BGP/MPLS-VPN AS 18084 VPN-A 18
VPNQoS VPNQoS VPNQoS JitterdelayVoIP VPN 19
VPNQoS MPLS EXP ClassP/PE PE/P EXP0 EXP3 EXP 6 EXP6 EXP3 EXP6 WRED/WFQ WRED:Weighted Random Early Detection WFQ : Weighted Fair Queuing VPNQoS SAA (Service Assurance Agent) POP-POP,END-to-END SNMPQueue SNMPIngress/Egress SNMP 20
BGP/MPLS VPN BGP/MPLS-VPN VPN RFC2547bis(draft-ietf-l3vpn-rfc2547bis-03.txt) AS( option ) PE MPLS-VPN ISP-A ASBR ASBR MPLS-VPN ISP-B PE CE VPN-A VPN CE VPN-A 21
Option A VRF to VRF :FRSerialVPN RR-A RR-B PE-A1 SP-A PE-ASBR-A 1 logical int per VPN PE-ASBR-B SP-B PE-B1 CE-1 CE-2 PE-A2 Ipv4 VPN routes: IGP/BGP/static CE-3 PE-B2 CE-4 VPN-X VPN-Y Data VPN-X VPN-Y Option B ASBR-A to ASBR-B for ipv4 & vpnv4: PE-A1 RR-A ASBR-A vpv4 SP-A/SP-B: EBGP vpnv4 ASBR-B RR-B PE-B1 SP-A SP-B NH for vpnv4 CE-1 CE-2 PE-A2 ASBRs : next hop self Redistribute connected subnets CE-3 PE-B2 CE-4 VPN-X VPN-Y VPN Label VPN-X VPN-Y Data Label Stack 22
Option C PE-A vpv4 SP-A/SP-B: EBGP vpnv4 next hop RR-B PE-A1 ASBR-A ASBR-B PE-B1 SP-A SP-B CE-1 CE-2 PE-A2 IGP/static + LDP EBGP ipv4 + label CE-3 PE-B2 CE-4 VPN-X VPN-Y IGP Label VPN Label Data Label Stack VPN-X VPN-Y Option Option A (VRF to VRF) NNIMPLS TCP/IPToS Option B (ASBR to ASBR) PE-ASBR-ASBR-PEMPLS Option C (RR to RR) Plus Option B 23
BGP/MPLS-VPN Cisco PEConfig VPN ip vrf VPN-TEST rd 203.100.1.1:1 route-target import 18084:1 route-target export 18084:1 VPN Interface Serial1/0/0 ip vrf forwarding VPN-TEST ip address 10.0.0.1 255.255.255.252 24
Cisco PEConfig(Cont.) mpbgp(cestatic) router bgp 18084 no bgp default ipv4-unicast neighbor 192.168.0.1 remote-as 18084 PEPeer! address-family ipv4 vrf VPN-TEST VPN redistribute static no auto-summary no synchronization exit-address-family! address-family vpnv4 route-target neighbor 192.168.0.1 send-community extended! Cisco PEConfig(Cont.) VPNStatic ip route vrf VPN-TEST 10.0.0.0 255.0.0.0 Serial1/0/0 10.0.0.2 ip route vrf OTHER-VPN 10.0.0.0 255.0.0.0 Serial1/1/0 10.0.0.2 VPN 25
Juniper PE Router Config VPN routing-instance{ VPN-TEST{ instance-type vrf; interface t1-0/3/0.0; route-distinguisher 203.100.1.1:1; vrf-import VPN-TEST-import; vrf-export VPN-TEST-export; routing-options { static{ route 10.10.10.0/24 next-hop 203.100.254.2; } } } } Juniper PE Router Config (cont.) policy-options { policy-statement VPN-TEST-import { term 1 { from community VPN-TEST-import; then accept; } term 2 { then reject; } } policy-statement VPN-TEST-export { term 1 { from protocol static; then { community add VPN-TEST-export; accept; } } term 2 { from protocol direct; then { community add VPN-TEST-export; accept; } } term 3 { then reject; } } community VPN-TEST-export members target:813:1; community VPN-TEST-import members target:813:1; 26
BGP/MPLS-VPN MPLS-VPN Static CE 10.2.1.0/24 10.2.2.0/24 0.0.0.0/0 CE CE 0.0.0.0/0 10.2.1.0/24 10.2.2.0/24 VPN A 0.0.0.0/0 0.0.0.0/0 CE CE Internet 10.1.1.0/24 192.1.0.0/24 CE PE 27
MPLS-VPN 10.2.1.0/24 10.2.2.0/24 BGP 0.0.0.0/0 0.0.0.0/0 ISDN BGP 10.2.1.0/24 VPN A 10.2.1.0 0.0.0.0 10.2.2.0 10.2.2.0/24 Internet 10.1.1.0/24 192.1.0.0/24 10.2.1.0= BGP/MPLS-VPN () 28
BGP/MPLS-VPN Informational RFCdraft-ietf-l3vpnrfc2547bis-03.txt L3VPN-WGProvider Provisioned Layer3 VPN Cisco MPLSVPNVR Layer2 MPLS-VPN, EoMPLS IP-VPN BGP/MPLS-VPN ISP VPN ISP ISP 1VPN*1000200VPN=20 PEBGP Peer 29
BGP/MPLS-VPN Multicast over MPLS-VPN Multicast PIM-SMVPN Multicast Multicast Join request CE PE MPLS-VPN PE Join request CE SV SV Remote Client Multicast Sender BGP/MPLS-VPN Carrier s Carrier IP-VPNISP IPMPLS-VPN CEMPLSCE MPLS-IX CE PE MPLS-VPN ibgp or ebgp PE CE Internet ISP POP-A Or ISP-A ISP POP-B Or ISP-B 30
BGP/MPLS-VPN MPLS-VPNTraffic Engineering,Queue VPNTE QoS,CoS(MPLS-Diffserve, Diffservaware-TE)FRR(FastReroute),LSP BGP/MPLS-VPN MPLS-VPNTraffic Engineering, Queue MPLS-VPN Highest Priority CE VPN-A PE Another Priority IP Traffic PE CE VPN-A ToS bit = 5 EXP bit = 5 EXP bit = 5 ToS bit = 5 IP QoS 31
Layer2 VPN IP Ether/ATM/Framerelay/SDH : VPW(Wire)S, VPLS BGP/MPLS-VPNVPN Ether Ether CE-SW PE MPLS/IP PE CE-SW 1LAN VPLS(Virtual Private LAN Services) L3VPN BGP/MPLS-VPN BGP/MPLS-VPN BGP/MPLS-VPN BGPVPN BGP/MPLS-VPNQoS BGP/MPLS-VPN BGP/MPLS-VPN BGP/MPLS-VPN 32