Hot answers tagged

20

Both Daniel and John gave very good answers to your question; I'll just add some practical things that come to mind when I read the question. Keep in mind that much discussion about the security of MPLS VPNs comes by way of the trust normally afforded to Frame Relay and ATM VPNs. Is MPLS secure? Ultimately the question of security comes down to one unasked ...


18

I am only directly aware of one issue with BFD, which is CPU demand. I am currently investigating an issues with a Cisco 7301 which when pushing more traffic during our peak hours, compared to the rest of the day, BFD is sometimes timing out and routing trips over to the next link. It seems that under high traffic volumes the router CPU usage is rising (...


13

No it's not possible today, because neither CSCO or JNPR have implemented LDP to distribute labels for IPV6 prefixes. In my opinion people have too sentimental view on this matter, thinking IPV6-only is value in itself, it's not. You should differentiate services you offer from your control-plane used to offer those. There is no particular reason to have ...


12

Label itself is either an aggregate label, which means label does not have rewrite information attached to it, so it does not know egress interface nor egress MAC address. Aggregate labels are used for example to connected networks. Aggregate label implies that you do not know egress information after MPLS lookup, so you must do normal IP lookup to determine ...


12

L2VPN is generic term for group of technologies out of which one is VPLS, but could be number of other technologies such as emerging EVPN. For more information read WG charter/mailing lists as L2VPN has lot of active work going on. Also read RFC6624 and RFC4761


11

... The load balancing works when I replace the MPLS by ATM switches. This doesn't sound like a parallel comparison, because routers don't care whether you're forwarding through an ATM PVC or an MPLS LSP, they will load-balance in the same way, assuming the routers have the same configuration. Perhaps you've done something unusual with your ATM VCs, but ...


10

It seems that the 6500 generates MPLS labels for every route if BGP is run in VRF. The fact that your IPv4 and MPLS TCAM usage is almost identical seems to indicate this as well. Can you try this command: show bgp vpnv4 uni all labels There seems to be a hidden command that makes IOS allocate labels per VRF instead of per prefix. mpls label mode all-vrfs ...


9

The difference between aggregate labels and normal labels is such that normal labels directly point to L2 rewrite details (an interface and L2 address). This means a normal label will be label switched by the egress PE node directly out, without doing an IP lookup. Adversely, aggregate labels can potentially represent many different egress options, so L2 ...


9

I'm assuming you are talking about MPLS VPN. The MPLS VPN is more secure than a regular Internet connection, it's basically like a virtual leased line. However it runs no encryption. So it is free from eavesdropping unless someone misconfigures the VPN but if you carry sensitive traffic it should still be encrypted. This kind of VPN is not authenticated so ...


9

Yes both LSR[12] could advertise given FEC, say 10.0.0.1/32 with label 10 to each other. Then if IGP says to LSR1 10.0.0.1/32 egress interface is towards LSR2, it'll impose (or swap to) label 10 and send towards LSR2. LSR2 then will find egress interface being something else than towards LSR1 and swap label to what ever that direction has advertised, might ...


9

FEC or 'Forwarding equivalence class' identifies identity for packet which will determine path it will take in the network. For pure IPv4 forwarding, with routing-table 10.0.0.0/24 -> 192.0.2.1 you can think that addresses 10.0.0.0 - 10.0.0.255 share that FEC, as they are treated same way, each of them are going to go to 192.0.2.1. In MPLS typically FEC is ...


9

First, I would recommend checking out Cisco's MPLS FAQ For Beginners, or the NANOG Presentation "MPLS for Dummies" by Richard A Steenbergen. They both have some really good information. With that said, let me address your questions one at a time. (I have excerpted them in part below.) 1: After the initial convergence of the network, LSPs now exist ...


9

The two Windstream Routers each have an MPLS port: 192.168.1.2 = Host MPLS 192.168.2.2 = Remote MPLS The Windstream routers also each have an open internet port to which I have attached a Firewall Router for filtering the internet, making the internet gateways: 192.168.1.1 = Host Gateway 192.168.2.1 = Remote Gateway Problem ...


9

The problem is the: [edit protocols rsvp] load-balance bandwidth If you look at the Juniper documentation for Unequal Cost Load Balancing RSVP LSPs, it states: For uneven load balancing using bandwidth to work, you must have at least two equal-cost LSPs toward the same egress router and at least one of the LSPs must have a bandwidth value configured at ...


8

You could ask TW to give you SNMP read-ony access to the box if possible


8

I had this issue. You did not indicate of you have a data center or not. Making the assumption that inter remote site traffic is manageable, in your data centers you allow prefixes to be advertied between the two SP clouds using your data centers as trasits. It is true that remote site to remote side will take the hop through your data centers but there is ...


8

Short answer, just use Resource ReSerVation Protocol (RSVP). Long answer, you could use multi-topology-routing and have multiple metrics in each interface and force some packets to different topology than another packets. But I would not really venture there. You might want to talk to your account team that you want segment routing implemented: http://...


8

MPLS features rerouting, can it not just create the routes by itself? You've enabled LDP; however, as an MPLS label distribution protocol LDP, only maps IGP routes to MPLS labels; in your case the IGP is EIGRP... Quoting RFC 3031 - MPLS Architecture, page 8 (emphasis mine): MPLS node a node which is running MPLS. An MPLS ...


8

Why does MPLS need an IGP (like OSPF) in order to work? In an MPLS network, OSPF is not used to route customer traffic. It is only used to provide routing for the internal provider network so that labels can be generated. LDP is used to advertise these labels to neighboring label-switched routers. So, why to use also MPLS if we already had OSPF? You'...


8

It depends what you are advertising into LDP. If your ping is to a destination address that is advertised by LDP and there is an end-to-end LSP for that destination, then the ping will be encapsulated and MPLS switched, even if the destination is in the global table. This is how the outer (tunnel) LSP works in MPLS VPN By default Cisco networks advertise ...


7

This looks like a simple layer two domain. MPLS is typically used only as backbone or distribution transit, that is, among routers. To implement MPLS, you would need to push the VLAN interfaces down to the access switches (and thus split Host5 into a new network or move it to switch 2) and run MPLS among the multilayer switches. Although, this wouldn't bring ...


7

If you really want to terminate MPLS in vSwitches (I wouldn't do it for numerous reasons, some of them here http://blog.ioshints.info/2012/03/mplsvpn-in-data-center-maybe-not-in.html and here http://blog.ioshints.info/2012/07/could-mpls-over-ip-replace-vxlan-or.html), look @ Juniper's Contrail acquisition, they actually do that with BGP between controller ...


7

Oh the 6500. I run a small service provider network and run the 6500 as a PE router. Worst decision of my life. (That was an embellished statement, but you get my point.) I run full BGP routes in a VRF and have experienced a lot of problem surrounding this. You're example is not very surprising. As Daniel said in his post there is an LFIB entry for each ...


7

This is a very common situation, which I've seen many times over the years. Regardless of whether you're turning down and replacing legacy Point-to-Point T1 circuits, integrating networks in an acquisition/merger, or just changing providers as in this question, the solution will almost always involve utilizing your existing network equipment/routing ...


7

The short answer is "no". Without visibility into the status of the T1s, you have no way of knowing if one is down (in alarm) vs. just not passing traffic (unbundled). TW will have to give you access to the system (telnet, snmp, etc.), or setup a means of notifying you of status changes (syslog, snmp trap, etc.)


7

EDIT: Just checked the literature - doesn't look like static LSP's are supported on MLX/XMR/CES/CER IronWare at least as of 5.2.0. :-/ My Brocade account rep also confirmed that LSP's signaled with RSVP or LDP are the only options and they have no plans to add support back in for static LSP's. Aside from the above, what you can do with RSVP is define a ...


7

Short answer: MPLS is not a Layer 3 Routing protocol, however, it requires one to establish it's paths. -- Per RFC 3031 Multiprotocol Label Switching Architecture: An MPLS node will be aware of MPLS control protocols, will operate one or more L3 routing protocols, and will be capable of forwarding packets based on labels. What this means is that an ...


7

So it seems the way to go is to use a logical tunnel interface on MX. Just put one end of the lt Interface in the VPLS instance and the other end in the L2VPN instance: lt-1/2/0 { mtu 1514; unit 0 { encapsulation ethernet-ccc; peer-unit 1; family ccc; } unit 1 { encapsulation ...


6

You need a router. The HP 2520G is a Layer 2 managed switch, and has no Layer 3 capabilities. This is highlighted in the features tab on hp.com and in the 2520G feature support matrix If you're not able to get funding for a router, maybe you could power up a Vyatta VM at the ProCurve site?


Only top voted, non community-wiki answers of a minimum length are eligible