Showing posts with label OSPFv3. Show all posts
Showing posts with label OSPFv3. Show all posts

Friday, January 13, 2017

CCIE SPv4 - MPLS L3 VPN - OSPF PE-CE Routing with Domain IDs

Software versions:
IOS XE 15.5
IOS XR 5.3

The topology for this demo:
In this post we will examine the "domain id". The domain ID is essentially an identifier that is used to determine whether 2 CE sites area in the same area. Since the MPLS core acts like another area 0 hierarchy above the area 0 we have already defined on the CE side, the domain id is used to differentiate between sites in the same domain and in different domains. If the domain ids match, then those 2 sites are in the same domain, hence, O IA routes; if the domain ids do not match, then those 2 sites are not in the same domain, hence, O E2 routes. Domain ids can be configured on the PEs under the VRF process. There are a few variants however we're only going to look at the 0005 option. 

R13s RIB
R13#sh ip route vrf OSPF | b Gateway

Gateway of last resort is not set

      10.0.0.0/32 is subnetted, 1 subnets
O E2     10.101.10.10 [110/2] via 131.0.0.1, 00:05:18, GigabitEthernet1.1110
      11.0.0.0/24 is subnetted, 1 subnets
O        11.0.0.0 [110/2] via 131.0.0.1, 2d21h, GigabitEthernet1.1110
      16.0.0.0/32 is subnetted, 1 subnets
O E2     16.0.0.6 [110/1] via 131.0.0.1, 2d00h, GigabitEthernet1.1110
      38.0.0.0/32 is subnetted, 2 subnets
O E2     38.0.0.3 [110/1] via 131.0.0.1, 1d01h, GigabitEthernet1.1110
O E2     38.0.0.13 [110/1] via 131.0.0.1, 1d01h, GigabitEthernet1.1110
      83.0.0.0/24 is subnetted, 1 subnets
O E2     83.0.0.0 [110/1] via 131.0.0.1, 00:05:18, GigabitEthernet1.1110
      106.0.0.0/24 is subnetted, 1 subnets
O E2     106.0.0.0 [110/1] via 131.0.0.1, 00:05:18, GigabitEthernet1.1110
      110.0.0.0/32 is subnetted, 3 subnets
O E2     110.110.110.8 [110/2] via 131.0.0.1, 00:05:18, GigabitEthernet1.1110
C        110.110.110.13 is directly connected, Loopback110
O IA     110.110.110.14 [110/3] via 131.0.0.1, 00:04:48, GigabitEthernet1.1110
      131.0.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        131.0.0.0/24 is directly connected, GigabitEthernet1.1110
L        131.0.0.13/32 is directly connected, GigabitEthernet1.1110

As you can see, all of the routes learned except 11.0.0.0/24 and 110.110.110.14. Our goal, is to make all the routes above appear as O IA after we have completed this process. The configuration is very simple, changing the domain id to some value that all PEs have configured will accomplish this. 

XE PEs
router ospf 110 vrf OSPF
 domain-id type 0005 value 000000F40200

XR PEs
router ospf 110
 vrf OSPF
  domain-id type 0005 value 000000f40200

I chose the value of "f40200" as it stands for the IPv4 family, the 200 is just a random value. The same exact configuration is used under the IPv6 variants

I was testing out placement of the "capability vrf lite" command, this is supposed to go on a CE device. I applied it on the PE, honestly by accident during a copy/paste, the CE ended up getting all the routes as O E2, which makes sense. The PE was receiving them, but since we we're redistributing BGP into OSPF, the CE should have seen a bunch of  O IA routes. That wasn't the case, after a few minutes of investigation, I realized the issue. I fixed it, by place "capability vrf lite" on the CE. 

R10#sh ip route vrf OSPF ospf 110
Gateway of last resort is not set

      11.0.0.0/24 is subnetted, 1 subnets
O E2     11.0.0.0 [110/1] via 106.0.0.6, 00:08:59, GigabitEthernet1.1110
      38.0.0.0/32 is subnetted, 2 subnets
O E2     38.0.0.3 [110/1] via 106.0.0.6, 00:08:59, GigabitEthernet1.1110
O E2     38.0.0.13 [110/1] via 106.0.0.6, 00:08:59, GigabitEthernet1.1110
      59.0.0.0/24 is subnetted, 1 subnets
O E2     59.0.0.0 [110/1] via 106.0.0.6, 00:08:59, GigabitEthernet1.1110
      83.0.0.0/24 is subnetted, 1 subnets
O E2     83.0.0.0 [110/1] via 106.0.0.6, 00:08:59, GigabitEthernet1.1110
      110.0.0.0/32 is subnetted, 3 subnets
O E2     110.110.110.8 [110/1] via 106.0.0.6, 00:08:59, GigabitEthernet1.1110
O E2     110.110.110.13 [110/1] via 106.0.0.6, 00:08:59, GigabitEthernet1.1110
O E2     110.110.110.14 [110/1] via 106.0.0.6, 00:08:59, GigabitEthernet1.1110
      131.0.0.0/24 is subnetted, 1 subnets
O E2     131.0.0.0 [110/1] via 106.0.0.6, 00:08:59, GigabitEthernet1.1110

After the "vrf-lite" configuration migration from the PE to the CE.

R10#sh ip route vrf OSPF ospf | b Gateway
Gateway of last resort is not set

      11.0.0.0/24 is subnetted, 1 subnets
O IA     11.0.0.0 [110/2] via 106.0.0.6, 00:04:15, GigabitEthernet1.1110
      38.0.0.0/32 is subnetted, 2 subnets
O E2     38.0.0.3 [110/1] via 106.0.0.6, 00:04:15, GigabitEthernet1.1110
O E2     38.0.0.13 [110/1] via 106.0.0.6, 00:04:15, GigabitEthernet1.1110
      59.0.0.0/24 is subnetted, 1 subnets
O IA     59.0.0.0 [110/2] via 106.0.0.6, 00:04:15, GigabitEthernet1.1110
      83.0.0.0/24 is subnetted, 1 subnets
O IA     83.0.0.0 [110/2] via 106.0.0.6, 00:04:15, GigabitEthernet1.1110
      110.0.0.0/32 is subnetted, 3 subnets
O IA     110.110.110.8 [110/3] via 106.0.0.6, 00:04:15, GigabitEthernet1.1110
O IA     110.110.110.13 [110/3] via 106.0.0.6, 00:04:15, GigabitEthernet1.1110
O IA     110.110.110.14 [110/3] via 106.0.0.6, 00:04:15, GigabitEthernet1.1110
      131.0.0.0/24 is subnetted, 1 subnets
O IA     131.0.0.0 [110/2] via 106.0.0.6, 00:04:15, GigabitEthernet1.1110

Now all the routes that should be showing up as Inter Area are doing so.

Let's take a look at the PE side and breakdown the BGP outputs for these routes. Its important to know what your looking at to ensure the proper propagation is happening.

R6#sh bgp vpnv4 unicast vrf OSPF 131.0.0.0/24
BGP routing table entry for 110:50693:131.0.0.0/24, version 373
Paths: (2 available, best #1, table OSPF)
  Not advertised to any peer
  Refresh Epoch 2
  Local
    192.168.1.1 (metric 2) (via default) from 192.168.1.2 (192.168.1.2)
      Origin incomplete, metric 0, localpref 100, valid, internal, best
      Extended Community: RT:110:50693 OSPF DOMAIN ID:0x0005:0x000000F40200
        OSPF RT:0.0.0.0:2:0 OSPF ROUTER ID:131.0.0.1:0
      Originator: 192.168.1.1, Cluster list: 192.168.1.2
      mpls labels in/out nolabel/42
      rx pathid: 0, tx pathid: 0x0
  Refresh Epoch 1
  Local
    192.168.1.1 (metric 2) (via default) from 192.168.1.14 (192.168.1.14)
      Origin incomplete, metric 0, localpref 100, valid, internal
      Extended Community: RT:110:50693 OSPF DOMAIN ID:0x0005:0x000000F40200
        OSPF RT:0.0.0.0:2:0 OSPF ROUTER ID:131.0.0.1:0
      Originator: 192.168.1.1, Cluster list: 192.168.1.14
      mpls labels in/out nolabel/42
      rx pathid: 0, tx pathid: 0

The extended community portion is where I want to focus on. The RT is the route target value, configured as 110:50693 that is uniquely configured for OSPF traffic over the core.The OSPF Domain ID is the focus of this post, like I stated above, used to code the routes propagated by BGP after being learned from OSPF, an attribute used to ID LSAs that belong to the same domain. The OSPF RT is the Route Type. The 0.0.0.0 is the area ID, the 2 is the LSA type, where this one shows as a DR. The 0 is the options field. 

The IOS and IOS XR variations are literally the same, configured the same, the outputs are summarized a bit more in XR, not enough to warrant an output. 

Thanks for stopping by!
Rob Riker, CCIE #50693

Thursday, January 12, 2017

CCIE SPv4 - MPLS L3 VPN - OSPF PE-CE Routing - Sham Links

Software versions:
IOS XE 15.5
IOS XR 5.3

The topology for this demo:
In this post we'll be taking a look at sham links for OSPF as a PE-CE routing protocol. RFC 4577 defines this scenario as bridging OSPF area 0 over the MPLS backbone. With the MPLS Super Backbone, the CEs act as an ABR, injecting Type 3 LSAs into the area 0 that connects to the rest of the LAN. 

We';; configure XR3 and R8 to form a "Sham Link" peering with each other over the MPLS backbone. The shamlink is a service provider "virtual link" that allows communication over the MPLS backbone enabling OSPF to run over the MPLS core. Effectively, all the CE sites that connect will look like they are part of the same area 0 domain. 

R14
R14#sh ip route vrf OSPF ospf | b Gateway
Gateway of last resort is not set

      10.0.0.0/32 is subnetted, 1 subnets
O E2     10.101.10.10 [110/2] via 113.0.0.13, 00:15:37, GigabitEthernet1.1110
      11.0.0.0/24 is subnetted, 1 subnets
O E2     11.0.0.0 [110/1] via 113.0.0.13, 1d00h, GigabitEthernet1.1110
      16.0.0.0/32 is subnetted, 1 subnets
O E2     16.0.0.6 [110/1] via 113.0.0.13, 23:18:23, GigabitEthernet1.1110
      83.0.0.0/24 is subnetted, 1 subnets
O E2     83.0.0.0 [110/1] via 113.0.0.13, 1d00h, GigabitEthernet1.1110
      106.0.0.0/24 is subnetted, 1 subnets
O E2     106.0.0.0 [110/1] via 113.0.0.13, 00:15:37, GigabitEthernet1.1110
      110.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
O E2     110.110.110.8/32 [110/2] via 113.0.0.13, 1d00h, GigabitEthernet1.1110
O E2     110.110.110.13/32
           [110/2] via 113.0.0.13, 1d00h, GigabitEthernet1.1110
      131.0.0.0/24 is subnetted, 1 subnets
O E2     131.0.0.0 [110/1] via 113.0.0.13, 1d00h, GigabitEthernet1.1110


R14#sh ipv6 route vrf OSPF ospf | b App
       ld - LISP dyn-eid, a - Application
OI  2001:11::/64 [110/2]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OI  2038:CC1E::/64 [110/2]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OI  2106:CC1E::/64 [110/2]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OI  2131:CC1E::/64 [110/2]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OE2 FC00:16::6/128 [110/1]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110

This is the current state of R14's OSPFv2 and OSPFv3 RIB. 

Let's go ahead and configure the sham link. There are a few things that we need to have in place in order to get this scenario to work.

R3
interface Loopback38
 vrf forwarding OSPF
 ip address 38.0.0.3 255.255.255.255
 ipv6 address FC00:38::3/128
!
!
router bgp 50693
address-family ipv4 vrf OSPF
  network 38.0.0.3 mask 255.255.255.255
  redistribute ospf 110
 exit-address-family
 !
 address-family ipv6 vrf OSPF
  redistribute ospf 110 include-connected
  network FC00:38::3/128
 exit-address-family
!
!
router ospfv3 110
 !
 exit-address-family
 !
 address-family ipv6 unicast vrf OSPF
   area 0 sham-link FC00:38::3 FC00:38::13
!
router ospf 110 vrf OSPF
 area 0 sham-link 38.0.0.3 38.0.0.13


XR3
interface Loopback38
 vrf OSPF
 ipv4 address 38.0.0.13 255.255.255.255
 ipv6 address fc00:38::13/128
!
!
rotuer bgp 50693
vrf OSPF
  rd 110:50693
  address-family ipv4 unicast
   network 38.0.0.13/32
  !
  address-family ipv6 unicast
   network fc00:38::13/128
!
router ospfv3 110
 vrf OSPF
  redistribute bgp 50693
  area 0
   sham-link fc00:38::13 fc00:38::3
!
router ospf 110
 vrf OSPF
  area 0
   sham-link 38.0.0.13 38.0.0.3


Let's take a look at the verification.

RP/0/0/CPU0:XR3#sh ospf vrf OSPF sham-links
Thu Jan 12 21:14:49.269 UTC

Sham Links for OSPF 110, VRF OSPF

Sham Link OSPF_SL0 to address 38.0.0.3 is up
Area 0, source address 38.0.0.13
IfIndex = 2
  Run as demand circuit
  DoNotAge LSA allowed., Cost of using 1
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:03:684
    Adjacency State FULL (Hello suppressed)
    Number of DBD retrans during last exchange 0
    Index 2/2, retransmission queue length 0, number of retransmission 0
    First 0(0)/0(0) Next 0(0)/0(0)
    Last retransmission scan length is 0, maximum is 0
    Last retransmission scan time is 0 msec, maximum is 0 msec


RP/0/0/CPU0:XR3#sh ospfv3 vrf OSPF sham-links
Thu Jan 12 21:15:09.468 UTC

Sham Links for OSPFv3 110, VRF OSPF

Sham Link OSPF_SL0 to address fc00:38::3 is up
Area 0, source address fc00:38::13
IfIndex = 2
  Run as demand circuit
  DoNotAge LSA allowed., Cost of using 1
  Transmit Delay is 1 sec, State POINT_TO_POINT,
  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5
    Hello due in 00:00:01
    Adjacency State FULL (Hello suppressed)
    Number of DBD retrans during last exchange 0
    Index 2/2, retransmission queue length 0, number of retransmission 1
    First 0(0)/0(0) Next 0(0)/0(0)
    Last retransmission scan length is 1, maximum is 1
    Last retransmission scan time is 0 msec, maximum is 0 msec

As you can see for both IPv4 and IPv6, the DNA bit is set as the SL runs as a demand circuit, hellos are configured to be sent every 10 seconds but since this is a P2P DC type circuit, hellos are suppressed and only used during the initial SL establishment. Demand Circuit means and the DNA or do not age bit are set which means that "paranoid" update will not happen. Like a Virtual link, a SL can have additional configuration, like authentication, if configured, the VL and SL should both be flapped to make sure the configuration took correctly.

On the CE side, R14 now has some "O" or Intra Area routes showing up.

R14#sh ipv6 route vrf OSPF ospf | b App
       ld - LISP dyn-eid, a - Application
OI  2001:11::/64 [110/2]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
O   2038:CC1E::/64 [110/3]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OI  2106:CC1E::/64 [110/2]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OI  2131:CC1E::/64 [110/2]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OE2 FC00:16::6/128 [110/1]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OE2 FC00:16::16/128 [110/1]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OE2 FC00:38::3/128 [110/1]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110
OE2 FC00:38::13/128 [110/1]
     via FE80::20C:29FF:FE29:9C4A, GigabitEthernet1.1110


R14#sh ip route vrf OSPF ospf | b Gateway
Gateway of last resort is not set

      10.0.0.0/32 is subnetted, 1 subnets
O IA     10.101.10.10 [110/4] via 113.0.0.13, 00:40:32, GigabitEthernet1.1110
      11.0.0.0/24 is subnetted, 1 subnets
O IA     11.0.0.0 [110/3] via 113.0.0.13, 00:40:32, GigabitEthernet1.1110
      16.0.0.0/32 is subnetted, 2 subnets
O E2     16.0.0.6 [110/1] via 113.0.0.13, 1d00h, GigabitEthernet1.1110
O E2     16.0.0.16 [110/1] via 113.0.0.13, 00:40:32, GigabitEthernet1.1110
      38.0.0.0/32 is subnetted, 2 subnets
O E2     38.0.0.3 [110/1] via 113.0.0.13, 00:41:26, GigabitEthernet1.1110
O E2     38.0.0.13 [110/1] via 113.0.0.13, 00:40:32, GigabitEthernet1.1110
      83.0.0.0/24 is subnetted, 1 subnets
O        83.0.0.0 [110/3] via 113.0.0.13, 00:40:32, GigabitEthernet1.1110
      106.0.0.0/24 is subnetted, 1 subnets
O IA     106.0.0.0 [110/3] via 113.0.0.13, 00:40:32, GigabitEthernet1.1110
      110.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
O        110.110.110.8/32
           [110/4] via 113.0.0.13, 00:40:32, GigabitEthernet1.1110
O IA     110.110.110.13/32
           [110/4] via 113.0.0.13, 00:40:32, GigabitEthernet1.1110
      131.0.0.0/24 is subnetted, 1 subnets
O IA     131.0.0.0 [110/3] via 113.0.0.13, 00:40:32, GigabitEthernet1.1110

The routes learned from R8 show up as "O" routes now. Let's go ahead and go and do a ping/trace test.

R14#ping vrf OSPF 110.110.110.8 source lo110
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 110.110.110.8, timeout is 2 seconds:
Packet sent with a source address of 110.110.110.14
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/12 ms


R14#trace vrf OSPF 110.110.110.8 source lo110
Type escape sequence to abort.
Tracing the route to 110.110.110.8
VRF info: (vrf in name/id, vrf out name/id)
  1 113.0.0.13 3 msec 2 msec 1 msec
  2 10.13.2.2 [MPLS: Labels 20/56 Exp 0] 5 msec 6 msec 4 msec
  3 83.0.0.3 [MPLS: Label 56 Exp 0] 5 msec 7 msec 4 msec
  4 83.0.0.8 5 msec *  5 msec

This proves that we can reach the endpoint on the remote end.

Thanks for stopping by!
Rob Riker, CCIE #50693

Wednesday, January 11, 2017

CCIE SPv4 - MPLS L3 VPN - OSPFv2 and OSPFv3 PE-CE Routing

Software versions:
IOS XE 15.5
IOS XR 5.3

The topology for this demo:
In this post we will implement OSPFv2 and OSPFv3 as the PE to CE routing protocol. There are several caveats when rolling out OSPF in this type of deployment, not advisable in a production environment. OSPF has some unique challenges when deployed the way we will be rolling it out. We will leveraging the "Multi VRF CE" design where our connection to the provider is in a VRF. We'll focus on setting up the PEs and the CEs first.


R1
router ospf 110 vrf OSPF
 redistribute bgp 50693 subnets
 network 131.0.0.0 0.0.0.255 area 0
!
router ospfv3 110
 !
 address-family ipv6 unicast vrf OSPF
  redistribute bgp 50693
!
interface GigabitEthernet1.1110
 encapsulation dot1Q 1110
 vrf forwarding OSPF
 ip address 131.0.0.1 255.255.255.0
 ipv6 address 2131:CC1E::1/64
 ospfv3 110 ipv6 area 0
!
router bgp 50693
address-family ipv4 vrf OSPF
  redistribute ospf 110
 exit-address-family
 !
 address-family ipv6 vrf OSPF
  redistribute ospf 110 include-connected
 exit-address-family

R13
router ospfv3 110
 !
 address-family ipv6 unicast vrf OSPF
  exit-address-family
router ospf 110 vrf OSPF
 network 131.0.0.0 0.0.0.255 area 0
!
interface GigabitEthernet1.1110
 encapsulation dot1Q 1110
 vrf forwarding OSPF
 ip address 131.0.0.13 255.255.255.0
 ipv6 address 2131:CC1E::13/64
 ospfv3 110 ipv6 area 0


XR3
router ospf 110
 vrf OSPF
  redistribute bgp 50693
  area 0
   interface GigabitEthernet0/0/0/0.1110
!
router ospfv3 110
 redistribute bgp 50693
 area 0
 !
 vrf OSPF
  redistribute bgp 50693
  area 0
   interface GigabitEthernet0/0/0/0.1110
!
router bgp 50693
vrf OSPF
  rd 110:50693
  address-family ipv4 unicast
   redistribute ospf 110
  !
  address-family ipv6 unicast
   redistribute ospfv3 110


R14
router ospfv3 110
 !
 address-family ipv6 unicast
 exit-address-family
 !
 address-family ipv6 unicast vrf OSPF
 exit-address-family
router ospf 110 vrf OSPF
 network 113.0.0.0 0.0.0.255 area 0
!
interface GigabitEthernet1.1110
 encapsulation dot1Q 1311
 vrf forwarding OSPF
 ip address 113.0.0.14 255.255.255.0
 ipv6 address 2113:CC1E::14/64
 ospfv3 110 ipv6 area 0


Now that we have our configuration in place, we need to verify the configuration.

R13#sh ip ospf 110 neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
131.0.0.1         1   FULL/DR         00:00:34    131.0.0.1       GigabitEthernet1.1110

R13#sh ospfv3 vrf OSPF neighbor

          OSPFv3 110 address-family ipv6 vrf OSPF (router-id 110.110.110.13)

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
131.0.0.1         1   FULL/DR         00:00:39    20              GigabitEthernet1.1110

As you can see our peerings to the PE are up and operational. Let's take a look at the VRF aware RIB to see what we have reachability to.

R13#sh ip route vrf OSPF | b Gateway
Gateway of last resort is not set

      110.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C        110.110.110.0/24 is directly connected, Loopback110
L        110.110.110.13/32 is directly connected, Loopback110
      131.0.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        131.0.0.0/24 is directly connected, GigabitEthernet1.1110
L        131.0.0.13/32 is directly connected, GigabitEthernet1.1110


We haven't learned any routes, there is a reason why this is happening. I've added an interface into the global RIB on R13 to show a scenario where the CE interface is not in a VRF. 

interface GigabitEthernet1.10
 encapsulation dot1Q 11
 ip address 11.0.0.13 255.255.255.0
 ipv6 address 2001:11::13/64
 ospfv3 110 ipv6 area 0
!
router ospf 1
 network 11.0.0.0 0.0.0.255 area 0

R13#sh ip route ospf | b Gateway
Gateway of last resort is not set

      83.0.0.0/24 is subnetted, 1 subnets
O IA     83.0.0.0 [110/2] via 11.0.0.1, 00:02:56, GigabitEthernet1.10
      110.0.0.0/32 is subnetted, 3 subnets
O IA     110.110.110.8 [110/3] via 11.0.0.1, 00:02:56, GigabitEthernet1.10
O        110.110.110.13 [110/3] via 11.0.0.1, 00:02:56, GigabitEthernet1.10
O E2     110.110.110.14 [110/2] via 11.0.0.1, 00:02:56, GigabitEthernet1.10
      113.0.0.0/24 is subnetted, 1 subnets
O E2     113.0.0.0 [110/1] via 11.0.0.1, 00:02:56, GigabitEthernet1.10

As you can see we've learned routes from our other CE routers and have installed them in the RIB. 

Now to identify the issue with the CE VRF configuration.

R13#sh ip ospf database summary adv-router 131.0.0.1
OSPF Router with ID (131.0.0.13) (Process ID 110)

                Summary Net Link States (Area 0)

  LS age: 749
  Options: (No TOS-capability, DC, Downward)
  LS Type: Summary Links(Network)
  Link State ID: 83.0.0.0 (summary Network Number)
  Advertising Router: 131.0.0.1
  LS Seq Number: 80000091
  Checksum: 0xA49
  Length: 28
  Network Mask: /24
        MTID: 0         Metric: 1

  LS age: 749
  Options: (No TOS-capability, DC, Downward)
  LS Type: Summary Links(Network)
  Link State ID: 110.110.110.8 (summary Network Number)
  Advertising Router: 131.0.0.1
  LS Seq Number: 8000008D
  Checksum: 0x7FD6
  Length: 28
  Network Mask: /32
        MTID: 0         Metric: 2

The key piece that needs to be zeroed in on here is the "downward" bit that is set from R1 (131.0.0.1) who is the advertising router and is the PE. The PE device will set the downward bit in an effort to prevent the route from being propagated inside the customer network and then readvertised back to the provider. The only drawback with this is the route is in the LSDB but because the DN bit is set, SPF can't be ran on the LSA and won't be installed in the RIB. There is a simple fix for this and is applicable for OSPFv2 and OSPFv3, configured on the CE. Capability vrf-lite is used to disable the "DN" bit check and let's SPF run on those LSAs and installs the routes in the RIB. This bit is set on Type 3, 5 and 7 LSAs when BGP routes are redistributed into OSPF.

R13#debug ip opsf spf
R13#debug ip ospf rib local
R13#debug ip ospf rib global

R14#sh ip ospf 110 | in VPN
 Connected to MPLS VPN Superbackbone, VRF OSPF

This means that R14 is connected to the MPLS backbone via OSPF, where the MPLS backbone is acting has a superior Area 0, the CEs take on an ABR style role where they are the connection into the MPLS backbone. You will see on R13 for the non VRF OSPF connection that there is no connection like that. According to the Cisco Docs, the MPLS Super backbone is only applicable in Multi VRF CE. 

R13#sh ip ospf 1 | in VPN
#no output. 

These debugs will let you see the SPF run get kicked off and the RIB get the best routes installed. I'll now configure "capability vrf-lite" on R13 for both OSPFv2 and OSPFv3.

router ospfv3 110
 address-family ipv6 unicast vrf OSPF
  capability vrf-lite
 exit-address-family
router ospf 110 vrf OSPF
 capability vrf-lite

R13#sh ip ospf database summary adv-router 131.0.0.1
OSPF Router with ID (131.0.0.13) (Process ID 110)

                Summary Net Link States (Area 0)

  LS age: 1437
  Options: (No TOS-capability, DC, Downward)
  LS Type: Summary Links(Network)
  Link State ID: 83.0.0.0 (summary Network Number)
  Advertising Router: 131.0.0.1
  LS Seq Number: 80000091
  Checksum: 0xA49
  Length: 28
  Network Mask: /24
        MTID: 0         Metric: 1

  LS age: 1437
  Options: (No TOS-capability, DC, Downward)
  LS Type: Summary Links(Network)
  Link State ID: 110.110.110.8 (summary Network Number)
  Advertising Router: 131.0.0.1
  LS Seq Number: 8000008D
  Checksum: 0x7FD6
  Length: 28
  Network Mask: /32
        MTID: 0         Metric: 2

As you can see the downward bit is showing up, it doesn't actually "go away", the check for it is simply disabled. Allowing SPF to be run and those routes to get installed in the RIB.

R13# sh ip route vrf OSPF ospf | b Gateway
Gateway of last resort is not set

      11.0.0.0/24 is subnetted, 1 subnets
O        11.0.0.0 [110/2] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110
      83.0.0.0/24 is subnetted, 1 subnets
O IA     83.0.0.0 [110/2] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110
      110.0.0.0/8 is variably subnetted, 4 subnets, 2 masks
O IA     110.110.110.8/32
           [110/3] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110
O E2     110.110.110.14/32
           [110/2] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110
      113.0.0.0/24 is subnetted, 1 subnets
O E2     113.0.0.0 [110/1] via 131.0.0.1, 00:07:03, GigabitEthernet1.1110

Now we have routes installed in the RIB. I'll now go ahead and do some ping/traces from R13. You'll notice that some of the OSPF routes are O IA and some are O E2. Our configuration on all the PEs requires us to redistribute OSPF and BGP bidirectionally. The PEs that are IOS XE, R3, R6 R1. The CEs attached will see anything advertised to them from the PEs as Inter Area or O IA. IOS XR advertises routes as O E2. 

Let's go ahead and verify the reachability. 

R13#ping vrf OSPF 110.110.110.14
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 110.110.110.14, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/5/7 ms

R8#traceroute vrf OSPF 110.110.110.14 source 110.110.110.8 num
Type escape sequence to abort.
Tracing the route to 110.110.110.14
VRF info: (vrf in name/id, vrf out name/id)
  1 83.0.0.3 3 msec 1 msec 1 msec
  2 10.3.4.4 [MPLS: Labels 20/24012 Exp 0] 12 msec 5 msec 8 msec
  3 10.4.5.5 [MPLS: Labels 20/24012 Exp 0] 14 msec 20 msec 29 msec
  4 10.5.6.6 [MPLS: Labels 20/24012 Exp 0] 24 msec 13 msec 19 msec
  5 10.2.6.2 [MPLS: Labels 17/24012 Exp 0] 21 msec 31 msec 32 msec
  6 10.13.2.13 [MPLS: Label 24012 Exp 0] 23 msec 9 msec 8 msec
  7 113.0.0.14 7 msec *  8 msec


As you can see, both ping and traces are functioning. 

Thanks for stopping by!
Rob Riker, CCIE #50693




Tuesday, January 3, 2017

CCIE SPv4 - MPLS L3 VPN - VRF Lite - OSPFv2 and OSPFv3

Software versions:
IOS XE 15.5
IOS XR 5.3

The topology for this demo:
This post will focus on OSPFv2 and OSPFv3 in the context of VRF Lite. Both IOS and IOS XR both fully support IPv4 and IPv6 VRF aware routing for OSPF. 

One caveat, IOS XR does not support the IPv6 AFI under the ospf router context, unlike IOS, which  supports IPv4 and IPv6 under OSPFv3. IOS XR requires IPv4 under the OSPFv2 AFI and IPv6 under the OSPFv3 AFI.

R1
router ospf 2 vrf CCIE
 network 0.0.0.0 255.255.255.255 area 0
!
interface GigabitEthernet1.100
 ospfv3 2 ipv6 area 0
!
interface GigabitEthernet1.100
 ospfv3 2 ipv6 area 0


XR5
router ospf 2
 vrf CCIE
  area 0
   interface Loopback100
   !
   interface GigabitEthernet0/0/0/0.100
   !
   interface GigabitEthernet0/0/0/0.101
!
router ospfv3 2
 vrf CCIE
  area 0
   interface Loopback100
   !
   interface GigabitEthernet0/0/0/0.100
   !
   interface GigabitEthernet0/0/0/0.101


R4
router ospf 2 vrf CCIE
 network 0.0.0.0 255.255.255.255 area 0
!
interface GigabitEthernet1.101
 ospfv3 2 ipv6 area 0
interface GigabitEthernet1.102
 ospfv3 2 ipv6 area 0
!
interface Loopback100
 ospfv3 2 ipv6 area 0


R3
router ospf 2 vrf CCIE
 network 0.0.0.0 255.255.255.255 area 0
!
interface Loopback100
 ospfv3 2 ipv6 area 0
!
interface GigabitEthernet1.102
 ospfv3 2 ipv6 area 0



RP/0/0/CPU0:XR5#sh ospf vrf CCIE neighbor
Tue Jan  3 22:06:31.330 UTC

* Indicates MADJ interface

Neighbors for OSPF 2, VRF CCIE

Neighbor ID     Pri   State           Dead Time   Address         Interface
100.100.100.1   1     FULL/DR         00:00:31    192.168.15.1    GigabitEthernet0/0/0/0.100
    Neighbor is up for 00:11:54
100.100.100.4   1     FULL/BDR        00:00:34    192.168.45.4    GigabitEthernet0/0/0/0.101
    Neighbor is up for 00:11:16
Total neighbor count: 2


RP/0/0/CPU0:XR5#sh ospfv3 vrf CCIE neighbor
Tue Jan  3 22:06:51.949 UTC

Neighbors for OSPFv3 2, VRF CCIE

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
100.100.100.4   1     FULL/BDR        00:00:38    15              GigabitEthernet0/0/0/0.101
    Neighbor is up for 00:11:25
100.100.100.1   1     FULL/DR         00:00:34    30              GigabitEthernet0/0/0/0.100
    Neighbor is up for 00:12:14
Total neighbor count: 2

The outputs above are specific to the IPv4 and IPv6 VRF aware processes, you can see there are 2 neighbors per AFI.


R4#sh ospf 2 vrf CCIE neighbor

          OSPFv3 2 address-family ipv6 vrf CCIE (router-id 100.100.100.4)

Neighbor ID     Pri   State           Dead Time   Interface ID    Interface
100.100.100.3     1   FULL/BDR        00:00:32    18              GigabitEthernet1.102
192.168.1.15      1   FULL/DR         00:00:38    15              GigabitEthernet1.101


R4#sh ip ospf 2 neighbor

Neighbor ID     Pri   State           Dead Time   Address         Interface
100.100.100.3     1   FULL/BDR        00:00:37    192.168.34.3    GigabitEthernet1.102
192.168.1.15      1   FULL/DR         00:00:33    192.168.45.15   GigabitEthernet1.101

You should take notice to something, with IPv6, you can specify the VRF to pull the correct information. You do not specify the VRF with IPv4, you specify the OSPF process ID. 


R1#sh ip route vrf CCIE ospf | b Gateway
Gateway of last resort is not set

      100.0.0.0/32 is subnetted, 4 subnets
O        100.100.100.3
           [110/4] via 192.168.15.15, 00:11:04, GigabitEthernet1.100
O        100.100.100.4
           [110/3] via 192.168.15.15, 00:12:44, GigabitEthernet1.100
O        100.100.100.15
           [110/2] via 192.168.15.15, 00:14:07, GigabitEthernet1.100
O     192.168.34.0/24
           [110/3] via 192.168.15.15, 00:12:44, GigabitEthernet1.100
O     192.168.45.0/24
           [110/2] via 192.168.15.15, 00:14:07, GigabitEthernet1.100


R1#sh ipv6 route vrf CCIE ospf
IPv6 Routing Table - CCIE - 9 entries

O   2100:34::/64 [110/3]
     via FE80::20C:29FF:FEB7:44DF, GigabitEthernet1.100
O   2100:45::/64 [110/2]
     via FE80::20C:29FF:FEB7:44DF, GigabitEthernet1.100
O   FC00::3/128 [110/3]
     via FE80::20C:29FF:FEB7:44DF, GigabitEthernet1.100
O   FC00::4/128 [110/2]
     via FE80::20C:29FF:FEB7:44DF, GigabitEthernet1.100
O   FC00::15/128 [110/1]
     via FE80::20C:29FF:FEB7:44DF, GigabitEthernet1.100

The outputs above prove that we are connected via IPv4 and IPv6.

Thanks for stopping by!
Rob Riker, CCIE #50693