Complete MPLS L3VPN Configuration Guide Using OSPF, LDP, MP-BGP and VRF
This complete educational blog explains how to configure a full MPLS Layer 3 VPN network using Cisco CSR routers. We will configure:
- OSPF as the IGP inside the Service Provider core
- MPLS and LDP label distribution
- MP-BGP VPNv4 peering
- Route Reflector topology
- VRF creation
- PE-CE BGP routing
- End-to-end MPLS VPN communication
🎯 What You Will Learn
- How MPLS works internally
- OSPF design inside provider networks
- Label Distribution Protocol (LDP)
- MP-BGP VPNv4 route propagation
- Route Reflector architecture
- VRF creation and route separation
- PE to CE routing using BGP
- MPLS forwarding mathematics
- Troubleshooting MPLS VPN environments
Table of Contents
1. MPLS Introduction
MPLS stands for Multiprotocol Label Switching.
MPLS improves packet forwarding efficiency by using labels instead of performing traditional IP lookups at every router hop.
In MPLS VPN networks:
- PE routers maintain VRFs
- P routers only switch labels
- MP-BGP distributes VPNv4 routes
- LDP distributes transport labels
MPLS Forwarding Formula
$$ Packet\\ Forwarding = Label\\ Lookup + LFIB\\ Action $$Where:
- LFIB = Label Forwarding Information Base
- Labels simplify forwarding decisions
Network Topology
R4 -------- CSR1 -------- CSR2 -------- CSR3 -------- R5
PE P PE
- CSR1 and CSR3 are PE routers
- CSR2 acts as P router and Route Reflector
- R4 and R5 are CE routers
- OSPF runs in provider core
- MP-BGP distributes VPN routes
2. Task 1 - Configure OSPF Between All SP Routers
OSPF is used as the Interior Gateway Protocol inside the Service Provider core.
Every router uses a loopback address as Router-ID.
OSPF SPF Formula
$$ Shortest\\ Path = \sum Cost $$OSPF calculates shortest paths using Dijkstra’s SPF algorithm.
Why Use Loopback Interfaces?
- Loopbacks are always stable
- Loopbacks do not go down with physical failures
- Best practice for Router-ID selection
CSR1 OSPF Configuration
Code Example
router ospf 1
CSR1 router ospf 1 router-id 1.1.1.1 network 1.1.1.1 0.0.0.0 area 0 network 192.1.12.1 0.0.0.0 area 0
Detailed Explanation
The network statement with wildcard mask 0.0.0.0 matches only one IP address.
This activates OSPF on the exact interface.
CSR2 OSPF Configuration
CSR2 router ospf 1 router-id 2.2.2.2 network 2.2.2.2 0.0.0.0 area 0 network 192.1.12.2 0.0.0.0 area 0 network 192.1.23.2 0.0.0.0 area 0
CSR3 OSPF Configuration
CSR3 router ospf 1 router-id 3.3.3.3 network 3.3.3.3 0.0.0.0 area 0 network 192.1.23.3 0.0.0.0 area 0 network 192.1.34.3 0.0.0.0 area 0
CSR4 OSPF Configuration
CSR4 router ospf 1 router-id 4.4.4.4 network 4.4.4.4 0.0.0.0 area 0 network 192.1.34.4 0.0.0.0 area 0
Expected OSPF Neighbor Output
CSR1#show ip ospf neighbor Neighbor ID Pri State Dead Time Address 2.2.2.2 1 FULL/DR 00:00:39 192.1.12.2
3. Task 2 - Configure MPLS LDP
LDP stands for Label Distribution Protocol.
LDP distributes labels between MPLS routers.
Every MPLS router creates labels for routes and advertises them to neighbors.
MPLS Label Formula
$$ Incoming\\ Label \rightarrow Swap \rightarrow Outgoing\\ Label $$Why Use Loopback as LDP Router-ID?
- Loopbacks are stable
- LDP sessions survive interface failures
- Industry best practice
CSR1 MPLS Configuration
CSR1 mpls ldp router-id loopback0 interface Gig1 mpls ip ! interface Gig2 mpls ip
CSR2 MPLS Configuration
CSR2 mpls ldp router-id loopback0 interface Gig1 mpls ip ! interface Gig2 mpls ip
CSR3 MPLS Configuration
CSR3 mpls ldp router-id loopback0 interface Gig1 mpls ip ! interface Gig2 mpls ip
Expected LDP Neighbor Output
CSR1#show mpls ldp neighbor Peer LDP Identifier: 2.2.2.2:0 TCP connection: 2.2.2.2.646 State: Oper
Transport Label Logic
$$ VPN\\ Label + Transport\\ Label $$MPLS VPN packets typically carry two labels:
- Outer label = Transport label
- Inner label = VPN label
4. Task 3 - Configure MP-BGP VPNv4
MP-BGP distributes VPNv4 routes across the MPLS network.
CSR2 acts as the Route Reflector.
This removes the need for full mesh iBGP.
iBGP Full Mesh Formula
$$ Sessions = \frac{n(n-1)}{2} $$If:
$$ n=100 $$Then:
$$ 4950\\ Sessions $$Route Reflectors reduce complexity dramatically.
CSR1 MP-BGP Configuration
CSR1 router bgp 100 neighbor 2.2.2.2 remote-as 100 neighbor 2.2.2.2 update-source lo0 ! address-family vpnv4 neighbor 2.2.2.2 activate
CSR2 Route Reflector Configuration
CSR2 router bgp 100 neighbor IBGP peer-group neighbor IBGP remote-as 100 neighbor IBGP update-source lo0 neighbor 1.1.1.1 peer-group IBGP neighbor 3.3.3.3 peer-group IBGP ! address-family vpnv4 neighbor IBGP route-reflector-client neighbor 1.1.1.1 activate neighbor 3.3.3.3 activate
Why Use Peer Groups?
- Reduces CPU usage
- Simplifies configuration
- Improves scalability
CSR3 MP-BGP Configuration
CSR3 router bgp 100 neighbor 2.2.2.2 remote-as 100 neighbor 2.2.2.2 update-source lo0 ! address-family vpnv4 neighbor 2.2.2.2 activate
Expected VPNv4 Output
CSR1#show bgp vpnv4 unicast all summary Neighbor V AS MsgRcvd MsgSent State/PfxRcd 2.2.2.2 4 100 50 55 2
5. Task 4 - Configure VRF Cust-A on PE Routers
VRF allows multiple customer routing tables on the same PE router.
VRF Isolation Formula
$$ Routing\\ Table_{CustA} \neq Routing\\ Table_{Global} $$CSR1 VRF Configuration
CSR1 vrf definition Cust-A rd 100:1 address-family ipv4 route-target both 100:1 ! interface Gig3 vrf forwarding Cust-A ip address 192.1.14.1 255.255.255.0 no shut ! router bgp 100 address-family ipv4 vrf Cust-A neighbor 192.1.14.4 remote-as 65004
CSR3 VRF Configuration
CSR3 vrf definition Cust-A rd 100:1 address-family ipv4 route-target both 100:1 ! interface Gig3 vrf forwarding Cust-A ip address 192.1.35.3 255.255.255.0 no shut ! router bgp 100 address-family ipv4 vrf Cust-A neighbor 192.1.35.5 remote-as 65005
Understanding RD and RT
Route Distinguisher makes routes unique.
Route Target controls route import/export.
$$
VPNv4 = RD + IPv4\\ Prefix
$$
6. Task 5 - Configure CE Routers
CE routers establish eBGP peering with PE routers.
Customer routes enter MPLS VPN through PE routers.
R4 Configuration
R4 interface e0/0 ip address 192.1.14.4 255.255.255.0 no shut ! interface loopback0 ip address 10.4.4.4 255.255.255.0 ! router bgp 65004 neighbor 192.1.14.1 remote-as 100 network 10.4.4.0 mask 255.255.255.0
R5 Configuration
R5 interface e0/0 ip address 192.1.35.5 255.255.255.0 no shut ! interface loopback0 ip address 10.5.5.5 255.255.255.0 ! router bgp 65005 neighbor 192.1.35.3 remote-as 100 network 10.5.5.0 mask 255.255.255.0
How PE-CE BGP Works
The CE router advertises customer routes to the PE router.
The PE router converts them into VPNv4 routes and advertises them through MP-BGP.
7. Verification Commands
Verify OSPF Neighbors
show ip ospf neighbor
Verify MPLS Interfaces
show mpls interfaces
Verify LDP Neighbors
show mpls ldp neighbor
Verify VPNv4 Routes
show bgp vpnv4 unicast all
Verify VRF Routes
show ip route vrf Cust-A
Verify BGP Summary
show bgp vpnv4 unicast summary
Expected Ping Test
R4#ping 10.5.5.5 !!!!! Success rate is 100 percent
8. MPLS VPN Mathematics
VPN Route Formula
$$ VPNv4\\ Route = RD + IPv4\\ Prefix + RT $$Label Stack Formula
$$ Packet = Outer\\ Label + Inner\\ VPN\\ Label + Payload $$BGP Best Path Simplified
$$ Best\\ Path = Highest\\ Preference + Lowest\\ Metric $$OSPF Cost Formula
$$ OSPF\\ Cost = \frac{Reference\\ Bandwidth}{Interface\\ Bandwidth} $$Scalability Formula
$$ VRFs = Customers \times Services $$9. Troubleshooting MPLS VPN Networks
| Problem | Cause | Solution |
|---|---|---|
| LDP Neighbor Down | Missing MPLS IP | Enable mpls ip on interface |
| BGP VPNv4 Down | Loopback unreachable | Check OSPF reachability |
| No VRF Routes | Missing RT | Verify Route Target |
| Ping Failure | No labels | Check MPLS forwarding table |
💡 Important Key Takeaways
- OSPF provides underlay connectivity
- LDP distributes transport labels
- MP-BGP distributes VPNv4 routes
- Route Reflectors reduce iBGP sessions
- VRFs isolate customer traffic
- Route Targets control VPN membership
- PE routers maintain customer routing tables
- P routers only switch labels
10. Related Articles
- Complete MPLS Multicast VPN Configuration Guide Part 2 | Cisco MVPN PIM Sparse Dense Mode Lab
- Cisco Nexus FEX and vPC Configuration
- Cisco Nexus vPC Peer Gateway and VDC
- Cisco Nexus VRRP Configuration Guide
- Cisco Nexus EIGRP and HSRP
- Complete Cisco Nexus VXLAN EVPN
- Complete Cisco Nexus VXLAN
- Complete Cisco Nexus Multicast
- Complete Cisco Nexus BGP Authentication
- Complete Cisco Nexus BGP OSPF Stub Area
Final Conclusion
This complete MPLS Layer 3 VPN tutorial demonstrated how to build a service provider MPLS VPN network using Cisco CSR routers.
We configured:
- OSPF underlay routing
- MPLS label switching
- LDP neighbor relationships
- MP-BGP VPNv4 route exchange
- Route Reflector architecture
- VRF separation
- PE-CE BGP connectivity
- Customer route exchange
Understanding these technologies is essential for mastering enterprise WAN and service provider networking.
No comments:
Post a Comment