Services: Routing MPLS, VPNs
Nick Feamster CS 7260 February 15, 2006
Administrivia
Problem Set 2 is out, due 2/24
4 problems: 1 Data streaming, 2 scriptroute, 1 Netflow Try to test out the scriptroute installation early, in case there are problems. Fewer, shorter problems, but more scripting/coding Scriptroute scripts are in Rubycome to office hours if you need help with the language Last problem is not that hard. Most could probably be done with grep/awk as a last resort.
2
MPLS Overview
Main idea: Virtual circuit
Packets forwarded based only on circuit identifier
Source 1
Destination
Source 2
Router can forward traffic to the same destination on different interfaces/paths.
3
Circuit Abstraction: Label Swapping
D A
1 2
Tag Out New A 2 D
3
Label-switched paths (LSPs): Paths are named by the label at the paths entry point At each hop, label determines:
Outgoing interface New label to attach
Label distribution protocol: responsible for disseminating signalling information
4
Layer 3 Virtual Private Networks
Private communications over a public network A set of sites that are allowed to communicate with each other Defined by a set of administrative policies determine both connectivity and QoS among sites established by VPN customers One way to implement: BGP/MPLS VPN mechanisms (RFC 2547)
5
Building Private Networks
Separate physical network
Good security properties Expensive!
Secure VPNs
Encryption of entire network stack between endpoints
Layer 2 Tunneling Protocol (L2TP)
PPP over IP No encryption
Privacy and interconnectivity (not confidentiality, integrity, etc.)
Layer 3 VPNs
6
Layer 2 vs. Layer 3 VPNs
Layer 2 VPNs can carry traffic for many different protocols, whereas Layer 3 is IP only More complicated to provision a Layer 2 VPN Layer 3 VPNs: potentially more flexibility, fewer configuration headaches
7
Layer 3 BGP/MPLS VPNs
VPN A/Site 2 10.2/16 VPN B/Site 1 10.1/16
CE B1
2
CE B1 P1
1
CEA2 PE2 P2 CEB2
10.2/16 VPN B/Site 2 BGP to exchange routes
PE3
PE1 CEA1 P3 CEB3
MPLS to forward traffic
CEA3
10.3/16 10.1/16 VPN A/Site 1 10.4/16 VPN B/Site 3 VPN A/Site 3
Isolation: Multiple logical networks over a single, shared physical infrastructure Tunneling: Keeping routes out of the core
8
High-Level Overview of Operation
IP packets arrive at PE Destination IP address is looked up in forwarding table Datagram sent to customers network using tunneling (i.e., an MPLS label-switched path)
9
BGP/MPLS VPN key components
Forwarding in the core: MPLS Distributing routes between PEs: BGP Isolation: Keeping different VPNs from routing traffic over one another
Constrained distribution of routing information Multiple virtual forwarding tables
Unique addresses: VPN-IP4 Address extension
10
Layer VPNs
Vanilla 3 Layer 3 VPNs: All customer routes in the core
Site 1
Site 2
CORE
IBGP EBGP
BGP/MPLS VPNs: BGP between PEs; MPLS in the core
Site 1
PE
LDP
LDP
LDP
Site 2
P
MPLS CORE
P
PE 11
Problems Introduced by Layer 3 VPNs
Overlapping address space in forwarding table
Solution: Virtual routing and forwarding table (VRF)
Overlapping address space in BGP routes
Solution: Route distinguisher--- 8-byte VPN-specific identifier prepended to each IP address Typically, one route distinguisher per VPN New VPN-IP address family Routes carried with multi-protocol BGP
Filtering routes from routes not at that site
Route target: basically a special BGP community value
12
Virtual Routing and Forwarding
Separate tables per customer at each router
Customer 1 10.0.1.0/24 10.0.1.0/24 RD: Green
Customer 1
Customer 2 10.0.1.0/24 Customer 2 10.0.1.0/24 RD: Blue
13
Routing: Constraining Distribution
Performed by Service Provider using route filtering based on BGP Extended Community attribute
BGP Community is attached by ingress PE route filtering based on BGP Community is performed by egress PE
BGP RD:10.0.1.0/24 Route target: Green Next-hop: A Site 2
Static route, RIP, etc. Site 1 10.0.1.0/24 A
Site 3
14
BGP/MPLS VPN Routing in Cisco IOS
Customer A ip vrf Customer_A rd 100:110 route-target export 100:1000 route-target import 100:1000 ! ip vrf Customer_B rd 100:120 route-target export 100:2000 route-target import 100:2000 Customer B
15
Forwarding
PE and P routers have BGP next-hop reachability through the backbone IGP Labels are distributed through LDP (hop-by-hop) corresponding to BGP Next-Hops Two-Label Sta...