Hot answers tagged

20

Both Daniel and John gave very good answers to your question; I'll just add some practical things that come to mind when I read the question. Keep in mind that much discussion about the security of MPLS VPNs comes by way of the trust normally afforded to Frame Relay and ATM VPNs. Is MPLS secure? Ultimately the question of security comes down to one unasked ...


13

No it's not possible today, because neither CSCO or JNPR have implemented LDP to distribute labels for IPV6 prefixes. In my opinion people have too sentimental view on this matter, thinking IPV6-only is value in itself, it's not. You should differentiate services you offer from your control-plane used to offer those. There is no particular reason to have ...


11

... The load balancing works when I replace the MPLS by ATM switches. This doesn't sound like a parallel comparison, because routers don't care whether you're forwarding through an ATM PVC or an MPLS LSP, they will load-balance in the same way, assuming the routers have the same configuration. Perhaps you've done something unusual with your ATM VCs, but ...


10

FEC or 'Forwarding equivalence class' identifies identity for packet which will determine path it will take in the network. For pure IPv4 forwarding, with routing-table 10.0.0.0/24 -> 192.0.2.1 you can think that addresses 10.0.0.0 - 10.0.0.255 share that FEC, as they are treated same way, each of them are going to go to 192.0.2.1. In MPLS typically FEC is ...


9

The two Windstream Routers each have an MPLS port: 192.168.1.2 = Host MPLS 192.168.2.2 = Remote MPLS The Windstream routers also each have an open internet port to which I have attached a Firewall Router for filtering the internet, making the internet gateways: 192.168.1.1 = Host Gateway 192.168.2.1 = Remote Gateway Problem ...


9

I'm assuming you are talking about MPLS VPN. The MPLS VPN is more secure than a regular Internet connection, it's basically like a virtual leased line. However it runs no encryption. So it is free from eavesdropping unless someone misconfigures the VPN but if you carry sensitive traffic it should still be encrypted. This kind of VPN is not authenticated so ...


9

Yes both LSR[12] could advertise given FEC, say 10.0.0.1/32 with label 10 to each other. Then if IGP says to LSR1 10.0.0.1/32 egress interface is towards LSR2, it'll impose (or swap to) label 10 and send towards LSR2. LSR2 then will find egress interface being something else than towards LSR1 and swap label to what ever that direction has advertised, might ...


9

First, I would recommend checking out Cisco's MPLS FAQ For Beginners, or the NANOG Presentation "MPLS for Dummies" by Richard A Steenbergen. They both have some really good information. With that said, let me address your questions one at a time. (I have excerpted them in part below.) 1: After the initial convergence of the network, LSPs now exist ...


9

The problem is the: [edit protocols rsvp] load-balance bandwidth If you look at the Juniper documentation for Unequal Cost Load Balancing RSVP LSPs, it states: For uneven load balancing using bandwidth to work, you must have at least two equal-cost LSPs toward the same egress router and at least one of the LSPs must have a bandwidth value configured at ...


9

Why does MPLS need an IGP (like OSPF) in order to work? In an MPLS network, OSPF is not used to route customer traffic. It is only used to provide routing for the internal provider network so that labels can be generated. LDP is used to advertise these labels to neighboring label-switched routers. So, why to use also MPLS if we already had OSPF? You'...


8

MPLS features rerouting, can it not just create the routes by itself? You've enabled LDP; however, as an MPLS label distribution protocol LDP, only maps IGP routes to MPLS labels; in your case the IGP is EIGRP... Quoting RFC 3031 - MPLS Architecture, page 8 (emphasis mine): MPLS node a node which is running MPLS. An MPLS ...


8

It depends what you are advertising into LDP. If your ping is to a destination address that is advertised by LDP and there is an end-to-end LSP for that destination, then the ping will be encapsulated and MPLS switched, even if the destination is in the global table. This is how the outer (tunnel) LSP works in MPLS VPN By default Cisco networks advertise ...


7

So it seems the way to go is to use a logical tunnel interface on MX. Just put one end of the lt Interface in the VPLS instance and the other end in the L2VPN instance: lt-1/2/0 { mtu 1514; unit 0 { encapsulation ethernet-ccc; peer-unit 1; family ccc; } unit 1 { encapsulation ...


7

Short answer: MPLS is not a Layer 3 Routing protocol, however, it requires one to establish it's paths. -- Per RFC 3031 Multiprotocol Label Switching Architecture: An MPLS node will be aware of MPLS control protocols, will operate one or more L3 routing protocols, and will be capable of forwarding packets based on labels. What this means is that an MPLS ...


6

"VPN" in the most common definition doesn't necessarily imply security. The same goes for MPLS, and the two terms are often combined (see "MPLS VPN") because certain aspects of MPLS can provide similar functionality to a traditional VPN (AToMPLS, EoMPLS, TDMoMPLS, etc). It's entirely possible to run MPLS over an encrypted VPN tunnel, and to run encrypted ...


6

is a unique label generated per Destination prefix in routing Table or is it per Next-hop in the routing table? ...i have seen customer scenarios approaching 1 million routes... But the MPLS doesn't have any common guidelines for label generation ? Is there not a common rule saying a unique label should be generated per Destination-prefix or per nexthop ? ...


6

The ME3600s don't support the forwarding of STP or MST frames through EVC. Port based PWE3s will transport STP frames but you will have to chew up a lot of ports. Really you should be engaging your vendor to platform specific questions like this that are "Will the switch support X feature" or "Does your switch forward X traffic". I suggest also habinga look ...


6

Here is a short answer: A L2 VPN acts like a layer 2 network. That is, all the devices that connect to the VPN would normally be on the same subnet, and broadcasts go to all devices. In a L3 VPN, each site makes a L3 point to point link to the MPLS provider. Each site must run a routing protocol (or use static routing) with the provider to reach other ...


6

I think your question is not truly correct. First of all, as explain here "an MPLS VPN is a VPN that is built on top of an MPLS network, usually from a service provider, to deliver connectivity between enterprise office locations. " The MPLS is the mechanism that directs data from one network node to the next, based on short path labels instead network ...


6

MPLS is a virtual "layer 3" network. The customer addresses packets by IP. The PE equipment have customer IPs and serve as customer routers. The MPLS admin needs to manage at least a little of the routing (unless there have been improvements since I last administered an MPLS network, I'd be interested to know if that is the case). VPLS is a virtual "layer 2"...


6

Traffic steering is actually the task that is beyond MPLS TE itself. TE tunnel just provides the path, and it's up to other protocols and techniques to steer actual traffic. The same is true for bandwidth reservation. TE just says "there are 300 mbps reserved", but nothing stops your client from sending more than that. So, your options are policies, static ...


6

This is a very broad question and you need to do some more background reading, but quick answers to your questions: L2 MPLS VPN – forwards based on the L2 address of the L2 PDU. The L2 PDU is encapsulated in the transport protocol (MPLS). The VPN can provide point-to-point (AToM) or LAN type multipoint service (VPLS). Something to remember about these ...


6

LFA - Loop-Free Alternate(s) (also sometimes called LFA-FRR which may add to your confusion) is a feature of IGPs such OSPF and IS-IS to allow nodes to calculate alternative paths to each prefix in the event of a link failure. These backup paths are maintained by each node and rapidly installed upon link/node failure so that traffic flow is preserved while ...


5

Based on the information you provide, I would go with option #3. Add a secondary /22 or /23 IP range to the interface. Test the new range for expected results (especially since some servers/services may limit access by IP in firewall or ACL). Set this new range as the DHCP scope so clients will move automatically as they renew their DHCP lease. For ...


5

In theory you can run MPLS without an IGP, any sane network admin would not though. MPLS labels can be assigned through: LDP RSVP-TE Generally a router runs IGP to populate the Routing Information Base (RIB). This is the control plane, routes are then installed into the Forwarding Information Base (FIB). This is the data plane forwarding, depending on ...


5

MUX-UNI support: It looks like you're trying to configure a MUX-UNI with: A Layer3 interface on Vlan 556 A Vlan-mode PW on Vlan 920 The WS-X6516A is considered a Catalyst 6500 / Cisco 7600 LAN Card; LAN cards have some feature restrictions... one of the restrictions is how you configure a Layer3 interface on a LAN card with dot1q encapsulation. When you'...


5

Let's clear up some terminology first, sorry if I repeat some things that you already know: LER: This is a "Label Edge Router". These terminate MPLS LSP's. LSR: This is a "Label Switching Router". This is ANY router participating in MPLS. PE: This is a "Provider Edge". This is the device that is controlled by the service provider, closest to the customer ...


5

Do all TE routes work this way? Does the original LSP path (w/o TE) have to be only one hop away? No the original LSP path can be multiple hops away. MPLS TE is a very complicated subject, and I can hardly do justice to the nuances in a reasonable-sized answer. These are some of MPLS TE protection models for a primary LSP path along A -> B -> C ->...


5

This is quite complex to answer in simple set of questions, but let's try: Yes, it's possible to have internet connectivity by means of MPLS cloud, but it either means you need to self-deploy MPLS L3 VPN for yourself, or your MPLS cloud will be provided by upstream ISPs. Usually, edge routers - the ones running MPLS, are distinct from L3 switches/routers in ...


5

You cannot really tell the path that a packet may travel or has traveled. The packet has no record of that, and the path could change from one packet to the next because routing is dynamic. Routers route packets one at a time, regardless of any packets that came before, and an Internet path can change with no notice.


Only top voted, non community-wiki answers of a minimum length are eligible