Inter-AS VPRN Model B Using MPLS over UDP
This chapter describes Inter-AS VPRN Model B using MPLS over UDP.
Topics in this chapter include:
Applicability
This chapter was initially written based on SR OS Release 15.0.R8, but the CLI in the current edition corresponds to SR OS Release 23.3.R3.
Overview
MPLS over UDP encapsulates MPLS packets into a UDP tunnel that can be transported by any IP network, and is defined in RFC 7510.
With MPLS over UDP, an outer IPv4/UDP or IPv6/UDP header encapsulates the inner MPLS label stack and message body; see IP over MPLS over UDP packet format. In the UDP header, the destination UDP port 6635 identifies the MPLS over UDP format to the egress PE and the source port number in the range from 49152 to 65535 is a source of entropy, because it is based on an ECMP hash calculation by the ingress PE. The entropy in the IP/UDP header ensures that ECMP uses all the available parallel paths between the tunnel endpoints.
The MPLS over UDP implementation in SR OS has the following characteristics:
The UDP checksum is set to 0 on transmission and ignored on reception.
MPLS over UDP packets are processed only if they arrive with an IP destination address matching the system IP address.
MPLS over UDP packets are originated with the Don't Fragment (DF) bit set in the outer IP header.
Reassembly of received MPLS over UDP packets is not supported.
BGP next-hops can be resolved to UDP-based tunnels for L3 VPN and EVPN services, which is useful, for example, in data center (DC) environments where IP is prevalent. This chapter describes the use and configuration of MPLS over UDP in an inter-AS VPRN model B environment. See the Inter-AS VPRN Model B chapter for more information.
Configuration
Inter-AS VPRN model B topology using MPLS over UDP in AS 64496 shows the topology used in this chapter, with two autonomous systems (ASs) and using inter-AS VPRN model B. VPRN 1 carries customer traffic between PE-1 and PE-2 in AS 64496, and PE-5 and PE-6 in AS 64497. IS-IS is configured in AS 64496 and 64497, and MP-IBGP sessions are established between the PEs of each AS. An MP-EBGP session is established between autonomous system border routers (ASBRs) ASBR-4 and ASBR-8. RR-3 and RR-7 are the route reflectors (RRs) in AS 64496 and 64497, respectively, for the VPN-IPv4 and VPN-IPv6 address families. AS 64496 uses MPLS over UDP for its transport, whereas AS 64497 uses LDP.
An inter-AS VPRN model B requires configuration of an MP-EBGP session with support for the VPN-IPv4 and VPN-IPv6 address families and enabling the inter-AS functionality on the ASBRs by the enable-inter-as-vpn command. No configuration is required to support inter-AS VPRN model B on the PEs and the RRs. See the Inter-AS VPRN Model B chapter for more information.
The initial configuration includes:
cards, MDAs, and ports
router interfaces
IS-IS as IGP on all interfaces (alternatively, OSPF can be used), with traffic engineering enabled.
LDP configured in AS 64497, but not in AS 64496
IBGP configured in both ASs
EBGP configured between ASBR-4 and ASBR-8
RR-3 and RR-7 configured as RR for VPN-IPv4 and VPN-IPv6 in AS 64496 and AS 64497
MPLS over UDP configuration
MPLS over UDP tunnels are UDP-based LSP tunnels that are created dynamically through a BGP import policy, where the action is create-udp-tunnel. This import policy is configured and used on PE-1, PE-2, and ASBR-4. MPLS over UDP tunnels are created when BGP receives an update message where the incoming route has a next hop which matches the import policy. This import policy create-UDP-tunnel is defined as follows:
# on PE-1, PE-2, ASBR-4:
configure
router Base
policy-options
begin
prefix-list "system-pfxs"
prefix 192.0.2.0/24 prefix-length-range 32-32
exit
policy-statement "create-UDP-tunnel"
entry 10
from
next-hop prefix-list "system-pfxs"
family vpn-ipv4 vpn-ipv6
exit
action accept
create-udp-tunnel
exit
exit
exit
commit
This policy is applied to the IBGP sessions on which the VPN routes are exchanged; on PE-1 and PE-2, this is in the IBGP-vpn group, as follows:
# on PE-1, PE-2:
configure
router Base
autonomous-system 64496
bgp
loop-detect discard-route
split-horizon
next-hop-resolution
labeled-routes
transport-tunnel
family vpn
resolution-filter
no ldp
no bgp
udp
exit
resolution filter
exit
exit
exit
exit
group "IBGP-vpn"
vpn-apply-import
import "create-UDP-tunnel"
peer-as 64496
neighbor 192.0.2.3
family vpn-ipv4 vpn-ipv6
exit
exit
On RR-3, BGP is configured as follows:
# on RR-3:
configure
router Base
autonomous-system 64496
bgp
loop-detect discard-route
split-horizon
group "IBGP-vpn"
family vpn-ipv4 vpn-ipv6
cluster 192.0.2.3
peer-as 64496
neighbor 192.0.2.1
exit
neighbor 192.0.2.2
exit
neighbor 192.0.2.4
exit
exit
For ASBR-4 to advertise VPRN routes to the peer AS, ASBR-4 must know the VPRN routes used within the AS, so it peers with RR-3 through IBGP, using the IBGP-vpn group. Although the enable-inter-as-vpn command enables inter-AS VPN model B, the VPN-IPv4 and VPN-IPv6 address family must also resolve to MPLS over UDP tunnels, so the BGP configuration on ASBR-4 is as follows:
# on ASBR-4:
configure
router Base
autonomous-system 64496
bgp
loop-detect discard-route
enable-inter-as-vpn # inter-AS VPRN model B
split-horizon
next-hop-resolution
labeled-routes
transport-tunnel
family vpn
resolution-filter
no ldp
no bgp
udp
exit
resolution filter
exit
exit
exit
exit
group "EBGP-vpn"
neighbor 192.168.48.2
family vpn-ipv4 vpn-ipv6
peer-as 64497
exit
exit
group "IBGP-vpn"
vpn-apply-import
import "create-UDP-tunnel"
peer-as 64496
neighbor 192.0.2.3
family vpn-ipv4 vpn-ipv6
exit
exitService configuration
VPRN "VPRN-1" is configured on PE-1, PE-2, PE-5, and PE-6. Although the VPRN service names and IDs used in both ASs do not have to match, when inter-AS VPRN model B applies, the route targets (RTs) used in both ASs must be coordinated. The RT exported by the PE-1 VPRN must be imported by PE-2, PE-5, and PE-6, and vice versa. In this example, no specific VRF import and VRF export policies are used; the vrf-target command is used instead.
To carry the customer data across AS 64496, the MPLS over UDP tunnels must bind to a VPRN service with the auto-bind-tunnel command. The resolution is set to filter, indicating that SR OS must select a tunnel using the information defined in the resolution-filter context. The udp keyword in the resolution-filter context indicates that MPLS over UDP tunnels can be used. If resolution is set to any, the resolution filter is ignored, and a tunnel from the tunnel table manager (TTM) is selected, based on availability and preference.
In AS 64496, the service "VPRN-1" on PE-1 is defined as follows. The configuration of service "VPRN-1" on PE-2 is similar.
# on PE-1:
configure
service
vprn 1 name "VPRN-1" customer 1 create
interface "int-S1-1" create
address 10.1.10.1/24
ipv6
address 2001:db8:1::1:1/120
exit
sap 1/1/c4/1:1 create
exit
exit
bgp-ipvpn
mpls
auto-bind-tunnel
resolution-filter
no ldp
no bgp
udp
exit
resolution filter
exit
route-distinguisher 64496:1
vrf-target target:64496:1
no shutdown
exit
exit
no shutdown
The transport technology in AS 64497 is LDP, so service "VPRN-1" in PE-5 and PE-6 auto-binds to LDP LSPs in the tunnel table, to resolve VPN-IPv4 routes for which the VRF target matches the VRF target community value configured in PE-1 and PE-2, as follows. The configuration of "VPRN-1" on PE-6 is similar.
# on PE-5:
configure
service
vprn 1 name "VPRN-1" customer 1 create
interface "int-S1-1" create
address 10.1.50.1/24
ipv6
address 2001:db8:1::5:1/120
exit
sap 1/1/c4/1:1 create
exit
exit
bgp-ipvpn
mpls
auto-bind-tunnel
resolution-filter
ldp
no bgp
exit
resolution filter
exit
route-distinguisher 64497:1
vrf-target target:64496:1 # same value as on PE-1, PE-2
no shutdown
exit
exit
no shutdownVerification
With the configurations from previous subsections applied, so that PE-1, PE-2, PE-5, and PE-6 have a service instance of "VPRN-1" running, PE-1 receives three VPN-IPv4 and three VPN-IPv6 prefixes, as follows:
*A:PE-1# show router bgp summary all
===============================================================================
BGP Summary
===============================================================================
Legend : D - Dynamic Neighbor
===============================================================================
Neighbor
Description
ServiceId AS PktRcvd InQ Up/Down State|Rcv/Act/Sent (Addr Family)
PktSent OutQ
-------------------------------------------------------------------------------
192.0.2.3
Def. Inst 64496 19 0 00h04m24s 3/3/1 (VpnIPv4)
17 0 3/3/1 (VpnIPv6)
-------------------------------------------------------------------------------
PE-1 creates two UDP tunnels, and its tunnel table is as follows. The UDP tunnel to 192.0.2.2 is used for intra-AS customer traffic; the UDP tunnel to 192.0.2.4 is used for inter-AS customer traffic.
*A:PE-1# show router tunnel-table
===============================================================================
IPv4 Tunnel Table (Router: Base)
===============================================================================
Destination Owner Encap TunnelId Pref Nexthop Metric
Color
-------------------------------------------------------------------------------
192.0.2.2/32 udp MPLS 786434 254 192.168.12.2 10
192.0.2.4/32 udp MPLS 786435 254 192.168.12.2 20
-------------------------------------------------------------------------------
Flags: B = BGP or MPLS backup hop available
L = Loop-Free Alternate (LFA) hop available
E = Inactive best-external BGP route
k = RIB-API or Forwarding Policy backup hop
===============================================================================
These tunnels are used as BGP next-hops for the VPN-IPv4 (and VPN-IPv6) routes, as follows:
*A:PE-1# show router bgp next-hop vpn-ipv4
===============================================================================
BGP Router ID:192.0.2.1 AS:64496 Local AS:64496
===============================================================================
===============================================================================
BGP VPN Next Hop
===============================================================================
VPN Next Hop Owner
Autobind FibProg Reason
Labels (User-labels) FlexAlgo Metric
Admin-tag-policy (strict-tunnel-tagging) Last Mod.
-------------------------------------------------------------------------------
192.0.2.2 UDP
udp Y
-- (2) -- 10
-- (N) 00h05m17s
192.0.2.4 UDP
udp Y
-- (2) -- 20
-- (N) 00h04m45s
-------------------------------------------------------------------------------
Next Hops : 2
===============================================================================The IPv4 and IPv6 routing tables for VPRN 1 are as follows:
*A:PE-1# show router 1 route-table ipv4
===============================================================================
Route Table (Service: 1)
===============================================================================
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Metric
-------------------------------------------------------------------------------
10.1.10.0/24 Local Local 00h05m54s 0
int-S1-1 0
10.1.20.0/24 Remote BGP VPN 00h05m31s 170
192.0.2.2 (tunneled:UDP) 10
10.1.50.0/24 Remote BGP VPN 00h04m59s 170
192.0.2.4 (tunneled:UDP) 20
10.1.60.0/24 Remote BGP VPN 00h04m59s 170
192.0.2.4 (tunneled:UDP) 20
-------------------------------------------------------------------------------
No. of Routes: 4
Flags: n = Number of times nexthop is repeated
B = BGP backup route available
L = LFA nexthop available
S = Sticky ECMP requested
===============================================================================*A:PE-1# show router 1 route-table ipv6
===============================================================================
IPv6 Route Table (Service: 1)
===============================================================================
Dest Prefix[Flags] Type Proto Age Pref
Next Hop[Interface Name] Metric
-------------------------------------------------------------------------------
2001:db8:1::1:0/120 Local Local 00h05m53s 0
int-S1-1 0
2001:db8:1::2:0/120 Remote BGP VPN 00h05m31s 170
192.0.2.2 (tunneled:UDP) 10
2001:db8:1::5:0/120 Remote BGP VPN 00h04m59s 170
192.0.2.4 (tunneled:UDP) 20
2001:db8:1::6:0/120 Remote BGP VPN 00h04m59s 170
192.0.2.4 (tunneled:UDP) 20
-------------------------------------------------------------------------------
No. of Routes: 4
Flags: n = Number of times nexthop is repeated
B = BGP backup route available
L = LFA nexthop available
S = Sticky ECMP requested
===============================================================================In this case, all VPRN remote prefixes are reachable through an MPLS over UDP tunnel (tunneled:UDP). The VPN label values for these prefixes are assigned and advertised by ASBR-4 and get to PE-1 via RR-3 in an MP-BGP update message, and can be displayed as follows:
*A:PE-1# show router bgp neighbor 192.0.2.3 received-routes vpn-ipv4
===============================================================================
BGP Router ID:192.0.2.1 AS:64496 Local AS:64496
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP VPN-IPv4 Routes
===============================================================================
Flag Network LocalPref MED
Nexthop (Router) Path-Id IGP Cost
As-Path Label
-------------------------------------------------------------------------------
u*>i 64496:1:10.1.20.0/24 100 None
192.0.2.2 None 10
No As-Path 524287
u*>i 64497:1:10.1.50.0/24 100 None
192.0.2.4 None 20
64497 524286
u*>i 64497:1:10.1.60.0/24 100 None
192.0.2.4 None 20
64497 524287
-------------------------------------------------------------------------------
Routes : 3
===============================================================================
The prefixes 10.1.50.0/24 and 10.1.60.0/24 have ASBR-4 as next hop: prefix 10.1.50.0/24 gets VPRN label 524286 and prefix 10.1.60.0/24 gets VPRN label 524287.
*A:PE-1# show router bgp neighbor 192.0.2.3 received-routes vpn-ipv6
===============================================================================
BGP Router ID:192.0.2.1 AS:64496 Local AS:64496
===============================================================================
Legend -
Status codes : u - used, s - suppressed, h - history, d - decayed, * - valid
l - leaked, x - stale, > - best, b - backup, p - purge
Origin codes : i - IGP, e - EGP, ? - incomplete
===============================================================================
BGP VPN-IPv6 Routes
===============================================================================
Flag Network LocalPref MED
Nexthop (Router) Path-Id IGP Cost
As-Path Label
-------------------------------------------------------------------------------
u*>i 64496:1:2001:db8:1::2:0/120 100 None
::ffff:192.0.2.2 None 10
No As-Path 524287
u*>i 64497:1:2001:db8:1::5:0/120 100 None
::ffff:192.0.2.4 None 20
64497 524285
u*>i 64497:1:2001:db8:1::6:0/120 100 None
::ffff:192.0.2.4 None 20
64497 524284
-------------------------------------------------------------------------------
Routes : 3
===============================================================================
The prefixes 2001:db8:1::5:0/120 and 2001:db8:1::6:0/120 have ASBR-4 as next hop: prefix 2001:db8:1::5:0/120 gets VPRN label 524285 and prefix 2001:db8:1::6:0/120 gets VPRN label 524284.
The forwarding plane is programmed accordingly, as follows:
*A:PE-1# show router 1 fib 1 ipv4
===============================================================================
FIB Display
===============================================================================
Prefix [Flags] Protocol
NextHop
-------------------------------------------------------------------------------
10.1.10.0/24 LOCAL
10.1.10.0 (int-S1-1)
10.1.20.0/24 BGP_VPN
192.0.2.2 (VPRN Label:524287 Transport:UDP)
10.1.50.0/24 BGP_VPN
192.0.2.4 (VPRN Label:524286 Transport:UDP)
10.1.60.0/24 BGP_VPN
192.0.2.4 (VPRN Label:524287 Transport:UDP)
-------------------------------------------------------------------------------
Total Entries : 4
-------------------------------------------------------------------------------
===============================================================================
*A:PE-1# show router 1 fib 1 ipv6
===============================================================================
FIB Display
===============================================================================
Prefix [Flags] Protocol
NextHop
-------------------------------------------------------------------------------
2001:db8:1::1:0/120 LOCAL
2001:db8:1::1:0 (int-S1-1)
2001:db8:1::2:0/120 BGP_VPN
192.0.2.2 (VPRN Label:524287 Transport:UDP)
2001:db8:1::5:0/120 BGP_VPN
192.0.2.4 (VPRN Label:524285 Transport:UDP)
2001:db8:1::6:0/120 BGP_VPN
192.0.2.4 (VPRN Label:524284 Transport:UDP)
-------------------------------------------------------------------------------
Total Entries : 4
-------------------------------------------------------------------------------
===============================================================================
Traffic over the VPRN is generated using a ping command on PE-1 to the remote address, as follows:
*A:PE-1# ping router 1 10.1.50.1 source 10.1.10.1
PING 10.1.50.1 56 data bytes
64 bytes from 10.1.50.1: icmp_seq=1 ttl=64 time=6.06ms.
64 bytes from 10.1.50.1: icmp_seq=2 ttl=64 time=6.16ms.
64 bytes from 10.1.50.1: icmp_seq=3 ttl=64 time=6.12ms.
64 bytes from 10.1.50.1: icmp_seq=4 ttl=64 time=5.89ms.
64 bytes from 10.1.50.1: icmp_seq=5 ttl=64 time=6.00ms.
---- 10.1.50.1 PING Statistics ----
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min = 5.89ms, avg = 6.05ms, max = 6.16ms, stddev = 0.094ms
In contrast with the traditional inter-AS VPRN model B, where customer traffic is pushed with a VPN label followed by a transport label, now customer traffic to destination 10.1.50.1 is pushed with VPN label 524286, followed by an IP/UDP header with IP SA 192.0.2.1 and IP DA 192.0.2.4 and with UDP source and destination port.
The interconnection between the ASBRs carries the VPN data with a single MPLS label, so ASBR-4 removes the IP/UDP header and swaps the VPN label 524286 with the VPN label 524282 received from ASBR-8. The inter-AS label mapping on ASBR-4 is as follows:
*A:ASBR-4# show router bgp inter-as-label
===============================================================================
BGP Inter-AS labels
Flags: B - entry has backup, P - entry is promoted
===============================================================================
NextHop Received Advertised Label
Label Label Origin
-------------------------------------------------------------------------------
192.0.2.1 524287 524283 Internal
192.0.2.1 524287 524281 Internal
192.0.2.2 524287 524282 Internal
192.0.2.2 524287 524280 Internal
192.168.48.2 524280 524285 External
192.168.48.2 524281 524284 External
192.168.48.2 524282 524286 External
192.168.48.2 524283 524287 External
-------------------------------------------------------------------------------
Total Labels allocated: 8
===============================================================================
The forward data flow from PE-1 to PE-5 for VPRN 1 uses the labels for which the label origin is external. The VPN labels used for the backward data flow use the labels for which the label origin is internal.
For brevity, the commands to display and check VPN prefixes and labels in AS 64497 are omitted.
Customer traffic destined to the VPN routes received by ASBR-4 can be sent to the correct destination because ASBR-4 has the relevant BGP next-hops resolved to UDP tunnels, as follows:
*A:ASBR-4# show router bgp next-hop vpn-ipv4
===============================================================================
BGP Router ID:192.0.2.4 AS:64496 Local AS:64496
===============================================================================
===============================================================================
BGP VPN Next Hop
===============================================================================
VPN Next Hop Owner
Autobind FibProg Reason
Labels (User-labels) FlexAlgo Metric
Admin-tag-policy (strict-tunnel-tagging) Last Mod.
-------------------------------------------------------------------------------
192.0.2.1 UDP
udp Y
-- (2) -- 20
-- (N) 00h07m47s
192.0.2.2 UDP
udp Y
-- (2) -- 10
-- (N) 00h07m47s
192.168.48.2 LOCAL
udp Y
-- (2) -- 0
-- (N) 00h07m51s
-------------------------------------------------------------------------------
Next Hops : 3
===============================================================================
The forwarding plane is programmed accordingly, as follows:
*A:ASBR-4# show router fp-tunnel-table 1
===============================================================================
IPv4 Tunnel Table Display
Legend:
label stack is ordered from bottom-most to top-most
B - FRR Backup
===============================================================================
Destination Protocol Tunnel-ID
Lbl/SID
NextHop Intf/Tunnel
Lbl/SID (backup)
NextHop (backup)
-------------------------------------------------------------------------------
192.0.2.1/32 UDP -
-
192.168.24.1 1/1/c2/1:1000
192.0.2.2/32 UDP -
-
192.168.24.1 1/1/c2/1:1000
-------------------------------------------------------------------------------
Total Entries : 2
-------------------------------------------------------------------------------
===============================================================================
Changing the BGP next-hop resolution for auto-binding the BGP next-hop on PE-1, and for VPN next-hop resolution on ASBR-4 from resolution filter to resolution any, does not lead to the tunnel being changed, but to a change of the allowed tunnel types for auto-bind. On PE-1 and PE-2, SR OS selects UDP as the only viable tunnel type, because no tunnels of type LDP, RSVP, SR-ISIS, SR-OSPF, GRE and so on are available:
*A:PE-1# show router bgp next-hop vpn-ipv4
===============================================================================
BGP Router ID:192.0.2.1 AS:64496 Local AS:64496
===============================================================================
===============================================================================
BGP VPN Next Hop
===============================================================================
VPN Next Hop Owner
Autobind FibProg Reason
Labels (User-labels) FlexAlgo Metric
Admin-tag-policy (strict-tunnel-tagging) Last Mod.
-------------------------------------------------------------------------------
192.0.2.2 UDP
ldp rsvp sr-isis sr-ospf gre bgp sr-te udp sr-p Y
olicy rib-api mpls-fwd-policy sr-ospf3
-- (2) -- 10
-- (N) 00h00m10s
192.0.2.4 UDP
ldp rsvp sr-isis sr-ospf gre bgp sr-te udp sr-p Y
olicy rib-api mpls-fwd-policy sr-ospf3
-- (2) -- 20
-- (N) 00h00m10s
-------------------------------------------------------------------------------
Next Hops : 2
===============================================================================
*A:ASBR-4# show router bgp next-hop vpn-ipv4
===============================================================================
BGP Router ID:192.0.2.4 AS:64496 Local AS:64496
===============================================================================
===============================================================================
BGP VPN Next Hop
===============================================================================
VPN Next Hop Owner
Autobind FibProg Reason
Labels (User-labels) FlexAlgo Metric
Admin-tag-policy (strict-tunnel-tagging) Last Mod.
-------------------------------------------------------------------------------
192.0.2.1 UDP
ldp rsvp sr-isis sr-ospf bgp sr-te udp sr-polic Y
y rib-api mpls-fwd-policy sr-ospf3
-- (2) -- 20
-- (N) 00h00m19s
192.0.2.2 UDP
ldp rsvp sr-isis sr-ospf bgp sr-te udp sr-polic Y
y rib-api mpls-fwd-policy sr-ospf3
-- (2) -- 10
-- (N) 00h00m19s
192.168.48.2 LOCAL
ldp rsvp sr-isis sr-ospf bgp sr-te udp sr-polic Y
y rib-api mpls-fwd-policy sr-ospf3
-- (2) -- 0
-- (N) 00h00m19s
-------------------------------------------------------------------------------
Next Hops : 3
===============================================================================
Conclusion
VPRN services support the resolution of VPN-IPv4 and VPN-IPv6 BGP next-hops to MPLS over UDP tunnels. MPLS over UDP tunnels are useful in IP-based fabric networks, such as DCs. SR OS supports inter-AS model B for any type of MPLS-based tunnels, including MPLS over UDP.