MPLS-VPN/BGP Approach Hari Rakotoranto Technical Marketing Engineer

Agenda MPLS Business Perspective VPN Concept MPLS VPN

Virtual Private Networking: A $24B Opportunity 1998 VPN Service Distribution WW VPN Service Revenues ($B) Source: CIMI Corp. Barriers? VPNs Opportunity

Business Perspective Businesses are building on IP Businesses need private IP services Customers Suppliers Partners Telecommuters Mobile Users Remote Offices IP Intranet IP Extranet

Agenda MPLS Business Perspective VPN Concept MPLS VPN

Virtual Private Networks Concepts 6 © 2000, Cisco Systems, Inc. NW’00 Paris

Virtual Private Networks A network infrastructure delivering private network services over a public infrastructure Certainly not a new concept

Service Provider Network Provider Edge (PE) device VPN Site VPN - Overlay Model CPE (CE) Device Virtual Circuit Layer-3 Routing Adjacency

VPN - Overlay Model Private trunks across a telco/SP shared infrastructure leased/dialup lines FR/ATM virtual circuits IP(GRE) tunnelling Point-to-point solution between customer sites how to size inter-site circuit capacities ? full mesh requirement for optimal routing CPE routing adjacencies between sites

Service Provider Network Provider Edge (PE) Router VPN Site CPE (CE) Router Layer-3 Routing Adjacency VPN - Peer-to-Peer Model

Provider edge (PE) device exchanges routing information with CPE all customer routes carried within SP IGP simple routing scheme for VPN customer routing between sites is optimal circuit sizing no longer an issue Private addressing is not an option Addition of new site is simpler no overlay mesh to contend with

The Solution: MPLS A new paradigm that delivers the best of both worlds: Privacy of ATM, Frame Relay flexibility and scalability of IP IP business servicesFoundation for IP business services flexible grouping of users and value-added services Low cost managed IP servicesLow cost managed IP services scales to large and small private networks Based on RFC2547bis.

Agenda MPLS Business Perspective VPN Concept MPLS VPN

P Router MPLS/VPN Backbone VPN A SITE-2 Site-1 routes Site-2 routes Site-3 routes Site-4 routes MP-iBGP Basic Intranet Model Site-3 & Site-4 routes RT=VPN-A Site-1 & Site-2 routes RT=VPN-A Site-1 routes Site-2 routes Site-3 routes Site-4 routes SITE-1SITE-3 SITE-4

MPLS VPN mechanisms VRF and Multiple Routing Instances Site-1Site-2Site-3Site-4 Logical view Routing view VRF for site-1 Site-1 routes Site-2 routes VRF for site-4 Site-3 routes Site-4 routes VRF for site-2 Site-1 routes Site-2 routes Site-3 routes VRF for site-3 Site-2 routes Site-3 routes Site-4 routes Site-1 Site-3 Site-4 Site-2 VPN-A VPN-C VPN-B PE PP Multihop MP-iBGP

MPLS VPN Connection Model PE-1 VPN Backbone IGP PE-2 P P P P PE routers receive IPv4 updates (EBGP, RIPv2, OSPF, Static) PE routers translate into VPN-IPv4 Assign a SOO and RT based on configuration Re-write Next-Hop attribute Assign a label based on VRF and/or interface Send MP-iBGP update to all PE neighbors BGP,RIPv2 update for Net1,Next-Hop=CE-1 VPN-IPv4 update: RD:Net1, Next-hop=PE-1 SOO=Site1, RT=Green, Label=(intCE1) CE-1 Site-2 VPN-IPv4 update is translated into IPv4 address (Net1) put into VRF green since RT=Green and advertised to CE-2 Site-1 CE-2

MPLS VPN Connection Model Receiving PEs translate to IPv4 Insert the route into the VRF identified by the RT attribute (based on PE configuration) The label associated to the VPN-IPv4 address will be set on packet forwarded towards the destination PE-1 VPN Backbone IGP PE-2 P P P P BGP,RIPv2 update for Net1,Next-Hop=CE-1 VPN-IPv4 update: RD:Net1, Next-hop=PE-1 SOO=Site1, RT=Green, Label=(intCE1) CE-1 Site-2 VPN-IPv4 update is translated into IPv4 address (Net1) put into VRF green since RT=Green and advertised to CE-2 Site-1 CE-2

MPLS/VPN Packet Forwarding

P router In Label FEC Out Label /32 - In Label FEC Out Label /32 POP In Label FEC Out Label /32 41 MPLS/VPN Packet Forwarding Paris Use label implicit-null for destination /32 Use label 41 for destination /24 VPN-v4 update: RD:1:27: /24, NH= SOO=Paris, RT=VPN-A, Label=(28) PE-1 London PE and P routers have BGP next-hop reachability through the backbone IGP Labels are distributed through LDP corresponding to BGP Next- Hops or RSVP with Traffic Engineering /24

In Label FEC Out Label /32 41 MPLS/VPN Packet Forwarding Paris PE-1 London /24 Ingress PE receives normal IP packets PE router performs IP Longest Match from VPN FIB, finds iBGP next-hop and imposes a stack of labels VPN-A VRF /24, NH= Label=(28)

In Label FEC Out Label /32 POP MPLS/VPN Packet Forwarding Paris PE-1 London / VPN-A VRF /24, NH= Label=(28) In Label FEC Out Label 28(V) /24 - VPN-A VRF /24, NH=Paris Penultimate PE router removes the IGP label Penultimate Hop Popping procedures (implicit-null label) Egress PE router uses the VPN label to select which VPN/CE to forward the packet to VPN label is removed and the packet is routed toward the VPN site

22 © 2000, Cisco Systems, Inc. NW’00 Paris