MPLS Topics

MPLS Concepts

* Introducing Basic MPLS Concepts
* Introducing MPLS Labels and Label Stacks
* Identifying MPLS Applications


Label Assignment and Distribution

* Discovering LDP Neighbors
* Introducing Typical Label Distribution in Frame-Mode MPLS
* Introducing Convergence in Frame-Mode MPLS
* Introducing MPLS Label Allocation, Distribution, and Retention Modes


Frame-Mode MPLS Implementation on Cisco IOS Platforms

* Introducing CEF Switching
* Configuring Frame-Mode MPLS on Cisco IOS Platforms
* Monitoring Frame-Mode MPLS on Cisco IOS Platforms
* Troubleshooting Frame-Mode MPLS on Cisco IOS Platforms


MPLS VPN Technology

* Introducing VPNs
* Categorizing VPNs
* Introducing MPLS VPN Architecture
* Introducing the MPLS VPN Routing Model
* Forwarding MPLS VPN Packets


MPLS VPN Implementation

* Using MPLS VPN Mechanisms on Cisco IOS Platforms
* Configuring VRF Tables
* Configuring an MP-BGP Session Between PE Routers
* Configuring Small-Scale Routing Protocols Between PE and CE Routers
* Monitoring MPLS VPN Operations
* Configuring OSPF as the Routing Protocol Between PE and CE routers
* Configuring BGP as the Routing Protocol Between PE and CE routers
* Troubleshooting MPLS VPNs


Complex MPLS VPNs

* Using Advanced VRF Import and Export Features
* Introducing Overlapping VPNs
* Introducing Central Services VPNs
* Introducing the Managed CE Routers Service


Internet Access and MPLS VPNs

* Introducing VPN Internet Access Topologies
* Implementing Separate Internet Access and VPN Services
* Implementing Internet Access as a Separate VPN


MPLS TE Overview

* Introducing the TE Concept
* Understanding MPLS TE Components
* Configuring MPLS TE on Cisco IOS Platforms
* Monitoring Basic MPLS TE on Cisco IOS Platforms

Virtual private LAN service

Virtual private LAN service (VPLS) is a way to provide Ethernet based multipoint to multipoint communication over IP/MPLS networks. It allows geographically dispersed sites to share an Ethernet broadcast domain by connecting sites through pseudo-wires. The technologies that can be used as pseudo-wire can be Ethernet over MPLS, L2TPv3 or even GRE. There are two IETF standards track RFCs (RFC 4761 and RFC 4762) describing VPLS establishment.VPLS is a virtual private network (VPN) technology. In contrast to L2TPv3, which allows only point-to-point layer 2 tunnels, VPLS allows any-to-any (multipoint) connectivity. In a VPLS, the local area network (LAN) at each site is extended to the edge of the provider network. The provider network then emulates a switch or bridge to connect all of the customer LANs to create a single bridged LAN. Since VPLS emulates a LAN, full mesh connectivity is required. There are two methods for full mesh establishment for VPLS: using BGP and using Label Distribution Protocol (LDP). The "control plane" is the means by which provider edge (PE) routers communicate for auto-discovery and signaling. Auto-discovery refers to the process of finding other PE routers participating in the same VPN or VPLS. Signaling is the process of establishing pseudo-wires (PW). The PWs constitute the "data plane", whereby PEs send customer VPN/VPLS traffic to other PEs.

With BGP, one has auto-discovery as well as signaling. The mechanisms used are very similar to those used in establishing Layer-3 MPLS VPNs. Each PE is configured to participate in a given VPLS. The PE, through the use of BGP, simultaneously discovers all other PEs in the same VPLS, and establishes a full mesh of pseudo-wires to those PEs. With LDP, each PE router must be configured to participate in a given VPLS, and, in addition, be given the addresses of other PEs participating in the same VPLS. A full mesh of LDP sessions is then established between these PEs. LDP is then used to create an equivalent mesh of PWs between those PEs. An advantage to using PWs as the underlying technology for the data plane is that in case of failure, traffic will automatically be routed along available backup paths in the service provider's network. Failover will be much faster than could be achieved with e.g. Spanning Tree Protocol (STP). VPLS is thus a more reliable solution for linking together Ethernet networks in different locations than simply connecting a WAN link to Ethernet switches in both locations.

VPLS has significant advantages for both service providers and customers. Service providers benefit because they can generate additional revenues by offering a new Ethernet service with flexible bandwidth and sophisticated service level agreements (SLAs). VPLS is also simpler and more cost effective to operate than a traditional service. Customers benefit because they can connect all of their sites to an Ethernet VPN that provides a secure, high speed and homogenous network. Moreover, VPLS provides a logical next step in the continuing evolution of Ethernet from a 10 Mbps shared LAN protocol to a multi-Gbps global service. VPLS MPLS packets have a two-label stack. The outer label is used for normal MPLS forwarding in the service provider's network. If BGP is used to establish the VPLS, the inner label is allocated by a PE as part of a label block. If LDP is used, the inner label is a virtual circuit ID assigned by LDP when it first established a mesh between the participating PEs. Every PE keeps track of assigned inner label, and associates these with the VPLS instance.

PEs participating in a VPLS-based VPN must appear as an Ethernet bridge to connected customer edge (CE) devices. Received Ethernet frames must be treated in such a way as to ensure CEs can be simple Ethernet devices.When a PE receives a frame from a CE, it inspects the frame and learns the CE's MAC address, storing it locally along with LSP routing information. It then checks the frame's destination MAC address. If it is a broadcast frame, or the MAC address is not known to the PE, it floods the frame to all PEs in the mesh. Ethernet does not have a time to live (TTL) field in its frame header, so loop avoidance must be arranged by other means. In regular Ethernet deployments, Spanning Tree Protocol is used for this. In VPLS, loop avoidance is arranged by the following rule: A PE never forwards a frame received from a PE, to another PE. The use of a full mesh combined with split horizon forwarding guarantees a loop-free broadcast domain.VPLS is typically used to link a large number of sites together. Scalability is therefore an important issue that needs addressing.

Virtual Routing and Forwarding (VRF)

In IP-based computer networks, Virtual Routing and Forwarding (VRF) is a technology that allows multiple instances of a routing table to co-exist within the same router at the same time. Because the routing instances are independent, the same or overlapping IP addresses can be used without conflicting with each other. Alternative meaning of VRF is a VPN Routing and Forwarding, the key element in the Cisco MPLS VPN technology.A VRF is a routing table instance, that can exist in one instance or multiple instances per each VPN on a Provider Edge (PE) router.VRF may be implemented in a network device by distinct routing tables known as forwarding information bases (FIBs), one per VRF. Alternatively, a network device may have the ability to configure different virtual routers, where each one has its own FIB that is not accessible to any other virtual router instance on the same device.

The simplest form of VRF implementation is VRF Lite. In this implementation, each router within the network participates in the virtual routing environment in a peer-based fashion. While simple to deploy and appropriate for small to medium enterprises and shared data centres, VRF Lite does not scale to the size required by global enterprises or large carriers, as there is the need to implement each VRF instance on every router. The scaling limitations of VRF Lite are resolved by the implementation of IPVPNs. In this implementation, a core backbone network is responsible for the transmission of data across the wide area between VRF instances at each edge location. IPVPNs have been traditionally deployed by carriers to provide a shared wide-area backbone network for multiple customers. They are also appropriate in large enterprise, multi-tenant and shared data centre environments.

In a typical deployment, Customer Edge (CE) routers handle local routing in a traditional fashion and disseminate routing information into Provider Edge (PE) where the routing tables are virtualised. The PE router then encapsulates the traffic, marks it to identify the VRF instance, and transmits it across the provider backbone network to the destination PE router. The destination PE router then un-encapsulates the traffic and forwards it to the CE router at the destination. The backbone network is completely transparent to the customer equipment, allowing multiple customers or user communities to utilize the common backbone network while maintaining end-to-end traffic separation.Routes across the provider backbone network are maintained using an Interior Gateway Protocol - typically iBGP. iBGP uses extended community attributes in a common routing table to differentiate the customers' routes with overlapping IP addresses. IPVPN is most commonly deployed across a Multi-protocol Label Switching (MPLS) backbone as the inherent labelling of packets in MPLS lends itself to the identification of the customer VRF. Some IPVPN implementations (notably Nortel's IP-VPN Lite) utilize a simpler IP-in-IP encapsulation over a pure IP backbone, eliminating the need to maintain and support an MPLS environment.

Generic Routing Encapsulation

GRE or Generic Routing Encapsulation - it is a tunneling protocol that was originally developed by Cisco for encapsulation of arbitrary kinds of network layer packets inside arbitrary kinds of network layer packets. This is brief tutorial on creating a GRE tunnel between two Cisco routes. Suppose that we have two sites; SiteA and SiteB. SiteA's router has interface Eth0 with the following IP address 10.0.1.1/24 and secondary IP address 1.0.1.1/24. Where the users (LAN) are connected to 10.0.1.0/24 subnet. The router has serial interface connected to the Internet (ISP). Same for SiteB, it has Eth0 with IP address 10.0.2.1/24 and secondary IP 1.0.2.1/24 where the users (LAN) are connected to 10.0.1.0/24 subnet. The router has serial interface connected to the Internet (ISP). Now we want to create a GRE tunnel in order for 10.0.1.0/24 and 10.0.2.0/24 subnets to communicate with each other.

Ingress router

An ingress router is a Label Switch Router that is a starting point (source) for a given Label Switched Path. An ingress router may be an egress router or an intermediate router for any other LSP(s). Hence the role of ingress and egress routers is LSP specific. Usually, the MPLS label is attached with an IP packet at the ingress router and removed at the egress router, whereas label swapping is performed on the intermediate routers. However, in special cases (such as LSP Hierarchy in RFC 4206, LSP Stitching [1] and MPLS local protection) the ingress router could be pushing label in label stack of an already existing MPLS packet (instead of an IP packet). Note that, although the ingress router is the starting point of an LSP, it may or may not be the source of the under-lying IP packets.

Label switch router

A Label Switch Router (LSR) (sometimes called transit router), is a type of a router located in the middle of a Multiprotocol Label Switching (MPLS) network. It is responsible for switching the labels used to route packets. When an LSR receives a packet, it uses the label included in the packet header as an index to determine the next hop on the Label Switched Path (LSP) and a corresponding label for the packet from a look-up table. The old label is then removed from the header and replaced with the new label before the packet is routed forward.

Label Switched Path

In MPLS networking, a Label Switched Path (LSP) is a path through an MPLS network, set up by a signaling protocol such as LDP, RSVP-TE, BGP or CR-LDP.The path begins at a Label Edge Router (LER), which makes a decision on which label to prefix to a packet based on the appropriate FEC. It then forwards the packet along to the next router in the path, which swaps the packet's outer label for another label, and forwards it to the next router. The last router in the path removes the label from the packet and forwards the packet based on the header of its next layer, for example IPv4. Due to the forwarding of packets through an LSP being opaque to higher network layers, an LSP is also sometimes referred to as an MPLS tunnel.

The router which first prefixes the MPLS header to a packet is called an ingress router. The last router in an LSP, which pops the label from the packet, is called an egress router. Routers in between, which need only swap labels, are called transit routers or Label Switching Router (LSR)s.Note that LSPs are unidirectional; they enable a packet to be label switched through the MPLS network from one endpoint to another. Since bidirectional communication is typically desired, the aforementioned dynamic signaling protocols can set up an LSP in the other direction to compensate for this. When protection is considered, LSPs could be categorized as primary(working), secondary(backup) and tertiary (LSP of last resort). As described above, LSPs are normally P2P (Point to Point). A new concept of LSPs, which are known as P2MP (Point to Multi Point), was introduced recently. These are mainly used for multicasting purposes.

Multiprotocol Label Switching

Multiprotocol Label Switching (MPLS) is a mechanism in high-performance telecommunications networks which directs and carries data from one network node to the next. MPLS makes it easy to create "virtual links" between distant nodes. It can encapsulate packets of various network protocols. MPLS is a highly scalable, protocol agnostic, data-carrying mechanism. In an MPLS network, data packets are assigned labels. Packet-forwarding decisions are made solely on the contents of this label, without the need to examine the packet itself. This allows one to create end-to-end circuits across any type of transport medium, using any protocol.

The primary benefit is to eliminate dependence on a particular Data Link Layer technology, such as ATM, frame relay, SONET or Ethernet, and eliminate the need for multiple Layer 2 networks to satisfy different types of traffic. MPLS belongs to the family of packet-switched networks. MPLS operates at an OSI Model layer that is generally considered to lie between traditional definitions of Layer 2 (Data Link Layer) and Layer 3 (Network Layer), and thus is often referred to as a "Layer 2.5" protocol.

It was designed to provide a unified data-carrying service for both circuit-based clients and packet-switching clients which provide a datagram service model. It can be used to carry many different kinds of traffic, inc While the traffic management benefits of migrating to MPLS are quite valuable (better reliability, increased performance), there is a significant loss of visibility and access into the MPLS cloud for IT departments. Including IP packets, as well as native ATM, SONET, and Ethernet frames.

MPLS based Ethernet MAN

An MPLS based Metro Ethernet network uses MPLS in the Service Provider Network. The subscriber will get an Ethernet interface on Copper (ex:-100BASE-TX) or fiber (ex:-100BASE-FX). The customer's Ethernet packet is transported over MPLS and the service provider network uses Ethernet again as the underlying technology to transport MPLS. So, it is Ethernet over MPLS over Ethernet. Here, Label Distribution Protocol (LDP) signaling is used as site to site signaling for the inner label (VC label) and Resource reSerVation Protocol-Traffic Engineering (RSVP-TE) or LDP may be used as Network signaling for the outer label. One of the restoration mechanisms used in an MPLS based Metro Ethernet Networks is Fast Re Route-FRR (MPLS local protection) The main advantages of an MPLS-based Metro Ethernet against a pure Ethernet are:

Scalability: pure Ethernet MAN are limited to a maximum of 4,096 VLANs for the whole network, when using MPLS, Ethernet VLANs have local meaning only (like Frame Relay PVC). Same scalability considerations applies to the MAC addresses where in a pure Ethernet MAN all MAC addresses are being shared among the network while only having local meaning in the MPLS context.

Resiliency: pure Ethernet network resiliency relies on STP, RSTP or MSTP (30 to 1 sec convergence) while MPLS-based MANs use MPLS-based mechanism (i.e. MPLS Fast Reroute) to achieve SDH-like (50 msecs) convergence times.

Multiprotocol convergence: with the maturity on pseudowires standards (ATM Virtual Leased Line VLL, FR VLL, etc.) an MPLS-based Metro Ethernet can backhaul not only IP/Ethernet traffic but virtually any type of traffic coming from customer networks or other access networks (i.e. ATM aggregation for UMTS or TDM aggregation for GSM).

End to End OAM: MPLS-based MAN offers a wider set of troubleshooting and OAM MPLS-based tools which enrich Service Providers ability to effectively troubleshoot and diagnose network problems. These include for example, MAC ping, MAC traceroute, LSP ping etc.

Layer 3 MPLS VPN

A layer 3 MPLS VPN, also known as L3VPN, combines enhanced BGP signaling, MPLS traffic isolation and router support for VRFs (Virtual Routing/Forwarding) to create an IP based VPN. Compared to other types of VPN such as IPSec VPN or ATM, MPLS L3VPN is more cost efficient and can provide more services. Layer 3 MPLS VPNs are characterized by fully meshed architectures that enable, for instance, multicast conferencing in support of projects involving a dispersed work group.

Some businesses like the Layer 3 options that are available now because the service provider takes over all the WAN routing. Outsourcing of routing tables is also seen as a weakness of Layer 3 VPN services because many corporations don't want to relinquish control or even share their routing schemes with anyone, not even their service provider. They prefer Layer 2 network services that are simpler in architecture and that allow customers to retain control of their own routing tables

Layer 2 MPLS VPN

A Layer 2 MPLS VPN is a method that Internet service providers use to segregate their network for their customers, to allow them to transmit data over an IP network. This is often sold as a service to businesses. Layer 2 VPNs are a type of Virtual Private Network (VPN) that uses MPLS labels to transport data. The communication occurs between routers that are known as Provider Edge routers (PEs), as they sit on the edge of the provider's network, next to the customer's network.

BGP-based

The BGP-based type is based on a draft specification by Kireeti Kompella, from Juniper Networks. It uses the Border Gateway Protocol (BGP) as the mechanism for PE routers to communicate with each other about their customer connections. Each router connects to a central cloud, using BGP. This means that when new customers are added (usually to new routers), the existing routers will communicate with each other, via BGP, and automatically add the new customers to the service.

LDP-based

The second type is based on a draft specification by Vach Kompella (Alcatel-Lucent). This method is also known as a Layer 2 circuit. It uses the Label Distribution Protocol (LDP) to communicate between PE routers. In this case, every router will connect to every other router in the VPN, which differs from the BGP-based methodology.

Juniper Networks : LDP / BGP based (M/T/J/E-series)

Cisco Systems : LDP-based