Rob Riker/ Simplified Networking: IPv6

Showing posts with label IPv6. Show all posts

Saturday, January 14, 2017

CCIE SPv4 - MPLS L3 VPN - IS-IS PE-CE Routing

Software versions:
IOS XE 15.5
IOS XR 5.3

The topology for this demo:

In this post we will hit the last dynamic protocol, IS-IS, which has the least support as well. VRF Aware IS-IS isn't supported in IOS XR, so we'll be demoing this setup on just a few routers. Overall, very simple to get working. Like RIPv2, just the configs and a quick verification are all that is needed.

router isis 115

vrf IS-IS

net 49.0000.0000.0000.0001.00

is-type level-2-only

metric-style wide

redistribute bgp 50693

address-family ipv6

multi-topology

redistribute bgp 50693

exit-address-family

interface GigabitEthernet1.1115

encapsulation dot1Q 1115

vrf forwarding IS-IS

ip address 131.0.0.1 255.255.255.0

ip router isis 115

ipv6 address 2131:CC1E::1/64

ipv6 router isis 115

router bgp 50693

address-family ipv4 vrf IS-IS

redistribute isis 115 level-2

exit-address-family

address-family ipv6 vrf IS-IS

redistribute isis 115 level-2

exit-address-family

R13

router isis 115

vrf IS-IS

net 49.0000.0000.0000.0013.00

is-type level-2-only

metric-style wide

address-family ipv6

multi-topology

exit-address-family

interface GigabitEthernet1.1115

encapsulation dot1Q 1115

vrf forwarding IS-IS

ip address 131.0.0.13 255.255.255.0

ip router isis 115

ipv6 address 2131:CC1E::13/64

ipv6 router isis 115

So now that we have the configuration in place, we can take a look at the verification. We'll start R13, then R1 and go from there.

R13#sh ip route vrf IS-IS isis | b Gateway

Gateway of last resort is not set

172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks

i L2 172.16.110.0/24

[115/10] via 131.0.0.1, 00:21:34, GigabitEthernet1.1115

i L2 172.16.114.0/24

[115/10] via 131.0.0.1, 00:21:34, GigabitEthernet1.1115

i L2 172.16.119.0/24

[115/10] via 131.0.0.1, 00:21:34, GigabitEthernet1.1115

R13#sh ipv6 route vrf IS-IS isis | b App

ld - LISP dyn-eid, a - Application

I2 FC00::8/128 [115/10]

via FE80::20C:29FF:FE11:973F, GigabitEthernet1.1115

I2 FC00:110::8/128 [115/10]

via FE80::20C:29FF:FE11:973F, GigabitEthernet1.1115

I2 FC00:114::8/128 [115/10]

via FE80::20C:29FF:FE11:973F, GigabitEthernet1.1115

I2 FC00:119::8/128 [115/10]

via FE80::20C:29FF:FE11:973F, GigabitEthernet1.1115

As you can see, I have routes from both AFIs in the applicable RIBs. Let's do some verification on the PE side.

R1#sh bgp vpnv4 unicast vrf IS-IS 172.16.110.0/24

BGP routing table entry for 115:50693:172.16.110.0/24, version 698

Paths: (2 available, best #2, table IS-IS)

Not advertised to any peer

Refresh Epoch 1

Local

192.168.1.6 (metric 5) (via default) from 192.168.1.14 (192.168.1.14)

Origin incomplete, metric 20, localpref 100, valid, internal

Extended Community: RT:115:50693

Originator: 192.168.1.6, Cluster list: 192.168.1.14

mpls labels in/out nolabel/47

rx pathid: 0, tx pathid: 0

Refresh Epoch 2

Local

192.168.1.6 (metric 5) (via default) from 192.168.1.2 (192.168.1.2)

Origin incomplete, metric 20, localpref 100, valid, internal, best

Extended Community: RT:115:50693

Originator: 192.168.1.6, Cluster list: 192.168.1.2

mpls labels in/out nolabel/47

rx pathid: 0, tx pathid: 0x0

R1#sh bgp vpnv6 unicast vrf IS-IS FC00::8/128

BGP routing table entry for [115:50693]FC00::8/128, version 1755

Paths: (2 available, best #1, table IS-IS)

Not advertised to any peer

Refresh Epoch 1

Local

::FFFF:192.168.1.3 (metric 4) (via default) from 192.168.1.2 (192.168.1.2)

Origin incomplete, metric 20, localpref 100, valid, internal, best

Extended Community: RT:115:50693

Originator: 192.168.1.3, Cluster list: 192.168.1.2

mpls labels in/out nolabel/35

rx pathid: 0, tx pathid: 0x0

Refresh Epoch 1

Local

::FFFF:192.168.1.3 (metric 4) (via default) from 192.168.1.14 (192.168.1.14)

Origin incomplete, metric 20, localpref 100, valid, internal

Extended Community: RT:115:50693

Originator: 192.168.1.3, Cluster list: 192.168.1.14

mpls labels in/out nolabel/35

rx pathid: 0, tx pathid: 0

As you can see, the metric (20) is copied from IS-IS.

Let's verify connectivity.

R8#traceroute vrf IS-IS 172.16.115.13 source 172.16.114.8

Type escape sequence to abort.

Tracing the route to 172.16.115.13

VRF info: (vrf in name/id, vrf out name/id)

1 83.0.0.3 3 msec 1 msec 1 msec

2 10.14.3.14 [MPLS: Labels 24007/32 Exp 0] 8 msec 6 msec 5 msec

3 10.11.14.11 [MPLS: Labels 24000/32 Exp 0] 33 msec 32 msec 76 msec

4 131.0.0.1 [MPLS: Label 32 Exp 0] 8 msec 8 msec 6 msec

5 131.0.0.13 7 msec * 11 msec

R8#traceroute vrf IS-IS ipv6

Target IPv6 address: FC00:115::13

Source address: FC00:114::8

Insert source routing header? [no]:

Numeric display? [no]:

Timeout in seconds [3]:

Probe count [3]:

Minimum Time to Live [1]:

Maximum Time to Live [30]:

Priority [0]:

Port Number [0]:

Type escape sequence to abort.

Tracing the route to FC00:115::13

1 2038:CC1E::3 3 msec 1 msec 0 msec

2 ::FFFF:10.3.4.4 [MPLS: Labels 25/42 Exp 0] 49 msec 5 msec 19 msec

3 2016:15:4::15 [MPLS: Labels 24031/42 Exp 0] 36 msec 35 msec 34 msec

4 2131:CC1E::1 [MPLS: Label 42 Exp 0] 17 msec 15 msec 25 msec

5 2131:CC1E::13 23 msec 14 msec 15 msec

As you can see we have reachability.

Thanks for stopping by!

Rob Riker, CCIE #50693

CCIE SPv4 - MPLS L3 VPN - RIPv2

Software versions:
IOS XE 15.5
IOS XR 5.3

The topology for this demo:

In this post we'll take a look at RIPv2 as the PE-CE routing protocol. There isn't a whole lot to cover here, both IPv4 and IPv6 are supported in IOS, only IPv4 is supported on XR.

ipv6 rip vrf-mode enable

interface GigabitEthernet1.1120

encapsulation dot1Q 1120

vrf forwarding RIPv2

ip address 131.0.0.1 255.255.255.0

ipv6 address 2131:CC1E::1/64

ipv6 rip CCIE enable

router rip

address-family ipv4 vrf RIPv2

redistribute bgp 50693 metric transparent

network 131.0.0.0

no auto-summary

version 2

exit-address-family

redistribute rip metric 5

redistribute rip CCIE metric 5

ipv6 router rip CCIE

address-family ipv6 vrf RIPv2

redistribute bgp 50693 metric 5

exit-address-family

router bgp 50693

address-family ipv4 vrf RIPv2

redistribute rip metric 5

exit-address-family

address-family ipv6 vrf RIPv2

redistribute rip CCIE metric 5

exit-address-family

R13

ipv6 rip vrf-mode enable

interface GigabitEthernet1.1120

encapsulation dot1Q 1120

vrf forwarding RIPv2

ip address 131.0.0.13 255.255.255.0

ipv6 address 2131:CC1E::13/64

ipv6 rip CCIE enable

router rip

address-family ipv4 vrf RIPv2

network 131.0.0.0

network 172.16.0.0

no auto-summary

version 2

exit-address-family

ipv6 router rip CCIE

address-family ipv6 vrf RIPv2

exit-address-family

XR3

router rip

vrf RIPv2

interface GigabitEthernet0/0/0/0.1120

redistribute bgp 50693

R14

ipv6 rip vrf-mode enable

interface GigabitEthernet1.1120

encapsulation dot1Q 1312

vrf forwarding RIPv2

ip address 113.0.0.14 255.255.255.0

ipv6 address 2113:CC1E::14/64

ipv6 rip CCIE enable

router rip

address-family ipv4 vrf RIPv2

network 113.0.0.0

no auto-summary

version 2

exit-address-family

ipv6 router rip CCIE

address-family ipv6 vrf RIPv2

exit-address-family

To verify the configuration.

R1#sh bgp vpnv4 unicast vrf RIPv2 113.0.0.0/24

BGP routing table entry for 120:50693:113.0.0.0/24, version 228

Paths: (2 available, best #2, table RIPv2)

Not advertised to any peer

Refresh Epoch 1

Local

192.168.1.13 (metric 3) (via default) from 192.168.1.14 (192.168.1.14)

Origin incomplete, metric 5, localpref 100, valid, internal

Extended Community: RT:120:50693

Originator: 192.168.1.13, Cluster list: 192.168.1.14

mpls labels in/out nolabel/24014

rx pathid: 0, tx pathid: 0

Refresh Epoch 2

Local

192.168.1.13 (metric 3) (via default) from 192.168.1.2 (192.168.1.2)

Origin incomplete, metric 5, localpref 100, valid, internal, best

Extended Community: RT:120:50693

Originator: 192.168.1.13, Cluster list: 192.168.1.2

mpls labels in/out nolabel/24014

rx pathid: 0, tx pathid: 0x0

A couple of things to note, the metric is 5, which is what was configured on the PE devices.

R13#sh ip route vrf RIPv2 113.0.0.0

Routing Table: RIPv2

Routing entry for 113.0.0.0/24, 1 known subnets

Redistributing via rip

R 113.0.0.0 [120/6] via 131.0.0.1, 00:00:20, GigabitEthernet1.1120

You can see that R13 has learned the 113.0.0.0/24 with a metric of 6, which is the metric advertises by the PE on the remote end and what R1 advertised to reach R13.

R13#traceroute vrf RIPv2 113.0.0.14

Type escape sequence to abort.

Tracing the route to 113.0.0.14

VRF info: (vrf in name/id, vrf out name/id)

1 131.0.0.1 5 msec 2 msec 0 msec

2 10.1.12.12 [MPLS: Labels 24009/24014 Exp 0] 12 msec 13 msec 9 msec

3 10.12.13.13 6 msec 16 msec 10 msec

4 113.0.0.14 13 msec * 8 msec

As you can see, we have reachability.

Thanks for stopping by!

Rob Riker, CCIE #50693

Wednesday, January 11, 2017

CCIE SPv4 - MPLS L3 VPN - OSPFv2 and OSPFv3 PE-CE Routing

Software versions:
IOS XE 15.5
IOS XR 5.3

The topology for this demo:

In this post we will implement OSPFv2 and OSPFv3 as the PE to CE routing protocol. There are several caveats when rolling out OSPF in this type of deployment, not advisable in a production environment. OSPF has some unique challenges when deployed the way we will be rolling it out. We will leveraging the "Multi VRF CE" design where our connection to the provider is in a VRF. We'll focus on setting up the PEs and the CEs first.

router ospf 110 vrf OSPF

redistribute bgp 50693 subnets

network 131.0.0.0 0.0.0.255 area 0

router ospfv3 110

address-family ipv6 unicast vrf OSPF

redistribute bgp 50693

interface GigabitEthernet1.1110

encapsulation dot1Q 1110

vrf forwarding OSPF

ip address 131.0.0.1 255.255.255.0

ipv6 address 2131:CC1E::1/64

ospfv3 110 ipv6 area 0

router bgp 50693

address-family ipv4 vrf OSPF

redistribute ospf 110

exit-address-family

address-family ipv6 vrf OSPF

redistribute ospf 110 include-connected

exit-address-family

R13

router ospfv3 110

address-family ipv6 unicast vrf OSPF

exit-address-family

router ospf 110 vrf OSPF

network 131.0.0.0 0.0.0.255 area 0

interface GigabitEthernet1.1110

encapsulation dot1Q 1110

vrf forwarding OSPF

ip address 131.0.0.13 255.255.255.0

ipv6 address 2131:CC1E::13/64

ospfv3 110 ipv6 area 0

XR3

router ospf 110

vrf OSPF

redistribute bgp 50693

area 0

interface GigabitEthernet0/0/0/0.1110

router ospfv3 110

redistribute bgp 50693

area 0

vrf OSPF

redistribute bgp 50693

area 0

interface GigabitEthernet0/0/0/0.1110

router bgp 50693

vrf OSPF

rd 110:50693

address-family ipv4 unicast

redistribute ospf 110

address-family ipv6 unicast

redistribute ospfv3 110

R14

router ospfv3 110

address-family ipv6 unicast

exit-address-family

address-family ipv6 unicast vrf OSPF

exit-address-family

router ospf 110 vrf OSPF

network 113.0.0.0 0.0.0.255 area 0

interface GigabitEthernet1.1110

encapsulation dot1Q 1311

vrf forwarding OSPF

ip address 113.0.0.14 255.255.255.0

ipv6 address 2113:CC1E::14/64

ospfv3 110 ipv6 area 0

Now that we have our configuration in place, we need to verify the configuration.

R13#sh ip ospf 110 neighbor

Neighbor ID Pri State Dead Time Address Interface

131.0.0.1 1 FULL/DR 00:00:34 131.0.0.1 GigabitEthernet1.1110

R13#sh ospfv3 vrf OSPF neighbor

OSPFv3 110 address-family ipv6 vrf OSPF (router-id 110.110.110.13)

Neighbor ID Pri State Dead Time Interface ID Interface

131.0.0.1 1 FULL/DR 00:00:39 20 GigabitEthernet1.1110

As you can see our peerings to the PE are up and operational. Let's take a look at the VRF aware RIB to see what we have reachability to.

R13#sh ip route vrf OSPF | b Gateway

Gateway of last resort is not set

110.0.0.0/8 is variably subnetted, 2 subnets, 2 masks

C 110.110.110.0/24 is directly connected, Loopback110

L 110.110.110.13/32 is directly connected, Loopback110

131.0.0.0/16 is variably subnetted, 2 subnets, 2 masks

C 131.0.0.0/24 is directly connected, GigabitEthernet1.1110

L 131.0.0.13/32 is directly connected, GigabitEthernet1.1110

We haven't learned any routes, there is a reason why this is happening. I've added an interface into the global RIB on R13 to show a scenario where the CE interface is not in a VRF.

interface GigabitEthernet1.10

encapsulation dot1Q 11

ip address 11.0.0.13 255.255.255.0

ipv6 address 2001:11::13/64

ospfv3 110 ipv6 area 0

router ospf 1

network 11.0.0.0 0.0.0.255 area 0

R13#sh ip route ospf | b Gateway

Gateway of last resort is not set

83.0.0.0/24 is subnetted, 1 subnets

O IA 83.0.0.0 [110/2] via 11.0.0.1, 00:02:56, GigabitEthernet1.10

110.0.0.0/32 is subnetted, 3 subnets

O IA 110.110.110.8 [110/3] via 11.0.0.1, 00:02:56, GigabitEthernet1.10

O 110.110.110.13 [110/3] via 11.0.0.1, 00:02:56, GigabitEthernet1.10

O E2 110.110.110.14 [110/2] via 11.0.0.1, 00:02:56, GigabitEthernet1.10

113.0.0.0/24 is subnetted, 1 subnets

O E2 113.0.0.0 [110/1] via 11.0.0.1, 00:02:56, GigabitEthernet1.10

As you can see we've learned routes from our other CE routers and have installed them in the RIB.

Now to identify the issue with the CE VRF configuration.

R13#sh ip ospf database summary adv-router 131.0.0.1

OSPF Router with ID (131.0.0.13) (Process ID 110)

Summary Net Link States (Area 0)

LS age: 749

Options: (No TOS-capability, DC, Downward)

LS Type: Summary Links(Network)

Link State ID: 83.0.0.0 (summary Network Number)

Advertising Router: 131.0.0.1

LS Seq Number: 80000091

Checksum: 0xA49

Length: 28

Network Mask: /24

MTID: 0 Metric: 1

LS age: 749

Options: (No TOS-capability, DC, Downward)

LS Type: Summary Links(Network)

Link State ID: 110.110.110.8 (summary Network Number)

Advertising Router: 131.0.0.1

LS Seq Number: 8000008D

Checksum: 0x7FD6

Length: 28

Network Mask: /32

MTID: 0 Metric: 2

The key piece that needs to be zeroed in on here is the "downward" bit that is set from R1 (131.0.0.1) who is the advertising router and is the PE. The PE device will set the downward bit in an effort to prevent the route from being propagated inside the customer network and then readvertised back to the provider. The only drawback with this is the route is in the LSDB but because the DN bit is set, SPF can't be ran on the LSA and won't be installed in the RIB. There is a simple fix for this and is applicable for OSPFv2 and OSPFv3, configured on the CE. Capability vrf-lite is used to disable the "DN" bit check and let's SPF run on those LSAs and installs the routes in the RIB. This bit is set on Type 3, 5 and 7 LSAs when BGP routes are redistributed into OSPF.

R13#debug ip opsf spf

R13#debug ip ospf rib local

R13#debug ip ospf rib global

R14#sh ip ospf 110 | in VPN

Connected to MPLS VPN Superbackbone, VRF OSPF

This means that R14 is connected to the MPLS backbone via OSPF, where the MPLS backbone is acting has a superior Area 0, the CEs take on an ABR style role where they are the connection into the MPLS backbone. You will see on R13 for the non VRF OSPF connection that there is no connection like that. According to the Cisco Docs, the MPLS Super backbone is only applicable in Multi VRF CE.

R13#sh ip ospf 1 | in VPN

#no output.

These debugs will let you see the SPF run get kicked off and the RIB get the best routes installed. I'll now configure "capability vrf-lite" on R13 for both OSPFv2 and OSPFv3.

router ospfv3 110

address-family ipv6 unicast vrf OSPF

capability vrf-lite

exit-address-family

router ospf 110 vrf OSPF

capability vrf-lite

R13#sh ip ospf database summary adv-router 131.0.0.1

OSPF Router with ID (131.0.0.13) (Process ID 110)

Summary Net Link States (Area 0)

LS age: 1437

Options: (No TOS-capability, DC, Downward)

LS Type: Summary Links(Network)

Link State ID: 83.0.0.0 (summary Network Number)

Advertising Router: 131.0.0.1

LS Seq Number: 80000091

Checksum: 0xA49

Length: 28

Network Mask: /24

MTID: 0 Metric: 1

LS age: 1437

Options: (No TOS-capability, DC, Downward)

LS Type: Summary Links(Network)

Link State ID: 110.110.110.8 (summary Network Number)

Advertising Router: 131.0.0.1

LS Seq Number: 8000008D

Checksum: 0x7FD6

Length: 28

Network Mask: /32

MTID: 0 Metric: 2

As you can see the downward bit is showing up, it doesn't actually "go away", the check for it is simply disabled. Allowing SPF to be run and those routes to get installed in the RIB.

R13# sh ip route vrf OSPF ospf | b Gateway

Gateway of last resort is not set

11.0.0.0/24 is subnetted, 1 subnets

O 11.0.0.0 [110/2] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110

83.0.0.0/24 is subnetted, 1 subnets

O IA 83.0.0.0 [110/2] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110

110.0.0.0/8 is variably subnetted, 4 subnets, 2 masks

O IA 110.110.110.8/32

[110/3] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110

O E2 110.110.110.14/32

[110/2] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110

113.0.0.0/24 is subnetted, 1 subnets

O E2 113.0.0.0 [110/1] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110

Now we have routes installed in the RIB. I'll now go ahead and do some ping/traces from R13. You'll notice that some of the OSPF routes are O IA and some are O E2. Our configuration on all the PEs requires us to redistribute OSPF and BGP bidirectionally. The PEs that are IOS XE, R3, R6 R1. The CEs attached will see anything advertised to them from the PEs as Inter Area or O IA. IOS XR advertises routes as O E2.

Let's go ahead and verify the reachability.

R13#ping vrf OSPF 110.110.110.14

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 110.110.110.14, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 5/5/7 ms

R8#traceroute vrf OSPF 110.110.110.14 source 110.110.110.8 num

Type escape sequence to abort.

Tracing the route to 110.110.110.14

VRF info: (vrf in name/id, vrf out name/id)

1 83.0.0.3 3 msec 1 msec 1 msec

2 10.3.4.4 [MPLS: Labels 20/24012 Exp 0] 12 msec 5 msec 8 msec

3 10.4.5.5 [MPLS: Labels 20/24012 Exp 0] 14 msec 20 msec 29 msec

4 10.5.6.6 [MPLS: Labels 20/24012 Exp 0] 24 msec 13 msec 19 msec

5 10.2.6.2 [MPLS: Labels 17/24012 Exp 0] 21 msec 31 msec 32 msec

6 10.13.2.13 [MPLS: Label 24012 Exp 0] 23 msec 9 msec 8 msec

7 113.0.0.14 7 msec * 8 msec

As you can see, both ping and traces are functioning.

Thanks for stopping by!

Rob Riker, CCIE #50693

Monday, January 9, 2017

CCIE SPv4 - MPLS L3 VPN - BGP Site of Origin

Software versions:
IOS XE 15.5
IOS XR 5.3

The topology for this demo:

In this post we will take a look at BGP Site of Origin. The idea behind the solution is a backdoor link to another site isn't the preferred path to the destination. Typically there is a highspeed link that is directly connecting the two sites and it is preferred over the L3 VPN circuit. Because eBGP peerings automatically get an AD of 20, from a routing perspective, the eBGP route will win unless a more specific route, static route is used or SoO is used to stop the advertisement of routes.

From our previous post we have both IPv4 and IPv6 routes using the MPLS connection, our customer decided to provision a L2 P2P circuit and use that for other reasons. They have complained to us about the issue and want us to fix the issue. We could tell the customer to use a static route, which is the most common solution but they have hundreds of routes and opted to have us fix the issue.

R7#sh bgp vpnv4 unicast vrf BGP

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 20:50693 (default for vrf BGP)

*> 10.10.10.0/24 37.0.0.3 0 50693 10 ?

*> 13.13.13.0/24 37.0.0.3 0 50693 134 ?

* 37.0.0.0/24 37.0.0.3 0 50693 127 i

*> 0.0.0.0 0 32768 i

*> 59.0.0.0/24 37.0.0.3 0 50693 9 i

*> 83.0.0.0/24 37.0.0.3 0 50693 8 i

*> 106.0.0.0/24 37.0.0.3 0 50693 10 i

*> 112.0.0.0/24 37.0.0.3 0 50693 127 i

*> 113.0.0.0/24 37.0.0.3 0 50693 143 i

*> 131.0.0.0/24 37.0.0.3 0 50693 134 i

* 192.168.7.0 37.0.0.3 0 50693 127 i

*> 0.0.0.0 0 32768 i

*> 192.168.12.0 37.0.0.3 0 50693 127 i

As you can see, all the routes have the same next hop, R3 which is 37.0.0.3.

R7#sh bgp vpnv4 unicast vrf BGP summary | b Neighbor

Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd

12.7.0.12 4 127 37 36 18 0 0 00:20:39 9

This is the new point to point circuit that the customer has. Routes have been learned on it but because this is configured as an iBGP peer, the AD of 200 makes it less preferred.

Now it's time for us to configure Site Of Origin and make use of the backdoor link. This is configured on the PE side under the VRF configuration.

router bgp 50693

address-family ipv4 vrf BGP

neighbor 37.0.0.7 remote-as 127

neighbor 37.0.0.7 activate

neighbor 37.0.0.7 soo 127:50693

XR1

router bgp 50693

neighbor 112.0.0.12

remote-as 127

address-family ipv4 unicast

route-policy PASS in

route-policy PASS out

as-override

site-of-origin 127:50693

You can see underneath bolded the SoO community value.

RP/0/0/CPU0:XR1#sh bgp vpnv4 unicast vrf BGP 37.0.0.0/24

Mon Jan 9 23:45:16.336 UTC

BGP routing table entry for 37.0.0.0/24, Route Distinguisher: 20:50693

Versions:

Process bRIB/RIB SendTblVer

Speaker 254 254

Local Label: 24013

Last Modified: Jan 9 23:15:14.688 for 00:30:01

Paths: (3 available, best #1)

Advertised to update-groups (with more than one peer):

0.2

Path #1: Received by speaker 0

Advertised to update-groups (with more than one peer):

0.2

127

112.0.0.12 from 112.0.0.12 (192.168.1.12)

Origin IGP, localpref 100, valid, external, best, group-best, import-candidate

Received Path ID 0, Local Path ID 1, version 254

Extended community: SoO:127:50693 RT:20:50693

Path #2: Received by speaker 0

Not advertised to any peer

127

192.168.1.3 (metric 3) from 192.168.1.2 (192.168.1.3)

Received Label 22

Origin IGP, metric 0, localpref 100, valid, internal, import-candidate, imported

Received Path ID 0, Local Path ID 0, version 0

Extended community: RT:20:50693

Originator: 192.168.1.3, Cluster list: 192.168.1.2

Source VRF: BGP, Source Route Distinguisher: 20:50693

Path #3: Received by speaker 0

Not advertised to any peer

127

192.168.1.3 (metric 3) from 192.168.1.14 (192.168.1.3)

Received Label 22

Origin IGP, metric 0, localpref 100, valid, internal, import-candidate, imported

Received Path ID 0, Local Path ID 0, version 0

Extended community: RT:20:50693

Originator: 192.168.1.3, Cluster list: 192.168.1.14

Source VRF: BGP, Source Route Distinguisher: 20:50693

R7 debug output:

BGP(4): (base) 37.0.0.3 send UPDATE (format) 112.0.0.0/24, next 37.0.0.7, metric 0, path Local, extended community RT:20:50693

BGP(0): 37.0.0.3 rcv UPDATE about 112.0.0.0/24 -- withdrawn

BGP: 37.0.0.3 Modifying prefix 112.0.0.0/24 from 0 -> 4 address

BGP(0): 37.0.0.3 rcv UPDATE about 192.168.12.0/24 -- withdrawn

BGP: 37.0.0.3 Modifying prefix 192.168.12.0/24 from 0 -> 4 address

BGP(0): 37.0.0.3 rcv UPDATE about 37.0.0.0/24 -- withdrawn

BGP: 37.0.0.3 Modifying prefix 37.0.0.0/24 from 0 -> 4 address

BGP(0): 37.0.0.3 rcv UPDATE about 192.168.7.0/24 -- withdrawn

BGP: 37.0.0.3 Modifying prefix 192.168.7.0/24 from 0 -> 4 address

The withdrawn message indicates that those routes from R3 are no longer being used. Instead R7 will update the BGP table and then the VRF BGP RIB to use the backdoor link

R7#sh bgp vpnv4 unicast vrf BGP

Network Next Hop Metric LocPrf Weight Path

Route Distinguisher: 20:50693 (default for vrf BGP)

* i 10.10.10.0/24 12.7.0.12 0 100 0 50693 10 ?

*> 37.0.0.3 0 50693 10 ?

* i 13.13.13.0/24 12.7.0.12 0 100 0 50693 134 ?

*> 37.0.0.3 0 50693 134 ?

*> 37.0.0.0/24 0.0.0.0 0 32768 i

* i 59.0.0.0/24 12.7.0.12 0 100 0 50693 9 i

*> 37.0.0.3 0 50693 9 i

* i 83.0.0.0/24 12.7.0.12 0 100 0 50693 8 i

*> 37.0.0.3 0 50693 8 i

* i 106.0.0.0/24 12.7.0.12 0 100 0 50693 10 i

*> 37.0.0.3 0 50693 10 i

*>i 112.0.0.0/24 12.7.0.12 0 100 0 i

* i 113.0.0.0/24 12.7.0.12 0 100 0 50693 143 i

Network Next Hop Metric LocPrf Weight Path

*> 37.0.0.3 0 50693 143 i

* i 131.0.0.0/24 12.7.0.12 0 100 0 50693 134 i

*> 37.0.0.3 0 50693 134 i

*> 192.168.7.0 0.0.0.0 0 32768 i

*>i 192.168.12.0 12.7.0.12 0 100 0 i

As you can see, the 112.0.0.0/24 and the 192.168.12.0/24 are both using the backdoor link.

R7#sh ip route vrf BGP | in 12.7.0.12

B 112.0.0.0 [200/0] via 12.7.0.12, 00:07:20

B 192.168.12.0/24 [200/0] via 12.7.0.12, 00:07:20

The AD on both routes is 200 indicating an iBGP peered route. Due to the SoO configuration, R7 will send any traffic destined to either destination over the backdoor link.

R7#trace vrf BGP 192.168.12.12

Type escape sequence to abort.

Tracing the route to 192.168.12.12

VRF info: (vrf in name/id, vrf out name/id)

1 12.7.0.12 2 msec 1 msec *

Thanks for stopping by!

Rob Riker, CCIE #50693